signalk-forecast-dataset-provider 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.2.0 — 2026-10-31
+
+- Require Node.js 22 or later, dropping Node.js 20 support. Align Node.js
+  development types with version 22 and test on Node.js 22/24.
+- Upgrade Express to 5 and validate named route parameters explicitly. Cover
+  the HTTP lifecycle against both Express 4 hosts and Express 5 hosts.
+- Upgrade to TypeScript 7 with Node16 module resolution, preserving CommonJS
+  output for Signal K plugin loading.
+- Update Signal K development API types to 2.35 and the OpenAPI validator to 13.
+  Development checks require Node.js 22.19+; installed runtime code supports 22+.
+- Separate major dependency migrations from routine Dependabot updates; keep
+  Express and its types together and Node.js types on the supported baseline.
+- Keep storage, settings, dataset identities and HTTP contract 0.1 unchanged.
+- Verify Signal K 2.34.0/2.35.1 integration and the existing sandbox deployment.
+
+## 0.1.1 — 2026-10-31
+
+- Enable Forecast Dataset Provider by default on fresh installations, so the
+  catalogue is available without a separate activation step.
+- Preserve existing explicit enabled/disabled settings through Signal K's
+  standard activation behaviour. Already-disabled installations still require
+  enabling the provider once in Plugin Config.
+- Keep storage, permissions and HTTP contract 0.1 unchanged.
+
 ## 0.1.0 — 2026-10-30
 
 - First stable catalogue release, promoting the tested streaming publication,

package/README.md

@@ -2,13 +2,13 @@
 
 Signal K Resource Provider for **`forecastDatasets`**: a shared catalogue of persistent, immutable forecast content. Downloaders and receivers publish original bytes; routing, weather and navigation clients discover and retrieve them without depending on private directories.
 
-**Version 0.1.0 is the first stable catalogue release.** It implements staged multi-asset publication (including unknown-size streams), live publication progress, SHA-256 content versions, resumable publication after restart, verified-inventory enrichment, filtered discovery, HTTP Range/HEAD/ETag access, deletion coordination and v2 resource deltas. No GRIB/Zarr decoder is bundled. Formats are declared, not detected or validated meteorologically.
+**Version 0.2.0 requires Node.js 22 or later.** It implements staged multi-asset publication (including unknown-size streams), live publication progress, SHA-256 content versions, resumable publication after restart, verified-inventory enrichment, filtered discovery, HTTP Range/HEAD/ETag access, deletion coordination and v2 resource deltas. No GRIB/Zarr decoder is bundled. Formats are declared, not detected or validated meteorologically.
 
 The architecture and examples come from the [project outline](https://github.com/macjl/signalk-grib-resources/blob/c289876e4d4e5faadbb6779d865d7aa21a0d9822/docs/project-outline.md). The wire contract selected for this prototype is documented in [contract 0.1](docs/contract-v0.1.md); it is experimental, not an adopted Signal K specification.
 
 ## Install
 
-Requires **Signal K server 2.34 or later within 2.x** and Node.js 20.19 or later for this plugin (the server may require a newer Node version). The target server for integration verification is 2.34.0.
+Requires **Signal K server 2.34 or later within 2.x** and Node.js 22 or later for this plugin. Dependency migration integration was also verified against Signal K 2.35.1.
 
 See the [coordinated upgrade guide](docs/upgrading.md) before upgrading the downloader and Weather Provider from local-file releases. The complete chain requires Node.js 24+.
 
@@ -18,7 +18,7 @@ Install the stable release from the Signal K App Store or from its configuration
 npm install signalk-forecast-dataset-provider@latest
 ```
 
-Restart the server and enable **Forecast Dataset Provider** in Plugin Config. To build a local archive from source:
+Restart the server. From version **0.1.1**, fresh installations enable **Forecast Dataset Provider** automatically. Signal K preserves an existing explicit disabled setting: for an already installed but disabled provider, enable it once in Plugin Config and save. To build a local archive from source:
 
