gencow 0.1.253 → 0.1.254

package/core/index.js

@@ -446,90 +446,6 @@ function isWakeAppDeferredResult(result) {
   return !result.ok && (result.status === "capacity_rejected" || result.status === "queue_timeout" || result.status === "convergence_pending");
 }
 
-// ../core/src/platform-capacity-profile.ts
-var PLATFORM_CAPACITY_PROFILE_ENV = "GENCOW_CAPACITY_PROFILE";
-var PLATFORM_CAPACITY_ENV_KEYS = [
-  PLATFORM_CAPACITY_PROFILE_ENV,
-  "MAX_CONCURRENT_RUNNING",
-  "MAX_CONCURRENT_WAKE",
-  "MAX_WAKE_QUEUE_MS",
-  "MIN_AVAILABLE_RAM_MB",
-  "WAKE_RETRY_AFTER_SEC",
-  "EVICTION_THRESHOLD_MB",
-  "GENCOW_SLEEP_TIMEOUT_MINUTES",
-  "GENCOW_SLEEP_MAX_PER_CYCLE",
-  "WARM_POOL_MIN_IDLE",
-  "WARM_POOL_MAX",
-  "DEPLOY_CANDIDATE_RESERVE",
-  "GENCOW_APP_PORT_RANGE",
-  "COWBOX_WARM_POOL_PORT_RANGE"
-];
-var PLATFORM_CAPACITY_PRESETS = Object.freeze({
-  prod: Object.freeze({
-    profile: "prod",
-    maxConcurrentRunning: 600,
-    maxConcurrentWake: 20,
-    maxWakeQueueMs: 5e3,
-    minAvailableRamMB: 8192,
-    evictionThresholdMB: 16384,
-    sleepTimeoutMinutes: 15,
-    sleepMaxPerCycle: 50,
-    warmPoolMinIdle: 10,
-    warmPoolMax: 650,
-    deployCandidateReserve: 40
-  }),
-  dev: Object.freeze({
-    profile: "dev",
-    maxConcurrentRunning: 60,
-    maxConcurrentWake: 5,
-    maxWakeQueueMs: 3e3,
-    minAvailableRamMB: 2048,
-    evictionThresholdMB: 4096,
-    sleepTimeoutMinutes: 10,
-    sleepMaxPerCycle: 20,
-    warmPoolMinIdle: 3,
-    warmPoolMax: 70,
-    deployCandidateReserve: 5
-  }),
-  local: Object.freeze({
-    profile: "local",
-    maxConcurrentRunning: null,
-    maxConcurrentWake: null,
-    maxWakeQueueMs: 5e3,
-    minAvailableRamMB: null,
-    evictionThresholdMB: null,
-    sleepTimeoutMinutes: 30,
-    sleepMaxPerCycle: 10,
-    warmPoolMinIdle: 3,
-    warmPoolMax: 10,
-    deployCandidateReserve: 0
-  })
-});
-function normalizeDomain(value) {
-  return (value || "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
-}
-function detectPlatformCapacityProfile(env = process.env) {
-  const explicit = env[PLATFORM_CAPACITY_PROFILE_ENV]?.trim().toLowerCase();
-  if (explicit) {
-    if (["prod", "production", "128gb"].includes(explicit)) return "prod";
-    if (["dev", "development", "16gb"].includes(explicit)) return "dev";
-    if (["local", "test", "disabled"].includes(explicit)) return "local";
-    throw new Error(`Invalid ${PLATFORM_CAPACITY_PROFILE_ENV}: ${explicit}. Expected prod, dev, or local.`);
-  }
-  const baseDomain = normalizeDomain(env.BASE_DOMAIN);
-  if (baseDomain === "gencow.dev") return "dev";
-  if (baseDomain === "gencow.app") return "prod";
-  const platformUrl = normalizeDomain(env.GENCOW_PLATFORM_URL);
-  if (platformUrl === "gencow.dev") return "dev";
-  if (platformUrl === "gencow.app") return "prod";
-  if (env.NODE_ENV === "production" && env.IS_PLATFORM === "true") return "prod";
-  return "local";
-}
-function resolvePlatformCapacityPreset(env = process.env) {
-  const profile = detectPlatformCapacityProfile(env);
-  return { ...PLATFORM_CAPACITY_PRESETS[profile] };
-}
-
 // ../core/src/grounded-answer-types.ts
 var DEFAULT_GROUNDING_BUDGET = {
   maxVerifyLoops: 2,
@@ -6189,9 +6105,6 @@ export {
   GencowValidationError,
   JobAdmissionError,
   MAX_FILE_SIZE,
-  PLATFORM_CAPACITY_ENV_KEYS,
-  PLATFORM_CAPACITY_PRESETS,
-  PLATFORM_CAPACITY_PROFILE_ENV,
   RLS_SESSION_KEY_RE,
   RealtimeChannelEventValidationError,
   STORAGE_LIST_DEFAULT_LIMIT,
@@ -6251,7 +6164,6 @@ export {
   defineRealtimeSubscriptions,
   deriveWorkflowStatus,
   deserializeWorkflowValue,
-  detectPlatformCapacityProfile,
   eqRlsContextColumn,
   filterTenantRuntimeEnvVars,
   formatBytes,
@@ -6305,7 +6217,6 @@ export {
   resetRealtimeChannelRegistryForTests,
   resetRealtimeSubscriptionRegistryForTests,
   resolveExplicitRealtimeChannelKey,
-  resolvePlatformCapacityPreset,
   resolveRealtimeChannelKey,
   resolveRealtimeQueryScopeHash,
   resolveRealtimeQuerySubscriptionKey,

