gencow 0.1.209 → 0.1.211

package/lib/project-migration-manifest.mjs

@@ -36,6 +36,10 @@ function projectSchemaSourcePaths({
     const missing = declared.filter((pathValue) => !existsSyncImpl(pathValue));
     if (missing.length > 0) throw new Error("Configured schema source is missing from the project");
   }
+  // An explicit schema list is the customer's immutable migration contract.
+  // Deploy codegen may materialize a compatibility auth schema later in the
+  // same workspace; it must not silently widen that declared contract.
+  if (config?.schema) return declared.filter((pathValue) => existsSyncImpl(pathValue));
   return resolveDrizzleSchemaPaths(config ?? { rootDir: backendDir }, {
     cwd,
     existsSyncImpl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.209",
+  "version": "0.1.211",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -33,9 +33,9 @@
   "devDependencies": {
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
-    "@gencow/client": "0.2.6",
     "@gencow/core": "0.1.43",
-    "@gencow/react": "0.2.6"
+    "@gencow/react": "0.2.6",
+    "@gencow/client": "0.2.6"
   },
   "scripts": {
     "prebuild": "pnpm --filter @gencow/migration-contract run build && pnpm --filter @gencow/server run build",

package/runtime/server.mjs

@@ -9660,7 +9660,13 @@ var init_deployment_executor_authority_contract = __esm({
       objectAuthority("app_runtime_activity_state", ["SELECT", "INSERT", "UPDATE"]),
       objectAuthority("app_runtime_activity_observers", ["SELECT", "INSERT", "UPDATE", "DELETE"]),
       objectAuthority("app_runtime_activity_leases", ["SELECT", "INSERT", "UPDATE", "DELETE"]),
-      objectAuthority("runtime_drain_requests", ["SELECT"]),
+      // runtime_stop_intents is owned by the public runtime role and references a
+      // drain request. PostgreSQL's FK check takes a KEY SHARE lock, which needs
+      // UPDATE authority on one referenced column. Constrain that capability to
+      // the immutable drain-request identity.
+      objectAuthority("runtime_drain_requests", ["SELECT"], {
+        columnPrivileges: [{ columns: ["id"], privileges: ["UPDATE"] }]
+      }),
       // The public Platform owns node heartbeat, readiness, capacity admission,
       // and authenticated node administration. These are system-plane data
       // mutations, not lifecycle execution authority.
@@ -110044,32 +110050,6 @@ var require_output = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@img+sharp-wasm32@0.34.5/node_modules/@img/sharp-wasm32/versions.json
-var require_versions = __commonJS({
-  "../../node_modules/.pnpm/@img+sharp-wasm32@0.34.5/node_modules/@img/sharp-wasm32/versions.json"(exports2, module2) {
-    module2.exports = {
-      aom: "3.13.1",
-      cgif: "0.5.0",
-      emscripten: "4.0.18",
-      exif: "0.6.25",
-      expat: "2.7.3",
-      ffi: "3.5.2",
-      glib: "2.86.1",
-      heif: "1.20.2",
-      highway: "1.3.0",
-      imagequant: "2.4.1",
-      lcms: "2.17",
-      mozjpeg: "0826579",
-      resvg: "0.45.1",
-      spng: "0.7.4",
-      tiff: "4.7.1",
-      vips: "8.17.3",
-      webp: "1.6.0",
-      "zlib-ng": "2.2.5"
-    };
-  }
-});
-
 // ../../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/utility.js
 var require_utility = __commonJS({
   "../../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/utility.js"(exports2, module2) {
@@ -110114,7 +110094,7 @@ var require_utility = __commonJS({
         }
       } else {
         try {
-          versions = require_versions();
+          versions = __require("@img/sharp-wasm32/versions");
         } catch (_4) {
         }
       }
@@ -185398,7 +185378,8 @@ function fleetSelection() {
   return {
     ...bindingSelection(),
     authorityMode: appRuntimeDesiredState.authorityMode,
-    desiredRuntimeState: appRuntimeDesiredState.desiredRuntimeState
+    desiredRuntimeState: appRuntimeDesiredState.desiredRuntimeState,
+    hasBackend: apps.hasBackend
   };
 }
 function queryBindingRows(db) {
@@ -185450,6 +185431,7 @@ function fleetAuthorityDigest(rows4) {
     row.appId,
     row.appName,
     row.authorityMode,
+    row.hasBackend,
     row.desiredActivationId,
     row.desiredRuntimeState,
     row.desiredActivationEpoch,
@@ -185509,7 +185491,7 @@ async function loadCanonicalTenantRouteFleetSnapshot(input) {