 ```sh
 npm ci
@@ -26,7 +26,7 @@ npm run check
 npm pack
 ```
 
-Install the resulting archive using the server's normal plugin installation workflow, for example `npm install /path/to/signalk-forecast-dataset-provider-0.1.0.tgz` from its configuration directory. No npm release is required for local testing.
+Install the resulting archive using the server's normal plugin installation workflow, for example `npm install /path/to/signalk-forecast-dataset-provider-0.2.0.tgz` from its configuration directory. No npm release is required for local testing.
 
 The default storage location is `<plugin data directory>/catalogue`. An optional absolute `storageDirectory` can be configured. Use a local filesystem supporting hard links and atomic rename, with a single catalogue writer. Limits are configurable for asset bytes, dataset bytes, asset count and unfinished publications. They are per-publication limits, not an automatic total-disk-quota policy. Unfinished publications persist until resumed or explicitly aborted.
 

package/RELEASING.md

@@ -5,15 +5,16 @@ GRIB Downloader and History Explorer): publish a GitHub Release, or manually run
 `.github/workflows/publish.yml`. Publication uses npm trusted publishing (OIDC)
 with provenance; no `NPM_TOKEN` GitHub secret is used.
 
-The package and trusted publisher already exist. Release **0.1.0** is the first
-stable version and publishes to `latest`; the earlier public release was
-`0.1.0-beta.1`. Older 0.1.0/0.1.1/0.1.2 entries were unpublished development
-snapshots. See [the coordinated upgrade guide](docs/upgrading.md).
+The package and trusted publisher already exist. Version **0.2.0** is a stable
+release published to `latest`. It requires Node.js 22+ and keeps HTTP contract
+0.1. Version 0.1.0 was the first stable release, followed by 0.1.1. The dated
+prototype entries under “Development snapshots” in the changelog were never
+published. See [the coordinated upgrade guide](docs/upgrading.md).
 
 ## First publication setup
 
 The package must exist before an npm trusted publisher can be configured. The
-existing `0.0.0-stage` bootstrap already satisfies this: **do not repeat the
+existing `0.0.1` bootstrap already satisfies this: **do not repeat the
 bootstrap for this package**. For a new package, as with History Explorer,
 bootstrap an **empty** placeholder outside its checkout.
 These commands publish publicly and must be run deliberately by the maintainer:
@@ -59,8 +60,8 @@ and [npm trust prerequisites](https://docs.npmjs.com/cli/v11/commands/npm-trust/
 
 ## Prepare the real plugin version
 
-The first stable version is **0.1.0**. Decide the new version before tagging
-subsequent releases.
+The release prepared here is **0.2.0**. Decide the new version before tagging
+each subsequent release.
 Keep `package.json`, `package-lock.json`, the OpenAPI info version and changelog
 consistent if changing it. The resource contract stays `0.1` independently of
 the npm package version.
@@ -77,7 +78,9 @@ helpers, local configuration and credentials must not be included. Compilation
 runs during `prepack`, so the installed App Store package needs no install/build
 script. `prepublishOnly` reruns the full checks before a real publish.
 
-The local CI checks Node 20/22/24. The separate Signal K reusable CI follows the
+Development and release checks require Node 22.19 or later (the OpenAPI
+validator requires this version baseline); installed runtime code supports Node 22+.
+The local CI checks Node 22/24. The separate Signal K reusable CI follows the
 other plugins and adds Linux/ARM64/macOS/Windows plus real-server integration.
 Those hosted checks only run after pushing; local success does not claim they
 have already passed. Publication uses Node 24 on a GitHub-hosted runner.
@@ -99,7 +102,19 @@ provenance. The OIDC path cannot be fully validated by a local dry run: npm must
 recognise the configured GitHub workflow. Tighten npm publishing access only
 after that first successful OIDC publication, as in the other plugins.
 
-## Preparation checks (2026-10-21)
+## Validation for 0.2.0
+
+The migration passed 29 top-level tests on Node.js 22/24, including an additional
+execution of the HTTP suite with an Express 4 host and Express 5 middleware.
+Hosted CI passed on Linux x64/ARM64, macOS and Windows, with integration against
+Signal K 2.34.0 and 2.35.1. The existing sandbox deployment also passed the
+publication, recovery, inventory, permissions and original-content transport
+checks, and the maintainer confirmed acceptance. Production dependency audit
+reported zero vulnerabilities. The release commit is checked again before
+publication; inspect its hosted checks rather than assuming earlier results
+apply to later changes.
+
+## Historical preparation checks (2026-10-21)
 
 The 27 local tests, formatting and TypeScript checks passed. `npm publish --dry-run`
 completed without publishing; the inspected archive contains 24 files, including

package/dist/http.js

@@ -106,15 +106,15 @@ function registerRoutes(router, getStore, report) {
     read.get('/datasets', wrap((req, res) => json(req, res, (0, discovery_1.listResources)(getStore(), req.query))));
     read.get('/datasets/:id', wrap((req, res) => {
         const store = getStore();
