gencow 0.1.180 → 0.1.181

package/lib/backend-bundle-file-plan.mjs

@@ -0,0 +1,67 @@
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import { relative, resolve } from "node:path";
+
+import { shouldIncludeTarEntry } from "./tar-archive.mjs";
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function canonicalPath(value) {
+  return value.replaceAll("\\", "/").normalize("NFC");
+}
+
+function collectFiles(backendRoot, archiveRoot, excludes, directory = backendRoot) {
+  const files = [];
+  for (const entry of readdirSync(directory).sort()) {
+    const path = resolve(directory, entry);
+    const stats = lstatSync(path);
+    if (stats.isDirectory()) {
+      files.push(...collectFiles(backendRoot, archiveRoot, excludes, path));
+      continue;
+    }
+    if (!stats.isFile() || stats.isSymbolicLink()) {
+      throw new Error(`Bundle entry ${JSON.stringify(entry)} must be a regular file`);
+    }
+    const relativePath = canonicalPath(relative(backendRoot, path));
+    const archivePath = canonicalPath(`${archiveRoot}/${relativePath}`);
+    if (!shouldIncludeTarEntry(archivePath, excludes)) continue;
+    const bytes = readFileSync(path);
+    files.push({ relativePath, archivePath, size: bytes.length, sha256: sha256(bytes) });
+  }
+  return files;
+}
+
+function assertUniqueCanonicalPaths(files) {
+  const exact = new Set();
+  const folded = new Set();
+  for (const file of files) {
+    const caseFolded = file.relativePath.toLocaleLowerCase("en-US");
+    if (exact.has(file.relativePath) || folded.has(caseFolded)) {
+      throw new Error("Backend bundle paths must be unique without Unicode or case-fold collisions");
+    }
+    exact.add(file.relativePath);
+    folded.add(caseFolded);
+  }
+}
+
+export function buildBackendBundleFilePlan({ backendRoot, archiveRoot = "gencow", excludes = [] }) {
+  const normalizedArchiveRoot = canonicalPath(archiveRoot).replace(/^\.\/+|\/+$/gu, "");
+  if (!normalizedArchiveRoot || normalizedArchiveRoot.includes("..")) {
+    throw new Error("Backend bundle archive root is invalid");
+  }
+  const files = collectFiles(backendRoot, normalizedArchiveRoot, excludes);
+  assertUniqueCanonicalPaths(files);
+  const bundleFileRows = files.map((file) => [file.relativePath, file.size, file.sha256]);
+  const archiveEntries = files.map((file) => file.archivePath);
+  const migrationsRoot = resolve(backendRoot, "migrations");
+  if (existsSync(migrationsRoot) && !files.some((file) => file.relativePath.startsWith("migrations/"))) {
+    archiveEntries.push(`${normalizedArchiveRoot}/migrations/`);
+  }
+  return {
+    archiveEntries,
+    bundleFileRows,
+    bundleSha256: sha256(JSON.stringify(bundleFileRows)),
+  };
+}

package/lib/db-command.mjs

@@ -173,6 +173,7 @@ export function createDbCommands({
   statSyncImpl = statSync,
   successImpl = success,
   tarCreateImpl,
+  verifyMigrationBundleArchiveRoundTripImpl,
   unlinkSyncImpl = unlinkSync,
   cpSyncImpl = cpSync,
   dirnameImpl = dirname,
@@ -210,6 +211,7 @@ export function createDbCommands({
     runInServer,
     successImpl,
     tarCreateImpl,
+    verifyMigrationBundleArchiveRoundTripImpl,
     tmpdirImpl,
     unlinkSyncImpl,
     warnImpl,

