gencow 0.1.185 → 0.1.187

package/bin/gencow.mjs

@@ -349,7 +349,7 @@ ${BOLD}Usage:${RESET}
 
 ${BOLD}Quick Start:${RESET}
   ${GREEN}init <name>${RESET}       Create a new Gencow project
-                     ${DIM}--template, -t  Select template (default, task-app, fullstack, ai-chat)${RESET}
+                     ${DIM}--template, -t  Select template (default, task-app, admin-tool, fullstack, ai-chat)${RESET}
                      ${DIM}--force, -f     Initialize in non-empty directory (preserves existing files)${RESET}
   ${GREEN}add <comp...>${RESET}   Add components ${DIM}(AI Agent RAG Tools Memory ...)${RESET}
   ${GREEN}codegen${RESET}          Generate frontend api.ts from schema
@@ -361,6 +361,7 @@ ${BOLD}Commands (login required):${RESET}
   ${GREEN}logout${RESET}           Clear credentials
   ${GREEN}whoami${RESET}           Show current user info
   ${GREEN}dev${RESET}              Watch + auto-deploy to cloud + live logs
+                     ${DIM}--local     Run local Bun + Hono + PGlite development${RESET}
                      ${DIM}--verbose   Show all HTTP logs (including admin/ws)${RESET}
   ${GREEN}db:push${RESET}          Apply versioned migrations to cloud DB
                      ${DIM}--prod      Push to production DB (confirmation required)${RESET}
@@ -378,7 +379,7 @@ ${BOLD}Commands (login required):${RESET}
   ${GREEN}templates clone <slug>${RESET} Clone a template into a local directory
   ${GREEN}deploy${RESET}           Deploy backend to cloud ${DIM}(dev by default)${RESET}
                      ${DIM}--static [dir]  Deploy backend, then static files${RESET}
-                     ${DIM}--prod          Deploy to production (Pro+ only)${RESET}
+                     ${DIM}--prod          Deploy to production (Startup/Enterprise)${RESET}
                      ${DIM}--rollback      Rollback to previous deployment${RESET}
                      ${DIM}--force, -f     Skip optional dependency scan${RESET}
                      ${DIM}logs [-n N]     Show cloud app server logs${RESET}
@@ -386,7 +387,7 @@ ${BOLD}Commands (login required):${RESET}
   ${GREEN}env list${RESET}         List cloud env vars ${DIM}(--prod for production)${RESET}
   ${GREEN}env set K=V${RESET}      Set cloud env var ${DIM}(hot-reload, no restart)${RESET}
   ${GREEN}env unset KEY${RESET}    Remove cloud env var
-  ${GREEN}env push${RESET}         Push .env to cloud ${DIM}(--prod reads .env.production)${RESET}
+  ${GREEN}env push${RESET}         Push backend env file ${DIM}(gencow/.env by default)${RESET}
   ${GREEN}cors list${RESET}        Show legacy CORS overrides
   ${GREEN}cors add URL${RESET}     Add legacy CORS override ${DIM}(compat only)${RESET}
   ${GREEN}cors remove URL${RESET}  Remove legacy CORS override
@@ -439,7 +440,7 @@ ${BOLD}Examples:${RESET}
   ${DIM}# Deploy built frontend files only:${RESET}
   gencow static dist/
 
-  ${DIM}# Deploy to production (Pro+ only):${RESET}
+  ${DIM}# Deploy to production (Startup/Enterprise):${RESET}
   gencow deploy --prod
 
   ${DIM}# Inspect stale workflows:${RESET}

package/lib/app-command.mjs

@@ -7,9 +7,27 @@ import {
   selectAppDiagnosticLogLines,
 } from "./app-diagnostics.mjs";
 import { resolveCreatedAppId, resolveCreatedAppResponse } from "./app-create-response.mjs";
+import {
+  isExactAppDeleteResponse,
+  parseAppListResponse,
+  parseAppStatusResponse,
+} from "./app-response-contract.mjs";
+import { readJsonObjectResponse } from "./http-response-json.mjs";
 import { BOLD, CYAN, DIM, GREEN, RED, RESET, error, info, log, success, warn } from "./output.mjs";
 import { loadCreds, rpcMutation, rpcQuery, saveCreds, requireCreds } from "./platform-client.mjs";
 