package/lib/app-command.mjs

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { resolve } from "path";
+import { basename, resolve } from "path";
 import {
   fetchAppDiagnosticLogsViaRpc,
   formatAppDiagnosticLogBlock,
@@ -22,6 +22,7 @@ import { resolveProjectMetadataPath, resolveProjectSelection } from "./project-c
 import { updateEnvLocalUrl } from "./cli-project-runtime.mjs";
 
 const DEFAULT_APP_CREATE_TIMEOUT_MS = 60_000;
+const SAFE_CLI_OPTION_PATTERN = /^--?[A-Za-z][A-Za-z0-9-]{0,40}$/u;
 
 function resolveAppCreateTimeoutMs(value) {
   const parsed = Number(value);
@@ -38,6 +39,11 @@ function invalidAppResponse(operation, response, kind) {
   return `CLI_APP_RESPONSE_INVALID: ${operation} returned an invalid ${kind} response (${appResponseStatus(response)})`;
 }
 
+function isTerminalAppDeleteResponse(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  return body.retryable === false || body.retryClass === "terminal-client";
+}
+
 export function formatAppDeployedAgo(dateStr, now = Date.now()) {
   if (!dateStr) return `${DIM}never${RESET}`;
   const diff = now - new Date(dateStr).getTime();
@@ -316,9 +322,17 @@ export function createAppCommand({
     }
 
     if (subcmd === "create") {
-      const name = rest[0];
+      const unsupportedOption = rest.find((value) => value.startsWith("-"));
+      const name = rest.find((value) => !value.startsWith("-"));
+      if (unsupportedOption !== undefined) {
+        const optionLabel = SAFE_CLI_OPTION_PATTERN.test(unsupportedOption) ? `${unsupportedOption} ` : "";
+        errorImpl(
+          `Unknown option for app create: ${optionLabel}is not supported. The app name is the only argument.\nCode: APP_CREATE_USAGE_INVALID\nUsage: gencow app create <name>`,
+        );
+        return 1;
+      }
       if (!name) {
-        errorImpl("Usage: gencow app create <name>");
+        errorImpl("Usage: gencow app create <name>\nCode: APP_CREATE_USAGE_INVALID");
         return 1;
       }
 
@@ -384,13 +398,15 @@ export function createAppCommand({
         successImpl(`${config.rootDir}/index.ts — created (starter)`);
       }
 
-      const configPath = projectSelection.configPath ?? resolve(projectDir, "gencow.config.ts");
-      if (existsSync(configPath)) {
+      // The same resolved config file is used for the write and for the message, so the
+      // reported name always matches the file that was actually changed.
+      const configPath = projectSelection.configPath ?? null;
+      if (configPath && existsSync(configPath)) {
         const src = readFileSync(configPath, "utf8");
         const nextSrc = addDeployAppToConfigSource(src, appId);
         if (nextSrc !== src) {
           writeFileSync(configPath, nextSrc);
-          successImpl(`gencow.config.ts — added deploy.app = "${appId}"`);
+          successImpl(`${basename(configPath)} — added deploy.app = "${appId}"`);
         }
       }
 
@@ -400,8 +416,11 @@ export function createAppCommand({
   ${GREEN}▸${RESET} App ID:    ${appId}
   ${GREEN}▸${RESET} API:       ${appUrl}
 ${dashboardLine}
-  ${GREEN}▸${RESET} .env: VITE_API_URL set
-
+  ${GREEN}▸${RESET} .env: VITE_API_URL set (dev app)
+  ${GREEN}▸${RESET} Prod app: not created yet. Your first ${GREEN}gencow deploy --prod${RESET} creates it.
+`);
+      logImpl(`
+  ${DIM}gencow deploy --prod   — create the prod app and deploy to it${RESET}
   ${DIM}pnpm gencow dev   — watch & auto-deploy to cloud + live logs${RESET}
 `);
       return 0;
@@ -448,6 +467,12 @@ ${dashboardLine}
             delRes,
             { expectedAppId: name },
           );
+        // A typed terminal failure (for example APP_NOT_FOUND) is not retryable, whatever its HTTP
+        // status. Telling the user to replay the same request contradicts the server classification.
+        if (isTerminalAppDeleteResponse(delData)) {
+          errorImpl(`${diagnosis}\nNext command: gencow app list`);
+          return 1;
+        }
         errorImpl(delRes.ok || delRes.status >= 500
           ? `${diagnosis}\nRequest ID: ${requestId}. Retry the same request: ${retryCommand}`
           : diagnosis);

package/lib/cli-command-runner.mjs

@@ -1,6 +1,8 @@
 import { formatProcedureRpcDiagnostic } from "./procedure-rpc-diagnostic.mjs";
 
 const SAFE_CORRELATION_ID = /^[A-Za-z0-9_-]{8,128}$/u;
+// A project-relative directory that can be pasted into a shell command as-is.
+const SAFE_DISPLAY_DIR = /^(?![/\\])(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]{1,240}$/u;
 const SAFE_PLATFORM_ERROR_DETAILS = new Map([
   ["ACCOUNT_DELETED", "This account has been deleted."],
   ["ACCOUNT_DELETION_PENDING", "This account is pending deletion."],
@@ -47,8 +49,62 @@ const SAFE_LOCAL_ERROR_CODES = new Map([
       pathLabel: "Conflicting source",
     },
   ],
+  [
+    "CODEGEN_SOURCE_SYNTAX_ERROR",
+    {
+      message: "Deploy stopped before upload: a backend source file has a syntax error.",
+      stage: "codegen",
+      action:
+        "Retryable: yes, after the source at the location above is fixed — run `npx gencow@latest codegen` to confirm it passes, then rerun your deploy command (for example `npx gencow@latest deploy --prod`).",
+      locationLabel: "Source location",
+    },
+  ],
+  [
+    "CODEGEN_SOURCE_LOAD_FAILED",
+    {
+      message: "Deploy stopped before upload: a backend source file throws while it is loaded.",
+      stage: "codegen",
+      action:
+        "Retryable: yes, after the top-level code that throws during module load is fixed — run `npx gencow@latest codegen` to confirm it passes, then rerun your deploy command. The throw location is not available; check the backend files that run code at import time.",
+    },
+  ],
+  [
+    "CODEGEN_GENERATION_FAILED",
+    {
+      message: "Deploy stopped before upload: backend code generation failed.",
+      stage: "codegen",
+      action:
+        "Retryable: no, until `npx gencow@latest codegen` passes locally — run it, fix what it reports, then rerun your deploy command.",
+    },
+  ],
+  [
+    "STATIC_ARTIFACT_INDEX_MISSING",
+    {
+      message: "Static deploy stopped before upload: the build output has no index.html at its root.",
+      stage: "artifact",
+      action: (caught) => {
+        const dir = safeDisplayDir(caught);
+        const target = dir ?? "<build-output-dir>";
+        return `Retryable: yes, after the build writes index.html into ${target} — run \`ls ${target}/index.html\` to confirm, then rerun \`gencow static ${target}\`.`;
+      },
+    },
+  ],
 ]);
 