-        json(req, res, store.resource(store.get(req.params.id)));
+        json(req, res, store.resource(store.get((0, validation_1.identifier)(req.params.id))));
     }));
     read.get('/datasets/:id/versions/:version', wrap((req, res) => {
         const store = getStore();
-        json(req, res, store.resource(store.get(req.params.id, req.params.version)));
+        json(req, res, store.resource(store.get((0, validation_1.identifier)(req.params.id), (0, validation_1.identifier)(req.params.version))));
     }));
     read.get('/datasets/:id/versions/:version/index', wrap(async (req, res) => {
         const store = getStore();
-        const { record, inventory } = await store.readInventory(req.params.id, req.params.version);
+        const { record, inventory } = await store.readInventory((0, validation_1.identifier)(req.params.id), (0, validation_1.identifier)(req.params.version));
         json(req, res, {
             datasetId: record.id,
             version: record.version,
@@ -128,7 +128,7 @@ function registerRoutes(router, getStore, report) {
         });
     }));
     read.get('/datasets/:id/versions/:version/assets/:asset', wrap(async (req, res) => {
-        const opened = await getStore().openAsset(req.params.id, req.params.version, req.params.asset);
+        const opened = await getStore().openAsset((0, validation_1.identifier)(req.params.id), (0, validation_1.identifier)(req.params.version), (0, validation_1.identifier)(req.params.asset));
         try {
             const { asset, handle } = opened;
             const tag = `"sha256-${asset.sha256}"`;
@@ -171,7 +171,7 @@ function registerRoutes(router, getStore, report) {
         }
     }));
     const begin = wrap(async (req, res) => {
-        const stage = await getStore().begin(req.body, req.params.id);
+        const stage = await getStore().begin(req.body, req.params.id === undefined ? undefined : (0, validation_1.identifier)(req.params.id));
         res.status(201).location(`${types_1.API_ROOT}/publications/${stage.id}`).json(stage);
     });
     write.post('/publications', body, begin);
@@ -182,14 +182,14 @@ function registerRoutes(router, getStore, report) {
     write.get('/publications/:publication', wrap((req, res) => {
         res
             .set('Cache-Control', 'no-store')
-            .json(getStore().publication(req.params.publication));
+            .json(getStore().publication((0, validation_1.identifier)(req.params.publication)));
     }));
     write.put('/publications/:publication/assets/:asset', wrap(async (req, res) => {
         if (req.is('application/octet-stream') !== 'application/octet-stream' ||
             (req.get('Content-Encoding') &&
                 req.get('Content-Encoding') !== 'identity'))
             throw new validation_1.ApiError(415, 'RAW_UPLOAD_REQUIRED', 'Upload unencoded application/octet-stream bytes');
-        const stage = getStore().publication(req.params.publication);
+        const stage = getStore().publication((0, validation_1.identifier)(req.params.publication));
         const expected = stage.declaration.assets.find((a) => a.id === req.params.asset);
         if (!expected)
             throw new validation_1.ApiError(404, 'ASSET_NOT_DECLARED', 'Asset was not declared');
@@ -201,23 +201,23 @@ function registerRoutes(router, getStore, report) {
                 throw new validation_1.ApiError(413, 'SIZE_LIMIT_EXCEEDED', 'Content-Length exceeds configured asset size limit');
         }
         req.setTimeout(120000, () => req.destroy(new Error('Upload timed out')));
-        const asset = await getStore().upload(req.params.publication, req.params.asset, req);
+        const asset = await getStore().upload((0, validation_1.identifier)(req.params.publication), (0, validation_1.identifier)(req.params.asset), req);
         res.status(201).json(asset);
     }));
     write.post('/publications/:publication/commit', wrap(async (req, res) => {
         const store = getStore();
-        const record = await store.commit(req.params.publication);
+        const record = await store.commit((0, validation_1.identifier)(req.params.publication));
         res
             .status(201)
             .location(`${types_1.API_ROOT}/datasets/${record.id}/versions/${record.version}`)
             .json(store.resource(record));
     }));
     write.delete('/publications/:publication', wrap(async (req, res) => {
-        await getStore().abort(req.params.publication);
+        await getStore().abort((0, validation_1.identifier)(req.params.publication));
         res.status(204).end();
     }));
     write.delete('/datasets/:id', wrap(async (req, res) => {
-        await getStore().remove(req.params.id);
+        await getStore().remove((0, validation_1.identifier)(req.params.id));
         res.status(204).end();
     }));
     // Verified inventory is an explicit assertion from an administrator/indexer,
@@ -227,7 +227,7 @@ function registerRoutes(router, getStore, report) {
         if (!value)
             throw new validation_1.ApiError(428, 'REVISION_REQUIRED', 'If-Match with the current dataset ETag is required');
         const store = getStore();
-        const record = store.get(req.params.id, req.params.version);
