deepspace 0.19.1 → 0.19.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # deepspace
 
+## 0.19.2
+
+### Patch Changes
+
+- Harden post-release upgrade and scaffold behavior: pin only real package
+  dependencies, expose PresenceRoom offline state, restrict fresh user rows to
+  their owners, wire feature roles and cron tasks correctly, and remove generated
+  build-preview secrets from deploy output while guiding existing Vite configs.
+
 ## 0.19.1
 
 ### Patch Changes

package/dist/cli.js

@@ -3869,7 +3869,7 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync14, lstatSync as lstatSync2, readFileSync as readFileSync17, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "fs";
 import { dirname as dirname7, join as join15, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
@@ -4409,6 +4409,16 @@ function findWorkerOwnedNotFoundBlockers(source, file) {
 
 // src/cli/commands/deploy/build.ts
 var RESERVED_RUN_WORKER_FIRST2 = new Set(RESERVED_RUN_WORKER_FIRST);
+function removeBuildDevVars(workerDir) {
+  const path = join15(workerDir, ".dev.vars");
+  if (!existsSync14(path)) return false;
+  const stat = lstatSync2(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`Refusing unsafe build secret path: ${path}`);
+  }
+  unlinkSync2(path);
+  return true;
+}
 function declaredCompatibilityDate(config) {
   const declared = config.compatibility_date;
   return typeof declared === "string" && /^\d{4}-\d{2}-\d{2}$/.test(declared) ? declared : null;
@@ -4465,6 +4475,11 @@ async function buildDeployBundle(options) {
     );
   }
   const workerDir = dirname7(outputWranglerPath);
+  try {
+    removeBuildDevVars(workerDir);
+  } catch (error) {
+    output.die(errorMessage(error), "build_output_unsafe");
+  }
   const workerBundlePath = join15(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
   if (!existsSync14(workerBundlePath)) {
@@ -7292,7 +7307,9 @@ function integrateCode(config, targetDir, emit) {
     if (insertion.import && !content.includes(insertion.import)) {
       const importIndex = content.search(/^import\s/m);
       content = `${content.slice(0, importIndex < 0 ? 0 : importIndex)}${insertion.import}
-${content.slice(importIndex < 0 ? 0 : importIndex)}`;
+${content.slice(
+        importIndex < 0 ? 0 : importIndex
+      )}`;
     }
     const currentMarkerIndex = content.indexOf(insertion.marker);
     const insertAt = insertion.placement === "before" ? currentMarkerIndex : currentMarkerIndex + insertion.marker.length;
@@ -7446,15 +7463,22 @@ ${css}`;
   return unresolved;
 }
 function unresolvedRoute(route, config, reason, emit) {
+  const roles = routeRolesSuffix(route);
   emit("");
   emit("   Add manually to src/nav.ts:");
-  emit(`     { path: '${route.path}', label: '${config.name}' },`);
+  emit(`     { path: '${route.path}', label: '${config.name}'${roles} },`);
   return {
     area: "nav",
     reason,
-    steps: [`Add { path: '${route.path}', label: '${config.name}' } to the exported nav array.`]
+    steps: [
+      `Add { path: '${route.path}', label: '${config.name}'${roles} } to the exported nav array.`
+    ]
   };
 }
+function routeRolesSuffix(route) {
+  const roles = route.roles?.length ? route.roles : route.protected === false ? [] : ["member"];
+  return roles.length ? `, roles: [${roles.map((role) => `'${role}' as Role`).join(", ")}]` : "";
+}
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
   const navPath = join17(targetDir, "src", "nav.ts");
@@ -7478,7 +7502,7 @@ function integrateRoute(config, targetDir, emit) {
       )
     ];
   }
-  const roles = config.route.protected === false ? "" : ", roles: ['member' as Role]";
+  const roles = routeRolesSuffix(config.route);
   const entry = `  { path: '${routePath}', label: '${config.name}'${roles} },`;
   content = content.replace(NAV_MARKER, `${NAV_MARKER}
 ${entry}`);
@@ -7674,7 +7698,7 @@ function installFeature(options) {
   );
   if (config.instructions?.length) {
     emit("");
-    emit("--- Manual wiring needed ---");
+    emit("--- Next steps ---");
     emit("");
     config.instructions.forEach((instruction, index) => {
       emit(`${index + 1}. ${instruction}`);
@@ -8017,6 +8041,7 @@ Create one with: deepspace app create <name>`,
     }
     if (!outcome.ok) {
       throw new Refusal(outcome.error, outcome.code, {
+        actionRequired: outcome.code === "manual_integration_required",
         ..."data" in outcome ? { extra: outcome.data } : {}
       });
     }
@@ -13603,7 +13628,7 @@ import { join as join23, resolve as resolve20 } from "path";
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.19.1",
+  version: "0.19.2",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -13755,6 +13780,8 @@ var package_default = {
 // src/cli/commands/update.ts
 var REGISTRY = "https://registry.npmjs.org/deepspace/latest";
 var DOCS_URL = "https://documentation.deep.space/cli-reference/commands";
+var BUILD_PREVIEW_SECRETS_GUIDE = "https://github.com/deepdotspace/deepspace-sdk/blob/main/docs/migrations/build-preview-secrets.md";
+var USERS_SCHEMA_VISIBILITY_GUIDE = "https://github.com/deepdotspace/deepspace-sdk/blob/main/docs/migrations/users-schema-member-visibility.md";
