v0.27.0

Minor Changes

• Every confirmed finding from the v0.26.0 three-lane AX pass is fixed. First-use healing: an INTERRUPTED dependency install no longer reads as ready (npm writes node_modules/deepspace/package.json long before it links .bin; readiness now also requires no started-without-done sentinel evidence, so a killed install retries on the next command instead of failing later as vitest: not found). A committed __APP_ID__ placeholder now refuses with its own diagnosis (placeholder_committed, action deepspace app init [--env <name>], scoped to the SECTION being targeted so a real top-level id with a committed staging placeholder heals the right thing) instead of "this does not look like a DeepSpace app" — the state every GitHub-lane scaffold enters by pushing itself to GitHub; the plain app_not_initialized refusal now ships the app init action too. GitHub-inferred apps: pull, clone, and workspace new on an intentionally-empty cloud repo now consult the release ledger (ledger evidence ONLY — a mirror remote on a never-released app is not evidence and does not refuse) and refuse source_managed_by_github naming the repository — previously all three prescribed deepspace push, the PERMANENT DeepSpace claim; pull and workspace new also no longer write the space remote or the checkout's git identity before refusing, and status stops inventing a cloud trunk for such checkouts (trunk.state: "external", marked inferred). deploy --json carries the source evidence the human stream announces (source: {provider, repository?, inferred?} | null). Suggestions: auth status now suggests status (the shallowest exact match wins; requiring a globally unique leaf sent it to the fuzzy — and destructive — logout). Collaboration: a never-deployed app's owner_jwt_missing tells the collaborator the owner must deploy once first (not "redeploy" an app that never deployed); undeploy checks ownership before its consent gate (a collaborator is no longer told to re-run the most destructive verb with --yes); collaborators can READ app collaborators list (mutations stay owner-only; PENDING invites stay visible to the owner alone — unaccepted invitees' emails are not roster data); deploy tells a collaborator they are shipping someone else's app; the not_app_owner hint no longer presumes the reader is a current collaborator; transfer offer --json carries onAcceptance (the loss-of-all-access consequence only the human path printed); deleting a developer account now cascades to the test accounts they created (their user rows and signup attribution included). Secrets: deepspace secrets set KEY --stdin pipes a value without putting it on argv (the CLI's own rule, previously satisfiable only via secrets upload); an empty piped value refuses empty_input rather than silently storing "". Tests: test run all re-asserts the port between vitest and Playwright so a winding-down runtime server is never adopted (the cold-start phantom-404 race), and the default suite's skipped-specs correction prints on stderr where captures see it. First-use registration announces the ACCOUNT EMAIL, not "your account". pull's unborn-checkout advice names git reset --mixed instead of steering into a divergent second root; the deploy-lock refusal says to judge liveness by start time, not pid (container zombies read as alive). Scaffolder: create-deepspace no longer registers at scaffold time — every app registers on first use, logged in or not, so a spare npm create no longer burns a quota slot (--no-register is a deprecated no-op — it asks for what now always happens, and refusing it would exit-1 existing scripts); --yes/-y are accepted as no-ops instead of exiting 1; the template's toast viewport no longer swallows clicks under it (pointer-events-none); the template's /api 404 guard answers JSON on every method, not only GET; the template's collab spec skips itself (naming test accounts create --password-stdin) when the account pool is empty instead of failing a cold machine's first run.

Patch Changes

• Widen the deploy app-id guard's documentation exclusion to the whole
  _documentation* output family (_documentation/ and, for root-mounted
  docs sites, _documentation-root/): 0.26.2 excluded only the compiled MDX
  chunks, but the prerendered per-page HTML and the root-mounted variant
  carry the same __DEEPSPACE_APP_ID__ sample text and still refused the
  deploy. The subtree is generated entirely by the SDK's docs builder;
  app-owned assets stay scanned.