deepspace 0.8.2 → 0.9.1

package/CHANGELOG.md

@@ -1,10 +1,48 @@
 # deepspace
 
+## 0.9.1
+
+### Patch Changes
+
+- Keep `deepspace app migrate` as the permanent ordered app-upgrade runner and
+  repair obsolete `x-app-name` platform identity wiring before a canonical app
+  deployment, without changing retained `APP_NAME` data namespaces. Track
+  source-only migration commits against live release lineage so both GitHub and
+  DeepSpace apps are guided through the required deploy.
+
+## 0.9.0
+
+### Minor Changes
+
+- Require canonical app ids at normal backend and runtime boundaries while retaining the owner-only `deepspace app migrate` workflow and permanent physical-resource continuity.
+- Add first-class single-authority GitHub and DeepSpace source control, including
+  manual GitHub verification, provider-aware deploys, and reversible branch/tag
+  transfers through `deepspace app source`.
+- Add the resumable `deepspace app migrate` workflow for GitHub-owned legacy
+  apps. Migrations mint a canonical immutable app id while preserving existing
+  Workers, Durable Objects, files, secrets, releases, billing history, routes,
+  collaborators, and other physical resources in place.
+  Dry-run returns an exact, non-mutating registry re-key inventory, and
+  `--cancel` / `--rollback` provide GitHub-first recovery before any canonical
+  deployment begins.
+
+### Patch Changes
+
+- Report GitHub-owned cloud Git operations as source-policy refusals instead of app-quota errors.
+- Build every SDK entry from one pre-cleaned output directory so concurrent declaration generation cannot remove sibling entry artifacts.
+- Install the AI SDK runtime and provider packages used by `deepspace/worker` as
+  real dependencies. Apps that do not use the AI helpers no longer fail to bundle
+  the Worker because optional provider peers are absent, and an app-owned AI SDK
+  v4 install no longer prevents DeepSpace's v5 provider runtime from installing.
+  Calls that consume `createDeepSpaceAI` models still use the documented v5 API.
+- Keep managed workspace dependencies inside their own Git checkout and roll back a newly created worktree if its private ownership marker cannot be recorded.
+
 ## 0.8.2
 
 ### Patch Changes
 
 - Publish the SDK after verifying its packed artifacts across the supported Node 22.15, 24, and 26 Linux runtimes.
+- Install the AI SDK runtime and provider packages used by `deepspace/worker` as real dependencies, so apps can bundle the Worker without manually installing optional provider peers and an app-owned AI SDK v4 install no longer prevents DeepSpace's v5 provider runtime from installing. Calls that consume `createDeepSpaceAI` models still use the documented v5 API.
 
 ## 0.8.1
 

package/README.md

@@ -89,14 +89,64 @@ npx deepspace dev start  # run locally
 npx deepspace deploy     # deploy to *.app.space
 ```
 
-Committed app source can also use DeepSpace's Git-native cloud remote.
-`deepspace push` publishes the current branch and `deepspace clone <app>`
-checks it out; both configure a `space` remote and credential helper, so normal
-`git fetch space` and `git push space` work afterward. Commands support
+The [normative CLI hierarchy](../../docs/platform/cli-contract.md#public-command-hierarchy)
+keeps durable app lifecycle and version migrations under `deepspace app`,
+while checkout-oriented Git, workspace, release, and deploy operations stay
+top-level. In particular, app migration is
+`deepspace app migrate`; there is no top-level `deepspace migrate` alias.
+
+Every app has one authoritative Git repository. DeepSpace source is the packaged
+default: the first normal deploy claims it and publishes automatically.
+`deepspace push` publishes the current branch and `deepspace clone <app>` checks
+it out; both configure a `space` remote and credential helper, so normal
+`git fetch space` and `git push space` work afterward.
+
+GitHub source is explicit and manual because the developer owns that repository:
+
+```bash
+git remote add origin git@github.com:owner/repository.git
+git push -u origin main
+npx deepspace app source github
+npx deepspace deploy
+```
+
+DeepSpace verifies GitHub but never writes it. Inspect or transfer authority with
+`deepspace app source`, `deepspace app source github`, or
+`deepspace app source deepspace`. Transfers mirror branches and tags before one
+atomic authority change; switching back uses the same commands. Commands support
 `--json` for agents. See the
 [repository guide](https://github.com/deepdotspace/deepspace/blob/main/docs/platform/repo-store-git.md)
 for workspaces, releases, and rollback.
 
+`deepspace app migrate` is the permanent upgrade runner for breaking app
+changes. It contains an ordered set of structural, idempotent migrations, so
+agents and developers keep using the same command across releases:
+
+```bash
+npx deepspace app migrate --dry-run
+npx deepspace app migrate
+```
+
+The dry-run lists pending source migrations without changing files. For a
+legacy GitHub app whose `DEEPSPACE_APP_ID` is still name-shaped, it also lists
+the exact registry rows that will be re-keyed and the physical stores that
+remain at the existing resource id. The command applies only transformations
+it recognizes safely, pauses for normal commit/push, and finishes with one
+deploy. Source migration commits carry a machine-readable Git trailer, so the
+next run can compare them with the live release and return the deploy action
+without a local state file. Rerun after each returned action; when nothing is
+pending it reports `up_to_date`. This is the same workflow for GitHub and
+DeepSpace source; only their normal push behavior differs. `APP_NAME`-based
+legacy room and storage addresses are retained; canonical `DEEPSPACE_APP_ID`
+is used only for logical identity and platform authentication.
+
+Keep deploy, release rollback, and undeploy idle from the mutating command until
+that returned deploy begins; normal app traffic continues throughout.
+Before that deploy starts, `--cancel` reverses a prepared migration and
+`--rollback` reverses a committed migration; both require the restored legacy
+configuration to be committed and pushed first. DeepSpace never writes the
+GitHub repository.
+
 ## Debugging
 
 Client SDK connection/auth/Yjs logs are silent by default. Enable them with