deepspace 0.8.2 → 0.9.0

package/CHANGELOG.md

@@ -1,10 +1,38 @@
 # deepspace
 
+## 0.9.0
+
+### Minor Changes
+
+- Require canonical app ids at normal backend and runtime boundaries while retaining the owner-only `deepspace app migrate` workflow and permanent physical-resource continuity.
+- Add first-class single-authority GitHub and DeepSpace source control, including
+  manual GitHub verification, provider-aware deploys, and reversible branch/tag
+  transfers through `deepspace app source`.
+- Add the resumable `deepspace app migrate` workflow for GitHub-owned legacy
+  apps. Migrations mint a canonical immutable app id while preserving existing
+  Workers, Durable Objects, files, secrets, releases, billing history, routes,
+  collaborators, and other physical resources in place.
+  Dry-run returns an exact, non-mutating registry re-key inventory, and
+  `--cancel` / `--rollback` provide GitHub-first recovery before any canonical
+  deployment begins.
+
+### Patch Changes
+
+- Report GitHub-owned cloud Git operations as source-policy refusals instead of app-quota errors.
+- Build every SDK entry from one pre-cleaned output directory so concurrent declaration generation cannot remove sibling entry artifacts.
+- Install the AI SDK runtime and provider packages used by `deepspace/worker` as
+  real dependencies. Apps that do not use the AI helpers no longer fail to bundle
+  the Worker because optional provider peers are absent, and an app-owned AI SDK
+  v4 install no longer prevents DeepSpace's v5 provider runtime from installing.
+  Calls that consume `createDeepSpaceAI` models still use the documented v5 API.
+- Keep managed workspace dependencies inside their own Git checkout and roll back a newly created worktree if its private ownership marker cannot be recorded.
+
 ## 0.8.2
 
 ### Patch Changes
 
 - Publish the SDK after verifying its packed artifacts across the supported Node 22.15, 24, and 26 Linux runtimes.
+- Install the AI SDK runtime and provider packages used by `deepspace/worker` as real dependencies, so apps can bundle the Worker without manually installing optional provider peers and an app-owned AI SDK v4 install no longer prevents DeepSpace's v5 provider runtime from installing. Calls that consume `createDeepSpaceAI` models still use the documented v5 API.
 
 ## 0.8.1
 

package/README.md

@@ -89,14 +89,53 @@ npx deepspace dev start  # run locally
 npx deepspace deploy     # deploy to *.app.space
 ```
 
-Committed app source can also use DeepSpace's Git-native cloud remote.
-`deepspace push` publishes the current branch and `deepspace clone <app>`
-checks it out; both configure a `space` remote and credential helper, so normal
-`git fetch space` and `git push space` work afterward. Commands support
+The [normative CLI hierarchy](../../docs/platform/cli-contract.md#public-command-hierarchy)
+keeps durable app identity and lifecycle operations under `deepspace app`,
+while checkout-oriented Git, workspace, release, and deploy operations stay
+top-level. In particular, legacy identity migration is
+`deepspace app migrate`; there is no top-level `deepspace migrate` alias.
+
+Every app has one authoritative Git repository. DeepSpace source is the packaged
+default: the first normal deploy claims it and publishes automatically.
+`deepspace push` publishes the current branch and `deepspace clone <app>` checks
+it out; both configure a `space` remote and credential helper, so normal
+`git fetch space` and `git push space` work afterward.
+
+GitHub source is explicit and manual because the developer owns that repository:
+
+```bash
+git remote add origin git@github.com:owner/repository.git
+git push -u origin main
+npx deepspace app source github
+npx deepspace deploy
+```
+
+DeepSpace verifies GitHub but never writes it. Inspect or transfer authority with
+`deepspace app source`, `deepspace app source github`, or
+`deepspace app source deepspace`. Transfers mirror branches and tags before one
+atomic authority change; switching back uses the same commands. Commands support
 `--json` for agents. See the
 [repository guide](https://github.com/deepdotspace/deepspace/blob/main/docs/platform/repo-store-git.md)
 for workspaces, releases, and rollback.
 
+Legacy GitHub apps whose `DEEPSPACE_APP_ID` is still name-shaped migrate in
+place with one resumable command:
+
+```bash
+npx deepspace app migrate --dry-run
+npx deepspace app migrate
+```
+
+The dry-run lists the exact registry rows that will be re-keyed and the
+physical stores that remain at the existing resource id. The command then
+pauses for the normal manual GitHub commit/push and finishes with one deploy.
+Keep deploy, release rollback, and undeploy idle from the mutating command until
+that returned deploy begins; normal app traffic continues throughout.
+Before that deploy starts, `--cancel` reverses a prepared migration and
+`--rollback` reverses a committed migration; both require the restored legacy
+configuration to be committed and pushed first. DeepSpace never writes the
+GitHub repository.
+
 ## Debugging
 
 Client SDK connection/auth/Yjs logs are silent by default. Enable them with