gencow 0.1.138 → 0.1.140

package/bin/gencow.mjs

@@ -306,7 +306,7 @@ ${BOLD}Commands (login required):${RESET}
                      ${DIM}--prod      Seed production app${RESET}
   ${GREEN}static [dir]${RESET}     Deploy static files ${DIM}(dist/, out/, build/)${RESET}
                      ${DIM}--prod          Deploy to production app${RESET}
-                     ${DIM}--force, -f     Skip dependency audit${RESET}
+                     ${DIM}--force, -f     Skip optional dependency scan${RESET}
   ${GREEN}templates publish${RESET} Publish current project as a marketplace template
                      ${DIM}--title, --slug, --price, --private, --unlisted${RESET}
   ${GREEN}templates list${RESET}    Browse public templates
@@ -314,7 +314,7 @@ ${BOLD}Commands (login required):${RESET}
   ${GREEN}deploy${RESET}           Deploy backend to cloud ${DIM}(dev by default)${RESET}
                      ${DIM}--prod          Deploy to production (Pro+ only)${RESET}
                      ${DIM}--rollback      Rollback to previous deployment${RESET}
-                     ${DIM}--force, -f     Skip dependency audit${RESET}
+                     ${DIM}--force, -f     Skip optional dependency scan${RESET}
   ${GREEN}env list${RESET}         List cloud env vars ${DIM}(--prod for production)${RESET}
   ${GREEN}env set K=V${RESET}      Set cloud env var ${DIM}(hot-reload, no restart)${RESET}
   ${GREEN}env unset KEY${RESET}    Remove cloud env var

package/core/index.js

@@ -1391,6 +1391,103 @@ function buildDocumentCacheKey(input) {
   ].join(":");
 }
 
