embedded-postgres-node 0.1.0-alpha.2 → 0.1.0

package/README.md

@@ -2,12 +2,12 @@
 
 Real PostgreSQL for Node.js tests, supervised by the [embedded-postgres v2 CLI](https://github.com/fergusstrange/embedded-postgres/releases/tag/v2.0.0-alpha.1). TypeScript types, ESM and CommonJS, dynamic ports, explicit async cleanup, and **zero runtime npm dependencies**. Use your own PostgreSQL driver, test runner and migration framework.
 
-**Alpha:** `0.1.0-alpha.2` pins CLI `v2.0.0-alpha.1` with verified SHA-256 checksums for all six platforms. The API may change before a stable release. Prereleases use npm's `next` tag.
+**Release status:** `0.1.0` is the first regular release, available through npm's `latest` tag. The public API is still in initial development and may change before `1.0.0`. It pins the prerelease CLI `v2.0.0-alpha.1` with verified SHA-256 checksums for all six platforms; the Go CLI remains an alpha dependency.
 
 ## Install
 
 ```sh
-npm install --save-dev --save-exact embedded-postgres-node@0.1.0-alpha.2
+npm install --save-dev --save-exact embedded-postgres-node@0.1.0
 ```
 
 To run the examples from this repository:

package/docs/releasing.md

@@ -1,6 +1,6 @@
 # Release preparation
 
-The public source repository is [fergusstrange/embedded-postgres-node](https://github.com/fergusstrange/embedded-postgres-node), and the npm package is owned by `fergusstrange`. The first library release is `0.1.0-alpha.2` under the `next` dist-tag. Releasing requires the owner's explicit authorization; pushes run CI without publishing. The registration history below records the earlier setup-only placeholder and draft. The `v0.1.0-alpha.1` tag remains unchanged after its publish command failed before uploading a package.
+The public source repository is [fergusstrange/embedded-postgres-node](https://github.com/fergusstrange/embedded-postgres-node), and the npm package is owned by `fergusstrange`. Version `0.1.0` is the first regular release and uses the `latest` dist-tag. It promotes the verified `0.1.0-alpha.2` library without runtime changes. The API remains in initial development before `1.0.0`, and the default Go CLI pin remains the prerelease `v2.0.0-alpha.1`. Releasing requires the owner's explicit authorization; pushes run CI without publishing. The registration history below records the earlier setup-only placeholder and draft. The `v0.1.0-alpha.1` tag remains unchanged after its publish command failed before uploading a package.
 
 ## Before a release
 
@@ -20,22 +20,28 @@ Locally, `npm run check:package` produces the same `.local/*.tgz` shape and vali
 
 After explicit owner authorization, rerun the workflow with `publish: true` and `NPM_PUBLISH_ENABLED=true`. The protected `npm` environment is the final human gate. The publish job consumes the exact tarball from the successful packaging job; it does not rebuild from a moving branch. It uses npm OIDC trusted publishing and provenance, without a stored publishing token.
 
-This initial prerelease has `publishConfig.tag: next`, and both workflow commands explicitly pass `--tag next` because publishing a tarball must not rely on its embedded publish configuration. For a stable release, deliberately review changing both to `latest`; changing only the numeric version does not promote the dist-tag. Prefix relative tarball paths with `./` so npm cannot interpret them as GitHub shorthand. Confirm package ownership and first-publication setup with the current npm UI/CLI before attempting the first publish; the workflow does not bypass that onboarding.
+This regular release has `publishConfig.tag: latest`, and both workflow commands explicitly pass `--tag latest` because publishing a tarball must not rely on its embedded publish configuration. For a future prerelease, deliberately change both the package configuration and workflow commands to `next`; changing only the numeric version does not change the dist-tag. Prefix relative tarball paths with `./` so npm cannot interpret them as GitHub shorthand. Confirm package ownership and publishing setup before a release; the workflow does not bypass onboarding.
 