+        const record = store.get((0, validation_1.identifier)(req.params.id), (0, validation_1.identifier)(req.params.version));
         if (value !== etag(store.resource(record)))
             throw new validation_1.ApiError(412, 'REVISION_CHANGED', 'Dataset metadata has changed');
         const updated = await store.enrich(record.id, record.version, req.body, record.metadataRevision);

package/dist/openapi.js

@@ -124,7 +124,7 @@ exports.openApi = {
     openapi: '3.0.3',
     info: {
         title: 'Forecast Dataset Provider',
-        version: '0.1.0',
+        version: '0.2.0',
         description: 'Experimental contract 0.1. Original-content catalogue; no GRIB/Zarr decoding or subset processor is bundled.'
     },
     servers: [{ url: types_1.API_ROOT }],

package/docs/sandbox-verification.md

@@ -54,3 +54,24 @@ Update/rollback note: committed contract 0.1 datasets retain the same storage an
 Plugin Config now exposes `maxAssetMiB: 2048` and `maxDatasetMiB: 8192`, with explicit MiB labels (1,048,576 bytes). Effective default byte limits and byte-based HTTP/index/progress semantics are unchanged. No configuration migration or compatibility aliases are included for the unpublished prototype. Only this sandbox plugin's settings were manually adjusted through its configuration API.
 
 The updated 0.1.2 archive was installed with a backup at `local-packages/forecast-provider-before-update-2026-10-21T18-45-50-384Z`. The actual `/plugins` schema and saved settings were verified. The 45 other plugin configurations, enable/debug flags and both existing dataset content versions remained unchanged. The provider's streaming/recovery/transport integration helper passed again and removed its synthetic data. Local checks pass 27 tests, including unit conversion, invalid configuration and enforcement of a MiB-configured limit during an upload.
+
+## Dependency migration verification — 2026-10-31
+
+The provider now requires Node.js 22+. Local checks passed on Node.js 22.23.4
+and 24.22.2 with TypeScript 7, Express 5 and the updated OpenAPI validator.
+The 29 top-level tests include a second execution of the HTTP suite using an
+Express 4 host with the provider's Express 5 JSON middleware.
+
+A separate Signal K 2.35.1 instance used Node.js 24.22.1 and the server's
+Express 4.22.3. It ran on a free port with its own temporary configuration,
+catalogue and test accounts, using the packed provider with production-only
+dependencies. Fresh-install activation, reader/write permissions, anonymous
+access rejection, unknown-size streaming, commit, core Resource API discovery
+and filtering, Range, HEAD, ETag and deletion passed. The instance was stopped
+and its temporary configuration removed. The existing sandbox configuration,
+installed plugins and datasets were not changed.
+
+The targeted sandbox install/update helpers require Express 5 to be available
+for the provider. They deliberately do not resolve dependencies; do not use
+them to reuse the server's Express 4 installation during this migration. Use
+a normal package installation that installs the provider's dependencies.

package/docs/upgrading.md

@@ -1,11 +1,15 @@
 # Coordinated forecast-plugin upgrade
 
-Stable versions: Forecast Dataset Provider **0.1.0**, GRIB Downloader **0.4.0**,
+The first coordinated stable migration used: Forecast Dataset Provider **0.1.0**, GRIB Downloader **0.4.0**,
 GRIB Weather Provider **0.7.0**, Forecast Dataset Browser **0.1.0**.
 The catalogue HTTP contract remains **0.1**; it is not an adopted Signal K standard.
 
 ## Requirements and upgrade from local-file releases
 
+Provider 0.2.0 requires Node.js 22+ and preserves the same catalogue storage and
+HTTP contract. It does not require a dataset or configuration migration. Use the
+latest compatible releases when applying the historical migration steps below.
+
 The complete chain requires **Node.js 24+** (the Weather Provider's ecCodes
 WebAssembly decoder needs memory64) and **Signal K 2.34+ within 2.x**.
 Downloader 0.3.x and Weather Provider 0.6.x shared local files. Upgrade both

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signalk-forecast-dataset-provider",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Signal K Resource Provider for immutable forecast datasets, original assets and verified inventories",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -46,9 +46,9 @@
     "url": "https://github.com/macjl/signalk-forecast-dataset-provider/issues"
   },
   "engines": {
-    "node": ">=20.19.0"
+    "node": ">=22"
   },
-  "signalk-plugin-enabled-by-default": false,
+  "signalk-plugin-enabled-by-default": true,
   "signalk": {
     "displayName": "Forecast Dataset Provider",
     "appIcon": "icon.svg"
@@ -57,14 +57,15 @@
     "@signalk/server-api": ">=2.34.0 <3"
   },
   "devDependencies": {
-    "@apidevtools/swagger-parser": "^12.1.0",
-    "@signalk/server-api": "2.34.0",
-    "@types/express": "^4.17.21",
-    "@types/node": "^20.19.0",
+    "@apidevtools/swagger-parser": "^13.1.0",
+    "@signalk/server-api": "2.35.0",
+    "@types/express": "^5.0.6",
+    "@types/node": "^22.20.5",
+    "express4": "npm:express@^4.22.3",
     "prettier": "^3.6.2",
-    "typescript": "~5.9.3"
+    "typescript": "7.0.2"
   },
   "dependencies": {
-    "express": "^4.21.2"
+    "express": "^5.3.0"
   }
 }