+// ../core/src/wake-app-result.ts
+var DEFAULT_WAKE_RETRY_AFTER_SEC = 30;
+function buildWakeAppSuccessResult(status, port) {
+  return { ok: true, status, port };
+}
+function buildWakeAppBootFailedResult(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return { ok: false, status: "boot_failed", error: message };
+}
+function isWakeAppDeferredResult(result) {
+  return !result.ok && (result.status === "capacity_rejected" || result.status === "queue_timeout");
+}
+
+// ../core/src/platform-capacity-profile.ts
+var PLATFORM_CAPACITY_PROFILE_ENV = "GENCOW_CAPACITY_PROFILE";
+var PLATFORM_CAPACITY_ENV_KEYS = [
+  PLATFORM_CAPACITY_PROFILE_ENV,
+  "MAX_CONCURRENT_RUNNING",
+  "MAX_CONCURRENT_WAKE",
+  "MAX_WAKE_QUEUE_MS",
+  "MIN_AVAILABLE_RAM_MB",
+  "WAKE_RETRY_AFTER_SEC",
+  "EVICTION_THRESHOLD_MB",
+  "GENCOW_SLEEP_TIMEOUT_MINUTES",
+  "GENCOW_SLEEP_MAX_PER_CYCLE",
+  "WARM_POOL_MIN_IDLE",
+  "WARM_POOL_MAX",
+  "DEPLOY_CANDIDATE_RESERVE",
+  "GENCOW_APP_PORT_RANGE",
+  "COWBOX_WARM_POOL_PORT_RANGE"
+];
+var PLATFORM_CAPACITY_PRESETS = Object.freeze({
+  prod: Object.freeze({
+    profile: "prod",
+    maxConcurrentRunning: 600,
+    maxConcurrentWake: 20,
+    maxWakeQueueMs: 5e3,
+    minAvailableRamMB: 8192,
+    evictionThresholdMB: 16384,
+    sleepTimeoutMinutes: 15,
+    sleepMaxPerCycle: 50,
+    warmPoolMinIdle: 10,
+    warmPoolMax: 650,
+    deployCandidateReserve: 40
+  }),
+  dev: Object.freeze({
+    profile: "dev",
+    maxConcurrentRunning: 60,
+    maxConcurrentWake: 5,
+    maxWakeQueueMs: 3e3,
+    minAvailableRamMB: 2048,
+    evictionThresholdMB: 4096,
+    sleepTimeoutMinutes: 10,
+    sleepMaxPerCycle: 20,
+    warmPoolMinIdle: 3,
+    warmPoolMax: 70,
+    deployCandidateReserve: 5
+  }),
+  local: Object.freeze({
+    profile: "local",
+    maxConcurrentRunning: null,
+    maxConcurrentWake: null,
+    maxWakeQueueMs: 5e3,
+    minAvailableRamMB: null,
+    evictionThresholdMB: null,
+    sleepTimeoutMinutes: 30,
+    sleepMaxPerCycle: 10,
+    warmPoolMinIdle: 3,
+    warmPoolMax: 10,
+    deployCandidateReserve: 0
+  })
+});
+function normalizeDomain(value) {
+  return (value || "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+}
+function detectPlatformCapacityProfile(env = process.env) {
+  const explicit = env[PLATFORM_CAPACITY_PROFILE_ENV]?.trim().toLowerCase();
+  if (explicit) {
+    if (["prod", "production", "128gb"].includes(explicit)) return "prod";
+    if (["dev", "development", "16gb"].includes(explicit)) return "dev";
+    if (["local", "test", "disabled"].includes(explicit)) return "local";
+    throw new Error(`Invalid ${PLATFORM_CAPACITY_PROFILE_ENV}: ${explicit}. Expected prod, dev, or local.`);
+  }
+  const baseDomain = normalizeDomain(env.BASE_DOMAIN);
+  if (baseDomain === "gencow.dev") return "dev";
+  if (baseDomain === "gencow.app") return "prod";
+  const platformUrl = normalizeDomain(env.GENCOW_PLATFORM_URL);
+  if (platformUrl === "gencow.dev") return "dev";
+  if (platformUrl === "gencow.app") return "prod";
+  if (env.NODE_ENV === "production" && env.IS_PLATFORM === "true") return "prod";
+  return "local";
+}
+function resolvePlatformCapacityPreset(env = process.env) {
+  const profile = detectPlatformCapacityProfile(env);
+  return { ...PLATFORM_CAPACITY_PRESETS[profile] };
+}
+
 // ../core/src/grounded-answer-types.ts
 var DEFAULT_GROUNDING_BUDGET = {
   maxVerifyLoops: 2,
@@ -1499,6 +1596,34 @@ var mutationRegistry = globalThis.__gencow_mutationRegistry;
 var httpActionRegistry = globalThis.__gencow_httpActionRegistry;
 var subscribers = globalThis.__gencow_subscribers;
 var connectedClients = globalThis.__gencow_connectedClients;
+var SUBSCRIPTION_KEY_SEPARATOR = "::";
+function normalizeForStableJson(value) {
+  if (value === void 0) return void 0;
+  if (value === null) return null;
+  if (value instanceof Date) return value.toISOString();
+  if (Array.isArray(value)) return value.map((item) => normalizeForStableJson(item));
+  if (typeof value === "object") {
+    const source = value;
+    const sorted = {};
+    for (const key of Object.keys(source).sort()) {
+      const normalized = normalizeForStableJson(source[key]);
+      if (normalized !== void 0) sorted[key] = normalized;
+    }
+    return sorted;
+  }
+  return value;
+}
+function isEmptyPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
+}
+function buildQuerySubscriptionKey(queryKey, args) {
+  const normalized = normalizeForStableJson(args);
+  if (normalized === void 0 || isEmptyPlainObject(normalized)) return queryKey;
+  return `${queryKey}${SUBSCRIPTION_KEY_SEPARATOR}${JSON.stringify(normalized)}`;
+}
+function subscriptionKeyMatchesQueryKey(subscriptionKey, queryKey) {
+  return subscriptionKey === queryKey || subscriptionKey.startsWith(`${queryKey}${SUBSCRIPTION_KEY_SEPARATOR}`);
+}
 function query(key, handlerOrDef) {
   let handler;
   let argsSchema;
@@ -1584,6 +1709,25 @@ function deregisterClient(ws) {
     clients.delete(ws);
   }
 }
+function sendInvalidateToLocalSubscribers(queryKeys) {
+  const targets = /* @__PURE__ */ new Map();
+  for (const queryKey of queryKeys) {
+    for (const [subscriptionKey, clients] of subscribers) {
+      if (!subscriptionKeyMatchesQueryKey(subscriptionKey, queryKey)) continue;
+      for (const ws of clients) {
+        if (!targets.has(ws)) targets.set(ws, /* @__PURE__ */ new Set());
+        targets.get(ws).add(subscriptionKey);
+      }
+    }
+  }
+  for (const [ws, keys] of targets) {
+    try {
+      ws.send(JSON.stringify({ type: "invalidate", queries: [...keys] }));
+    } catch {
+      deregisterClient(ws);
+    }
+  }
+}
 function buildRealtimeCtx(options) {
   const pendingEmits = /* @__PURE__ */ new Map();
   const _pendingRefresh = [];
@@ -1616,6 +1760,15 @@ function buildRealtimeCtx(options) {
       }, 50);
       pendingEmits.set(queryKey, { data, timer });
     },
+    invalidate(queryKey) {
+      _hasEmitted = true;
+      const queryKeys = Array.isArray(queryKey) ? [...new Set(queryKey)] : [queryKey];
+      if (options?.httpCallback) {
+        options.httpCallback({ type: "invalidate", queryKeys });
+        return;
+      }
+      sendInvalidateToLocalSubscribers(queryKeys);
+    },
     refresh(queryKey) {
       _hasEmitted = true;
       if (!_pendingRefresh.includes(queryKey)) {
@@ -2529,7 +2682,7 @@ var RESERVED_TENANT_RUNTIME_ENV_KEYS = /* @__PURE__ */ new Set([
   "MIMALLOC_PURGE_DELAY",
   "NODE_PATH"
 ]);
-var RESERVED_TENANT_RUNTIME_ENV_PREFIXES = ["__GENCOW_", "GENCOW_DOCUMENT_", "GENCOW_WARM_"];
+var RESERVED_TENANT_RUNTIME_ENV_PREFIXES = ["__GENCOW_", "GENCOW_DOCUMENT_", "GENCOW_TEMPLATE_", "GENCOW_WARM_"];
 function isReservedTenantRuntimeEnvKey(key) {
   const normalized = key.trim();
   return RESERVED_TENANT_RUNTIME_ENV_KEYS.has(normalized) || RESERVED_TENANT_RUNTIME_ENV_PREFIXES.some((prefix) => normalized.startsWith(prefix));
@@ -2596,6 +2749,11 @@ function defineAuth(config) {
   return config;
 }
 