+function appResponseStatus(response) {
+  return Number.isSafeInteger(response?.status) ? `HTTP ${response.status}` : "unknown HTTP status";
+}
+
+function invalidAppResponse(operation, response, kind) {
+  return `CLI_APP_RESPONSE_INVALID: ${operation} returned an invalid ${kind} response (${appResponseStatus(response)})`;
+}
+
+function appResponseError(body, fallback) {
+  return typeof body?.error === "string" && body.error.trim() ? body.error : fallback;
+}
+
 export function formatAppDeployedAgo(dateStr, now = Date.now()) {
   if (!dateStr) return `${DIM}never${RESET}`;
   const diff = now - new Date(dateStr).getTime();
@@ -109,11 +127,18 @@ export function createAppCommand({
     if (!subcmd || subcmd === "list") {
       logImpl(`\n${BOLD}${CYAN}Your Apps${RESET}\n`);
       const res = await rpcQueryImpl(creds, "apps.list");
+      const body = await res.json().catch(() => null);
       if (!res.ok) {
-        errorImpl((await res.json().catch(() => ({}))).error || "Failed to list apps");
+        errorImpl(appResponseError(body, invalidAppResponse("app list", res, "error")));
+        processRef.exit(1);
+        return;
+      }
+      const apps = parseAppListResponse(body);
+      if (!apps) {
+        errorImpl(invalidAppResponse("app list", res, "success"));
+        processRef.exit(1);
         return;
       }
-      const apps = await res.json();
       if (!apps.length) {
         infoImpl("No apps yet. Run: gencow app create <name>");
         return;
@@ -143,10 +168,16 @@ export function createAppCommand({
       logImpl(`\n${BOLD}${CYAN}Gencow App Create${RESET}\n`);
       infoImpl(`Creating app "${name}"...`);
       const res = await rpcMutationImpl(creds, "apps.create", { name });
-      const data = await res.json();
+      const data = await readJsonObjectResponse(res);
       if (!res.ok) {
-        errorImpl(data.error || "Failed to create app");
+        errorImpl(appResponseError(data, invalidAppResponse("app create", res, "error")));
         processRef.exit(1);
+        return;
+      }
+      if (!data) {
+        errorImpl(invalidAppResponse("app create", res, "success"));
+        processRef.exit(1);
+        return;
       }
 
       let createdApp;
@@ -241,10 +272,16 @@ ${dashboardLine}
 
       infoImpl(`Deleting app "${name}"...`);
       const delRes = await rpcMutationImpl(creds, "apps.delete", { name });
-      const delData = await delRes.json();
+      const delData = await readJsonObjectResponse(delRes);
       if (!delRes.ok) {
-        errorImpl(delData.error || "Failed to delete app");
+        errorImpl(appResponseError(delData, invalidAppResponse("app delete", delRes, "error")));
         processRef.exit(1);
+        return;
+      }
+      if (!isExactAppDeleteResponse(delData, name)) {
+        errorImpl(invalidAppResponse("app delete", delRes, "success"));
+        processRef.exit(1);
+        return;
       }
 
       const currentCreds = loadCredsImpl();
@@ -261,17 +298,20 @@ ${dashboardLine}
       if (!name) {
         errorImpl("Usage: gencow app status <name>");
         processRef.exit(1);
+        return;
       }
       const res = await rpcQueryImpl(creds, "apps.get", { name });
-      const body = await res.json();
-      const data = body?.result || body;
+      const body = await readJsonObjectResponse(res);
       if (!res.ok) {
-        errorImpl(data?.error || "App not found");
+        errorImpl(appResponseError(body, invalidAppResponse("app status", res, "error")));
         processRef.exit(1);
+        return;
       }
+      const data = parseAppStatusResponse(body, name);
       if (!data) {
-        errorImpl("App not found");
+        errorImpl(invalidAppResponse("app status", res, "success"));
         processRef.exit(1);
+        return;
       }
       logImpl(`\n  ${BOLD}${data.name}${RESET}`);
       const status = formatAppStatusForCli(data);

package/lib/app-response-contract.mjs

@@ -0,0 +1,49 @@
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function optionalString(value) {
+  return value == null || typeof value === "string";
+}
+
+export function parseAppListResponse(value) {
+  if (!Array.isArray(value)) return null;
+  return value.every((row) => {
+    const app = record(row);
+    return (
+      nonEmptyString(app?.name) &&
+      nonEmptyString(app?.status) &&
+      optionalString(app?.url) &&
+      optionalString(app?.lastDeployedAt)
+    );
+  })
+    ? value
+    : null;
+}
+
+export function parseAppStatusResponse(value, expectedAppId) {
+  const body = record(value);
+  if (!body) return null;
+  const hasEnvelope = Object.prototype.hasOwnProperty.call(body, "result");
+  const app = record(hasEnvelope ? body.result : body);
+  if (
+    !app ||
+    app.name !== expectedAppId ||
+    !nonEmptyString(app.status) ||
+    !Number.isSafeInteger(app.port) ||
+    app.port <= 0 ||
+    app.port > 65535
+  ) {
+    return null;
+  }
+  return app;
+}
+
+export function isExactAppDeleteResponse(value, expectedAppId) {
+  const body = record(value);
+  return body?.success === true && body.deleted === expectedAppId;
+}

