TerritoryKit 3.0.0

TerritoryKit 3.0.0

TerritoryKit 3.0.0 completes the current production publishing and Turkey delivery milestone.

Highlights

• Adds source-aware Turkey V2 delivery metadata to MVT tiles, including parent ADM2 and source version, and a deterministic manifest for tile, shard, attribution, adjacency, index, and source-lock checksums.
• Adds @territory-kit/runtime/turkey-v2-delivery district resolution with shard size and SHA-256 checks, dataset/version and parent validation, explicit estimated-boundary control, cache identity, attribution selection, and neighbor lookup.
• Adds CLI delivery-manifest, inspect, and source-diff operations to inventory artifacts and audit changed source locks and affected provinces before a candidate rebuild.
• Hardens registry and delivery trust boundaries with manifest validation and pinning, bounded downloads, HTTPS and same-origin defaults, and Node redirect and private-network checks.
• Hardens the guarded release path and records deterministic Turkey benchmark evidence that can be verified in a clean CI checkout without regenerating canonical geometry.

The Turkey V2 2.1.0-rc.7 national dataset remains a separate dataset candidate; this npm package release does not promote or bundle the large national geometry or tile artifacts.

Breaking changes

@territory-kit/registry@3.0.0 now requires HTTPS for remote registries and same-origin artifact URLs by default. Existing trusted HTTP, local-file, cross-origin, or private-network integrations must opt in explicitly with allowHttp, allowFile, allowedOrigins, or allowPrivateNetwork, as appropriate. A remote registry cannot select local artifact files. See the registry URL trust policy and security migration guidance. Use these exceptions only for endpoints you trust.

Published packages

• @territory-kit/adapter-core@3.0.0
• @territory-kit/cli@3.0.0
• @territory-kit/core@3.0.0
• @territory-kit/data-de@3.0.0
• @territory-kit/data-id@3.0.0
• @territory-kit/data-jp@3.0.0
• @territory-kit/data-tr@3.0.0
• @territory-kit/data-us@3.0.0
• @territory-kit/dataset@3.0.0
• @territory-kit/game@3.0.0
• @territory-kit/generators@3.0.0
• @territory-kit/maplibre@3.0.0
• @territory-kit/nestjs@3.0.0
• @territory-kit/registry@3.0.0
• @territory-kit/runtime@3.0.0
• @territory-kit/migration@2.1.1
• @territory-kit/leaflet@1.2.13
• @territory-kit/openlayers@1.2.13
• @territory-kit/react-native@1.1.14

Migration, Leaflet, OpenLayers, and React Native received patch releases in the same release train to update workspace dependency ranges; their version numbers therefore differ from 3.0.0.

Validation

• Node 22 CI: passed.
• Node 24 CI: passed.
• Live PostGIS validation: passed.
• pnpm verify, pnpm release:check, pnpm release:hardening, and pnpm package:dry-run: passed in the production publish job.
• Production npm publication: passed; all 19 expected versions were verified on the public registry.
• Signed npm provenance was generated and published to the transparency log during package publication.

Source

• Release commit: a2593d074ee195c98b7e01471f81d9553337a69c
• Production Release workflow

TerritoryKit 2.1.0

TerritoryKit 2.1.0 publishes the Sprint 1-3 production spatial workflow set to npm.

Highlights:

• Production territory identity, dataset versioning, and geometry versioning primitives.
• Point-to-territory, bounds/viewport, hierarchy, adjacency, and route-to-territory workflows.
• Exact polygon-intersection route support and sampled route workflows.
• MapLibre production delivery controls, simplification, stable feature IDs, and registry-backed GeoJSON source creation.
• React Native offline/cache hardening with dataset version mismatch protection.
• NestJS/PostGIS repository hardening, schema/import helpers, viewport, point, hierarchy, adjacency, and route SQL workflows.
• New @territory-kit/migration@2.1.0 package and territory migrate-spatial CLI.
• H3 removal readiness and release hardening evidence.

Published packages:

• @territory-kit/adapter-core@2.1.0
• @territory-kit/cli@2.1.0
• @territory-kit/core@2.1.0
• @territory-kit/data-de@2.1.0
• @territory-kit/data-id@2.1.0
• @territory-kit/data-jp@2.1.0
• @territory-kit/data-tr@2.1.0
• @territory-kit/data-us@2.1.0
• @territory-kit/dataset@2.1.0
• @territory-kit/game@2.1.0
• @territory-kit/generators@2.1.0
• @territory-kit/leaflet@1.2.12
• @territory-kit/maplibre@2.1.0
• @territory-kit/migration@2.1.0
• @territory-kit/nestjs@2.1.0
• @territory-kit/openlayers@1.2.12
• @territory-kit/react-native@1.1.13
• @territory-kit/registry@2.1.0
• @territory-kit/runtime@2.1.0

Validation completed before and after publish:

• PR CI: Node 22, Node 24, Live PostGIS validation passed.
• Release workflow: format, lint, typecheck, test, build, bundle size, and npm publish passed.
• npm registry verification: all package versions and latest dist-tags match expected versions.
• Clean npm registry install smoke passed for ESM/CJS imports, migration API, and CLI help.