@nexcraft-dev/r2d1 0.1.0 → 1.0.0

package/README.md

@@ -146,7 +146,11 @@ npm run check:package
 
 Tests cover SQLite execution, failure paths, rebuilds, concurrency and local Miniflare/Workerd R2/D1 bindings. `verify:java` requires Java 21+ and the Java checkout at `../r2d1`, or set `R2D1_JAVA_ROOT`. It compiles original source copies in a temporary directory and checks source hashes, fixtures and bidirectional cursors. It never builds or modifies the Java checkout. Normal tests use checked-in fixtures without Java.
 
-The `Publish npm package` workflow is manually dispatched from `main` with the exact stable `package.json` version. It verifies Node 22 and 24, inspects package contents, tests the release tarball, and passes that artifact to a separate GitHub-hosted OIDC publish job. The `npm` GitHub environment and npm trusted publisher must be configured first. The workflow does not create commits, tags, or GitHub releases. It needs no long-lived npm write token after trusted publishing is configured. A new npm package may need a separately authorized initial registration before package-level trusted publishing settings are available.
+The `Publish npm package` workflow is manually dispatched from `main`. The first formal release is `1.0.0`. Later runs increment the highest occupied stable version's patch component, checking both Git tags and the npm registry. The workflow updates both version files, validates Node 22 and 24, and atomically pushes a version commit and its `vX.Y.Z` tag. It uses the short-lived `GITHUB_TOKEN` for Git writes and OIDC for npm. No npm access token or PAT is configured.
+
+The publish job keeps the workflow's `main` execution context for the `npm` Environment, while checking out the tag's exact commit SHA. It rechecks source ancestry, versions, tests and the tarball. An existing identical npm artifact is a successful no-op. A different artifact at the same version is an error. An unpublished tag is resumed without another version increment. Use the optional `resume_tag` input for explicit recovery of an existing tag. Re-running the same workflow run retains its release through the run ID recorded in the version commit.
+
+The `npm` GitHub environment and package-level trusted publisher must be configured first. Repository rules must permit the workflow's short-lived token to update `main` and create release tags. The workflow never force-pushes, moves tags or creates GitHub releases. If Git reservation or npm publication fails, preserve existing tags and artifacts. Re-run all jobs to recover a reserved release, or use `resume_tag` from a new `main` dispatch. A new package may need separately authorized registration before package-level trust settings are available.
 
 Live testing is opt-in and writes to dedicated resources. Set these variables:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexcraft-dev/r2d1",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "Document storage on Cloudflare R2 with rebuildable D1 indexes for Node.js and Workers",
   "type": "module",
   "license": "Apache-2.0",