package/lib/db-push-command.mjs

@@ -17,6 +17,7 @@ import {
 import {
   buildAuthSchemaProvenanceDiagnostic,
   buildClientBundleFailureDiagnostic,
+  buildLocalBundleIntegrityFailureDiagnostic,
   buildClientPreflightFailureDiagnostic,
   buildClientUserFixableDiagnostic,
 } from "./migration-client-diagnostic.mjs";
@@ -350,11 +351,16 @@ function createDbMigrationCommand(deps, command) {
           resolvePathImpl: deps.resolvePathImpl,
           rmSyncImpl: deps.rmSyncImpl,
           tarCreateImpl: deps.tarCreateImpl,
+          verifyArchiveImpl: deps.verifyMigrationBundleArchiveRoundTripImpl,
           tmpdirImpl: deps.tmpdirImpl,
           writeFileSyncImpl: deps.writeFileSyncImpl,
         });
       } catch (error) {
-        emitFailure(buildClientBundleFailureDiagnostic(clientCorrelationId(), retryCommand));
+        emitFailure(
+          error?.code === "MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED"
+            ? buildLocalBundleIntegrityFailureDiagnostic(clientCorrelationId())
+            : buildClientBundleFailureDiagnostic(clientCorrelationId(), retryCommand),
+        );
         return;
       }
 

package/lib/deploy-package-runtime.mjs

@@ -22,6 +22,7 @@ import {
 } from "./project-migration-manifest.mjs";
 import { hasWorkspaceSourceRuntime } from "./runtime-mode.mjs";
 import { createTarGzipArchive } from "./tar-archive.mjs";
+import { verifyMigrationBundleArchiveRoundTrip } from "./migration-bundle-roundtrip.mjs";
 import { assertToolingRuntimeCapabilities, loadToolingRuntime } from "./tooling-runtime.mjs";
 import {
   extractActionableMigrationDiagnostic,
@@ -179,12 +180,14 @@ export function createDeployPackageRuntime({
     const cwd = cwdImpl();
     const { genEnv } = await loadMigrationGenerationContext(cwd);
 
-    if (!hasProjectDatabaseSchemaSource({
-      cwd,
-      config: migrationProjectConfig,
-      existsSyncImpl,
-      resolvePathImpl,
-    })) {
+    if (
+      !hasProjectDatabaseSchemaSource({
+        cwd,
+        config: migrationProjectConfig,
+        existsSyncImpl,
+        resolvePathImpl,
+      })
+    ) {
       logImpl(`${DIM}  ok No schema source — migration generation not required${RESET}`);
       return SUPPORTED_DRIZZLE_KIT_GENERATOR_VERSION;
     }
@@ -412,12 +415,13 @@ export function createDeployPackageRuntime({
         /* ignore and keep safe defaults */
       }
     }
-    const filesToPack = ["gencow/", "package.json"];
+    const filesToPack = ["package.json"];
     let migrationManifestStage;
     try {
       migrationManifestStage = stageProjectMigrationManifest({
         cwd,
         config: migrationProjectConfig,
+        backendExcludes: envExcludes,
         cliVersion,
         generatorVersion,
         existsSyncImpl,
@@ -427,6 +431,7 @@ export function createDeployPackageRuntime({
         rmSyncImpl,
         writeFileSyncImpl,
       });
+      filesToPack.push(...migrationManifestStage.backendArchiveEntries);
       if (migrationManifestStage.relativePath) filesToPack.push(migrationManifestStage.relativePath);
     } catch (caught) {
       errorImpl(`Migration bundle manifest generation failed: ${caught.message}`);
@@ -515,6 +520,13 @@ export function createDeployPackageRuntime({
 
     const bundleBuffer = readFileSyncImpl(tmpBundle);
     const bundleSize = statSyncImpl(tmpBundle).size;
+    try {
+      await verifyMigrationBundleArchiveRoundTrip({ bundleBuffer });
+    } catch (caught) {
+      errorImpl(`Migration bundle round-trip verification failed: ${caught.message}`);
+      exitImpl(1);
+      return null;
+    }
     let deployClaim;
     try {
       deployClaim = await buildDeployClaimFromArchiveImpl({