+// ../core/src/config.ts
+function defineConfig(config) {
+  return config;
+}
+
 // ../core/src/rls.ts
 import { sql as sql3 } from "drizzle-orm";
 import { pgPolicy } from "drizzle-orm/pg-core";
@@ -3037,17 +3195,11 @@ function crud(table, options) {
     }
     return await fn(db);
   }
-  async function fetchListWithTotal(db, whereClause, userId) {
-    let effectiveWhere = whereClause;
-    if (ownerMeta && userId && !ownerMeta.readPublic) {
-      const ownerFilter = eq(ownerMeta.column, userId);
-      effectiveWhere = effectiveWhere ? and(effectiveWhere, ownerFilter) : ownerFilter;
-    }
-    return await inRlsOrPlainTx(db, async (tx) => {
-      const data = await tx.select().from(anyTable).where(effectiveWhere).orderBy(desc(defaultOrderCol));
-      const countResult = await tx.select({ count: drizzleCount() }).from(anyTable).where(effectiveWhere);
-      return { data, total: Number(countResult[0]?.count ?? 0) };
-    });
+  function invalidateListRealtime(ctx) {
+    ctx.realtime.invalidate(`${prefix}.list`);
+  }
+  function invalidateGetRealtime(ctx, id) {
+    ctx.realtime.invalidate(buildQuerySubscriptionKey(`${prefix}.get`, { id }));
   }
   const enabledMethods = new Set(options?.methods ?? ["list", "get", "create", "update", "remove"]);
   const enabledMethodsList = Array.from(enabledMethods);
@@ -3141,9 +3293,7 @@ function crud(table, options) {
         async (tx) => tx.insert(anyTable).values(insertData).returning()
       );
       if (useRealtime && enabledMethods.has("list")) {
-        const currentUserId = user?.id;
-        const listResult = await fetchListWithTotal(ctx.db, void 0, currentUserId);
-        ctx.realtime.emit(`${prefix}.list`, listResult);
+        invalidateListRealtime(ctx);
       }
       return result;
     }
@@ -3173,13 +3323,13 @@ function crud(table, options) {
         async (tx) => tx.update(anyTable).set(updateData).where(updateWhere).returning()
       );
       if (useRealtime) {
-        const currentUserId = ownerMeta ? user?.id : void 0;
         if (enabledMethods.has("list")) {
-          const listResult = await fetchListWithTotal(ctx.db, void 0, currentUserId);
-          ctx.realtime.emit(`${prefix}.list`, listResult);
+          invalidateListRealtime(ctx);
         }
         if (enabledMethods.has("get")) {
-          ctx.realtime.emit(`${prefix}.get`, result);
+          const getKey = buildQuerySubscriptionKey(`${prefix}.get`, { id });
+          if (isPublic && !ownerMeta) ctx.realtime.emit(getKey, result);
+          else invalidateGetRealtime(ctx, id);
         }
       }
       return result;
@@ -3202,9 +3352,7 @@ function crud(table, options) {
         }
       });
       if (useRealtime && enabledMethods.has("list")) {
-        const currentUserId = ownerMeta ? user?.id : void 0;
-        const listResult = await fetchListWithTotal(ctx.db, void 0, currentUserId);
-        ctx.realtime.emit(`${prefix}.list`, listResult);
+        invalidateListRealtime(ctx);
       }
       return { success: true };
     }
@@ -3219,23 +3367,32 @@ function crud(table, options) {
 }
 export {
   DEFAULT_GROUNDING_BUDGET,
+  DEFAULT_WAKE_RETRY_AFTER_SEC,
   DEFAULT_WORKFLOW_MAX_DURATION_MS,
   DEFAULT_WORKFLOW_MAX_RETRIES,
   GencowValidationError,
+  PLATFORM_CAPACITY_ENV_KEYS,
+  PLATFORM_CAPACITY_PRESETS,
+  PLATFORM_CAPACITY_PROFILE_ENV,
   WORKFLOW_REALTIME_KEY_PREFIX,
   WORKFLOW_RESUME_ACTION_PREFIX,
   applyFilterOp,
   buildDocumentCacheKey,
+  buildQuerySubscriptionKey,
   buildRealtimeCtx,
+  buildWakeAppBootFailedResult,
+  buildWakeAppSuccessResult,
   createRlsDb,
   createScheduler,
   createWorkflowRealtimeToken,
   cronJobs,
   crud,
   defineAuth,
+  defineConfig,
   deregisterClient,
   deriveWorkflowStatus,
   deserializeWorkflowValue,
+  detectPlatformCapacityProfile,
   filterTenantRuntimeEnvVars,
   crud as gencowCrud,
   getOwnerRlsMeta,
@@ -3254,6 +3411,7 @@ export {
   handleWsMessage,
   httpAction,
   isReservedTenantRuntimeEnvKey,
+  isWakeAppDeferredResult,
   loadWorkflowSnapshot,
   mutation,
   ownerRls,
@@ -3269,8 +3427,10 @@ export {
   ragSources,
   registerClient,
   registerOwnerRls,
+  resolvePlatformCapacityPreset,
   serializeWorkflowValue,
   subscribe,
+  subscriptionKeyMatchesQueryKey,
   unsubscribe,
   v,
   withRetry,