   const removalTargets = [];
   for (const appRows of grouped.values()) {
     const desired = appRows[0];
-    if (desired.desiredRuntimeState === "serving" && desired.desiredNodeId === input.nodeId) {
+    if (desired.hasBackend && desired.desiredRuntimeState === "serving" && desired.desiredNodeId === input.nodeId) {
       const joinedRows = appRows.filter((row) => row.instanceId !== null);
       try {
         bindings.push(bindingFromRows(joinedRows));
@@ -401317,7 +401299,7 @@ function requestLocalHealth(url2, init) {
       },
       (response) => {
         const status = response.statusCode ?? 0;
-        response.once("end", () => resolve115({ ok: status >= 200 && status < 300 }));
+        resolve115({ ok: status >= 200 && status < 300 });
         response.resume();
       }
     );
@@ -415089,7 +415071,7 @@ async function persistDecision(tx, input, current, requiredTargets) {
                updated_at = NOW()
          WHERE app_id = ${input.appId}
            AND app_instance_id = ${input.appInstanceId}
-           AND route_epoch = ${input.expectedRouteEpoch}
+           AND route_epoch = ${Number(current.route_epoch)}
          RETURNING app_id
       `) : await tx.execute(sql79`
         INSERT INTO app_serving_route_authorities (
@@ -415212,8 +415194,31 @@ async function persistPreparedDecision(tx, input, current, requiredTargets) {
   }
   return outcome(input, routeEpoch, predecessorHash, eventId, publicationSequence, false);
 }
-async function assertAuthorityEpoch(current, input) {
-  if (current === null && input.expectedRouteEpoch !== 0 || current !== null && (current.environment !== input.environment || current.app_instance_id !== input.appInstanceId || Number(current.route_epoch) !== input.expectedRouteEpoch)) {
+async function loadLatestReservedEpoch(tx, input) {
+  const result2 = await tx.execute(sql79`
+    SELECT COALESCE(MAX(route_epoch), 0) AS route_epoch
+      FROM app_serving_route_outbox
+     WHERE app_id = ${input.appId}
+       AND app_instance_id = ${input.appInstanceId}
+       AND environment = ${input.environment}
+  `);
+  const routeEpoch = Number(
+    rowsFromResult31(result2)[0]?.route_epoch ?? 0
+  );
+  if (!Number.isSafeInteger(routeEpoch) || routeEpoch < 0) fail13("APP_SERVING_ROUTE_EPOCH_CONFLICT");
+  return routeEpoch;
+}
+async function assertPrepareAuthorityEpoch(tx, current, input) {
+  const authorityEpoch = current ? Number(current.route_epoch) : 0;
+  const reservedEpoch = await loadLatestReservedEpoch(tx, input);
+  if (current !== null && (current.environment !== input.environment || current.app_instance_id !== input.appInstanceId) || authorityEpoch > input.expectedRouteEpoch || Math.max(authorityEpoch, reservedEpoch) !== input.expectedRouteEpoch) {
+    fail13("APP_SERVING_ROUTE_EPOCH_CONFLICT");
+  }
+}
+async function assertCommitPreparedAuthorityEpoch(tx, current, input) {
+  const authorityEpoch = current ? Number(current.route_epoch) : 0;
+  const reservedEpoch = await loadLatestReservedEpoch(tx, input);
+  if (current !== null && (current.environment !== input.environment || current.app_instance_id !== input.appInstanceId) || authorityEpoch > input.expectedRouteEpoch || reservedEpoch !== input.expectedRouteEpoch + 1) {
     fail13("APP_SERVING_ROUTE_EPOCH_CONFLICT");
   }
 }
@@ -415221,7 +415226,6 @@ async function prepareNormalizedDecision(tx, input, acquireLock) {
   if (input.phase !== "prepare") fail13("APP_SERVING_ROUTE_DECISION_INVALID");
   await acquireLock(tx, `app-serving-route:${input.appId}`);
   const current = await loadAuthority(tx, input.appId);
-  await assertAuthorityEpoch(current, input);
   const requiredTargets = await resolveAppServingRouteTargetSet({
     db: tx,
     environment: input.environment,
@@ -415231,13 +415235,14 @@ async function prepareNormalizedDecision(tx, input, acquireLock) {
   });
   const replay = await inspectPreparedReplay(tx, input, current, requiredTargets);
   if (replay) return replay;
+  await assertPrepareAuthorityEpoch(tx, current, input);
   return persistPreparedDecision(tx, input, current, requiredTargets);
 }
 async function commitPreparedNormalizedDecision(tx, input, acquireLock) {
   if (input.phase !== "commit") fail13("APP_SERVING_ROUTE_DECISION_INVALID");
   await acquireLock(tx, `app-serving-route:${input.appId}`);
