DeckOps 3.0.0: cloud-only SDK and CLI

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 3.0.0 — 2026-10-19 — Cloud-only SDK and CLI
+
+Breaking. DeckOps is now a thin client for DeckOps Cloud: the server parses, owns the IR and renders
+Markdown; the client uploads, waits, stores the server's answer and downloads images.
+
+- Removed the local engine, `--engine`, upload authorization and local limits. All parsing and Markdown
+  come from DeckOps Cloud and need credentials (`deckops auth login` or an API key).
+- Removed DeckProbe preflight and `inspection` (`--preflight`, `probe.json`, `inspectionReport()`).
+- `ir.json` is the server's parse response verbatim, and `irSchemaVersion` is whatever the server
+  reports. Removed `deckir.v1` (and `schemas/deckir.v1.schema.json`), the client-side quality report and
+  routing decisions (`engine`, `quality`, `assessment`, `decision`).
+- Artifacts use manifest v3 (`parse.expiresAt`, `views.markdown.schemaVersion`); `upgrade.json` is now
+  `submission.json`. Artifacts from 2.x are refused with `input_error`: parse the source again with
+  `--force`.
+- `read` returns `deckops.read.v2`; `--report` writes `deckops.run.v2`.
+- `--timeout` (SDK `timeout`, fractional seconds allowed) bounds each parse or convert stage, image
+  downloads included, and the SDK `signal` stops downloads too. Sources over 256 MiB are refused with
+  `input_error` before they are read.
+- Removed the `capabilities` and `config migrate` commands; product configuration keeps only `timeout`.
+  Removed options (`--engine`, `--allow-upload`, `--fail-on-degraded`, `--preflight`, `--page-furniture`,
+  `--overlaid-text`, `--tracked-changes`, `--max-*`, `--worker-heap-mb`) and the `DECKOPS_ENGINE`,
+  `DECKOPS_ALLOW_UPLOAD` and `DECKOPS_FAIL_ON_DEGRADED` variables now fail as unknown (`usage_error`). The
+  Node SDK rejects unknown options the same way instead of ignoring them.
+- The browser entry drops `preflight`, `inspection`, `inspectionReport()` and the `preflight` progress
+  phase. Node and browser share one SDK core. The browser bundle measures 34,049 bytes minified +
+  gzip and no longer loads a Worker or WebAssembly; CI holds it to that plus 10 %.
+- Dependencies `@deckflow/deckprobe`, `@deckflow/pdf-lite-parse`, `parse5`, `saxes` and `fflate` are gone.
+- DeckOps-owned code is licensed under Apache-2.0 instead of AGPL-3.0-only. Published 2.x releases keep
+  the license they shipped with.
+
 ## 2.6.1 — 2026-09-24 — Empty task status grace
 
 - Keep waiting while the task status comes back empty for up to 30 seconds (`emptyStatusGrace`),