package/lib/app-command.mjs

@@ -15,6 +15,17 @@ export function formatAppDeployedAgo(dateStr, now = Date.now()) {
   return `${days}d ago`;
 }
 
+export function addDeployAppToConfigSource(src, appName) {
+  if (src.includes("deploy:")) return src;
+
+  const deployBlock = `    deploy: {\n        app: "${appName}",\n    },\n`;
+  const defineConfigSource = src.replace(/}\s*\)\s*;?\s*$/, `${deployBlock}});\n`);
+  if (defineConfigSource !== src) return defineConfigSource;
+
+  const objectExportSource = src.replace(/}\s*;?\s*$/, `${deployBlock}};\n`);
+  return objectExportSource;
+}
+
 async function confirmDelete(name) {
   const { createInterface } = await import("readline");
   const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -59,7 +70,9 @@ export function createAppCommand({ loadConfig }) {
       log(`  ${"NAME".padEnd(22)} ${"STATUS".padEnd(12)} ${"URL".padEnd(38)} DEPLOYED`);
       log(`  ${"-".repeat(85)}`);
       for (const appRow of apps) {
-        const status = appRow.running ? `${GREEN}running${RESET}` : `${DIM}${appRow.status || "stopped"}${RESET}`;
+        const status = appRow.running
+          ? `${GREEN}running${RESET}`
+          : `${DIM}${appRow.status || "stopped"}${RESET}`;
         const url = appRow.url || `${DIM}—${RESET}`;
         const deployed = formatAppDeployedAgo(appRow.lastDeployedAt);
         log(
@@ -116,10 +129,10 @@ export function createAppCommand({ loadConfig }) {
 
