gencow 0.1.188 → 0.1.190

package/core/index.js

@@ -8,10 +8,12 @@ function hasStandardSchema(schema) {
   return !!schema && typeof schema === "object" && "~standard" in schema && !!schema["~standard"] && typeof schema["~standard"].validate === "function";
 }
 var HttpRouteInputValidationError = class extends Error {
-  constructor(message) {
-    super(message);
+  constructor(issues) {
+    super(issues[0]?.message ?? "Invalid input");
+    this.issues = issues;
     this.name = "HttpRouteInputValidationError";
   }
+  issues;
 };
 var HttpRouteOutputValidationError = class extends Error {
   constructor(message) {
@@ -26,10 +28,16 @@ async function validateInput(schema, value) {
   }
   const result = await schema["~standard"].validate(value);
   if ("issues" in result && result.issues.length > 0) {
-    throw new HttpRouteInputValidationError(result.issues[0]?.message ?? "Invalid input");
+    throw new HttpRouteInputValidationError(
+      result.issues.map((issue) => ({
+        message: issue.message,
+        path: issue.path?.map(String),
+        code: issue.code === void 0 ? void 0 : String(issue.code)
+      }))
+    );
   }
   if ("value" in result) return result.value;
-  throw new HttpRouteInputValidationError("Invalid input");
+  throw new HttpRouteInputValidationError([{ message: "Invalid input" }]);
 }
 async function validateOutput(schema, value) {
   if (!schema) return value;
@@ -50,7 +58,7 @@ async function buildInputFromRequest(method, req) {
       return await req.json();
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      throw new HttpRouteInputValidationError(`Invalid JSON body: ${message}`);
+      throw new HttpRouteInputValidationError([{ message: `Invalid JSON body: ${message}` }]);
     }
   }
   return { ...req.query };
@@ -105,7 +113,7 @@ function composeRouteMiddlewares(middlewares, handler, inputSchema, outputSchema
   };
 }
 var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
-  constructor(method, routePath, middlewares = [], inputSchema, outputSchema, inputValidationIndex = -1, outputValidationIndex = -1, anonymousAllowed = false) {
+  constructor(method, routePath, middlewares = [], inputSchema, outputSchema, inputValidationIndex = -1, outputValidationIndex = -1, anonymousAllowed = false, inputErrorMapper) {
     this.method = method;
     this.routePath = routePath;
     this.middlewares = middlewares;
@@ -114,6 +122,7 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
     this.inputValidationIndex = inputValidationIndex;
     this.outputValidationIndex = outputValidationIndex;
     this.anonymousAllowed = anonymousAllowed;
+    this.inputErrorMapper = inputErrorMapper;
   }
   method;
   routePath;
@@ -123,6 +132,7 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
   inputValidationIndex;
   outputValidationIndex;
   anonymousAllowed;
+  inputErrorMapper;
   path(path) {
     return new _HttpRouteBuilderImpl(
       this.method,
@@ -132,7 +142,8 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
       this.outputSchema,
       this.inputValidationIndex,
       this.outputValidationIndex,
-      this.anonymousAllowed
+      this.anonymousAllowed,
+      this.inputErrorMapper
     );
   }
   allowAnonymous() {
@@ -144,7 +155,8 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
       this.outputSchema,
       this.inputValidationIndex,
       this.outputValidationIndex,
-      true
+      true,
+      this.inputErrorMapper
     );
   }
   use(middleware) {
@@ -156,10 +168,11 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
       this.outputSchema,
       this.inputValidationIndex,
       this.outputValidationIndex,
-      this.anonymousAllowed
+      this.anonymousAllowed,
+      this.inputErrorMapper
     );
   }
-  input(schema) {
+  input(schema, options) {
     const nextInputValidationIndex = this.middlewares.length;
     return new _HttpRouteBuilderImpl(
       this.method,
@@ -169,7 +182,8 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
       this.outputSchema,
       nextInputValidationIndex,
       this.outputValidationIndex,
-      this.anonymousAllowed
+      this.anonymousAllowed,
+      options?.onError
     );
   }
   output(schema) {
@@ -182,7 +196,8 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
       schema,
       this.inputValidationIndex,
       nextOutputValidationIndex,
-      this.anonymousAllowed
+      this.anonymousAllowed,
+      this.inputErrorMapper
     );
   }
   handler(handler) {
@@ -194,6 +209,7 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
     const isPublic = this.anonymousAllowed;
     const inputSchema = this.inputSchema;
     const outputSchema = this.outputSchema;
+    const inputErrorMapper = this.inputErrorMapper;
     const runRoute = composeRouteMiddlewares(
       this.middlewares,
       handler,
@@ -208,6 +224,7 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
         normalizedInput = inputSchema ? await buildInputFromRequest(method, req) : void 0;
       } catch (err) {
         if (err instanceof HttpRouteInputValidationError) {
+          if (inputErrorMapper) return await inputErrorMapper(err.issues);
           return { status: 400, body: { error: err.message } };
         }
         throw err;
@@ -217,6 +234,7 @@ var HttpRouteBuilderImpl = class _HttpRouteBuilderImpl {
         result = await runRoute(ctx, normalizedInput, req);
       } catch (err) {
         if (err instanceof HttpRouteInputValidationError) {
+          if (inputErrorMapper) return await inputErrorMapper(err.issues);
           return { status: 400, body: { error: err.message } };
         }
         if (err instanceof HttpRouteOutputValidationError) {
@@ -3006,6 +3024,10 @@ var RESERVED_TENANT_RUNTIME_ENV_KEYS = [
   "PGBOUNCER_PORT",
   "DIRECT_PG_PORT",
   "GENCOW_DIRECT_DATABASE_URL",
+  "GENCOW_BACKUP_DATABASE_URL",
+  "GENCOW_BACKUP_EXPECTED_ROLE",
+  "GENCOW_BACKUP_RLS_BYPASS_APPROVED",
+  "GENCOW_RESTORE_DATABASE_URL",
   "GENCOW_CATALOG_READ_DATABASE_URL",
   "GENCOW_DIRECT_DDL_DATABASE_URL",
   "DIRECT_DATABASE_URL",

