deepspace 0.26.3 → 0.27.1

package/CHANGELOG.md

@@ -1,6 +1,21 @@
 # deepspace
 
-## 0.26.3
+## 0.27.1
+
+### Patch Changes
+
+- App-token failures during `dev`/`deploy` now carry their HTTP status and server code, and an app id the platform cannot resolve refuses loudly with `app_not_found` instead of silently writing `.dev.vars` without `APP_IDENTITY_TOKEN` — which made every platform call fail verification at runtime with nothing printed. Deploy's `--json` envelope distinguishes these failures too: a token/`.dev.vars` failure that is not an `ApiError` and not a refreshed-cache failure now reports its own `dev_vars_failed` code instead of riding `secrets_refresh_failed`.
+- Deploy no longer uploads secret values: the deploy form names the secrets config (`secretsConfig`, `wranglerEnv ?? 'prd'`) and the platform reads its own store at commit — one authority, no plaintext values on the deploy wire. Store-side, the config-missing refusal is now enforced server-side (409 `secrets_config_missing`, with the same executable `secrets configs create` fix) where it cannot be bypassed, an uninitialized store deploys as authoritative-empty exactly as before, and a store read failure fails closed (503, nothing deployed). The CLI still refuses early — before build and uploads — and still rewrites `.dev.vars` for dev parity; it now also hard-requires the `secretsSource: 'store-read-v1'` capability from the deploy service so it can never deploy against an older server that would misread the new shape as an upload with no secret bindings and strip every live user secret from an owner deploy. One check moved later: a stored secret whose name is reserved or collides with a declared wrangler binding is now refused by the platform at commit (after asset upload) rather than by the CLI before build — the price of retiring the client-side copy of that check. For one release the server also accepts the legacy `userSecrets` field from pre-0.24 CLIs (mutually exclusive with `secretsConfig`; sending both is refused), so existing installs keep deploying through the transition; the legacy arm is removed in 0.25 — update to keep deploying after that.
+- Feature installer: drop the never-used `css` integration area and per-file `overwrite` flag (no feature has ever declared either), and remove the internal `presence-test` feature.
+- Remove dead client-era wire riders: `retagged` is gone from `POST /api/apps/:appId/transfer/accept` responses, `GET /api/deploy/:appId` (deployment-status read, no live consumer) is gone, and the GitHub-source `stale_base` guard plus the `baseReleaseId` deploy field (always null from every shipped CLI) are gone.
+- Deploy/rollback contract fixes from review: a same-key deploy retry that straddles a concurrent `secrets set` now supersedes the still-prepared reservation and proceeds (instead of dying `idempotency_key_reused`; after activation the mismatch stays a hard refusal). Rollback's not-active refusal is now coded `app_undeployed` (was `app_suspended` — the suspended status was retired, and stale registry rows are normalized to `undeployed` on schema init). Rollback's `do_guard_unavailable` refusal now carries the Cloudflare-side cause as `detail`, which the CLI renders as its `Cause:` line. The CLI's dead `bindings_read_unavailable` passthrough (no server ever emits it) is removed.
+- `/api/secrets/*` error contract: internal faults (registry down, binding missing) keep answering a generic 500 with no internal error text echoed to the client — unchanged — but the fault's own message is now logged server-side as a string, so those 500s stop being undiagnosable from Workers Logs. Also: `deploy`'s `secrets_config_missing` refusal now carries `actionRequired: true` with its executable `secrets configs create` action, matching the sibling refusals.
+
+## 0.27.0
+
+### Minor Changes
+
+- Every confirmed finding from the v0.26.0 three-lane AX pass is fixed. First-use healing: an INTERRUPTED dependency install no longer reads as ready (npm writes `node_modules/deepspace/package.json` long before it links `.bin`; readiness now also requires no started-without-done sentinel evidence, so a killed install retries on the next command instead of failing later as `vitest: not found`). A committed `__APP_ID__` placeholder now refuses with its own diagnosis (`placeholder_committed`, action `deepspace app init [--env <name>]`, scoped to the SECTION being targeted so a real top-level id with a committed staging placeholder heals the right thing) instead of "this does not look like a DeepSpace app" — the state every GitHub-lane scaffold enters by pushing itself to GitHub; the plain `app_not_initialized` refusal now ships the `app init` action too. GitHub-inferred apps: `pull`, `clone`, and `workspace new` on an intentionally-empty cloud repo now consult the release ledger (ledger evidence ONLY — a mirror remote on a never-released app is not evidence and does not refuse) and refuse `source_managed_by_github` naming the repository — previously all three prescribed `deepspace push`, the PERMANENT DeepSpace claim; `pull` and `workspace new` also no longer write the `space` remote or the checkout's git identity before refusing, and `status` stops inventing a cloud trunk for such checkouts (`trunk.state: "external"`, marked `inferred`). `deploy --json` carries the source evidence the human stream announces (`source: {provider, repository?, inferred?} | null`). Suggestions: `auth status` now suggests `status` (the shallowest exact match wins; requiring a globally unique leaf sent it to the fuzzy — and destructive — `logout`). Collaboration: a never-deployed app's `owner_jwt_missing` tells the collaborator the owner must deploy once first (not "redeploy" an app that never deployed); `undeploy` checks ownership before its consent gate (a collaborator is no longer told to re-run the most destructive verb with `--yes`); collaborators can READ `app collaborators list` (mutations stay owner-only; PENDING invites stay visible to the owner alone — unaccepted invitees' emails are not roster data); deploy tells a collaborator they are shipping someone else's app; the `not_app_owner` hint no longer presumes the reader is a current collaborator; `transfer offer --json` carries `onAcceptance` (the loss-of-all-access consequence only the human path printed); deleting a developer account now cascades to the test accounts they created (their user rows and signup attribution included). Secrets: `deepspace secrets set KEY --stdin` pipes a value without putting it on argv (the CLI's own rule, previously satisfiable only via `secrets upload`); an empty piped value refuses `empty_input` rather than silently storing "". Tests: `test run all` re-asserts the port between vitest and Playwright so a winding-down runtime server is never adopted (the cold-start phantom-404 race), and the default suite's skipped-specs correction prints on stderr where captures see it. First-use registration announces the ACCOUNT EMAIL, not "your account". `pull`'s unborn-checkout advice names `git reset --mixed` instead of steering into a divergent second root; the deploy-lock refusal says to judge liveness by start time, not pid (container zombies read as alive). Scaffolder: `create-deepspace` no longer registers at scaffold time — every app registers on first use, logged in or not, so a spare `npm create` no longer burns a quota slot (`--no-register` is a deprecated no-op — it asks for what now always happens, and refusing it would exit-1 existing scripts); `--yes`/`-y` are accepted as no-ops instead of exiting 1; the template's toast viewport no longer swallows clicks under it (`pointer-events-none`); the template's `/api` 404 guard answers JSON on every method, not only GET; the template's collab spec skips itself (naming `test accounts create --password-stdin`) when the account pool is empty instead of failing a cold machine's first run.
 