+function safeDisplayDir(caught) {
+  const { displayDir } = caught;
+  return typeof displayDir === "string" && SAFE_DISPLAY_DIR.test(displayDir) ? displayDir : null;
+}
+const SAFE_SOURCE_LOCATION_PATH = /^(?![/\\])(?!.*(?:^|\/)\.\.(?:\/|$))[^\u0000-\u001f\u007f]{1,240}$/u;
+
+function safeSourceLocation(caught) {
+  const { sourceFile, line, column } = caught;
+  if (typeof sourceFile !== "string" || !SAFE_SOURCE_LOCATION_PATH.test(sourceFile)) return null;
+  if (!Number.isInteger(line) || line < 1) return null;
+  if (column !== undefined && (!Number.isInteger(column) || column < 1)) return null;
+  return `${sourceFile}:${line}${column === undefined ? "" : `:${column}`}`;
+}
+
 function safePlatformOrigin(value) {
   try {
     const url = new URL(value);
@@ -58,6 +114,10 @@ function safePlatformOrigin(value) {
   }
 }
 
+export function formatCommandError(caught) {
+  return commandErrorMessage(caught);
+}
+
 function commandErrorMessage(caught) {
   const procedureDiagnostic = formatProcedureRpcDiagnostic(caught);
   if (procedureDiagnostic) return procedureDiagnostic;
@@ -67,10 +127,12 @@ function commandErrorMessage(caught) {
       localDiagnostic.message,
       `Code: ${caught.code}`,
       `Stage: ${localDiagnostic.stage}`,
-      "Database mutation: NONE",
-      "Incumbent serving: PRESERVED",
-      localDiagnostic.action,
     ];
+    const location = safeSourceLocation(caught);
+    if (location) lines.push(`${localDiagnostic.locationLabel ?? "Source location"}: ${location}`);
+    const action =
+      typeof localDiagnostic.action === "function" ? localDiagnostic.action(caught) : localDiagnostic.action;
+    lines.push("Database mutation: NONE", "Incumbent serving: PRESERVED", action);
     const diagnosticPaths = Array.isArray(caught.missingPaths)
       ? caught.missingPaths
       : Array.isArray(caught.conflictingPaths)

package/lib/cli-project-runtime.mjs

@@ -262,7 +262,7 @@ async function loadJsConfig(absPath, mtimeMs) {
 
 export async function loadConfigModuleForRuntime(options = {}) {
   const {
-    importSourceConfigImpl = () => import("../../internal/src/config/index.ts"),
+    importSourceConfigImpl = () => import("../../shared/src/config/index.ts"),
     importRuntimeConfigImpl = () => import("../runtime/config.mjs"),
   } = options;
   if (hasWorkspaceConfigSourceRuntime(options)) {