package/lib/app-command.mjs

@@ -10,7 +10,7 @@ import { resolveCreatedAppId, resolveCreatedAppResponse } from "./app-create-res
 import {
   isExactAppDeleteResponse,
   parseAppListResponse,
-  parseAppStatusResponse,
+  parseAppLookupResponse,
 } from "./app-response-contract.mjs";
 import { pollAppDeleteOperation } from "./app-delete-operation.mjs";
 import { appResponseError } from "./app-response-error.mjs";
@@ -32,6 +32,10 @@ function invalidAppResponse(operation, response, kind) {
   return `CLI_APP_RESPONSE_INVALID: ${operation} returned an invalid ${kind} response (${appResponseStatus(response)})`;
 }
 
+function appNotFoundError() {
+  return "App not found or not owned by you.\nCode: APP_NOT_FOUND";
+}
+
 export function formatAppDeployedAgo(dateStr, now = Date.now()) {
   if (!dateStr) return `${DIM}never${RESET}`;
   const diff = now - new Date(dateStr).getTime();
@@ -322,22 +326,32 @@ ${dashboardLine}
       const res = await rpcQueryImpl(creds, "apps.get", { name });
       const body = await readJsonObjectResponse(res);
       if (!res.ok) {
-        errorImpl(appResponseError(body, invalidAppResponse("app status", res, "error")));
+        errorImpl(
+          res.status === 404
+            ? appNotFoundError()
+            : appResponseError(body, invalidAppResponse("app status", res, "error")),
+        );
         processRef.exit(1);
         return;
       }
-      const data = parseAppStatusResponse(body, name);
-      if (!data) {
+      const lookup = parseAppLookupResponse(body, name);
+      if (lookup.kind === "not_found") {
+        errorImpl(appNotFoundError());
+        processRef.exit(1);
+        return;
+      }
+      if (lookup.kind === "invalid_response") {
         errorImpl(invalidAppResponse("app status", res, "success"));
         processRef.exit(1);
         return;
       }
+      const data = lookup.app;
       logImpl(`\n  ${BOLD}${data.name}${RESET}`);
       const status = formatAppStatusForCli(data);
       logImpl(`  Status: ${status.colored}`);
       const memoryExceededDetails = formatMemoryExceededDetails(data);
       if (memoryExceededDetails) logImpl(memoryExceededDetails);
-      logImpl(`  Port:   ${data.port}`);
+      logImpl(`  Port:   ${data.port ?? `${DIM}not deployed${RESET}`}`);
       if (isAppFailureStatus(data)) {
         let diagnosticLines = selectAppDiagnosticLogLines(data);
         if (diagnosticLines.length === 0) {

package/lib/app-response-contract.mjs

@@ -25,22 +25,26 @@ export function parseAppListResponse(value) {
     : null;
 }
 