       const configPath = resolve(cwd, "gencow.config.ts");
       if (existsSync(configPath)) {
-        let src = readFileSync(configPath, "utf8");
-        if (!src.includes("deploy:")) {
-          src = src.replace(/}\s*;?\s*$/, `    deploy: {\n        app: "${name}",\n    },\n};\n`);
-          writeFileSync(configPath, src);
+        const src = readFileSync(configPath, "utf8");
+        const nextSrc = addDeployAppToConfigSource(src, name);
+        if (nextSrc !== src) {
+          writeFileSync(configPath, nextSrc);
           success(`gencow.config.ts — added deploy.app = "${name}"`);
         }
       }

package/lib/deploy-auditor.mjs

@@ -18,6 +18,13 @@ import { build } from "esbuild";
 import { existsSync, readdirSync, readFileSync } from "fs";
 import { basename, dirname, join, relative } from "path";
 
+export {
+  DEPLOY_DEPENDENCY_AUDIT_MANIFEST,
+  auditDependencyVersions,
+  formatDependencyVersionAuditError,
+  getDependencyCompatibilityMatrix,
+} from "./deploy-dependency-compat.mjs";
+
 // ── Platform packages (available in cloud runtime NODE_PATH) ──
 // These are installed in the platform's node_modules and accessible
 // via NODE_PATH at runtime. Keep in sync with server NODE_PATH setup.

package/lib/deploy-command.mjs

@@ -7,7 +7,7 @@ export function renderDeployHelp() {
   log(`  ${BOLD}Options:${RESET}`);
   log(`    ${DIM}--prod${RESET}             Deploy to production (Pro+ only)`);
   log(`    ${DIM}--rollback${RESET}          Rollback to previous deployment`);
-  log(`    ${DIM}--force, -f${RESET}        Skip dependency audit`);
+  log(`    ${DIM}--force, -f${RESET}        Skip optional dependency scan`);
   log(`    ${DIM}--app, -a${RESET}          Target specific app\n`);
   log(`  ${BOLD}Examples:${RESET}`);
   log(`    gencow deploy`);