package/lib/backup-command.mjs

@@ -94,7 +94,7 @@ function renderBackupHelp(logImpl = log, errorImpl = error, subCmd = null) {
   logImpl(`    gencow backup restore <id>        Restore from backup`);
   logImpl(`    gencow backup restore-file <path> Restore from a downloaded dump file`);
   logImpl(`    gencow backup delete <id>         Delete a backup`);
-  logImpl(`    gencow backup download <id>       Download backup file (Pro+)\n`);
+  logImpl(`    gencow backup download <id>       Download backup file (plan-dependent)\n`);
 }
 
 export function buildRestoreConfirmPrompt(sourceLabel, { includeStorageRisk = false } = {}) {

package/lib/db-command.mjs

@@ -299,9 +299,9 @@ export function createDbCommands({
           cleanupOldBackups(backupDir, 3);
 
           rmSyncImpl(dbPath, { recursive: true, force: true });
-          successImpl("DB deleted — restart with gencow dev:local to create a new one");
+          successImpl("DB deleted — restart with gencow dev --local to create a new one");
         } else {
-          infoImpl("DB does not exist yet. Run gencow dev:local to get started.");
+          infoImpl("DB does not exist yet. Run gencow dev --local to get started.");
         }
       }
       logImpl("");
@@ -327,7 +327,7 @@ export function createDbCommands({
           if (!statusRes.ok) throw new Error("Server not ready");
         } catch {
           errorImpl(`Server not running on :${port}`);
-          infoImpl(`${DIM}Start the local server first: ${GREEN}gencow dev:local${RESET}`);
+          infoImpl(`${DIM}Start the local server first: ${GREEN}gencow dev --local${RESET}`);
           logImpl("");
           return;
         }
@@ -451,7 +451,7 @@ export function createDbCommands({
       }
       cpSyncImpl(latestPath, dbPath, { recursive: true });
       successImpl(`Restored from: .gencow/backups/${latest}`);
-      infoImpl("Restart with gencow dev.");
+      infoImpl("Restart with gencow dev --local.");
       logImpl("");
     },
 

package/lib/deploy-auditor.mjs

@@ -781,7 +781,7 @@ export function formatBundleSizeWarning(result) {
     "     • 불필요한 devDependencies를 dependencies에서 제거하세요",
     "     • 무거운 패키지를 가벼운 대안으로 교체해보세요",
     "       (예: moment → dayjs, lodash → lodash-es)",
-    "     • 메모리 한도가 부족하면 Pro/Scale 플랜으로 업그레이드하세요",
+    "     • 메모리 한도가 부족하면 Startup/Enterprise 플랜을 확인하세요",
     "       (Hobby: 256MB, Pro: 512MB, Scale: 1024MB)",
     "",
     "     💡 이 경고는 배포를 차단하지 않습니다.",

package/lib/deploy-command.mjs

@@ -12,7 +12,7 @@ export function renderDeployHelp() {
   log(`  ${BOLD}Usage:${RESET}  gencow deploy [options]\n`);
   log(`  ${BOLD}Options:${RESET}`);
   log(`    ${DIM}--static [dir]${RESET}     Deploy backend first, then static files`);
-  log(`    ${DIM}--prod${RESET}             Deploy to production (Pro+ only)`);
+  log(`    ${DIM}--prod${RESET}             Deploy to production (Startup/Enterprise)`);
   log(`    ${DIM}--region <slug>${RESET}    First production app placement region`);
   log(`    ${DIM}--rollback${RESET}          Rollback to previous deployment`);
   log(`    ${DIM}--force, -f${RESET}        Skip optional dependency scan`);

package/lib/deploy-dependency-compat.mjs

@@ -88,8 +88,8 @@ export function formatDependencyVersionAuditError(result) {
 
   lines.push("");
   lines.push("  Fix:");
-  lines.push(`    pnpm add ${installTargets.join(" ")}`);
-  lines.push("    npx gencow@latest deploy");
+  lines.push(`    bun add ${installTargets.join(" ")}`);
+  lines.push("    bunx gencow@latest deploy");
   lines.push("");
 
   return lines.join("\n");