package/lib/confirm-gate.mjs

@@ -0,0 +1,101 @@
+// Shared confirmation gate for CLI commands that require an explicit yes before
+// a production mutation. It decides whether to skip, prompt, or fail fast with a
+// typed diagnostic, so a non-interactive run never waits on a prompt forever.
+
+export const CONFIRMATION_REQUIRED_NON_INTERACTIVE = "CONFIRMATION_REQUIRED_NON_INTERACTIVE";
+
+export const CONFIRMATION_MODE = Object.freeze({
+  BYPASS: "BYPASS",
+  NON_INTERACTIVE: "NON_INTERACTIVE",
+  PROMPT: "PROMPT",
+});
+
+// Order matters: explicit --yes/-y passes first, then (only where a command opts in)
+// CI=true passes, then a non-TTY stdin fails fast, and only an interactive terminal
+// gets the existing prompt. CI=true is never an approval for a production DB change, so
+// db:push leaves allowCiBypass false. Only deploy's first prod create opts in.
+// An injected createInterface stands in for the terminal prompt channel.
+export function resolveConfirmationMode({
+  args = [],
+  processEnv = process.env,
+  createInterfaceImpl,
+  allowCiBypass = false,
+} = {}) {
+  if (args.includes("--yes") || args.includes("-y") || (allowCiBypass && processEnv.CI === "true")) {
+    return CONFIRMATION_MODE.BYPASS;
+  }
+  const interactive = createInterfaceImpl ? true : Boolean(process.stdin.isTTY);
+  return interactive ? CONFIRMATION_MODE.PROMPT : CONFIRMATION_MODE.NON_INTERACTIVE;
+}
+
+// Resolves to the raw answer string, or null when input ended before any answer
+// (EOF or readline close). Null must never be treated as a silent wait.
+export function askConfirmation({ createInterface, prompt, output }) {
+  return new Promise((resolveAnswer) => {
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      resolveAnswer(value);
+    };
+    const rl = createInterface({ input: process.stdin, output });
+    rl.on?.("close", () => settle(null));
+    rl.question(prompt, (answer) => {
+      settle(answer);
+      rl.close();
+    });
+  });
+}
+
+export function buildConfirmationRequiredDiagnostic({
+  correlationId,
+  inputEnded = false,
+  retryCommand,
+  subject,
+}) {
+  const reasonDetail = inputEnded
+    ? "Input ended before an answer was given, so nothing was confirmed."
+    : "stdin is not a terminal, so the confirmation prompt was not shown.";
+  return {
+    diagnosticVersion: 1,
+    code: CONFIRMATION_REQUIRED_NON_INTERACTIVE,
+    failureClass: "USER_FIXABLE",
+    phase: "CONFIRM",
+    databaseState: "UNCHANGED",
+    currentServingState: "UNCHANGED",
+    safeToRetryNow: false,
+    retryPolicy: "AFTER_FIX",
+    retryCondition:
+      "Run the same command again with --yes in a non-interactive shell, or answer the prompt in an interactive terminal.",
+    correlationId,
+    reason: {
+      code: "confirmation_required_non_interactive",
+      summary: subject,
+      detail: reasonDetail,
+    },
+    nextAction: { kind: "RETRY", command: retryCommand },
+    redaction: { serverReturnedRawSql: false, localExcerpt: "NONE" },
+  };
+}
+
+export function renderConfirmationRequiredLines(diagnostic) {
+  return {
+    headline: diagnostic.reason.summary,
+    lines: [
+      `Reason: ${diagnostic.reason.detail}`,
+      `Code: ${diagnostic.code}`,
+      `Phase: ${diagnostic.phase}`,
+      `Database state: ${diagnostic.databaseState}`,
+      `Current serving state: ${diagnostic.currentServingState}`,
+      `Retry condition: ${diagnostic.retryCondition}`,
+      `Next action: ${diagnostic.nextAction.command}`,
+      `Correlation ID: ${diagnostic.correlationId}`,
+    ],
+  };
+}
+
+export function renderConfirmationRequired(diagnostic, { errorImpl, logImpl }) {
+  const { headline, lines } = renderConfirmationRequiredLines(diagnostic);
+  errorImpl(headline);
+  lines.forEach((line) => logImpl(line));
+}

package/lib/db-command.mjs

@@ -103,6 +103,9 @@ function renderDbPushHelp(logImpl = log) {
   logImpl(`  ${BOLD}Usage:${RESET}  gencow db:push [options]\n`);
   logImpl(`  ${BOLD}Options:${RESET}`);
   logImpl(`    ${DIM}--prod${RESET}       Push to production DB (confirmation required)`);
+  logImpl(
+    `    ${DIM}--yes, -y${RESET}    Confirm --prod non-interactively (required when stdin is not a TTY; CI=true does not confirm)`,
+  );
   logImpl(`    ${DIM}--local${RESET}      Push to local dev DB`);
   logImpl(`    ${DIM}--app, -a${RESET}    Target specific app`);
   logImpl(`    ${DIM}--existing-bundle${RESET}  Push committed migrations without running a generator`);

package/lib/db-migration-command-steps.mjs

@@ -3,9 +3,14 @@ import {
   buildLocalExecutionFailureDiagnostic,
 } from "./migration-client-diagnostic.mjs";
 import { resolveBackendEnvFile } from "./backend-env-resolver.mjs";
-import { buildMigrationNoResponseDiagnostic } from "./migration-diagnostic.mjs";
+import {
+  buildMigrationNoResponseDiagnostic,
+  buildMigrationReceiptEnvironmentMismatchDiagnostic,
+  buildMigrationStatusUnsupportedResponseDiagnostic,
+} from "./migration-diagnostic.mjs";
 import { buildMigrationStatusCommand, fetchMigrationOperationStatus } from "./migration-operation-client.mjs";
 import { BOLD, CYAN, DIM, RED, RESET } from "./output.mjs";
+import { askConfirmation } from "./confirm-gate.mjs";
 import { emitMigrationAdvisories, extractMigrationAdvisories } from "./migration-advisory.mjs";
 
 const NO_CHANGE_MARKERS = ["No schema changes", "nothing to migrate", "No changes detected"];
@@ -15,18 +20,20 @@ export function isNoChangeGenerationError(error) {
   return NO_CHANGE_MARKERS.some((marker) => message.includes(marker));
 }
 
