@nspot/geo-engine 0.2.0 → 0.2.1

package/README.md

@@ -178,71 +178,3 @@ writing rows or editing regions at that moment. Registering a source is as power
 writing a trigger by hand — only let database administrators call `registerSource` /
 `unregisterSource` (the underlying `geo.register_source` / `geo.unregister_source` are not
 executable by PUBLIC).
-
-## Releasing
-
-`pnpm sdk:rehearsal` (from the repo root) packs the SDK and installs it into a throwaway
-project against a scratch database; run it before every release.
-
-To cut a release: bump `version` in `packages/sdk-node/package.json`, run
-`pnpm sdk:rehearsal` and confirm it passes, and open a pull request with the bump. There is
-no release tag to push by hand — when the pull request merges and CI passes on `main`,
-`.github/workflows/publish-sdk.yml` publishes it to npm, tags the commit
-`sdk-node-v<version>` and creates a GitHub release for it.
-
-That workflow publishes *every* publishable package in the repository whose version is not
-on npm yet, not only the SDK. `node scripts/publishable.mjs --all` lists every publishable
-package (one JSON line each — `name`, `version`, `dir`, `tag`, `published`), and the job
-walks that list in order:
-
-- a package whose version is **not** on npm is published (`npm publish --access public`);
-- every package that is on npm — published just now or long since — then has its tag
-  (`sdk-node-v<version>` for the SDK, `pack-<slug>-v<version>` for a region pack) and its
-  GitHub release created if they are missing, and left alone if they are not.
-
-A merge that bumps nothing publishes nothing; the job still runs, finds everything in
-order, and exits green.
-
-What "idempotent" means here is worth being precise about, because a re-run does more than
-skip work. Re-running the job **repairs** a half-finished release: a package that published
-successfully but whose tag push or release creation failed gets its tag and release on the
-next run, instead of being skipped forever because it is now on npm. And one package
-failing no longer stops the rest — a failure is recorded and the loop continues to the next
-package, with the job failing at the end and naming everything that went wrong. So it is
-always safe, and often useful, to re-run by hand from the Actions tab
-(`workflow_dispatch`).
-
-A manual run publishes **the current `main`**, not the commit of an older run: it checks
-out `main`'s head, and the job refuses to run on any other branch. There is no way to
-re-publish a past commit from the Actions tab; to release again, merge another bump.
-
-Only one publish runs at a time (`concurrency: publish`, never cancelled mid-flight). Two
-merges landing within a minute can therefore drop the middle run — a queued run is
-superseded by a newer one. That is harmless: the gate is "is this version on npm", not "did
-this commit run", so a version bump superseded before it published simply publishes on the
-next merge.
-
-The workflow publishes through npm Trusted Publishing (OpenID Connect), so there is no token
-and no repository secret. npm binds a trusted publisher to a workflow **filename**, which is
-why the file is still called `publish-sdk.yml` now that it publishes the packs too.
-
-Publishing does *not* pass `--provenance`: npm only accepts provenance attestations from a
-public source repository, and this repository is private, so asking for one fails the
-publish outright. Trusted publishing itself is unaffected. If the repository is ever made
-public, trusted publishing generates provenance on its own — no flag needed.
-
-The first version of a *new* package cannot be published by CI, because a trusted publisher
-can only be configured on a package that already exists. For each new package, once:
-
-1. Publish the first version from your machine: in the package directory run `npm login` and
-   `npm publish --access public` (for the SDK, npm runs `prepack`, which syncs the SQL and
-   builds; it asks for a one-time 2FA code).
-2. On npmjs.com open the package, Settings, Trusted Publisher, GitHub Actions: organisation
-   `NSpot-Games`, repository `geo-engine`, workflow filename `publish-sdk.yml`, environment
-   empty.
-
-Until both are done for a package, the publish job runs and fails at `npm publish` for it.
-`@nspot/geo-engine` is past that point: 0.1.0 was published by hand on 2026-09-16 and its
-trusted publisher is configured, so every later version comes from a merge to `main`.
-
-A Python SDK does not exist yet.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nspot/geo-engine",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Region membership for your own PostGIS tables: install the geo schema, register tables, install region packs, query by region.",
   "license": "MIT",
   "type": "module",
@@ -11,7 +11,7 @@
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
     "./types": { "types": "./dist/types.d.ts", "import": "./dist/types.js" }
   },
-  "bin": { "geo-engine": "./dist/cli.js" },
+  "bin": { "geo-engine": "dist/cli.js" },
   "files": ["dist", "sql", "README.md", "LICENSE"],
   "engines": { "node": ">=20" },
   "repository": {