package/lib/dev-cloud-bundle.mjs

@@ -13,6 +13,7 @@ import {
   formatDependencyVersionAuditError,
 } from "./deploy-auditor.mjs";
 import { shouldIncludeTarEntry } from "./tar-archive.mjs";
+import { verifyMigrationBundleArchiveRoundTrip } from "./migration-bundle-roundtrip.mjs";
 
 const OPTIONAL_BUNDLE_FILES = [
   "gencow.config.js",
@@ -119,8 +120,7 @@ export async function createDevCloudDeployBundle({
   writeFileSyncImpl = writeFileSync,
 } = {}) {
   const bundleRootDir = rootDir ?? functionsDir;
-  if (!cwd || !bundleRootDir)
-    throw new Error("cwd and rootDir are required to create a dev cloud bundle");
+  if (!cwd || !bundleRootDir) throw new Error("cwd and rootDir are required to create a dev cloud bundle");
 
   const functionsSource = resolvePathImpl(cwd, bundleRootDir);
   if (!existsSyncImpl(functionsSource)) throw new Error(`Backend root dir not found: ${functionsSource}`);
@@ -143,7 +143,7 @@ export async function createDevCloudDeployBundle({
   mkdirSyncImpl(stagingDir, { recursive: true });
 
   try {
-    const filesToPack = [bundleRootDir, "package.json", DEPLOY_DEPENDENCY_AUDIT_MANIFEST];
+    const filesToPack = ["package.json", DEPLOY_DEPENDENCY_AUDIT_MANIFEST];
     const envExcludes = buildBackendEnvExcludePatterns({
       rootDir: `./${bundleRootDir.replace(/^\.\/+/, "").replace(/[\\/]+$/, "")}`,
       ...(envFile ? { envFile } : {}),
@@ -156,7 +156,10 @@ export async function createDevCloudDeployBundle({
     mkdirSyncImpl(dirname(manifestPath), { recursive: true });
     writeFileSyncImpl(manifestPath, JSON.stringify(dependencyVersionResult.manifest, null, 2));
 
-    const cronManifest = await writeCronManifestForProjectImpl({ cwd: stagingDir, functionsDir: bundleRootDir });
+    const cronManifest = await writeCronManifestForProjectImpl({
+      cwd: stagingDir,
+      functionsDir: bundleRootDir,
+    });
     if (cronManifest) filesToPack.push(CRON_MANIFEST_RELATIVE_PATH);
 
     const filteredPackage = buildFilteredPackageJson(projectPkg, auditResult?.runtimeDeps);
@@ -174,6 +177,7 @@ export async function createDevCloudDeployBundle({
     const migrationManifestStage = stageProjectMigrationManifest({
       cwd: stagingDir,
       backendDir: bundleRootDir,
+      backendExcludes: envExcludes,
       config,
       cliVersion,
       generatorVersion,
@@ -184,6 +188,7 @@ export async function createDevCloudDeployBundle({
       rmSyncImpl,
       writeFileSyncImpl,
     });
+    filesToPack.push(...migrationManifestStage.backendArchiveEntries);
     if (migrationManifestStage.relativePath) filesToPack.push(migrationManifestStage.relativePath);
 
     try {
@@ -193,6 +198,7 @@ export async function createDevCloudDeployBundle({
         tarCreateImpl,
         excludes: envExcludes,
       });
+      await verifyMigrationBundleArchiveRoundTrip({ bundleBuffer: bundle, backendDir: bundleRootDir });
       return {
         bundle,
         auditMessage,

package/lib/migration-bundle-manifest.mjs

@@ -179,5 +179,6 @@ export function unsignedMigrationBundleManifest({
 
 export function buildMigrationBundleManifest(params) {
   const unsigned = unsignedMigrationBundleManifest(params);
-  return { ...unsigned, bundleSha256: sha256(JSON.stringify(bundleFileRows(params.backendRoot))) };
+  const rows = params.bundleFilePlan?.bundleFileRows ?? bundleFileRows(params.backendRoot);
+  return { ...unsigned, bundleSha256: sha256(JSON.stringify(rows)) };
 }