+// Resolves to true (typed "yes"), false (any other answer), or null when input
+// ended before an answer. Callers must treat null as a non-cancel failure.
 export async function promptDbPushConfirm(appId, createInterfaceImpl, plain = false) {
   const createInterface = createInterfaceImpl ?? (await import("readline")).createInterface;
-  const rl = createInterface({ input: process.stdin, output: plain ? process.stderr : process.stdout });
-  return await new Promise((resolveAnswer) => {
-    const prompt = plain
-      ? `\nPush schema to PRODUCTION database (${appId})?\nType "yes" to confirm: `
-      : `\n  ${RED}!${RESET} Push schema to ${BOLD}PRODUCTION${RESET} database (${appId})?\n  Type "yes" to confirm: `;
-    rl.question(prompt, (answer) => {
-      rl.close();
-      resolveAnswer(answer.trim().toLowerCase() === "yes");
-    });
+  const prompt = plain
+    ? `\nPush schema to PRODUCTION database (${appId})?\nType "yes" to confirm: `
+    : `\n  ${RED}!${RESET} Push schema to ${BOLD}PRODUCTION${RESET} database (${appId})?\n  Type "yes" to confirm: `;
+  const answer = await askConfirmation({
+    createInterface,
+    prompt,
+    output: plain ? process.stderr : process.stdout,
   });
+  if (answer === null) return null;
+  return answer.trim().toLowerCase() === "yes";
 }
 
 export function handleLocalMigrationCommand({
@@ -114,10 +121,36 @@ export async function handleMigrationStatus({
     receiptId,
     cliVersion: deps.cliVersion,
   });
-  if (!status) {
+  if (status.kind === "unreachable") {
     emitFailure(buildMigrationNoResponseDiagnostic(correlationId(), { receiptId, statusCommand }));
     return;
   }
+  if (status.kind === "server_diagnostic") {
+    // The server answered with a typed diagnostic: render it as-is, never replace it with NOT_RECEIVED.
+    emitFailure({ ...status.diagnostic, receiptId });
+    return;
+  }
+  if (status.kind === "unsupported") {
+    emitFailure(buildMigrationStatusUnsupportedResponseDiagnostic(correlationId(), { receiptId, statusCommand }));
+    return;
+  }
+  if (status.kind === "environment_mismatch") {
+    // The receipt's own environment is authoritative; the command is rebuilt from it, not from this call's flags.
+    emitFailure(
+      buildMigrationReceiptEnvironmentMismatchDiagnostic(correlationId(), {
+        receiptId,
+        receiptEnvironment: status.receipt.environment,
+        requestedEnvironment: environment,
+        statusCommand: buildMigrationStatusCommand({
+          appId,
+          environment: status.receipt.environment,
+          receiptId,
+          jsonMode,
+        }),
+      }),
+    );
+    return;
+  }
   if (status.kind === "blocked") {
     emitFailure({ ...status.diagnostic, receiptId: status.receipt.receiptId });
     return;

package/lib/db-push-command.mjs

@@ -10,6 +10,7 @@ import {
 } from "./drizzle-generate.mjs";
 import {
   buildMigrationNoResponseDiagnostic,
+  buildMigrationCheckInvalidResponseDiagnostic,
   buildMigrationCheckNoResponseDiagnostic,
   buildMigrationCheckUnsupportedResponseDiagnostic,
   buildMigrationUnsupportedResponseDiagnostic,
@@ -43,6 +44,12 @@ import {
   promptDbPushConfirm,
 } from "./db-migration-command-steps.mjs";
 import { resolveConfiguredSchemaPaths, resolveDrizzleSchemaPaths } from "./cli-schema-paths.mjs";
+import {
+  CONFIRMATION_MODE,
+  buildConfirmationRequiredDiagnostic,
+  renderConfirmationRequired,
+  resolveConfirmationMode,
+} from "./confirm-gate.mjs";
 import { emitMigrationResponsibilityNotice } from "./migration-advisory.mjs";
 import { readProjectMetadata } from "./project-context.mjs";
 
@@ -258,24 +265,44 @@ function createDbMigrationCommand(deps, command) {
         emitMigrationResponsibilityNotice(deps.warnImpl);
       }
 