package/lib/deploy-failure-diagnostic.mjs

@@ -0,0 +1,95 @@
+import { MIGRATION_NEXT_ACTION_KINDS } from "@gencow/migration-contract";
+
+import { formatDeployCorrelationId } from "./deploy-correlation-diagnostic.mjs";
+
+const DEPLOY_FAILURE_STAGES = new Set([
+  "admission",
+  "artifact",
+  "schema",
+  "candidate",
+  "activation",
+  "route",
+  "runtime",
+  "controller",
+]);
+const RETRY_CLASSES = new Set(["terminal-client", "retryable-infra", "platform-action"]);
+const USER_ACTIONS = new Set([...MIGRATION_NEXT_ACTION_KINDS, "OPERATOR_ACTION"]);
+const STRUCTURED_CONTRACT_FIELDS = ["code", "stage", "retryClass", "userAction", "correlationId"];
+const PLATFORM_ACTION_REQUIRED_MESSAGE = "Platform action is required before retrying";
+
+function safeText(value, maxLength) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  if (!normalized || normalized.length > maxLength || /[\u0000-\u001f\u007f]/u.test(normalized)) {
+    return null;
+  }
+  return normalized;
+}
+
+function readDeployFailureContract(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const code = safeText(value.code, 100);
+  const stage = safeText(value.stage, 20);
+  const retryClass = safeText(value.retryClass, 32);
+  const userAction = safeText(value.userAction, 32);
+  const correlationId = value.correlationId === undefined ? null : safeText(value.correlationId, 128);
+  if (
+    !code?.match(/^[A-Z][A-Z0-9_]{2,99}$/u) ||
+    !stage ||
+    !DEPLOY_FAILURE_STAGES.has(stage) ||
+    !retryClass ||
+    !RETRY_CLASSES.has(retryClass) ||
+    !userAction ||
+    !USER_ACTIONS.has(userAction) ||
+    (value.correlationId !== undefined && !correlationId) ||
+    (correlationId && !/^[A-Za-z0-9_-]{8,128}$/u.test(correlationId))
+  ) {
+    return null;
+  }
+  return {
+    code,
+    stage,
+    userAction: userAction === "CONTACT_SUPPORT" ? "OPERATOR_ACTION" : userAction,
+    correlationId,
+    legacySupportAction: userAction === "CONTACT_SUPPORT",
+  };
+}
+
+function normalizeLegacySupportMessage(message) {
+  return typeof message === "string" && /contact support/iu.test(message)
+    ? PLATFORM_ACTION_REQUIRED_MESSAGE
+    : message;
+}
+
+export function renderDeployFailureDiagnosticLines(responseBody, statusText) {
+  const contract = readDeployFailureContract(responseBody);
+  const fallbackMessage = safeText(statusText, 120) ?? "Request failed";
+  if (!contract) {
+    const structuredFields =
+      responseBody &&
+      typeof responseBody === "object" &&
+      !Array.isArray(responseBody) &&
+      STRUCTURED_CONTRACT_FIELDS.filter((field) => Object.hasOwn(responseBody, field));
+    const correlationLine = formatDeployCorrelationId(responseBody?.correlationId);
+    const isLegacyCorrelationEnvelope =
+      Array.isArray(structuredFields) &&
+      structuredFields.length === 1 &&
+      structuredFields[0] === "correlationId" &&
+      correlationLine;
+    const canTrustLegacyMessage =
+      (Array.isArray(structuredFields) && structuredFields.length === 0) || isLegacyCorrelationEnvelope;
+    const legacyMessage = canTrustLegacyMessage ? safeText(responseBody?.error, 240) : null;
+    const lines = [`Deploy failed: ${normalizeLegacySupportMessage(legacyMessage) || fallbackMessage}`];
+    if (isLegacyCorrelationEnvelope) lines.push(correlationLine);
+    return lines;
+  }
+  const publicMessage = contract.legacySupportAction
+    ? PLATFORM_ACTION_REQUIRED_MESSAGE
+    : (safeText(responseBody.error, 240) ?? fallbackMessage);
+  const lines = [`Deploy failed: ${publicMessage}`];
+  lines.push(`Code: ${contract.code}`, `Stage: ${contract.stage}`);
+  const correlationLine = formatDeployCorrelationId(contract.correlationId);
+  if (correlationLine) lines.push(correlationLine);
+  lines.push(`Next action: ${contract.userAction}`);
+  return lines;
+}