package/lib/deploy-dependency-compat.mjs

@@ -0,0 +1,191 @@
+export const DEPLOY_DEPENDENCY_AUDIT_MANIFEST = ".gencow/deploy-dependency-audit.json";
+export const DEPLOY_DEPENDENCY_MATRIX_VERSION = "2026-04-27";
+
+export const DEPENDENCY_COMPAT_MATRIX = Object.freeze([
+  {
+    packageName: "@gencow/core",
+    expectedRange: "latest || workspace:* || ^0.1.28",
+    installRange: "@gencow/core@latest",
+    policy: "block",
+  },
+  {
+    packageName: "drizzle-orm",
+    expectedRange: "workspace:* || ^1.0.0-beta || ^1.0.0",
+    installRange: "drizzle-orm@^1.0.0",
+    policy: "block",
+  },
+  {
+    packageName: "hono",
+    expectedRange: "workspace:* || ^4.12.0",
+    installRange: "hono@^4.12.0",
+    policy: "block",
+  },
+  {
+    packageName: "better-auth",
+    expectedRange: "workspace:* || ^1.5.1",
+    installRange: "better-auth@^1.5.1",
+    policy: "block",
+  },
+]);
+
+export function getDependencyCompatibilityMatrix() {
+  return DEPENDENCY_COMPAT_MATRIX.map((rule) => ({ ...rule }));
+}
+
+export function auditDependencyVersions(packageJson) {
+  const dependencies = collectHostRuntimeDependencies(packageJson);
+  const issues = [];
+
+  for (const rule of DEPENDENCY_COMPAT_MATRIX) {
+    const currentRange = dependencies[rule.packageName];
+    if (!currentRange) continue;
+    if (!isRangeCompatible(currentRange, rule.expectedRange)) {
+      issues.push({
+        packageName: rule.packageName,
+        currentRange,
+        expectedRange: rule.expectedRange,
+        installRange: rule.installRange,
+        policy: rule.policy,
+      });
+    }
+  }
+
+  return {
+    passed: issues.length === 0,
+    issues,
+    manifest: buildDependencyAuditManifest(dependencies),
+  };
+}
+
+export function buildDependencyAuditManifest(dependencies) {
+  return {
+    schemaVersion: 1,
+    generatedAt: new Date().toISOString(),
+    matrixVersion: DEPLOY_DEPENDENCY_MATRIX_VERSION,
+    dependencies: pickMatrixDependencies(dependencies),
+  };
+}
+
+export function formatDependencyVersionAuditError(result) {
+  if (result.passed) return "";
+
+  const installTargets = [...new Set(result.issues.map((issue) => issue.installRange))];
+  const lines = [
+    "",
+    "╔══════════════════════════════════════════════════════════════╗",
+    "║  ⛔ DEPLOY BLOCKED — Runtime dependency version mismatch    ║",
+    "╚══════════════════════════════════════════════════════════════╝",
+    "",
+    "  앱의 핵심 런타임 dependency가 Gencow host runtime contract와 맞지 않습니다.",
+    "  배포 후 Warm Pool/runtime crash를 막기 위해 배포를 차단합니다.",
+    "",
+  ];
+
+  for (const issue of result.issues) {
+    lines.push(`  ✗ ${issue.packageName}: ${issue.currentRange}`);
+    lines.push(`    expected: ${issue.expectedRange}`);
+  }
+
+  lines.push("");
+  lines.push("  Fix:");
+  lines.push(`    pnpm add ${installTargets.join(" ")}`);
+  lines.push("    npx gencow@latest deploy");
+  lines.push("");
+
+  return lines.join("\n");
+}
+
+function collectHostRuntimeDependencies(packageJson) {
+  const allDeps = {
+    ...(packageJson?.peerDependencies || {}),
+    ...(packageJson?.devDependencies || {}),
+    ...(packageJson?.dependencies || {}),
+  };
+  return pickMatrixDependencies(allDeps);
+}
+
+function pickMatrixDependencies(dependencies) {
+  const picked = {};
+  for (const rule of DEPENDENCY_COMPAT_MATRIX) {
+    const value = dependencies?.[rule.packageName];
+    if (typeof value === "string" && value.trim()) {
+      picked[rule.packageName] = value.trim();
+    }
+  }
+  return picked;
+}
+
+function isRangeCompatible(currentRange, expectedRange) {
+  const currentClauses = splitRange(currentRange);
+  const expectedClauses = splitRange(expectedRange);
+
+  for (const current of currentClauses) {
+    for (const expected of expectedClauses) {
+      if (clausesCompatible(current, expected)) return true;
+    }
+  }
+  return false;
+}
+
+function splitRange(range) {
+  return String(range)
+    .split("||")
+    .map((part) => part.trim())
+    .filter(Boolean);
+}
+
+function clausesCompatible(current, expected) {
+  if (isSpecialClause(current) || isSpecialClause(expected)) {
+    return current === expected || (current.startsWith("workspace:") && expected === "workspace:*");
+  }
+
+  const currentVersion = parseVersionClause(current);
+  const expectedVersion = parseVersionClause(expected);
+  if (!currentVersion || !expectedVersion) return false;
+
+  if (expectedVersion.major === 0) {
+    if (currentVersion.major !== 0 || currentVersion.minor !== expectedVersion.minor) return false;
+    if (currentVersion.operator === "exact") {
+      return compareVersions(currentVersion, expectedVersion) >= 0;
+    }
+    return true;
+  }
+
+  if (currentVersion.major !== expectedVersion.major) return false;
+  return compareVersions(currentVersion, expectedVersion) >= 0;
+}
+
+function isSpecialClause(value) {
+  return value === "latest" || value.startsWith("workspace:");
+}
+
+function parseVersionClause(clause) {
+  const trimmed = clause.trim();
+  const operator = trimmed.startsWith("^")
+    ? "^"
+    : trimmed.startsWith("~")
+      ? "~"
+      : trimmed.startsWith(">=")
+        ? ">="
+        : "exact";
+  const match = trimmed.match(/(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/);
+  if (!match) return null;
+  return {
+    operator,
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] || "",
+  };
+}
+
+function compareVersions(a, b) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] > b[key]) return 1;
+    if (a[key] < b[key]) return -1;
+  }
+  if (a.prerelease === b.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b.prerelease) return -1;
+  return a.prerelease > b.prerelease ? 1 : -1;
+}

package/lib/deploy-package-runtime.mjs

@@ -119,6 +119,41 @@ export function createDeployPackageRuntime({
 
     await runWorkflowShadowingAudit();
 
