deepspace 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # deepspace
 
+## 0.19.0
+
+### Minor Changes
+
+- Block paid app checkout until the owner can accept charges and payouts; require
+  current app roles for direct job mutations and enabled production debug routes;
+  disconnect role-changed sockets; remove email/avatar data from ephemeral
+  presence; refresh ordered/limited live-query snapshots; and clean Yjs awareness
+  per subscribed document. Also retain the earlier claimable-ownership, room
+  identity, log-sanitization, generated-artifact, and first-run agent-DX fixes.
+
+  Existing beta apps must run `npx deepspace@latest app update` with this release
+  so the migration is run by the target CLI. It moves verified room identity from
+  URL parameters to internal headers and installs the stock job-role/debug-route
+  checks using the SDK's shared app-role lookup. Customized seams receive a
+  precise manual blocker; no legacy runtime compatibility branch is retained.
+
+  Generated apps also drop unused model-provider packages and the legacy
+  Documents editor migration. Record writes expose existing room readiness and
+  fail with a stable `not_ready` error before connection; Yjs rooms expose current
+  transport connectivity. Testing sign-in keeps safe server error codes,
+  workspace land returns the deterministic pull action when needed, and generated
+  Documents code is typechecked from the packed release artifact.
+
 ## 0.18.0
 
 ### Minor Changes

package/README.md

@@ -75,6 +75,12 @@ function Tasks() {
 }
 ```
 
+`useMutations(collection)` exposes the existing RecordRoom `ready` state.
+Writes attempted before it is true reject with `RecordRoomNotReadyError`
+(`code: "not_ready"`) instead of disappearing into a closed socket. For direct
+Yjs rooms, `connected` describes the current WebSocket and `synced` describes
+completion of the current connection's initial document sync.
+
 Worker — expose a `RecordRoom` Durable Object:
 
 ```ts
@@ -93,6 +99,16 @@ npx deepspace dev start  # run locally
 npx deepspace deploy     # deploy to *.app.space
 ```
 
+When updating an existing app, run the target CLI rather than the app's old
+installed binary:
+
+```bash
+npx deepspace@latest app update
+```
+
+The target CLI owns the source migrations required by the SDK version it
+installs. Review and commit its source changes before deploying.
+
 The hierarchy shown by `deepspace --help` keeps durable app lifecycle under
 `deepspace app`, while checkout-oriented Git, workspace, release, and deploy
 operations stay top-level. The historical `deepspace app migrate` command was
@@ -121,6 +137,11 @@ atomic authority change; switching back uses the same commands. Commands support
 [public manual](https://documentation.deep.space) for workspaces, releases, and
 rollback.
 
+In a container, give Git its own credentials before a private-repository
+verification. Forward an SSH agent, or configure an ephemeral Git credential
+helper in the container. Never embed a token in the remote URL: URLs can appear
+in process listings, logs, and copied configuration.
+
 Use the current command-specific release notes for supported upgrade steps. If
 an app or checkout still carries a name-shaped legacy id, stop and contact the
 DeepSpace operator; do not downgrade the SDK or run migration commands copied