package/lib/migration-bundle-roundtrip.mjs

@@ -0,0 +1,55 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import {
+  MIGRATION_BUNDLE_MANIFEST_PATH,
+  buildMigrationBundleManifest,
+} from "./migration-bundle-manifest.mjs";
+
+export const MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED = "MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED";
+
+function localIntegrityError(cause) {
+  const error = new Error(MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED, cause ? { cause } : undefined);
+  error.code = MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED;
+  return error;
+}
+
+export async function verifyMigrationBundleArchiveRoundTrip({
+  archivePath,
+  bundleBuffer,
+  backendDir = "gencow",
+}) {
+  const verificationRoot = mkdtempSync(join(tmpdir(), "gencow-migration-roundtrip-"));
+  try {
+    mkdirSync(verificationRoot, { recursive: true });
+    const verificationArchive = archivePath ?? resolve(verificationRoot, "bundle.tar.gz");
+    if (!archivePath) writeFileSync(verificationArchive, bundleBuffer, { mode: 0o600 });
+    const { extract } = await import("tar");
+    await extract({ cwd: verificationRoot, file: verificationArchive });
+    const manifestPath = resolve(verificationRoot, MIGRATION_BUNDLE_MANIFEST_PATH);
+    const backendRoot = resolve(verificationRoot, backendDir);
+    if (!existsSync(manifestPath) || !existsSync(backendRoot)) {
+      throw localIntegrityError();
+    }
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const recomputed = buildMigrationBundleManifest({
+      backendRoot,
+      cliVersion: manifest.cliVersion,
+      generatorVersion: manifest.generatorVersion,
+      sourceMode: manifest.sourceMode,
+      schemaSourcePaths: manifest.schemaSources?.map((source) => resolve(backendRoot, source.path)),
+    });
+    if (JSON.stringify(recomputed) !== JSON.stringify(manifest)) {
+      throw localIntegrityError();
+    }
+    return manifest;
+  } catch (error) {
+    if (error?.code === MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED) {
+      throw error;
+    }
+    throw localIntegrityError(error);
+  } finally {
+    rmSync(verificationRoot, { recursive: true, force: true });
+  }
+}

package/lib/migration-bundle-staging.mjs

@@ -6,7 +6,9 @@ import {
   buildMigrationBundleManifest,
 } from "./migration-bundle-manifest.mjs";
 import { buildBackendEnvExcludePatterns } from "./backend-env-resolver.mjs";
+import { buildBackendBundleFilePlan } from "./backend-bundle-file-plan.mjs";
 import { createTarGzipArchive } from "./tar-archive.mjs";
+import { verifyMigrationBundleArchiveRoundTrip } from "./migration-bundle-roundtrip.mjs";
 
 export async function stageMigrationBundleArchive({
   backendRoot,
@@ -21,6 +23,7 @@ export async function stageMigrationBundleArchive({
   resolvePathImpl = resolve,
   rmSyncImpl = rmSync,
   tarCreateImpl,
+  verifyArchiveImpl = verifyMigrationBundleArchiveRoundTrip,
   tmpdirImpl = tmpdir,
   writeFileSyncImpl = writeFileSync,
 }) {
@@ -34,6 +37,12 @@ export async function stageMigrationBundleArchive({
     cpSyncImpl(backendRoot, stagedBackendRoot, { recursive: true, errorOnExist: true });
     mkdirSyncImpl(resolvePathImpl(stagedBackendRoot, "migrations"), { recursive: true });
     mkdirSyncImpl(metadataRoot, { recursive: true });
+    const excludes = buildBackendEnvExcludePatterns(config);
+    const bundleFilePlan = buildBackendBundleFilePlan({
+      backendRoot: stagedBackendRoot,
+      archiveRoot: "gencow",
+      excludes,
+    });
     const manifest = buildMigrationBundleManifest({
       backendRoot: stagedBackendRoot,
       cliVersion,
@@ -42,15 +51,17 @@ export async function stageMigrationBundleArchive({
       schemaSourcePaths: schemaSourcePaths?.map((sourcePath) =>
         resolvePathImpl(stagedBackendRoot, relative(backendRoot, sourcePath)),
       ),
+      bundleFilePlan,
     });
     writeFileSyncImpl(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
     await createTarGzipArchive({
       cwd: workspaceRoot,
       file: archivePath,
-      entries: ["gencow/", MIGRATION_BUNDLE_MANIFEST_PATH],
-      excludes: buildBackendEnvExcludePatterns(config),
+      entries: [...bundleFilePlan.archiveEntries, MIGRATION_BUNDLE_MANIFEST_PATH],
+      excludes,
       tarCreateImpl,
     });
+    await verifyArchiveImpl({ archivePath });
     return { archivePath, cleanup, manifest, workspaceRoot };
   } catch (error) {
     cleanup();