-export function parseAppStatusResponse(value, expectedAppId) {
+export function parseAppLookupResponse(value, expectedAppId) {
   const body = record(value);
-  if (!body) return null;
+  if (!body) return { kind: "invalid_response" };
   const hasEnvelope = Object.prototype.hasOwnProperty.call(body, "result");
+  if (hasEnvelope && body.result == null) return { kind: "not_found" };
   const app = record(hasEnvelope ? body.result : body);
   if (
     !app ||
     app.name !== expectedAppId ||
     !nonEmptyString(app.status) ||
-    !Number.isSafeInteger(app.port) ||
-    app.port <= 0 ||
-    app.port > 65535
+    (app.port != null && (!Number.isSafeInteger(app.port) || app.port <= 0 || app.port > 65535))
   ) {
-    return null;
+    return { kind: "invalid_response" };
   }
-  return app;
+  return { kind: "found", app };
+}
+
+export function parseAppStatusResponse(value, expectedAppId) {
+  const result = parseAppLookupResponse(value, expectedAppId);
+  return result.kind === "found" ? result.app : null;
 }
 
 export function isExactAppDeleteResponse(value, expectedAppId) {

package/lib/canonical-drizzle-generator.config.mjs

@@ -0,0 +1,61 @@
+import { existsSync, lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+
+export const GENCOW_DRIZZLE_CONFIG_CONTRACT_VERSION = 1;
+
+function requiredEnvironment(name) {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`Gencow migration generator requires ${name}`);
+  return value;
+}
+
+function insideProject(projectRoot, candidate) {
+  const pathFromRoot = relative(projectRoot, candidate);
+  return pathFromRoot === "" || (!pathFromRoot.startsWith("..") && !isAbsolute(pathFromRoot));
+}
+
+function canonicalOutputPath(projectRoot, rawPath) {
+  const candidate = resolve(projectRoot, rawPath);
+  if (existsSync(candidate)) return realpathSync(candidate);
+  return resolve(realpathSync(dirname(candidate)), basename(candidate));
+}
+
+function resolveSchemaFiles(projectRoot) {
+  const rawPaths = requiredEnvironment("GENCOW_SCHEMA_PATHS").split("\n");
+  const seen = new Set();
+  const files = [];
+  for (const rawPath of rawPaths) {
+    const trimmed = rawPath.trim();
+    if (!trimmed) continue;
+    const candidate = resolve(projectRoot, trimmed);
+    const stat = lstatSync(candidate);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error("Gencow migration schema must be a regular project file");
+    }
+    const canonical = realpathSync(candidate);
+    if (!insideProject(projectRoot, canonical)) {
+      throw new Error("Gencow migration schema must stay inside the project root");
+    }
+    if (!seen.has(canonical)) {
+      seen.add(canonical);
+      files.push(canonical);
+    }
+  }
+  if (files.length === 0) throw new Error("Gencow migration schema list is empty");
+  return files;
+}
+
+const projectRoot = realpathSync(process.cwd());
+const migrationsPath = canonicalOutputPath(projectRoot, requiredEnvironment("GENCOW_MIGRATIONS"));
+if (!insideProject(projectRoot, migrationsPath)) {
+  throw new Error("Gencow migrations output must stay inside the project root");
+}
+
+export default {
+  dialect: "postgresql",
+  schema: resolveSchemaFiles(projectRoot),
+  out: `./${relative(projectRoot, migrationsPath) || "."}`,
+  tablesFilter: ["!_system_*", "!_gencow_*"],
+  driver: "pglite",
+  dbCredentials: { url: process.env.GENCOW_DB_URL || "./.gencow/data" },
+};