package/lib/deploy-package-runtime.mjs

@@ -13,6 +13,8 @@ import {
   runDrizzleGenerateWithFallback,
 } from "./drizzle-generate.mjs";
 import { buildDeployClaimFromArchive } from "./deploy-package-claim.mjs";
+import { renderDeployFailureDiagnosticLines } from "./deploy-failure-diagnostic.mjs";
+import { readJsonObjectResponse } from "./http-response-json.mjs";
 import { acquireDeployReceipt, releaseDeployReceipt } from "./deploy-receipt-store.mjs";
 import { CYAN, DIM, RED, RESET, YELLOW, error, info, log, success, warn } from "./output.mjs";
 import { platformFetch, rpcMutation } from "./platform-client.mjs";
@@ -31,7 +33,6 @@ import {
   renderMigrationDiagnosticLines,
 } from "./migration-diagnostic.mjs";
 import { emitMigrationAdvisories, emitMigrationResponsibilityNotice } from "./migration-advisory.mjs";
-import { formatDeployCorrelationId } from "./deploy-correlation-diagnostic.mjs";
 import { detectDeployLockfile, formatDeployLockfileSelectionWarning } from "./deploy-lockfile-selection.mjs";
 import { detectProjectConfigFile, warnProjectConfigSelectionOnce } from "./project-config-selection.mjs";
 
@@ -575,13 +576,13 @@ export function createDeployPackageRuntime({
     infoImpl("Creating app (auto-generating ID)...");
     const createRes = await rpcMutationImpl(creds, "apps.create", { name: displayName });
     if (!createRes.ok) {
-      const createErr = await createRes.json().catch(() => ({}));
-      errorImpl(`App creation failed: ${createErr.error || createRes.statusText}`);
+      const createErr = await readJsonObjectResponse(createRes);
+      errorImpl(`App creation failed: ${createErr?.error || createRes.statusText}`);
       exitImpl(1);
       return null;
     }
 
-    const createData = await createRes.json();
+    const createData = await readJsonObjectResponse(createRes);
     let nextAppId;
     try {
       nextAppId = resolveCreatedAppResponse(createData, { platformUrl: creds.platformUrl }).appId;
@@ -727,7 +728,7 @@ export function createDeployPackageRuntime({
     }
 
     if (!deployRes.ok) {
-      const errData = await deployRes.json().catch(() => ({}));
+      const errData = await readJsonObjectResponse(deployRes);
       const retryableResponse =
         errData?.code === "DEPLOY_REQUEST_IN_PROGRESS" ||
         errData?.code === "CONTROL_PLANE_OBSERVATION_INCOMPLETE" ||
@@ -741,16 +742,23 @@ export function createDeployPackageRuntime({
         errorImpl(lines[0]);
         lines.slice(1).forEach((line) => logImpl(line));
       } else {
-        errorImpl(`Deploy failed: ${errData.error || deployRes.statusText}`);
-        const correlationLine = formatDeployCorrelationId(errData?.correlationId);
-        if (correlationLine) errorImpl(correlationLine);
+        const lines = renderDeployFailureDiagnosticLines(errData, deployRes.statusText);
+        errorImpl(lines[0]);
+        lines
+          .slice(1)
+          .forEach((line) => (line.startsWith("Correlation ID: ") ? errorImpl(line) : logImpl(line)));
       }
       await showCrashLogs(errData, "Server startup failure cause:", targetAppId);
       exitImpl(1);
       return null;
     }
 
-    const deployData = await deployRes.json();
+    const deployData = await readJsonObjectResponse(deployRes);
+    if (!deployData) {
+      errorImpl("Deploy failed: server returned an invalid JSON response; retry the same deploy request");
+      exitImpl(1);
+      return null;
+    }
     emitMigrationAdvisories(deployData?.warnings, warnImpl);
     if (receipt) releaseDeployReceipt(receipt);
     const deployElapsed = ((Date.now() - startTime) / 1000).toFixed(1);

package/lib/deploy-runtime.mjs

@@ -9,6 +9,7 @@ import {
   runStaticDeployFlow,
 } from "./deploy-static-fullstack-runtime.mjs";
 import { detectStaticDeployBackend, preflightStaticDeployArtifact } from "./static-deploy-command.mjs";
+import { readJsonObjectResponse } from "./http-response-json.mjs";
 
 export function parseDeployArgs(deployArgs) {
   const parsed = {
@@ -120,7 +121,7 @@ function showUnknownDeployArgument(arg, { errorImpl = error, infoImpl = info, lo
   logImpl("");
   infoImpl("Usage: gencow deploy [options]");
   infoImpl("  gencow deploy              Dev backend deploy");
-  infoImpl("  gencow deploy --prod       Production backend deploy (Pro+)");
+  infoImpl("  gencow deploy --prod       Production backend deploy (Startup/Enterprise)");
   infoImpl("  gencow deploy --prod --region kr  First production app placement");
   infoImpl("  gencow deploy --rollback   Rollback to previous version");
   infoImpl("  gencow deploy logs         View server logs");
@@ -196,7 +197,7 @@ async function ensureProductionDeployTarget({
   });
 