+    let dependencyAuditManifestPath = null;
+    let dependencyAuditManifest = null;
+    let dependencyVersionMessage = "";
+    try {
+      const {
+        DEPLOY_DEPENDENCY_AUDIT_MANIFEST,
+        auditDependencyVersions,
+        formatDependencyVersionAuditError,
+      } = await import("./deploy-auditor.mjs");
+      const projectPkg = JSON.parse(readFileSyncImpl(resolvePathImpl(cwd, "package.json"), "utf8"));
+      const dependencyVersionResult = auditDependencyVersions(projectPkg);
+      dependencyVersionMessage = formatDependencyVersionAuditError(dependencyVersionResult);
+      dependencyAuditManifestPath = resolvePathImpl(cwd, DEPLOY_DEPENDENCY_AUDIT_MANIFEST);
+      dependencyAuditManifest = dependencyVersionResult.manifest;
+    } catch (caught) {
+      errorImpl(`Dependency version audit failed: ${caught.message}`);
+      exitImpl(1);
+      return null;
+    }
+
+    if (dependencyVersionMessage) {
+      errorImpl(dependencyVersionMessage);
+      exitImpl(1);
+      return null;
+    }
+
+    try {
+      mkdirSyncImpl(dirname(dependencyAuditManifestPath), { recursive: true });
+      writeFileSyncImpl(dependencyAuditManifestPath, JSON.stringify(dependencyAuditManifest, null, 2));
+    } catch (caught) {
+      errorImpl(`Dependency audit manifest write failed: ${caught.message}`);
+      exitImpl(1);
+      return null;
+    }
+
     let auditResult = null;
     if (!forceDeploy) {
       try {
@@ -136,6 +171,7 @@ export function createDeployPackageRuntime({
 
     let useFilteredPkg = false;
     const filesToPack = ["gencow/", "package.json"];
+    if (dependencyAuditManifestPath) filesToPack.push(".gencow/deploy-dependency-audit.json");
     if (existsSyncImpl(resolvePathImpl(cwd, "bun.lockb"))) filesToPack.push("bun.lockb");
     if (existsSyncImpl(resolvePathImpl(cwd, "package-lock.json"))) filesToPack.push("package-lock.json");
     if (existsSyncImpl(resolvePathImpl(cwd, "tsconfig.json"))) filesToPack.push("tsconfig.json");
@@ -176,6 +212,7 @@ export function createDeployPackageRuntime({
           if (file.endsWith("/")) {
             execSyncImpl(`cp -r "${src}" "${dst}"`, { cwd });
           } else if (existsSyncImpl(src)) {
+            mkdirSyncImpl(dirname(dst), { recursive: true });
             execSyncImpl(`cp "${src}" "${dst}"`, { cwd });
           }
         }

package/lib/deploy-runtime.mjs

@@ -69,7 +69,7 @@ function showUnknownDeployArgument(arg, { errorImpl = error, infoImpl = info, lo
   infoImpl("  gencow deploy --rollback   Rollback to previous version");
   infoImpl("  gencow deploy logs         View server logs");
   infoImpl("  gencow deploy status       Check app status");
-  infoImpl("  gencow deploy --force      Skip dependency audit");
+  infoImpl("  gencow deploy --force      Skip optional dependency scan");
   logImpl("");
   infoImpl("Static files:");
   infoImpl("  gencow static [dir]        Deploy static files (dev)");

package/lib/init-command.mjs

@@ -80,16 +80,18 @@ const crons = cronJobs();
 export default crons;
 `;
 
-const GENCOW_CONFIG_TEMPLATE = `export default {
+const GENCOW_CONFIG_TEMPLATE = `import { defineConfig } from "@gencow/core";
+
+export default defineConfig({
     functionsDir: "./gencow",
     schema: "./gencow/schema.ts",
     // Optional: where generated frontend codegen artifacts are written.
-    // If omitted, CLI uses src/gencow when src/ exists, otherwise functionsDir.
+    // Default: "./src/gencow".
     codegenOutDir: "./src/gencow",
     storage: "./.gencow/uploads",
     db: { url: "./.gencow/data" },
     port: 5456,
-};
+});
 `;
 
 const DRIZZLE_CONFIG_TEMPLATE = `export default {