 ### Patch Changes
 

package/README.md

@@ -118,11 +118,14 @@ The hierarchy shown by `deepspace --help` keeps durable app lifecycle under
 operations stay top-level. The historical `deepspace app migrate` command was
 removed in 0.15.0; it is not an upgrade or recovery path.
 
-Every app has one authoritative Git repository. DeepSpace source is the packaged
-default: the first normal deploy claims it and publishes automatically.
-`deepspace push` publishes the current branch and `deepspace clone <app>` checks
-it out; both configure a `space` remote and credential helper, so normal
-`git fetch space` and `git push space` work afterward.
+Every app has one authoritative Git repository, and which one it is follows
+from what you do rather than from anything you declare. DeepSpace source is the
+packaged default: on a checkout with no GitHub remote, the first
+`deepspace push` — or the source sync inside the first normal deploy — claims
+it and publishes automatically. `deepspace push` publishes the current branch
+and `deepspace clone <app>` checks it out; both configure a `space` remote and
+credential helper, so normal `git fetch space` and `git push space` work
+afterward.
 
 GitHub source is explicit and manual because the developer owns that repository:
 

package/dist/{chunk-EN5XPHIF.js → chunk-CRIG6LPA.js}

@@ -1274,7 +1274,7 @@ function renderInlineMarkdown(value) {
 import { useEffect as useEffect6, useRef as useRef5, useState as useState5 } from "react";
 
 // package.json
-var version = "0.26.3";
+var version = "0.27.1";
 
 // src/documentation/runtime/navigation.tsx
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
@@ -1954,4 +1954,4 @@ export {
   DefaultDocumentation,
   DocumentationContent
 };
-//# sourceMappingURL=chunk-EN5XPHIF.js.map
+//# sourceMappingURL=chunk-CRIG6LPA.js.map