gencow 0.1.216 → 0.1.218

package/lib/app-delete-operation.mjs

@@ -76,6 +76,10 @@ function invalidPollResponse(accepted, response = null) {
   };
 }
 
+function isRetryableStatusPollFailure(response) {
+  return response?.status === 503 || response?.status >= 500;
+}
+
 function isMatchingTerminalResponse(value, accepted, expectedAppId) {
   return (
     isExactAppDeleteResponse(value, expectedAppId) &&
@@ -125,7 +129,17 @@ export async function pollAppDeleteOperation({
         operationId: accepted.operationId,
       });
       const statusData = await readJsonObjectResponse(statusRes);
-      if (!statusRes?.ok || !statusData) return invalidPollResponse(accepted, statusRes);
+      // A lifecycle operation is durable.  A transient 5xx while the status
+      // query is being served must not turn that durable receipt into a client
+      // contract failure or abandon the operation's correlation identity.
+      if (!statusRes?.ok || !statusData) {
+        if (isRetryableStatusPollFailure(statusRes)) {
+          transportFailures += 1;
+          if (attempt + 1 < pollAttempts) await sleepImpl(pollIntervalMs);
+          continue;
+        }
+        return invalidPollResponse(accepted, statusRes);
+      }
       successfulPollResponses += 1;
       if (isMatchingTerminalResponse(statusData, accepted, name)) return statusData;
       if (isMatchingTerminalFailureResponse(statusData, accepted, name)) {

package/lib/deploy-package-runtime.mjs

@@ -41,6 +41,37 @@ import {
 } from "./deploy-lockfile-selection.mjs";
 import { detectProjectConfigFile, warnProjectConfigSelectionOnce } from "./project-config-selection.mjs";
 import { writeCanonicalDeployBundle } from "./deploy-bundle-staging.mjs";
+
+const INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS = 3;
+
+function isRetryableInitialDeploymentAdmission(response) {
+  return Number.isInteger(response?.status) && response.status >= 500 && response.status <= 599;
+}
+
+/**
+ * A deploy claim is an idempotency key.  Before the Platform returns the
+ * operation receipt, a transport/5xx outcome is intentionally ambiguous;
+ * resubmit only that same claim a bounded number of times rather than making
+ * the customer invent a second operation.
+ */
+export async function submitDeploymentWithIdempotentRetry({
+  submit,
+  sleepImpl = (ms) => new Promise((resolveDelay) => setTimeout(resolveDelay, ms)),
+}) {
+  let response;
+  for (let attempt = 1; attempt <= INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS; attempt += 1) {
+    response = await submit();
+    if (
+      !isRetryableInitialDeploymentAdmission(response) ||
+      attempt === INITIAL_DEPLOYMENT_ADMISSION_ATTEMPTS
+    ) {
+      return response;
+    }
+    await sleepImpl(250 * attempt);
+  }
+  return response;
+}
+
 async function loadProjectConfigDefault(options) {
   const { loadConfig } = await import("./cli-project-runtime.mjs");
   return loadConfig(options);
@@ -637,6 +668,15 @@ export function createDeployPackageRuntime({
         platformFetch: platformFetchImpl,
         setTimeoutImpl,
       });
+    const submitDeployAdmission = () => {
+      // A legacy request without a deploy claim has no stable pre-receipt
+      // identity. Never retry that request automatically.
+      if (!activeDeployClaim) return deployOnce(targetAppId);
+      return submitDeploymentWithIdempotentRetry({
+        submit: () => deployOnce(targetAppId),
+        sleepImpl: (ms) => new Promise((resolveDelay) => setTimeoutImpl(resolveDelay, ms)),
+      });
+    };
 
     const showCrashLogs = async (errData, title, targetAppId) => {
       let diagnosticLines = normalizeDiagnosticLogLines(errData?.crashLogs);
@@ -661,7 +701,7 @@ export function createDeployPackageRuntime({
     const spinner = startSpinner("Deploying...");
     let deployRes;
     try {
-      deployRes = await deployOnce(targetAppId);
+      deployRes = await submitDeployAdmission();
       if (deployRes.status === 202) {
         deployRes = await pollAcceptedDeployment(deployRes);
       }
@@ -698,7 +738,7 @@ export function createDeployPackageRuntime({
       infoImpl("Retrying deploy...");
       const retrySpinner = startSpinner("Deploying...");
       try {
-        deployRes = await deployOnce(targetAppId);
+        deployRes = await submitDeployAdmission();
         if (deployRes.status === 202) {
           deployRes = await pollAcceptedDeployment(deployRes);
         }
@@ -737,7 +777,9 @@ export function createDeployPackageRuntime({
 
