deepspace 0.26.3 → 0.27.0

package/CHANGELOG.md

@@ -1,6 +1,10 @@
 # deepspace
 
-## 0.26.3
+## 0.27.0
+
+### Minor Changes
+
+- Every confirmed finding from the v0.26.0 three-lane AX pass is fixed. First-use healing: an INTERRUPTED dependency install no longer reads as ready (npm writes `node_modules/deepspace/package.json` long before it links `.bin`; readiness now also requires no started-without-done sentinel evidence, so a killed install retries on the next command instead of failing later as `vitest: not found`). A committed `__APP_ID__` placeholder now refuses with its own diagnosis (`placeholder_committed`, action `deepspace app init [--env <name>]`, scoped to the SECTION being targeted so a real top-level id with a committed staging placeholder heals the right thing) instead of "this does not look like a DeepSpace app" — the state every GitHub-lane scaffold enters by pushing itself to GitHub; the plain `app_not_initialized` refusal now ships the `app init` action too. GitHub-inferred apps: `pull`, `clone`, and `workspace new` on an intentionally-empty cloud repo now consult the release ledger (ledger evidence ONLY — a mirror remote on a never-released app is not evidence and does not refuse) and refuse `source_managed_by_github` naming the repository — previously all three prescribed `deepspace push`, the PERMANENT DeepSpace claim; `pull` and `workspace new` also no longer write the `space` remote or the checkout's git identity before refusing, and `status` stops inventing a cloud trunk for such checkouts (`trunk.state: "external"`, marked `inferred`). `deploy --json` carries the source evidence the human stream announces (`source: {provider, repository?, inferred?} | null`). Suggestions: `auth status` now suggests `status` (the shallowest exact match wins; requiring a globally unique leaf sent it to the fuzzy — and destructive — `logout`). Collaboration: a never-deployed app's `owner_jwt_missing` tells the collaborator the owner must deploy once first (not "redeploy" an app that never deployed); `undeploy` checks ownership before its consent gate (a collaborator is no longer told to re-run the most destructive verb with `--yes`); collaborators can READ `app collaborators list` (mutations stay owner-only; PENDING invites stay visible to the owner alone — unaccepted invitees' emails are not roster data); deploy tells a collaborator they are shipping someone else's app; the `not_app_owner` hint no longer presumes the reader is a current collaborator; `transfer offer --json` carries `onAcceptance` (the loss-of-all-access consequence only the human path printed); deleting a developer account now cascades to the test accounts they created (their user rows and signup attribution included). Secrets: `deepspace secrets set KEY --stdin` pipes a value without putting it on argv (the CLI's own rule, previously satisfiable only via `secrets upload`); an empty piped value refuses `empty_input` rather than silently storing "". Tests: `test run all` re-asserts the port between vitest and Playwright so a winding-down runtime server is never adopted (the cold-start phantom-404 race), and the default suite's skipped-specs correction prints on stderr where captures see it. First-use registration announces the ACCOUNT EMAIL, not "your account". `pull`'s unborn-checkout advice names `git reset --mixed` instead of steering into a divergent second root; the deploy-lock refusal says to judge liveness by start time, not pid (container zombies read as alive). Scaffolder: `create-deepspace` no longer registers at scaffold time — every app registers on first use, logged in or not, so a spare `npm create` no longer burns a quota slot (`--no-register` is a deprecated no-op — it asks for what now always happens, and refusing it would exit-1 existing scripts); `--yes`/`-y` are accepted as no-ops instead of exiting 1; the template's toast viewport no longer swallows clicks under it (`pointer-events-none`); the template's `/api` 404 guard answers JSON on every method, not only GET; the template's collab spec skips itself (naming `test accounts create --password-stdin`) when the account pool is empty instead of failing a cold machine's first run.
 
 ### Patch Changes
 

package/README.md

@@ -118,11 +118,14 @@ The hierarchy shown by `deepspace --help` keeps durable app lifecycle under
 operations stay top-level. The historical `deepspace app migrate` command was
 removed in 0.15.0; it is not an upgrade or recovery path.
 
-Every app has one authoritative Git repository. DeepSpace source is the packaged
-default: the first normal deploy claims it and publishes automatically.
-`deepspace push` publishes the current branch and `deepspace clone <app>` checks
-it out; both configure a `space` remote and credential helper, so normal
-`git fetch space` and `git push space` work afterward.
+Every app has one authoritative Git repository, and which one it is follows
+from what you do rather than from anything you declare. DeepSpace source is the
+packaged default: on a checkout with no GitHub remote, the first
+`deepspace push` — or the source sync inside the first normal deploy — claims
+it and publishes automatically. `deepspace push` publishes the current branch
+and `deepspace clone <app>` checks it out; both configure a `space` remote and
+credential helper, so normal `git fetch space` and `git push space` work
+afterward.
 
 GitHub source is explicit and manual because the developer owns that repository: