@tibia.sh/tibiawiki-data 3.0.1 → 3.0.2

package/README.md

@@ -78,6 +78,7 @@ What each release was built from:
 | Release | Generator `version` | `generate_time` |
 |---|---|---|
 | `3.0.0` | `9.0.0` | `2026-09-12T19:53:53.020856+00:00` |
+| `3.0.1` | `9.0.0` | `2026-09-13T07:02:58.860376+00:00` |
 
 To read them from any index:
 
@@ -101,9 +102,12 @@ pnpm build-index
 
 That builds `dist/`, then `scripts/build.ts` runs the devDependency's
 `tibiawiki-mcp build-index` with `TIBIAWIKI_MCP_DB` set to `DB_PATH`, so the build
-writes exactly the file this package ships and exports. Every build resolves the
-generator's PyPI dependencies after a 7-day cooldown, matching the one pnpm applies to npm
-packages, and setting `UV_EXCLUDE_NEWER` overrides it.
+writes exactly the file this package ships and exports. From `0.3.1`, the server installs
+the generator from its own requirements file, where every Python dependency is pinned and
+hashed, so every build runs the same packages. Builds still set a 7-day PyPI cooldown,
+matching the one pnpm applies to npm packages. It is a backstop for a server older than
+`0.3.1`, which resolves those dependencies fresh on every build. You can override it with
+`UV_EXCLUDE_NEWER`.
 
 `build-index` needs [`uv`](https://docs.astral.sh/uv/) and network access to
 TibiaWiki. It validates the new index before replacing `index.db`, so a build that
@@ -115,8 +119,18 @@ crawl.
 
 `pnpm test` pins the generator too. It fails for an index whose `database_info` `version`
 is anything but `9.0.0`. The major version covers only the server's enrichment tables,
-and no version covers the tables tibiawiki-sql writes yet, so a rebuild with another
-generator waits until that is decided.
+and no version covers the tables tibiawiki-sql writes.
+
+A generator upgrade does not bump the major. A user who installed the oldest published server
+that depends on `^N` gets every new `N.x` of this package, so before every publish, and in CI,
+the `oldest-consumer` job installs that server package from npm together with the packed
+candidate, and pages every item through its `tibia_find_items`. The gate passes only when no
+page is an error, every page carries the candidate index's `generate_time`, and every item in
+the index comes back exactly once. `pnpm oldest-consumer` runs the same gate, and needs network
+access to npm.
+
+The sweep covers items only, not creatures, NPCs, quests or spells. So the `9.0.0` pin in
+`test/data.test.ts` stays as the explicit decision point for a generator upgrade.
 
 ### Drift
 
@@ -168,7 +182,7 @@ explicitly, and checks that the answer's `indexGeneratedAt` matches `index.db`.
 ## Development
 
 Requires Node 22.18 or later, because the tests run TypeScript directly, and pnpm
-10.33.0, pinned in `packageManager`.
+12.4.1, pinned in `packageManager`.
 
 ```bash
 pnpm install --frozen-lockfile
@@ -183,7 +197,8 @@ pnpm test
    name, so it typechecks against the built declarations, as a consumer does.
 3. It runs every `test/*.test.ts`. `test/data.test.ts` spawns the server from the
    devDependency against `index.db`, and makes a real query. The other files check the
-   release and drift workflows, the smoke check and the test floor, with no network.
+   workflows, the smoke check, the oldest-consumer gate's decisions and the test floor, with
+   no network.
 
 The run fails when fewer than `MIN_TESTS` tests pass. `node --test` still exits 0 for a
 file that declares no tests, for a skipped test, and for a `--test-name-pattern` that
@@ -220,11 +235,15 @@ by name.
 ## Releases
 
 Merging a commit to `main` publishes its `package.json` `version` if npm does not have
-that version yet. On every push to `main`, `.github/workflows/release.yml` asks npm
-whether it lists that exact version. If it does, the run publishes nothing and ends
-green. Every merge that leaves `version` alone ends this way. If it does not, the run
-installs from the lockfile, runs `pnpm test`, and runs `npm publish`.
-
+that version yet. On every push to `main`, `.github/workflows/release.yml` runs the
+`oldest-consumer` gate from [How the index is built](#how-the-index-is-built), and its release
+job waits for that gate. The release job then asks npm whether it lists that exact version. If
+it does, the run publishes nothing and ends green. Every merge that leaves `version` alone,
+and passes the gate, ends this way. If it does not, the run installs from the lockfile, runs
+`pnpm test`, and runs `npm publish`.
+
+- The gate runs on every push, whether the run publishes or not, so an index that breaks the
+  oldest published server turns the run red even when nothing is published.
 - The check is for existence, never a comparison with `latest`. A revert leaves
   `version` below `latest`, and `npm publish` moves `latest` itself.
 - A registry the check cannot read fails the run. It is never taken for a missing
@@ -235,7 +254,7 @@ installs from the lockfile, runs `pnpm test`, and runs `npm publish`.
   attaches a provenance attestation for the merged commit. The trusted publisher is
   registered for the file name `release.yml`, and renaming the file breaks publishing
   with no warning.
-- Every pull request runs the same `pnpm test`, in `.github/workflows/ci.yml`.
+- Every pull request runs the same `pnpm test` and the same gate, in `.github/workflows/ci.yml`.
 
 Nothing is tagged, so a failed publish leaves nothing stranded. When a release run fails,
 follow [docs/RELEASING.md](docs/RELEASING.md).
@@ -295,7 +314,12 @@ repository, remove it in the pull request that moves the lockfile off `N.0.0` wi
 `pnpm update @tibia.sh/tibiawiki-data --no-save`. Without `--no-save`, pnpm also raises the
 server's `^N` to the new version, such as `^N.0.1`, and the server's
 `test/data-package.test.ts` rejects that. Without the exclude, a lockfile still on `N.0.0`
-fails the next `pnpm dedupe`.
+fails the next `pnpm dedupe`. pnpm 12.4.1 fails `update --no-save` with
+`ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE` whenever `minimumReleaseAge` is set
+([pnpm#14835](https://github.com/pnpm/pnpm/issues/14835)). Until `packageManager` names a
+pnpm with the fix, run `pnpm update @tibia.sh/tibiawiki-data` without `--no-save`, restore
+`^N` in the server's `package.json`, then run `pnpm install`. The lockfile moves and the range
+stays.
 
 **Verify the deadlock before relying on this.** On a scratch branch, set the server's
 `MCP_SCHEMA_VERSION` to N: its `test/data-package.test.ts` and regression sweep must

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tibia.sh/tibiawiki-data",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "The prebuilt TibiaWiki index served by @tibia.sh/tibiawiki-mcp. Its major version is the index schema version.",
   "type": "module",
   "license": "(CC-BY-SA-3.0 AND MIT)",
@@ -12,7 +12,7 @@
   "bugs": {
     "url": "https://github.com/tibia-sh/tibiawiki-data/issues"
   },
-  "packageManager": "pnpm@10.33.0",
+  "packageManager": "pnpm@12.4.1",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -34,6 +34,7 @@
     "test": "pnpm build && pnpm typecheck && node --test --test-reporter=spec --test-reporter-destination=stdout --test-reporter=./test/min-tests.ts --test-reporter-destination=stderr test/*.test.ts",
     "build-index": "pnpm build && node scripts/build.ts",
     "smoke": "node scripts/smoke.mjs",
+    "oldest-consumer": "pnpm build && node scripts/oldest-consumer.ts",
     "prepublishOnly": "pnpm test"
   },
   "devDependencies": {