     const deployData = await readJsonObjectResponse(deployRes);
     if (!deployData) {
-      errorImpl(`Deploy failed: no terminal deployment receipt was returned after packaging.\nCode: CLI_DEPLOY_TERMINAL_RECEIPT_MISSING\nStage: controller\nHTTP status: ${deployRes?.status ?? "unknown"}\nNext action: RETRY`);
+      errorImpl(
+        `Deploy failed: no terminal deployment receipt was returned after packaging.\nCode: CLI_DEPLOY_TERMINAL_RECEIPT_MISSING\nStage: controller\nHTTP status: ${deployRes?.status ?? "unknown"}\nNext action: RETRY`,
+      );
       exitImpl(1);
       return null;
     }
@@ -748,7 +790,11 @@ export function createDeployPackageRuntime({
     successImpl(`Server build complete! (${deployElapsed}s)`);
 
     if (deployData.url) {
-      const ready = await verifyAppReadyImpl(releaseAttemptId ? { appUrl: deployData.url, appId: targetAppId, announceReady: false } : { appUrl: deployData.url, appId: targetAppId });
+      const ready = await verifyAppReadyImpl(
+        releaseAttemptId
+          ? { appUrl: deployData.url, appId: targetAppId, announceReady: false }
+          : { appUrl: deployData.url, appId: targetAppId },
+      );
       if (!ready) {
         errorImpl("Deploy failed: app did not become ready after deployment.");
         await showCrashLogs(null, "Readiness failure diagnostics:", targetAppId);

package/lib/deploy-runtime.mjs

@@ -144,6 +144,13 @@ export function readDeployProjectContext({
   return { appId, displayName, gencowJsonPath, prodAppId, projectDir };
 }
 
+// gencow.json deliberately keeps the first production deployment separate
+// from the optional development app. Every production operation must resolve
+// that persisted production identity before it can create or deploy anything.
+export function resolveEnvironmentDeployTarget({ appId = null, envTarget = "dev", prodAppId = null } = {}) {
+  return envTarget === "prod" ? (prodAppId ?? appId) : appId;
+}
+
 function showUnknownDeployArgument(arg, { errorImpl = error, infoImpl = info, logImpl = log } = {}) {
   errorImpl(`Unknown deploy argument: "${arg}"`);
   logImpl("");
@@ -516,6 +523,7 @@ export function createDeployCommand({
       resolvePathImpl,
     });
     let { appId, displayName, gencowJsonPath, prodAppId, projectDir } = context;
+    appId = resolveEnvironmentDeployTarget({ appId, envTarget: parsed.envTarget, prodAppId });
     const backendProjectRoot = projectDir ?? projectRoot;
     const projectConfig = loadConfigImpl
       ? await loadConfigImpl({

package/lib/deploy-static-fullstack-runtime.mjs

@@ -5,6 +5,11 @@ import { createDeployPackageRuntime, writeProjectMetadata } from "./deploy-packa
 import { BOLD, CYAN, DIM, RESET, error, info, log, success } from "./output.mjs";
 import { preflightStaticDeployArtifact } from "./static-deploy-command.mjs";
 
+function shouldPreserveFinalizeAttempt(error) {
+  return error?.retryable === true ||
+    error?.message === "APP_SERVING_ROUTE_COMMIT_PENDING";
+}
+
 export function createScopedDeployPackageRuntime({
   buildEnvImpl,
   buildDeployClaimFromArchiveImpl,
@@ -181,7 +186,9 @@ export async function deployBackendPackage({
     try {
       await finalizeReleaseAttempt({ appId: deployed.appId, attemptId: releaseAttempt.attemptId });
     } catch (caught) {
-      await markAttemptFailed("finalize", "APP_RELEASE_FINALIZE_FAILED");
+      if (!shouldPreserveFinalizeAttempt(caught)) {
+        await markAttemptFailed("finalize", "APP_RELEASE_FINALIZE_FAILED");
+      }
       throw caught;
     }
     successImpl("App Ready! (release finalized)");

package/lib/deployment-operation-poll.mjs

@@ -63,6 +63,15 @@ function isNonterminalResponse(response, body, identity) {
   );
 }
 
