gencow 0.1.210 → 0.1.212

package/lib/project-migration-manifest.mjs

@@ -36,6 +36,10 @@ function projectSchemaSourcePaths({
     const missing = declared.filter((pathValue) => !existsSyncImpl(pathValue));
     if (missing.length > 0) throw new Error("Configured schema source is missing from the project");
   }
+  // An explicit schema list is the customer's immutable migration contract.
+  // Deploy codegen may materialize a compatibility auth schema later in the
+  // same workspace; it must not silently widen that declared contract.
+  if (config?.schema) return declared.filter((pathValue) => existsSyncImpl(pathValue));
   return resolveDrizzleSchemaPaths(config ?? { rootDir: backendDir }, {
     cwd,
     existsSyncImpl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.210",
+  "version": "0.1.212",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -33,9 +33,9 @@
   "devDependencies": {
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
-    "@gencow/core": "0.1.43",
     "@gencow/client": "0.2.6",
-    "@gencow/react": "0.2.6"
+    "@gencow/react": "0.2.6",
+    "@gencow/core": "0.1.43"
   },
   "scripts": {
     "prebuild": "pnpm --filter @gencow/migration-contract run build && pnpm --filter @gencow/server run build",

package/runtime/server.mjs

@@ -9660,7 +9660,13 @@ var init_deployment_executor_authority_contract = __esm({
       objectAuthority("app_runtime_activity_state", ["SELECT", "INSERT", "UPDATE"]),
       objectAuthority("app_runtime_activity_observers", ["SELECT", "INSERT", "UPDATE", "DELETE"]),
       objectAuthority("app_runtime_activity_leases", ["SELECT", "INSERT", "UPDATE", "DELETE"]),
-      objectAuthority("runtime_drain_requests", ["SELECT"]),
+      // runtime_stop_intents is owned by the public runtime role and references a
+      // drain request. PostgreSQL's FK check takes a KEY SHARE lock, which needs
+      // UPDATE authority on one referenced column. Constrain that capability to
+      // the immutable drain-request identity.
+      objectAuthority("runtime_drain_requests", ["SELECT"], {
+        columnPrivileges: [{ columns: ["id"], privileges: ["UPDATE"] }]
+      }),
       // The public Platform owns node heartbeat, readiness, capacity admission,
       // and authenticated node administration. These are system-plane data
       // mutations, not lifecycle execution authority.
@@ -110044,6 +110050,32 @@ var require_output = __commonJS({
   }
 });
 
+// ../../node_modules/.pnpm/@img+sharp-wasm32@0.34.5/node_modules/@img/sharp-wasm32/versions.json
+var require_versions = __commonJS({
+  "../../node_modules/.pnpm/@img+sharp-wasm32@0.34.5/node_modules/@img/sharp-wasm32/versions.json"(exports2, module2) {
+    module2.exports = {
+      aom: "3.13.1",
+      cgif: "0.5.0",
+      emscripten: "4.0.18",
+      exif: "0.6.25",
+      expat: "2.7.3",
+      ffi: "3.5.2",
+      glib: "2.86.1",
+      heif: "1.20.2",
+      highway: "1.3.0",
+      imagequant: "2.4.1",
+      lcms: "2.17",
+      mozjpeg: "0826579",
+      resvg: "0.45.1",
+      spng: "0.7.4",
+      tiff: "4.7.1",
+      vips: "8.17.3",
+      webp: "1.6.0",
+      "zlib-ng": "2.2.5"
+    };
+  }
+});
+
 // ../../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/utility.js
 var require_utility = __commonJS({
   "../../node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/lib/utility.js"(exports2, module2) {
@@ -110088,7 +110120,7 @@ var require_utility = __commonJS({
         }
       } else {
         try {
-          versions = __require("@img/sharp-wasm32/versions");
+          versions = require_versions();
         } catch (_4) {
         }
       }
@@ -185372,7 +185404,8 @@ function fleetSelection() {
   return {
     ...bindingSelection(),
     authorityMode: appRuntimeDesiredState.authorityMode,
-    desiredRuntimeState: appRuntimeDesiredState.desiredRuntimeState
+    desiredRuntimeState: appRuntimeDesiredState.desiredRuntimeState,
+    hasBackend: apps.hasBackend
   };
 }
 function queryBindingRows(db) {
@@ -185424,6 +185457,7 @@ function fleetAuthorityDigest(rows4) {
     row.appId,
     row.appName,
     row.authorityMode,
+    row.hasBackend,
     row.desiredActivationId,
     row.desiredRuntimeState,
     row.desiredActivationEpoch,
@@ -185483,7 +185517,7 @@ async function loadCanonicalTenantRouteFleetSnapshot(input) {
   const removalTargets = [];
   for (const appRows of grouped.values()) {
     const desired = appRows[0];
-    if (desired.desiredRuntimeState === "serving" && desired.desiredNodeId === input.nodeId) {
+    if (desired.hasBackend && desired.desiredRuntimeState === "serving" && desired.desiredNodeId === input.nodeId) {
       const joinedRows = appRows.filter((row) => row.instanceId !== null);
       try {
         bindings.push(bindingFromRows(joinedRows));
@@ -401291,7 +401325,7 @@ function requestLocalHealth(url2, init) {
       },
       (response) => {
         const status = response.statusCode ?? 0;
-        response.once("end", () => resolve115({ ok: status >= 200 && status < 300 }));
+        resolve115({ ok: status >= 200 && status < 300 });
         response.resume();
       }
     );