 The workflow validates the presence of real repository metadata and stays disabled unless both the dispatch input and repository variable opt in. These are supplemental controls; GitHub environment protection must be configured by the repository owner. Do not assume naming an environment automatically creates a required-reviewer policy.
 
-After publication, verify npm metadata, integrity and provenance, then install the published version into a clean consumer project. Do not overwrite existing versions or move release tags.
+After publication, verify npm metadata, integrity and provenance, then install the published version into a clean consumer project with an empty npm cache. Wait for npm processing and registry caches to make the tarball available before declaring verification complete. Publish the corresponding GitHub release only after those checks pass. Do not overwrite existing versions or move release tags.
+
+## Verified alpha release — 2026-10-07
+
+The [v0.1.0-alpha.2 release run](https://github.com/fergusstrange/embedded-postgres-node/actions/runs/37551200454) passed all twelve native jobs, package checks and the publish dry run. The owner approved the protected `npm` environment, and OIDC publication succeeded with signed provenance. An installation using an empty npm cache verified the public tarball's integrity against the reviewed CI artifact, registry signature and provenance, TypeScript declarations, ESM/CommonJS operation, fresh CLI and PostgreSQL downloads, SQL, offline reuse and cleanup. The provenance references commit `adcd7e3c39c67f319e91303e532adb25a627ac44` and that release run.
+
+The command explicitly selected `next`, but the registry subsequently listed the alpha under both `next` and `latest`. Version `0.1.0` deliberately replaces `latest` with the first regular release.
 
 ## npm registration record — 2026-10-06
 
 The account owner requested npm setup, and registration used `npm stage publish` with npm 11.15.0 (invoked temporarily; the global npm installation was unchanged). [npm staged publishing](https://docs.npmjs.com/staged-publishing/) creates a public placeholder while keeping the submitted version's code unavailable until approval.
 
 - Public package: `embedded-postgres-node`, owner `fergusstrange`.
-- Public placeholder: `0.0.0-stage`; current `latest` points to this npm-generated placeholder.
+- Public placeholder: `0.0.0-stage`; at registration, `latest` pointed to this npm-generated placeholder.
 - Setup draft: `0.0.0-setup.1`, tag `setup`.
 - Stage ID: `6e550c38-6fbe-439d-bd5b-501539e2f24b`.
 - Planned product prerelease remains `0.1.0-alpha.1`, tag `next`; that version was not staged or published.
 
 The setup draft is a snapshot of the locally verified package with only setup version/publishing metadata changed. It was uploaded locally without provenance and should not be approved as the product release. Keep it pending or reject it later after the owner enables 2FA; ordinary publication of a different version remains possible while a draft is pending. The actual product release should come from the reviewed CI tarball with provenance.
 
-Inspect the draft with `npm exec --yes --package=npm@11.15.0 -- npm stage view 6e550c38-6fbe-439d-bd5b-501539e2f24b`. The public GitHub repository now exists; trusted publishing still needs configuration. The initial `npm trust list` readback returned registry HTTP 403; no trusted publisher was configured during setup. Do not approve this setup draft merely to make the package settings accessible; ownership already exists.
+Inspect the draft with `npm exec --yes --package=npm@11.15.0 -- npm stage view 6e550c38-6fbe-439d-bd5b-501539e2f24b`. The initial `npm trust list` readback returned registry HTTP 403; no trusted publisher was configured during registration. GitHub Actions trusted publishing was configured and verified during the subsequent alpha release. Do not approve this setup draft merely to make the package settings accessible; ownership already exists.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "embedded-postgres-node",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0",
   "description": "Supervised, disposable PostgreSQL for Node.js tests using the embedded-postgres v2 CLI",
   "license": "MIT",
   "author": "Fergus Strange",
@@ -49,7 +49,7 @@
   "sideEffects": false,
   "publishConfig": {
     "access": "public",
-    "tag": "next",
+    "tag": "latest",
     "provenance": true,
     "registry": "https://registry.npmjs.org"
   },