-      if (
-        !isCheck &&
-        !statusReceiptId &&
-        isProd &&
-        !(await promptDbPushConfirm(appId, deps.createInterfaceImpl, jsonMode))
-      ) {
-        if (jsonMode) {
-          emitJson({
-            diagnosticVersion: 1,
-            ok: false,
-            command: "db:push",
-            code: "USER_CANCELLED",
-            databaseState: "UNCHANGED",
+      if (!isCheck && !statusReceiptId && isProd) {
+        const confirmMode = resolveConfirmationMode({
+          args,
+          createInterfaceImpl: deps.createInterfaceImpl,
+        });
+        const confirmed =
+          confirmMode === CONFIRMATION_MODE.BYPASS
+            ? true
+            : confirmMode === CONFIRMATION_MODE.PROMPT
+              ? await promptDbPushConfirm(appId, deps.createInterfaceImpl, jsonMode)
+              : null;
+        if (confirmed !== true) {
+          // Cancellation and unconfirmed exits both end non-zero; the JSON shape is unchanged.
+          failureEmitted = true;
+          if (confirmed === false) {
+            if (jsonMode) {
+              emitJson({
+                diagnosticVersion: 1,
+                ok: false,
+                command: "db:push",
+                code: "USER_CANCELLED",
+                databaseState: "UNCHANGED",
+              });
+            } else {
+              deps.warnImpl("Cancelled.");
+            }
+            return;
+          }
+          const diagnostic = buildConfirmationRequiredDiagnostic({
+            correlationId: clientCorrelationId(),
+            inputEnded: confirmMode === CONFIRMATION_MODE.PROMPT,
+            retryCommand: `${buildDbPushRetryCommand({ appId, args, isProd, jsonMode: false })} --yes`,
+            subject: `Production schema push to ${appId} needs explicit confirmation.`,
           });
-        } else {
-          deps.warnImpl("Cancelled.");
+          if (jsonMode) emitJson(diagnostic);
+          else renderConfirmationRequired(diagnostic, deps);
+          return;
         }
-        return;
       }
 
       let creds;
@@ -519,20 +546,33 @@ function createDbMigrationCommand(deps, command) {
             cliVersion: deps.cliVersion,
           });
           remoteRequestStarted = false;
-          if (status?.kind === "applied") {
+          if (status.kind === "applied") {
             recoveredSuccess = { migration: status.migration, receipt: status.receipt };
-          } else if (status?.kind === "blocked") {
+          } else if (status.kind === "blocked") {
             emitFailure({ ...status.diagnostic, receiptId: status.receipt.receiptId });
             return;
           } else {
+            // The push outcome is still unproven, so the recovery state stays; a typed status answer is kept visible.
             emitFailure(
-              buildMigrationNoResponseDiagnostic(clientCorrelationId(), { receiptId, statusCommand }),
+              buildMigrationNoResponseDiagnostic(clientCorrelationId(), {
+                receiptId,
+                statusCommand,
+                statusLookup:
+                  status.kind === "server_diagnostic"
+                    ? { code: status.diagnostic.code, correlationId: status.diagnostic.correlationId }
+                    : undefined,
+              }),
             );
             return;
           }
         }
 
         const data = recoveredSuccess ? null : await res.json().catch(() => ({}));
+        const hasJsonObjectBody = data !== null && typeof data === "object" && !Array.isArray(data);
+        if (isCheck && !recoveredSuccess && !hasJsonObjectBody) {
+          emitFailure(buildMigrationCheckInvalidResponseDiagnostic(clientCorrelationId(), retryCommand));
+          return;
+        }
         if (!recoveredSuccess && !res.ok) {
           const diagnostic = isActionableMigrationDiagnostic(data)
             ? enrichMigrationDiagnostic(
@@ -546,12 +586,12 @@ function createDbMigrationCommand(deps, command) {
               )
             : isCheck
               ? buildMigrationCheckUnsupportedResponseDiagnostic(
-                  typeof data.correlationId === "string" && data.correlationId.length <= 200
+                  typeof data?.correlationId === "string" && data.correlationId.length <= 200
                     ? data.correlationId
                     : clientCorrelationId(),
                 )
               : buildMigrationUnsupportedResponseDiagnostic(
-                  typeof data.correlationId === "string" && data.correlationId.length <= 200
+                  typeof data?.correlationId === "string" && data.correlationId.length <= 200
                     ? data.correlationId
                     : clientCorrelationId(),
                   { receiptId, statusCommand },