   if (!createProdRes.ok) {
-    const errData = await createProdRes.json().catch(() => ({}));
+    const errData = await readJsonObjectResponse(createProdRes);
     if (createProdRes.status === 403) {
       logImpl("");
       logImpl(`  ${RED}⛔ Production Deploy — Startup or Enterprise required${RESET}`);
@@ -212,13 +213,18 @@ async function ensureProductionDeployTarget({
       logImpl(`     ${GREEN}gencow upgrade${RESET}       ${DIM}← Upgrade to Startup${RESET}`);
       logImpl("");
     } else {
-      errorImpl(`Prod app creation failed: ${errData.error || createProdRes.statusText}`);
+      errorImpl(`Prod app creation failed: ${errData?.error || createProdRes.statusText}`);
     }
     exitImpl(1);
     return null;
   }
 
-  const createProdData = await createProdRes.json();
+  const createProdData = await readJsonObjectResponse(createProdRes);
+  if (!createProdData) {
+    errorImpl("Prod app creation failed: server returned an invalid JSON response");
+    exitImpl(1);
+    return null;
+  }
   const nextProdAppId = createProdData.prodApp;
   const gencowJson = existsSync(gencowJsonPath) ? JSON.parse(readFileSyncImpl(gencowJsonPath, "utf8")) : {};
   gencowJson.prodApp = nextProdAppId;
@@ -285,13 +291,18 @@ async function runRollbackDeploy({
   processRef.stdout.write("\r" + " ".repeat(50) + "\r");
 
   if (!rollbackRes.ok) {
-    const errData = await rollbackRes.json().catch(() => ({}));
-    errorImpl(`Rollback failed: ${errData.error || rollbackRes.statusText}`);
+    const errData = await readJsonObjectResponse(rollbackRes);
+    errorImpl(`Rollback failed: ${errData?.error || rollbackRes.statusText}`);
     exitImpl(1);
     return;
   }
 
-  const rollbackData = await rollbackRes.json();
+  const rollbackData = await readJsonObjectResponse(rollbackRes);
+  if (!rollbackData) {
+    errorImpl("Rollback failed: server returned an invalid JSON response");
+    exitImpl(1);
+    return;
+  }
   const rollbackElapsed = ((Date.now() - startTime) / 1000).toFixed(1);
   logImpl("");
   successImpl(`🔄 Rollback complete! (${rollbackElapsed}s)`);

package/lib/http-response-json.mjs

@@ -0,0 +1,9 @@
+export async function readJsonObjectResponse(response) {
+  let value;
+  try {
+    value = await response.json();
+  } catch {
+    return null;
+  }
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}

package/lib/init-command.mjs

@@ -199,7 +199,7 @@ function renderInitHelp(logImpl) {
   logImpl(`  ${BOLD}Arguments:${RESET}`);
   logImpl(`    ${CYAN}name${RESET}               Project name (creates directory) or "." for current dir\n`);
   logImpl(`  ${BOLD}Options:${RESET}`);
-  logImpl(`    ${DIM}--template, -t${RESET}     Select template (default, task-app, fullstack, ai-chat)`);
+  logImpl(`    ${DIM}--template, -t${RESET}     Select template (default, task-app, admin-tool, fullstack, ai-chat)`);
   logImpl(`    ${DIM}--force, -f${RESET}        Initialize in non-empty directory`);
   logImpl(`    ${DIM}--no-install${RESET}       Skip dependency install (CI/canary)\n`);
   logImpl(`  ${BOLD}Examples:${RESET}`);