+function isTransientPinnedOperationRead(response, expected) {
+  return (
+    expected.operationId !== null &&
+    Number.isInteger(response?.status) &&
+    response.status >= 500 &&
+    response.status <= 599
+  );
+}
+
 export async function pollAcceptedDeploymentOperation({
   initialResponse,
   creds,
@@ -153,6 +162,22 @@ export async function pollAcceptedDeploymentOperation({
       response = polledResponse;
       continue;
     }
+    // Once the server has sealed the operation identity, a gateway/database
+    // read failure cannot safely be presented as that operation's terminal
+    // result. Keep polling the same receipt; never submit a second deploy.
+    if (isTransientPinnedOperationRead(response, expected)) {
+      if (nowImpl() >= deadlineMs) return pendingResponse();
+      const retryAfter = Number(response.headers?.get?.("Retry-After"));
+      const retryDelayMs =
+        Number.isFinite(retryAfter) && retryAfter >= 1 && retryAfter <= 10 ? retryAfter * 1000 : 1000;
+      const remainingMs = Math.max(0, deadlineMs - nowImpl());
+      await new Promise((resolveDelay) => setTimeoutImpl(resolveDelay, Math.min(retryDelayMs, remainingMs)));
+      if (nowImpl() >= deadlineMs) return pendingResponse();
+      const polledResponse = await fetchWithinDeadline();
+      if (!polledResponse) return pendingResponse();
+      response = polledResponse;
+      continue;
+    }
     if (
       expected.operationId === null ||
       !TERMINAL_STATES.has(identity.state) ||

package/lib/init-command.mjs

@@ -587,7 +587,10 @@ export function createInitCommand({
         successImpl("Dependencies installed");
       } catch (caught) {
         installStatus = "failed";
-        warnImpl(`${caught?.code ?? "CLI_INIT_DEPENDENCY_INSTALL_FAILED"}: Dependency setup failed.`);
+        const reason = typeof caught?.reason === "string" ? ` (${caught.reason})` : "";
+        warnImpl(
+          `${caught?.code ?? "CLI_INIT_DEPENDENCY_INSTALL_FAILED"}${reason}: Dependency setup failed.`,
+        );
         exitImpl(1);
         return;
       }

package/lib/project-dependency-lock-sync.mjs

@@ -15,6 +15,33 @@ function corepackCommand(platform) {
   return platform === "win32" ? "corepack.cmd" : "corepack";
 }
 
+function isCommandUnavailable(error) {
+  return error?.code === "ENOENT";
+}
+
+function installProjectDependencies(projectDir, deps) {
+  const pnpmArgs = [approvedPnpmSelector(), "install", "--ignore-workspace"];
+  try {
+    deps.execFileSyncImpl(corepackCommand(deps.platform), pnpmArgs, {
+      cwd: projectDir,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { executor: "corepack" };
+  } catch (error) {
+    // Corepack is deliberately preferred because it is Node's package-manager
+    // authority. Some supported CLI hosts intentionally provide only Bun;
+    // boot the *same pinned pnpm* through Bun rather than switching lockfile
+    // authorities or requiring a machine-global install.
+    if (!isCommandUnavailable(error)) throw error;
+  }
+
+  deps.execFileSyncImpl(deps.bunRuntimePath, ["x", "--bun", ...pnpmArgs], {
+    cwd: projectDir,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  return { executor: "bun-pnpm" };
+}
+
 function readProjectDependencyFiles(projectDir, deps) {
   const packagePath = resolve(projectDir, PACKAGE_FILE);
   const lockPath = resolve(projectDir, LOCK_FILE);
@@ -65,6 +92,7 @@ function restoreFile(path, previous, deps) {
 