package/lib/cli-artifact-guard.mjs

@@ -5,6 +5,7 @@ export const REQUIRED_CLI_TARBALL_FILES = Object.freeze([
   "lib/deploy-auditor.mjs",
   "lib/cron-manifest.mjs",
   "lib/dev-cloud-bundle.mjs",
+  "lib/canonical-drizzle-generator.config.mjs",
   "runtime/tooling.mjs",
   "runtime/server.mjs",
   "templateFeature/ai/manifest.json",
@@ -17,6 +18,7 @@ export const REQUIRED_CLI_TARBALL_FILES = Object.freeze([
 ]);
 
 export const TOOLING_RUNTIME_BUNDLE_PATH = "runtime/tooling.mjs";
+export const SERVER_RUNTIME_BUNDLE_PATH = "runtime/server.mjs";
 
 const FORBIDDEN_TOOLING_RUNTIME_PATTERNS = Object.freeze([
   {
@@ -38,6 +40,11 @@ const FORBIDDEN_CLI_TARBALL_FILES = Object.freeze([
     path: "lib/codegen/index.mjs",
     message: "legacy CLI codegen artifact는 npm tarball에 포함되면 안 됩니다",
   },
+  {
+    code: "forbidden-runtime-source-map",
+    path: "runtime/server.mjs.map",
+    message: "server runtime source map은 npm tarball에 포함되면 안 됩니다",
+  },
 ]);
 
 export function validateCliTarballFiles(files, requiredFiles = REQUIRED_CLI_TARBALL_FILES) {
@@ -93,6 +100,28 @@ export function validateGeneratedCodegenBundle(source, options = {}) {
   };
 }
 
+export function validateServerRuntimeBundle(source, options = {}) {
+  const artifactPath = options.artifactPath ?? SERVER_RUNTIME_BUNDLE_PATH;
+  const repositorySourcePath = String.raw`(?:platform|server|route-gateway)[\\/]src[\\/][a-z0-9_./\\-]+\.(?:[cm]?[jt]s)`;
+  const repositorySourceImportPatterns = [
+    new RegExp("import\\(\\s*[`\"'][^`\"'\\n]{0,640}" + repositorySourcePath, "iu"),
+    new RegExp(
+      String.raw`(?:resolve|join|new\s+URL)\([^;\n]{0,640}(?:${repositorySourcePath}|["'](?:platform|server|route-gateway)["']\s*,\s*["']src["'])`,
+      "iu",
+    ),
+  ];
+  const errors = repositorySourceImportPatterns.some((pattern) => pattern.test(source))
+    ? [
+        {
+          code: "repository-source-import",
+          path: artifactPath,
+          message: "server runtime이 npm package 밖 repository source를 참조합니다",
+        },
+      ]
+    : [];
+  return { ok: errors.length === 0, errors };
+}
+
 export function formatArtifactGuardErrors(errors) {
   return errors.map((error) => `  ❌ ${error.path} — ${error.message}`).join("\n");
 }

package/lib/cli-project-runtime.mjs

@@ -18,6 +18,7 @@ export { readProjectDisplayName, updateEnvLocalUrl } from "./project-metadata-ru
 import { detectProjectConfigFile, warnProjectConfigSelectionOnce } from "./project-config-selection.mjs";
 import { hasWorkspaceConfigSourceRuntime } from "./runtime-mode.mjs";
 import { SUPPORTED_DRIZZLE_KIT_GENERATOR_VERSION } from "./drizzle-generate.mjs";
+import { buildDrizzleGeneratorInvocation } from "./drizzle-generator-invocation.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -327,7 +328,11 @@ export async function loadConfig(options = {}) {
         existsSyncImpl,
         resolvePathImpl,
       });
-      warnProjectConfigSelectionOnce({ cwd: projectSelection.projectDir, selection: configSelection, warnImpl });
+      warnProjectConfigSelectionOnce({
+        cwd: projectSelection.projectDir,
+        selection: configSelection,
+        warnImpl,
+      });
     }
   } catch (caught) {
     if (throwOnInvalid) {
@@ -530,6 +535,10 @@ function ensureEsbuildConsistency(options = {}) {
 