   const current = await loadAuthority(tx, input.appId);
-  await assertAuthorityEpoch(current, input);
+  await assertCommitPreparedAuthorityEpoch(tx, current, input);
   const preparedInput = { ...input, phase: "prepare" };
   const requiredTargets = await resolveAppServingRouteTargetSet({
     db: tx,
@@ -415532,8 +415537,42 @@ async function commitAppServingRouteSourceInTransaction(input) {
   if (authority && (authority.environment !== input.environment || authority.app_instance_id !== input.source.appInstanceId)) {
     fail15("APP_SERVING_ROUTE_SOURCE_DECISION_CONFLICT");
   }
-  const expectedRouteEpoch = authority ? Number(authority.route_epoch) : 0;
-  if (!Number.isSafeInteger(expectedRouteEpoch) || expectedRouteEpoch < 0) {
+  const reservedResult = await input.tx.execute(sql80`
+    SELECT COALESCE(MAX(route_epoch), 0) AS route_epoch
+      FROM app_serving_route_outbox
+     WHERE app_id = ${input.source.appId}
+       AND app_instance_id = ${input.source.appInstanceId}
+       AND environment = ${input.environment}
+  `);
+  const authorityEpoch = authority ? Number(authority.route_epoch) : 0;
+  const reservedEpoch = Number(
+    rowsFromResult32(reservedResult)[0]?.route_epoch ?? 0
+  );
+  let expectedRouteEpoch = Math.max(authorityEpoch, reservedEpoch);
+  if (input.phase === "commit") {
+    const preparedResult = await input.tx.execute(sql80`
+      SELECT event_id, publication_sequence, environment, app_id, app_instance_id, route_epoch,
+             phase, disposition, mutation_kind, entry_hash, predecessor_hash, topology_revision,
+             target_set_id, source_revision
+        FROM app_serving_route_outbox
+       WHERE app_id = ${input.source.appId}
+         AND app_instance_id = ${input.source.appInstanceId}
+         AND mutation_kind = ${input.mutationKind}
+         AND source_revision = ${input.sourceRevision}
+         AND phase = 'prepare'
+       FOR UPDATE
+    `);
+    const prepared = rowsFromResult32(preparedResult)[0];
+    const preparedEpoch = Number(prepared?.route_epoch);
+    const preparedEntryHash = Number.isSafeInteger(preparedEpoch) ? hashServingRouteManifestEntry(
+      compileAppServingRouteEntry({ ...input.source, routeEpoch: preparedEpoch })
+    ) : "";
+    if (!prepared || prepared.environment !== input.environment || prepared.disposition !== input.source.disposition || prepared.topology_revision !== input.topologyRevision || prepared.target_set_id !== input.targetSetId || prepared.entry_hash !== preparedEntryHash || preparedEpoch < 1) {
+      fail15("APP_SERVING_ROUTE_SOURCE_DECISION_CONFLICT");
+    }
+    expectedRouteEpoch = preparedEpoch - 1;
+  }
+  if (!Number.isSafeInteger(authorityEpoch) || authorityEpoch < 0 || !Number.isSafeInteger(reservedEpoch) || !Number.isSafeInteger(expectedRouteEpoch)) {
     fail15("APP_SERVING_ROUTE_SOURCE_DECISION_CONFLICT");
   }
   const entry = compileAppServingRouteEntry({
@@ -415579,9 +415618,6 @@ function fail16(code) {
 }
 async function recordActivationServingRoute(input) {
   if (!input.publication) return void 0;
-  if (input.deploymentEnvironment !== input.publication.environment) {
-    return fail16("ACTIVATION_SERVING_ROUTE_ENVIRONMENT_MISMATCH");
-  }
   const app2 = (await input.tx.select({
     instanceId: apps.instanceId,
     name: apps.name,
@@ -415707,7 +415743,6 @@ async function prepareCandidateActivationServingRoute(input) {
       publication: input.servingRoutePublication,
       acquireLock,
       appId: input.appId,
-      deploymentEnvironment: deployment.env,
       activationId: input.activationId,
       instanceId: input.instanceId,
       nodeId: activation.nodeId,
@@ -415871,7 +415906,6 @@ async function commitCandidateActivation(input) {
         publication: input.servingRoutePublication,
         acquireLock,
         appId: input.appId,
-        deploymentEnvironment: deploymentRows2[0].env,
         activationId: input.activationId,
         instanceId: input.instanceId,
         nodeId: activation.nodeId,
@@ -415988,7 +416022,6 @@ async function commitCandidateActivation(input) {
       publication: input.servingRoutePublication,
       acquireLock,
       appId: input.appId,
-      deploymentEnvironment: deploymentRows[0].env,
       activationId: input.activationId,
       instanceId: input.instanceId,