 function dependencyIoDeps(overrides = {}) {
   return {
+    bunRuntimePath: overrides.bunRuntimePath ?? process.execPath,
     execFileSyncImpl: overrides.execFileSyncImpl ?? execFileSync,
     existsSyncImpl: overrides.existsSyncImpl ?? existsSync,
     readFileSyncImpl: overrides.readFileSyncImpl ?? readFileSync,
@@ -77,17 +105,13 @@ function dependencyIoDeps(overrides = {}) {
 export function installAndVerifyProjectDependencies(projectDir, overrides = {}) {
   const deps = dependencyIoDeps(overrides);
   try {
-    deps.execFileSyncImpl(
-      corepackCommand(deps.platform),
-      [approvedPnpmSelector(), "install", "--ignore-workspace"],
-      {
-        cwd: projectDir,
-        stdio: ["ignore", "pipe", "pipe"],
-      },
-    );
-  } catch {
+    installProjectDependencies(projectDir, deps);
+  } catch (cause) {
     const error = new Error("CLI_INIT_DEPENDENCY_INSTALL_FAILED");
     error.code = "CLI_INIT_DEPENDENCY_INSTALL_FAILED";
+    error.reason = isCommandUnavailable(cause)
+      ? "APPROVED_PNPM_EXECUTOR_UNAVAILABLE"
+      : "APPROVED_PNPM_INSTALL_FAILED";
     throw error;
   }
   return assertDeployValidLock(projectDir, deps, "CLI_INIT_LOCK_POSTCONDITION_FAILED");

package/lib/release-client.mjs

@@ -24,6 +24,7 @@ const PUBLIC_RELEASE_ERROR_CODES = new Set([
   "APP_RELEASE_ENVIRONMENT_INVALID",
   "APP_RELEASE_ENVIRONMENT_MISMATCH",
   "APP_RELEASE_ENV_KEYS_MISSING",
+  "APP_RELEASE_FINALIZATION_PENDING",
   "APP_RELEASE_IDEMPOTENCY_CONFLICT",
   "APP_RELEASE_METADATA_INVALID",
   "APP_RELEASE_POLICY_READ_UNAVAILABLE",
@@ -113,7 +114,8 @@ export async function prepareReleaseAttempt({
   capabilityTimeoutSetTimeoutImpl = setTimeout,
   capabilityTimeoutClearTimeoutImpl = clearTimeout,
 }) {
-  const capabilityRequest = (signal) => releaseCapability({ creds, appId, environment, platformFetchImpl, signal });
+  const capabilityRequest = (signal) =>
+    releaseCapability({ creds, appId, environment, platformFetchImpl, signal });
   let capability;
   if (Number.isFinite(capabilityTimeoutMs) && capabilityTimeoutMs > 0) {
     let timeout;
@@ -122,13 +124,10 @@ export async function prepareReleaseAttempt({
       capability = await Promise.race([
         capabilityRequest(controller.signal),
         new Promise((_, reject) => {
-          timeout = capabilityTimeoutSetTimeoutImpl(
-            () => {
-              controller.abort();
-              reject(new Error("APP_RELEASE_CAPABILITY_TIMEOUT"));
-            },
-            capabilityTimeoutMs,
-          );
+          timeout = capabilityTimeoutSetTimeoutImpl(() => {
+            controller.abort();
+            reject(new Error("APP_RELEASE_CAPABILITY_TIMEOUT"));
+          }, capabilityTimeoutMs);
           timeout?.unref?.();
         }),
       ]);

package/lib/static-deploy-command.mjs

@@ -20,6 +20,11 @@ import { getCliInvocationSelection } from "./project-context.mjs";
 import { pollAcceptedDeploymentOperation } from "./deployment-operation-poll.mjs";
 import { writeProjectMetadata } from "./deploy-project-metadata.mjs";
 
+function shouldPreserveFinalizeAttempt(error) {
+  return error?.retryable === true ||
+    error?.message === "APP_SERVING_ROUTE_COMMIT_PENDING";
+}
+
 export function resolveStaticDeployDir({
   staticDirArg,
   cwd = process.cwd(),
@@ -447,7 +452,9 @@ export function createStaticDeployRuntime({
           platformFetchImpl,
         });
       } catch (caught) {
-        await markAttemptFailed("finalize", "APP_RELEASE_FINALIZE_FAILED");
+        if (!shouldPreserveFinalizeAttempt(caught)) {
+          await markAttemptFailed("finalize", "APP_RELEASE_FINALIZE_FAILED");
+        }
         throw caught;
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.216",
+  "version": "0.1.218",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -33,8 +33,8 @@
   "devDependencies": {
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
-    "@gencow/core": "0.1.43",
     "@gencow/client": "0.2.7",
+    "@gencow/core": "0.1.43",
     "@gencow/react": "0.2.7"
   },
   "scripts": {