 export function buildDrizzleKitCommand(subcmd, options = {}) {
   const {
+    canonicalConfigPath = resolve(
+      dirname(fileURLToPath(import.meta.url)),
+      "canonical-drizzle-generator.config.mjs",
+    ),
     cwd = process.cwd(),
     createRequireImpl = createRequire,
     dirnameImpl = dirname,
@@ -538,7 +547,7 @@ export function buildDrizzleKitCommand(subcmd, options = {}) {
     readFileSyncImpl = readFileSync,
     resolvePathImpl = resolve,
   } = options;
-  if (!/^[a-z][a-z0-9:-]*$/.test(subcmd)) throw new Error(`Invalid drizzle-kit command: ${subcmd}`);
+  if (!/^[a-z][a-z0-9:-]*$/u.test(subcmd)) throw new Error(`Invalid drizzle-kit command: ${subcmd}`);
   try {
     const cliRequire = createRequireImpl(import.meta.url);
     const packageJsonPath = resolvePathImpl(dirnameImpl(cliRequire.resolve("drizzle-kit")), "package.json");
@@ -554,8 +563,14 @@ export function buildDrizzleKitCommand(subcmd, options = {}) {
     const resolvedBin = resolvePathImpl(dirnameImpl(packageJsonPath), binRelative);
     if (!existsSyncImpl(resolvedBin)) throw new Error("bin file missing");
     const env = ensureEsbuildConsistency({ ...options, cwd });
+    const invocation = buildDrizzleGeneratorInvocation({
+      configPath: canonicalConfigPath,
+      generatorBinPath: resolvedBin,
+      processExecPath,
+      subcommand: subcmd,
+    });
     return {
-      cmd: `"${processExecPath}" "${resolvedBin}" ${subcmd}`,
+      ...invocation,
       env,
       generatorVersion: packageJson.version,
     };
@@ -595,7 +610,7 @@ export function findServerRoot(options = {}) {
   const siblingServer = resolvePathImpl(dirnameValue, "../../server");
   if (existsSyncImpl(siblingServer)) return siblingServer;
 
-  errorImpl("Server runtime not found. Run 'bun install'.");
+  errorImpl("Server runtime not found. Run 'pnpm install'.");
   exitImpl(1);
   return null;
 }

package/lib/db-migration-command-steps.mjs

@@ -180,9 +180,22 @@ export function emitCloudMigrationSuccess({
           ? "Migration state inspection completed; the plan is ready."
           : "Migration state inspection completed; the plan remains blocked.",
       );
-      deps.logImpl(
-        `  ${DIM}Code: ${checkData.inspection.code} · Next: ${checkData.inspection.nextAction} · Database unchanged${RESET}\n`,
-      );
+      deps.logImpl(`  ${DIM}Database unchanged${RESET}\n`);
+      const plan = checkData.inspection.plan;
+      if (
+        ready &&
+        plan?.safeToRewritePending === true &&
+        Array.isArray(plan.pendingMigrationNames) &&
+        plan.pendingMigrationNames.length > 0
+      ) {
+        deps.logImpl(`  Applied migrations: ${plan.appliedVerifiedCount} (keep unchanged)`);
+        deps.logImpl("  Pending migrations that may be regenerated:");
+        plan.pendingMigrationNames.forEach((name) => deps.logImpl(`    - ${name}`));
+        deps.logImpl("  Next: back up or commit the project, then remove only the listed pending folders.");
+        deps.logImpl("        gencow db:generate");
+        deps.logImpl("        pnpm exec drizzle-kit check");
+        deps.logImpl(`        gencow db:check${environment === "prod" ? " --prod" : ""}`);
+      }
       return;
     }
     deps.successImpl("Migration plan is safe to proceed.");