package/lib/migration-client-diagnostic.mjs

@@ -1,5 +1,6 @@
 import {
   MIGRATION_CAPABILITY_MANIFEST_V1,
+  platformActionDiagnostic,
   retryableInfraDiagnostic,
   userFixableDiagnostic,
 } from "@gencow/migration-contract";
@@ -139,6 +140,27 @@ export function buildClientBundleFailureDiagnostic(correlationId, retryCommand)
   };
 }
 
+export function buildLocalBundleIntegrityFailureDiagnostic(correlationId) {
+  return platformActionDiagnostic({
+    code: "MIGRATION_BUNDLE_LOCAL_INTEGRITY_FAILED",
+    phase: "PREFLIGHT",
+    databaseState: "UNCHANGED",
+    correlationId,
+    retryCondition: "Install a patched CLI, then create a fresh migration bundle.",
+    reason: {
+      code: "migration_bundle_local_integrity_failed",
+      summary: "The local archive did not match its migration manifest.",
+      detail: "No remote request was sent and the cloud database was not changed.",
+    },
+    suggestedFixes: [],
+    nextAction: "UPDATE_CLI",
+    docsUrl: MIGRATION_CAPABILITY_MANIFEST_V1.docsUrl,
+    supportedCliRange: MIGRATION_CAPABILITY_MANIFEST_V1.supportedCliRange,
+    forbiddenActions: [...FORBIDDEN_ACTIONS],
+    redaction: { serverReturnedRawSql: false, localExcerpt: "NONE" },
+  });
+}
+
 export function buildClientPreflightFailureDiagnostic(correlationId) {
   return {
     ...buildClientBundleFailureDiagnostic(correlationId),

package/lib/project-migration-manifest.mjs

@@ -5,6 +5,8 @@ import {
   MIGRATION_BUNDLE_MANIFEST_PATH,
   buildMigrationBundleManifest,
 } from "./migration-bundle-manifest.mjs";
+import { buildBackendEnvExcludePatterns } from "./backend-env-resolver.mjs";
+import { buildBackendBundleFilePlan } from "./backend-bundle-file-plan.mjs";
 import { resolveConfiguredSchemaPaths, resolveDrizzleSchemaPaths } from "./cli-schema-paths.mjs";
 
 export const PROJECT_AUXILIARY_SCHEMA_PATHS = [
@@ -18,11 +20,7 @@ export const PROJECT_AUXILIARY_SCHEMA_PATHS = [
 
 function declaredConfiguredSchemaPaths({ cwd, backendDir, config, resolvePathImpl }) {
   if (!config?.schema) return [];
-  return resolveConfiguredSchemaPaths(
-    cwd,
-    resolvePathImpl(cwd, config.rootDir ?? backendDir),
-    config.schema,
-  );
+  return resolveConfiguredSchemaPaths(cwd, resolvePathImpl(cwd, config.rootDir ?? backendDir), config.schema);
 }
 