package/lib/readme-codegen.mjs

@@ -272,12 +272,16 @@ export function buildAiPrompt(apiObj, namespaces) {
   md += `- Set a batch limit and AI fanout budget for crawler, backfill, import, and AI-heavy cron actions.\n`;
   md += `- Avoid unbounded Promise.all, unlimited crawling, and unlimited LLM/embedding calls.\n\n`;
   md += `Deployment rules:\n`;
-  md += `- Development: npx gencow dev\n`;
-  md += `- Static-only dev deploy: npx gencow static dist/\n`;
-  md += `- Production backend deploy: npx gencow deploy --prod (Pro+ only)\n`;
-  md += `- Fullstack static deploy: VITE_API_URL=https://{appId}.{domain} npm run build, then npx gencow deploy --static dist/\n`;
+  md += `- Development: bunx gencow@latest dev\n`;
+  md += `- Local development: bunx gencow@latest dev --local\n`;
+  md += `- Static-only dev deploy: bunx gencow@latest static dist/\n`;
+  md += `- Production backend deploy: bunx gencow@latest deploy --prod (Startup/Enterprise)\n`;
+  md += `- Fullstack static deploy: VITE_API_URL=https://{appId}.{domain} bun run build, then bunx gencow@latest deploy --static dist/\n`;
+  md += `- Node.js users can run the same CLI commands with npx gencow@latest.\n`;
+  md += `- Both @latest runners resolve the registry latest tag and reuse a matching cached package when possible.\n`;
+  md += `- Plain gencow can run the project-installed pinned CLI; use it only when that version pin is intentional.\n`;
   md += `- If a backend is present, Gencow deploys the backend before frontend assets.\n`;
-  md += `- Set cloud env vars with npx gencow env set KEY=VALUE.\n`;
+  md += `- Set cloud env vars with bunx gencow@latest env set KEY=VALUE.\n`;
   md += `- Read process.env inside handlers so hot-reloaded env values are current.\n\n`;
   md += `Data modeling rules:\n`;
   md += `- Use pgTable() and ownerRls() for user-owned data.\n`;
@@ -286,7 +290,7 @@ export function buildAiPrompt(apiObj, namespaces) {
   md += `- Use allowedFilters for filterable fields. Undefined filters are ignored by default.\n`;
   md += `- PostgreSQL RLS handles owner filtering, so do not duplicate userId filters unless a custom policy requires it.\n\n`;
   md += `Package and crypto rules:\n`;
-  md += `- npm-installed third-party packages are installed during deploy.\n`;
+  md += `- Packages added with bun add (or npm install for Node.js users) are installed during deploy.\n`;
   md += `- child_process, vm, os, cluster, and worker_threads are blocked in deployed tenant apps.\n`;
   md += `- Prefer SHA-256 with node:crypto or Web Crypto API instead of custom 32-bit hashes.\n`;
   md += `  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));\n\n`;
@@ -298,7 +302,7 @@ export function buildAiPrompt(apiObj, namespaces) {
   md += `- Use rerank({ model: createGencowAI().rerankingModel(...) }) or ai.rerank() only after retrieval authorization; do not pass private metadata as provider payload.\n`;
   md += `- createGencowAI().rerankingModel(...) is proxy-only today. Local direct mode with only OPENAI_API_KEY must fail fast for reranking.\n`;
   md += `- The generated reranker starter may use an explicit fallbackModel compatibility path, but strict providerPreference such as azure_cohere must still fail closed on auth/config errors.\n`;
-  md += `- Recommended chat models: gpt-5.4-mini for most apps, gpt-5.4 for Pro/Scale highest quality, gpt-5.4-nano for high-volume extraction.\n`;
+  md += `- Recommended chat models: gpt-5.4-mini for most apps, gpt-5.4 for Startup/Enterprise highest quality, gpt-5.4-nano for high-volume extraction.\n`;
   md += `- Use ai.generateObject() with a Zod schema for structured output. Do not use ai.chat() + JSON.parse().\n`;
   md += `- Install AI with gencow add AI, RAG with gencow add RAG, Memory with gencow add Memory, and durable agents with gencow add Agent.\n`;
   md += `\`\`\`\n\n`;
@@ -307,7 +311,7 @@ export function buildAiPrompt(apiObj, namespaces) {
 