package/lib/db-push-command.mjs

@@ -110,6 +110,21 @@ function extractReadOnlyMigrationInspection(data) {
     return null;
   }
   const plan = inspection.plan;
+  const pendingMigrationNames = plan?.pendingMigrationNames;
+  const hasSafePendingTail =
+    plan?.safeToRewritePending === true &&
+    Array.isArray(pendingMigrationNames) &&
+    pendingMigrationNames.length === plan?.pendingCount &&
+    pendingMigrationNames.length > 0 &&
+    new Set(pendingMigrationNames).size === pendingMigrationNames.length &&
+    pendingMigrationNames.every(
+      (name) =>
+        typeof name === "string" &&
+        name.length <= 200 &&
+        name !== "." &&
+        name !== ".." &&
+        !/[\\/\u0000-\u001f\u007f]/u.test(name),
+    );
   if (
     inspection.outcome === "READY" &&
     !(
@@ -135,6 +150,9 @@ function extractReadOnlyMigrationInspection(data) {
             planId: plan.planId,
             appliedVerifiedCount: plan.appliedVerifiedCount,
             pendingCount: plan.pendingCount,
+            ...(hasSafePendingTail
+              ? { pendingMigrationNames: [...pendingMigrationNames], safeToRewritePending: true }
+              : {}),
             ...(plan.databaseBootstrapRequired === true ? { databaseBootstrapRequired: true } : {}),
             ...(plan.migrationStorePreparationRequired === true
               ? { migrationStorePreparationRequired: true }
@@ -374,10 +392,11 @@ function createDbMigrationCommand(deps, command) {
       } else {
         if (!jsonMode) deps.infoImpl("Generating schema migrations...");
         try {
+          const generationEnv = deps.buildEnv(config, { cwd: deps.cwdImpl() });
           generatorVersion = runDrizzleGenerateWithFallback({
             cwd: deps.cwdImpl(),
             drizzleKitCmdImpl: deps.drizzleKitCmdImpl,
-            env: deps.processEnv,
+            env: generationEnv,
             execSyncImpl: deps.execSyncImpl,
             stdio: jsonMode ? "pipe" : "inherit",
             warnImpl: jsonMode ? () => {} : deps.warnImpl,

package/lib/deploy-auditor.mjs

@@ -2,7 +2,7 @@
  * Deploy Auditor — Pre-deploy dependency analysis (informational).
  *
  * Detects user third-party dependencies that need auto-install on the
- * Gencow cloud runtime. User deps are installed via `bun install` on
+ * Gencow cloud runtime. User deps are installed via frozen `pnpm install` on
  * the server during provisioning.
  *
  * How it works:

package/lib/deploy-dependency-compat.mjs

@@ -78,7 +78,7 @@ export function formatDependencyVersionAuditError(result) {
 
   lines.push("");
   lines.push("  Fix:");
-  lines.push(`    bun add ${installTargets.join(" ")}`);
+  lines.push(`    pnpm add ${installTargets.join(" ")}`);
   lines.push("    bunx gencow@latest deploy");
   lines.push("");
 

package/lib/deploy-failure-diagnostic.mjs

@@ -1,5 +1,6 @@
 import { MIGRATION_NEXT_ACTION_KINDS } from "@gencow/migration-contract";
 
+import { APP_DELETE_OPERATION_PATTERN } from "./app-response-error.mjs";
 import { formatDeployCorrelationId } from "./deploy-correlation-diagnostic.mjs";
 
 const DEPLOY_FAILURE_STAGES = new Set([
@@ -13,9 +14,17 @@ const DEPLOY_FAILURE_STAGES = new Set([
   "controller",
 ]);
 const RETRY_CLASSES = new Set(["terminal-client", "retryable-infra", "platform-action"]);
-const USER_ACTIONS = new Set([...MIGRATION_NEXT_ACTION_KINDS, "OPERATOR_ACTION"]);
-const STRUCTURED_CONTRACT_FIELDS = ["code", "stage", "retryClass", "userAction", "correlationId"];
-const PLATFORM_ACTION_REQUIRED_MESSAGE = "Platform action is required before retrying";
+const USER_ACTIONS = new Set([...MIGRATION_NEXT_ACTION_KINDS, "OPERATOR_ACTION", "VIEW_DELETE_STATUS"]);
+const STRUCTURED_CONTRACT_FIELDS = [
+  "code",
+  "stage",
+  "retryClass",
+  "userAction",
+  "correlationId",
+  "operationId",
+  "appName",
+];
+const PLATFORM_RECOVERY_MESSAGE = "Gencow is recovering this deployment. Your app files do not need changes.";
 
 function safeText(value, maxLength) {
   if (typeof value !== "string") return null;
@@ -26,13 +35,14 @@ function safeText(value, maxLength) {
   return normalized;
 }
 