       nodeId: activation.nodeId,
@@ -419033,6 +419066,7 @@ async function runImmutableDeploymentCandidate(input) {
       () => input.prepareSchema({ workspacePath: generation.workspacePath }),
       preparation
     );
+    await input.enterRuntimePreparation?.();
     if (!existingReady) {
       await runWithCandidateFailurePhase(
         "workspace_build",
@@ -421259,10 +421293,8 @@ async function deployWithRuntimeControlPlane(input) {
           verifyPreparedSchema: async (revisionId) => {
             await assertSchemaRevisionAllowsCandidate({ db: input.db, revisionId });
           },
-          build: async ({ workspacePath }) => {
-            await input.onExecutorPhase?.("runtime_preparing");
-            return provisioner.prepareWorkspace(input.app.name, workspacePath);
-          },
+          enterRuntimePreparation: () => input.onExecutorPhase?.("runtime_preparing") ?? Promise.resolve(),
+          build: ({ workspacePath }) => provisioner.prepareWorkspace(input.app.name, workspacePath),
           prepareIdentity,
           bootAndAttest: async (context2) => {
             await input.onExecutorPhase?.("candidate_attesting");
@@ -424053,7 +424085,7 @@ function loadAppServingRouteRolloutConfig(input) {
   const mode = route.publicationMode;
   if (mode === "off") return null;
   if (mode !== "enforce" || !Number.isSafeInteger(input.appId) || input.appId < 1) return fail30();
-  const environment = input.deploymentEnvironment;
+  const deploymentEnvironment = input.deploymentEnvironment;
   const configuredEnvironment = route.environment ?? void 0;
   const topologyRevision = route.topologyRevision ?? "";
   const upsertTargetSetId = route.upsertTargetSetId ?? "";
@@ -424065,24 +424097,24 @@ function loadAppServingRouteRolloutConfig(input) {
   } catch {
     return fail30();
   }
-  if (!ENVIRONMENTS3.has(environment) || !ENVIRONMENTS3.has(configuredEnvironment)) {
+  if (!ENVIRONMENTS3.has(deploymentEnvironment) || !ENVIRONMENTS3.has(configuredEnvironment)) {
     return fail30();
   }
-  if (configuredEnvironment !== environment) return null;
+  const servingEnvironment = configuredEnvironment;
   if (!REFERENCE4.test(topologyRevision) || !REFERENCE4.test(upsertTargetSetId) || !REFERENCE4.test(tombstoneTargetSetId)) {
     return fail30();
   }
   if (allowlist3 !== "all" && !allowlist3.has(input.appId)) return null;
   return {
     activation: {
-      environment,
+      environment: servingEnvironment,
       baseDomain,
       topologyRevision,
       targetSetId: upsertTargetSetId,
       backendRoutePrefixes: MANAGED_BACKEND_ROUTE_PREFIXES
     },
     deletion: {
-      environment,
+      environment: servingEnvironment,
       baseDomain,
       topologyRevision,
       tombstoneTargetSetId
@@ -427993,10 +428025,15 @@ async function assertAppDeleteTreeMutationReady(input) {
   if (childRows.some((child) => child.userId !== input.ownerId)) {
     throw new AppDeletePreAdmissionError(input.correlationId);
   }
-  const targetNodeIds = /* @__PURE__ */ new Set([
-    input.app.nodeId,
-    ...childRows.map((child) => child.nodeId)
-  ]);
+  const currentNodeId = input.currentNodeId?.trim() || process.env.GENCOW_NODE_ID?.trim() || null;
+  const targetNodeIds = new Set(
+    [input.app.nodeId ?? currentNodeId, ...childRows.map((child) => child.nodeId)].map((nodeId) => nodeId?.trim() || null).filter((nodeId) => nodeId !== null)
+  );
+  if (targetNodeIds.size === 0) {
+    throw new PlatformMutationAdmissionError("PLATFORM_MUTATION_IDENTITY_INVALID", {
+      correlationId: input.correlationId
+    });
+  }
   const assertTargetReady = input.assertTargetReadyImpl ?? assertTargetPlatformMutationReady;
   for (const nodeId of targetNodeIds) {
     await assertTargetReady({
@@ -428014,7 +428051,7 @@ async function isAppDeleteExecutorAvailable(input) {
     if (!input.operation.appInstanceId) return false;
     try {
       const rows4 = await input.db.select({ nodeId: apps.nodeId }).from(apps).where(and69(eq75(apps.id, input.operation.appId), eq75(apps.instanceId, input.operation.appInstanceId))).limit(1);
-      nodeId = rows4[0]?.nodeId?.trim() || null;
+      nodeId = rows4[0]?.nodeId?.trim() || input.currentNodeId?.trim() || process.env.GENCOW_NODE_ID?.trim() || null;
     } catch {
       return false;
     }