 var COMPATIBLE_AI_VERSION = package_default.dependencies.ai;
 var OLDEST_SUPPORTED_MINOR = 12;
 function parseVersion(raw) {
@@ -13780,18 +13807,45 @@ function readAppSdkVersion(appDir) {
 function pinSdkVersion(appDir, version) {
   const path = join23(appDir, "package.json");
   const source = readFileSync27(path, "utf8");
-  let updated = source.replace(
-    /("deepspace"\s*:\s*")[^"]+(")/,
-    (_match, head, tail) => `${head}^${version}${tail}`
-  );
-  updated = updated.replace(
-    /("ai"\s*:\s*")[^"]+(")/,
-    (_match, head, tail) => `${head}${COMPATIBLE_AI_VERSION}${tail}`
-  );
-  if (updated === source) return false;
-  writeFileSync8(path, updated);
+  const manifest = JSON.parse(source);
+  const dependencies = manifest.dependencies;
+  if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) return false;
+  let changed = false;
+  if (Object.prototype.hasOwnProperty.call(dependencies, "deepspace") && typeof dependencies.deepspace === "string" && dependencies.deepspace !== `^${version}`) {
+    dependencies.deepspace = `^${version}`;
+    changed = true;
+  }
+  if (Object.prototype.hasOwnProperty.call(dependencies, "ai") && typeof dependencies.ai === "string" && dependencies.ai !== COMPATIBLE_AI_VERSION) {
+    dependencies.ai = COMPATIBLE_AI_VERSION;
+    changed = true;
+  }
+  if (!changed) return false;
+  const eol = source.includes("\r\n") ? "\r\n" : "\n";
+  const indent = source.match(/\r?\n([\t ]+)"/)?.[1] ?? "  ";
+  const finalEol = source.endsWith("\n") ? eol : "";
+  writeFileSync8(path, JSON.stringify(manifest, null, indent).replaceAll("\n", eol) + finalEol);
   return true;
 }
+function buildPreviewSecretsUpgradeInstruction(appDir) {
+  const configName = [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vite.config.js",
+    "vite.config.mjs"
+  ].find((candidate) => existsSync25(join23(appDir, candidate)));
+  if (!configName) return null;
+  const source = readFileSync27(join23(appDir, configName), "utf8");
+  if (source.includes("deepspace-remove-build-preview-secrets")) return null;
+  return `${configName}: add the build-preview secret cleanup from ${BUILD_PREVIEW_SECRETS_GUIDE}; app update left this app-owned file unchanged.`;
+}
+function usersSchemaVisibilityUpgradeInstruction(appDir) {
+  const schemaName = "src/schemas/users-schema.ts";
+  const path = join23(appDir, schemaName);
+  if (!existsSync25(path)) return null;
+  const source = readFileSync27(path, "utf8");
+  if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
+  return `${schemaName}: review the member user-row visibility change at ${USERS_SCHEMA_VISIBILITY_GUIDE}; app update left this app-owned schema unchanged.`;
+}
 async function latestPublishedVersion() {
   const response = await fetch(REGISTRY, { signal: AbortSignal.timeout(15e3) }).catch(
     (error) => {
@@ -13881,27 +13935,36 @@ var update_default = defineDeepspaceCommand({
     }
     const dryRun = args["dry-run"] === true;
     const plan = planAppMigrations(appDir);
+    const previewSecretsInstruction = buildPreviewSecretsUpgradeInstruction(appDir);
+    const usersSchemaInstruction = usersSchemaVisibilityUpgradeInstruction(appDir);
+    const manualInstructions = [previewSecretsInstruction, usersSchemaInstruction].filter(
+      (instruction) => instruction !== null
+    );
     const pinned = dryRun ? false : pinSdkVersion(appDir, targetRaw);
     if (!dryRun && plan.edits.length) applyAppMigrationPlan(appDir, plan);
     if (!args.json) {
       p34.log.info(`deepspace ${currentRaw} \u2192 ${targetRaw}`);
       if (pinned) p34.log.success("package.json now asks for the current SDK");
+      for (const instruction of manualInstructions) p34.log.warn(instruction);
       if (!plan.pending.length && !plan.blockers.length) {
-        p34.log.success("No source changes required.");
+        p34.log.success("No automatic source changes required.");
       }
       reportPlan(plan, !dryRun);
     }
-    if (plan.blockers.length) {
+    if (plan.blockers.length || manualInstructions.length) {
+      const remaining = plan.blockers.length + manualInstructions.length;
       throw new Refusal(
-        `${plan.blockers.length} change(s) need a human or agent edit; each is listed above with its file, line, and the change required.`,
+        `${remaining} change(s) need a human or agent edit; follow the returned manual instructions and blockers.`,
         "manual_changes_required",
         {
+          ...pinned ? { action: cliAction("npm", "install") } : {},
           actionRequired: true,
           extra: {
             currentVersion: currentRaw,
             targetVersion: targetRaw,
             applied: plan.pending.map((migration) => migration.id),
-            blockers: plan.blockers
+            blockers: plan.blockers,
+            manualInstructions
           }
         }
       );
@@ -13912,6 +13975,7 @@ var update_default = defineDeepspaceCommand({
         targetVersion: targetRaw,
         pinned,
         dryRun,
+        manualInstructions,
         applied: plan.pending.map((migration) => ({
           id: migration.id,
           description: migration.description,