 export function buildAiUsageSection() {
   let md = `---\n\n## AI Usage\n\n`;
-  md += `Gencow supports an Azure-first active chat catalog: gpt-5.4 on Pro/Scale, gpt-5.4-mini by default, gpt-5.4-nano for high volume, plus compatibility models gpt-5-mini and gpt-5-nano. Deprecated requests such as \`gpt-5.5\` and \`gpt-4o-mini\` are automatically substituted to the closest supported model before provider execution. Image and embedding models are also controlled by the platform \`model_pricing\` catalog.\n`;
+  md += `Gencow supports an Azure-first active chat catalog: gpt-5.4 on Startup/Enterprise, gpt-5.4-mini by default, gpt-5.4-nano for high volume, plus compatibility models gpt-5-mini and gpt-5-nano. Deprecated requests such as \`gpt-5.5\` and \`gpt-4o-mini\` are automatically substituted to the closest supported model before provider execution. Image and embedding models are also controlled by the platform \`model_pricing\` catalog.\n`;
   md += `\`OPENAI_API_KEY\` is only for local direct/fallback usage. Cloud deployments use the Gencow AI proxy with platform-managed internal credentials and service credits.\n\n`;
   md += `\`\`\`typescript\n`;
   md += `import { generateImage, generateText, rerank } from "ai";\n`;
@@ -347,7 +351,7 @@ export function buildAiUsageSection() {
   md += `\`\`\`\n\n`;
   md += `| Purpose | Recommended model |\n`;
   md += `|---|---|\n`;
-  md += `| Highest quality / complex reasoning | \`gpt-5.4\` (Pro/Scale only) |\n`;
+  md += `| Highest quality / complex reasoning | \`gpt-5.4\` (Startup/Enterprise) |\n`;
   md += `| Most production chat, coding, and agent tasks | \`gpt-5.4-mini\` |\n`;
   md += `| High-volume classification and extraction | \`gpt-5.4-nano\` |\n`;
   md += `| Compatibility replacement for deprecated mini-class models | \`gpt-5-mini\` |\n`;
@@ -361,7 +365,7 @@ export function buildAiUsageSection() {
   md += `const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });\n`;
   md += `\`\`\`\n\n`;
   md += `\`\`\`bash\n`;
-  md += `# Local-only .env\n`;
+  md += `# Local-only backend secrets: gencow/.env\n`;
   md += `OPENAI_API_KEY=sk-your-key-here\n`;
   md += `\`\`\`\n\n`;
   return md;
@@ -371,10 +375,10 @@ export function buildDeploySection() {
   let md = `---\n\n## Deploy\n\n`;
   md += `### Cloud deploy\n\n`;
   md += `\`\`\`bash\n`;
-  md += `npx gencow login\n`;
-  md += `npx gencow dev\n`;
-  md += `npx gencow env set DATABASE_URL=postgres://...\n`;
-  md += `npx gencow env list\n`;
+  md += `bunx gencow@latest login\n`;
+  md += `bunx gencow@latest dev\n`;
+  md += `bunx gencow@latest env set MY_API_KEY=value\n`;
+  md += `bunx gencow@latest env list\n`;
   md += `\`\`\`\n\n`;
   md += `After deploy, the app is available at \`https://{appName}.{domain}\`.\n\n`;
   md += `### Environment variables\n\n`;
@@ -395,18 +399,18 @@ export function buildDeploySection() {
   md += `\`\`\`bash\n`;
   md += `gencow dev\n`;
   md += `cd frontend\n`;
-  md += `VITE_API_URL=https://{appId}.{domain} npm run build\n`;
-  md += `gencow deploy --static dist/\n`;
-  md += `gencow static dist/\n`;
-  md += `gencow deploy --prod\n`;
-  md += `gencow deploy --static --prod dist/\n`;
+  md += `VITE_API_URL=https://{appId}.{domain} bun run build\n`;
+  md += `bunx gencow@latest deploy --static dist/\n`;
+  md += `bunx gencow@latest static dist/\n`;
+  md += `bunx gencow@latest deploy --prod\n`;
+  md += `bunx gencow@latest deploy --static --prod dist/\n`;
   md += `\`\`\`\n\n`;
   md += `When a \`gencow/\` backend exists, \`gencow deploy --static dist/\` deploys the backend before frontend assets. Use \`gencow static dist/\` for frontend-only static deploys.\n\n`;
   md += `### Hosted analytics\n\n`;
   md += `Gencow-hosted frontend HTML receives same-origin analytics automatically at deploy time. Do not add analytics database credentials or collector internals to tenant app code.\n`;
   md += `External frontends cannot be instrumented automatically. Use the hosted snippet only after confirming the site is served by Gencow or an explicit external snippet is issued by the Dashboard.\n\n`;
-  md += `### Third-party npm packages\n\n`;
-  md += `Packages installed with \`npm install\` are installed during deploy. Platform-owned packages such as \`@gencow/core\`, \`drizzle-orm\`, \`better-auth\`, \`postgres\`, \`hono\`, \`ai\`, and \`zod\` are provided by default.\n`;
+  md += `### Third-party packages\n\n`;
+  md += `Packages added with \`bun add\` (or \`npm install\` for Node.js users) are installed during deploy. Platform-owned packages such as \`@gencow/core\`, \`drizzle-orm\`, \`better-auth\`, \`postgres\`, \`hono\`, \`ai\`, and \`zod\` are provided by default.\n`;
   md += `Blocked modules include \`child_process\`, \`vm\`, \`os\`, \`cluster\`, and \`worker_threads\`.\n\n`;
   md += `### Public origins\n\n`;
   md += `same-origin custom domains do not need public-origin configuration. Declare external frontend origins in \`gencow.config.js\` with \`frontendOrigins\` when hosting outside Gencow. Use \`gencow domain set <domain> --prod\` to connect a public domain to the production app when \`gencow.json\` has \`prodApp\`.\n\n`;