Skip to content

TerritoryKit 3.0.0

Latest
Latest

Choose a tag to compare

View all tags
@mberatkaya mberatkaya released this 01 Oct 17:33
v3.0.0
a2593d0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

TerritoryKit 3.0.0

TerritoryKit 3.0.0 completes the current production publishing and Turkey delivery milestone.

Highlights

  • Adds source-aware Turkey V2 delivery metadata to MVT tiles, including parent ADM2 and source version, and a deterministic manifest for tile, shard, attribution, adjacency, index, and source-lock checksums.
  • Adds @territory-kit/runtime/turkey-v2-delivery district resolution with shard size and SHA-256 checks, dataset/version and parent validation, explicit estimated-boundary control, cache identity, attribution selection, and neighbor lookup.
  • Adds CLI delivery-manifest, inspect, and source-diff operations to inventory artifacts and audit changed source locks and affected provinces before a candidate rebuild.
  • Hardens registry and delivery trust boundaries with manifest validation and pinning, bounded downloads, HTTPS and same-origin defaults, and Node redirect and private-network checks.
  • Hardens the guarded release path and records deterministic Turkey benchmark evidence that can be verified in a clean CI checkout without regenerating canonical geometry.

The Turkey V2 2.1.0-rc.7 national dataset remains a separate dataset candidate; this npm package release does not promote or bundle the large national geometry or tile artifacts.

Breaking changes

@territory-kit/registry@3.0.0 now requires HTTPS for remote registries and same-origin artifact URLs by default. Existing trusted HTTP, local-file, cross-origin, or private-network integrations must opt in explicitly with allowHttp, allowFile, allowedOrigins, or allowPrivateNetwork, as appropriate. A remote registry cannot select local artifact files. See the registry URL trust policy and security migration guidance. Use these exceptions only for endpoints you trust.

Published packages

  • @territory-kit/adapter-core@3.0.0
  • @territory-kit/cli@3.0.0
  • @territory-kit/core@3.0.0
  • @territory-kit/data-de@3.0.0
  • @territory-kit/data-id@3.0.0
  • @territory-kit/data-jp@3.0.0
  • @territory-kit/data-tr@3.0.0
  • @territory-kit/data-us@3.0.0
  • @territory-kit/dataset@3.0.0
  • @territory-kit/game@3.0.0
  • @territory-kit/generators@3.0.0
  • @territory-kit/maplibre@3.0.0
  • @territory-kit/nestjs@3.0.0
  • @territory-kit/registry@3.0.0
  • @territory-kit/runtime@3.0.0
  • @territory-kit/migration@2.1.1
  • @territory-kit/leaflet@1.2.13
  • @territory-kit/openlayers@1.2.13
  • @territory-kit/react-native@1.1.14

Migration, Leaflet, OpenLayers, and React Native received patch releases in the same release train to update workspace dependency ranges; their version numbers therefore differ from 3.0.0.

Validation

  • Node 22 CI: passed.
  • Node 24 CI: passed.
  • Live PostGIS validation: passed.
  • pnpm verify, pnpm release:check, pnpm release:hardening, and pnpm package:dry-run: passed in the production publish job.
  • Production npm publication: passed; all 19 expected versions were verified on the public registry.
  • Signed npm provenance was generated and published to the transparency log during package publication.

Source

Assets 2
Loading