-function readDeployFailureContract(value) {
+function readDeployFailureContract(value, expectedAppName) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const code = safeText(value.code, 100);
   const stage = safeText(value.stage, 20);
   const retryClass = safeText(value.retryClass, 32);
   const userAction = safeText(value.userAction, 32);
   const correlationId = value.correlationId === undefined ? null : safeText(value.correlationId, 128);
+  const operationId = value.operationId === undefined ? null : safeText(value.operationId, 80);
   if (
     !code?.match(/^[A-Z][A-Z0-9_]{2,99}$/u) ||
     !stage ||
@@ -42,27 +52,33 @@ function readDeployFailureContract(value) {
     !userAction ||
     !USER_ACTIONS.has(userAction) ||
     (value.correlationId !== undefined && !correlationId) ||
-    (correlationId && !/^[A-Za-z0-9_-]{8,128}$/u.test(correlationId))
+    (correlationId && !/^[A-Za-z0-9_-]{8,128}$/u.test(correlationId)) ||
+    (userAction === "VIEW_DELETE_STATUS" &&
+      (!operationId ||
+        !APP_DELETE_OPERATION_PATTERN.test(operationId) ||
+        !/^[a-z][a-z0-9]*(?:-[a-z0-9]+){2}$/u.test(expectedAppName ?? "")))
   ) {
     return null;
   }
   return {
     code,
     stage,
+    retryClass,
     userAction: userAction === "CONTACT_SUPPORT" ? "OPERATOR_ACTION" : userAction,
     correlationId,
+    operationId,
     legacySupportAction: userAction === "CONTACT_SUPPORT",
   };
 }
 
 function normalizeLegacySupportMessage(message) {
   return typeof message === "string" && /contact support/iu.test(message)
-    ? PLATFORM_ACTION_REQUIRED_MESSAGE
+    ? PLATFORM_RECOVERY_MESSAGE
     : message;
 }
 
-export function renderDeployFailureDiagnosticLines(responseBody, statusText) {
-  const contract = readDeployFailureContract(responseBody);
+export function renderDeployFailureDiagnosticLines(responseBody, statusText, options = {}) {
+  const contract = readDeployFailureContract(responseBody, options.expectedAppName);
   const fallbackMessage = safeText(statusText, 120) ?? "Request failed";
   if (!contract) {
     const structuredFields =
@@ -83,8 +99,29 @@ export function renderDeployFailureDiagnosticLines(responseBody, statusText) {
     if (isLegacyCorrelationEnvelope) lines.push(correlationLine);
     return lines;
   }
+  const platformOwned =
+    contract.retryClass === "platform-action" && contract.userAction === "OPERATOR_ACTION";
+  if (platformOwned) {
+    const lines = [`Deploy failed: ${PLATFORM_RECOVERY_MESSAGE}`];
+    const correlationLine = formatDeployCorrelationId(contract.correlationId);
+    if (correlationLine) lines.push(correlationLine);
+    return lines;
+  }
+  if (contract.userAction === "VIEW_DELETE_STATUS") {
+    const publicMessage = safeText(responseBody.error, 240) ?? fallbackMessage;
+    const lines = [
+      `Deploy failed: ${publicMessage}`,
+      `Code: ${contract.code}`,
+      `Stage: ${contract.stage}`,
+      `Operation ID: ${contract.operationId}`,
+    ];
+    const correlationLine = formatDeployCorrelationId(contract.correlationId);
+    if (correlationLine) lines.push(correlationLine);
+    lines.push(`Next command: gencow app delete ${options.expectedAppName} --force`);
+    return lines;
+  }
   const publicMessage = contract.legacySupportAction
-    ? PLATFORM_ACTION_REQUIRED_MESSAGE
+    ? PLATFORM_RECOVERY_MESSAGE
     : (safeText(responseBody.error, 240) ?? fallbackMessage);
   const lines = [`Deploy failed: ${publicMessage}`];
   lines.push(`Code: ${contract.code}`, `Stage: ${contract.stage}`);