 function projectSchemaSourcePaths({
@@ -38,10 +36,11 @@ function projectSchemaSourcePaths({
     const missing = declared.filter((pathValue) => !existsSyncImpl(pathValue));
     if (missing.length > 0) throw new Error("Configured schema source is missing from the project");
   }
-  return resolveDrizzleSchemaPaths(
-    config ?? { rootDir: backendDir },
-    { cwd, existsSyncImpl, resolvePathImpl },
-  ).filter((pathValue) => existsSyncImpl(pathValue));
+  return resolveDrizzleSchemaPaths(config ?? { rootDir: backendDir }, {
+    cwd,
+    existsSyncImpl,
+    resolvePathImpl,
+  }).filter((pathValue) => existsSyncImpl(pathValue));
 }
 
 export function hasProjectDatabaseSchemaSource({
@@ -52,14 +51,16 @@ export function hasProjectDatabaseSchemaSource({
   resolvePathImpl = resolve,
 }) {
   if (declaredConfiguredSchemaPaths({ cwd, backendDir, config, resolvePathImpl }).length > 0) return true;
-  return projectSchemaSourcePaths({
-    cwd,
-    backendDir,
-    config,
-    existsSyncImpl,
-    resolvePathImpl,
-    requireDeclaredSources: false,
-  }).length > 0;
+  return (
+    projectSchemaSourcePaths({
+      cwd,
+      backendDir,
+      config,
+      existsSyncImpl,
+      resolvePathImpl,
+      requireDeclaredSources: false,
+    }).length > 0
+  );
 }
 
 export function stageProjectMigrationManifest({
@@ -67,6 +68,7 @@ export function stageProjectMigrationManifest({
   cliVersion,
   generatorVersion,
   backendDir = "gencow",
+  backendExcludes,
   config,
   existsSyncImpl = existsSync,
   mkdirSyncImpl = mkdirSync,
@@ -84,6 +86,11 @@ export function stageProjectMigrationManifest({
     resolvePathImpl,
     requireDeclaredSources: true,
   });
+  const bundleFilePlan = buildBackendBundleFilePlan({
+    backendRoot,
+    archiveRoot: backendDir,
+    excludes: backendExcludes ?? buildBackendEnvExcludePatterns(config),
+  });
 
   const manifestPath = resolvePathImpl(cwd, MIGRATION_BUNDLE_MANIFEST_PATH);
   const previous = existsSyncImpl(manifestPath) ? readFileSyncImpl(manifestPath) : null;
@@ -93,6 +100,7 @@ export function stageProjectMigrationManifest({
     generatorVersion,
     sourceMode: "GENERATED",
     schemaSourcePaths,
+    bundleFilePlan,
   });
   mkdirSyncImpl(dirname(manifestPath), { recursive: true });
   writeFileSyncImpl(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
@@ -101,6 +109,7 @@ export function stageProjectMigrationManifest({
   return {
     relativePath: MIGRATION_BUNDLE_MANIFEST_PATH,
     manifest,
+    backendArchiveEntries: bundleFilePlan.archiveEntries,
     cleanup() {
       if (cleaned) return;
       cleaned = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.180",
+  "version": "0.1.181",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -19,7 +19,6 @@
     "dashboard/"
   ],
   "dependencies": {
-    "@gencow/migration-contract": "0.1.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "drizzle-kit": "1.0.0-rc.4",
     "drizzle-orm": "1.0.0-rc.4",
@@ -27,14 +26,15 @@
     "open": "^10.2.0",
     "tar": "^7.5.21",
     "ws": "^8.21.1",
-    "zod": "^4.4.3"
+    "zod": "^4.4.3",
+    "@gencow/migration-contract": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
     "@gencow/client": "0.2.6",
-    "@gencow/core": "0.1.42",
-    "@gencow/react": "0.2.6"
+    "@gencow/react": "0.2.6",
+    "@gencow/core": "0.1.42"
   },
   "scripts": {
     "prebuild": "pnpm --filter @gencow/migration-contract run build && pnpm --filter @gencow/server run build",