# Releasing

This package follows semver and publishes a GitHub release for every public version. The npm package is scoped and must be public.

## Support matrix

| Component | V0.1.x support |
| --- | --- |
| Node.js | `>=22` |
| Cordis | `^4.0.1` |
| DeepSeek Harness core peers | `^0.1.0-rc.6` |
| Package format | ESM source plus `cordis.patch.yml` |

The peer ranges intentionally track the current Harness developer-preview line. Harness is still pre-1.0, so compatibility-breaking changes may require a new plugin patch release or coordinated update. If a peer range drifts, install the plugin in a clean profile and run the smoke checks before upgrading a production profile.

## Pre-release checklist

From a clean checkout:

```sh
npm ci
npm run verify
npm pack --dry-run
```

The CI workflow runs these checks on pushes and pull requests. The release workflow repeats them against the release tag.

For a local profile smoke test, use the installed Harness CLI and a temporary home:

```sh
tmp_home="$(mktemp -d)"
trap 'rm -rf "$tmp_home"' EXIT
DSH_HOME="$tmp_home" dsh plugin --profile smoke add .
DSH_HOME="$tmp_home" dsh --profile smoke --dump-config | grep fullstack-expert
```

The profile command requires `pnpm` on `PATH`; the Harness CLI uses it to manage out-of-tree profile dependencies. A successful dump proves package resolution and patch-layer composition. It does not prove a model request or browser runtime. CI installs the pinned `@deepseek-ai/dsh@0.1.0-rc.6` CLI and `pnpm@11.7.0` before running this smoke test.

## GitHub release

1. Update `version` in `package.json` and `CHANGELOG.md`.
2. Run the clean-checkout commands above.
3. Commit and push the version change.
4. Create a tag/release matching the package version, for example `v0.1.1`:

   ```sh
   gh release create v0.1.1 --target main --title 'v0.1.1' --notes-file CHANGELOG.md
   ```

5. Confirm the release workflow passes.

## npm publication

The package is configured with:

```json
"publishConfig": { "access": "public" }
```

The package is currently published under the `@deepseek-ai` scope. Publishing requires an npm account authorized for that scope; GitHub authentication alone is not sufficient.

Authenticate as an account authorized to publish the `@deepseek-ai` scope, then publish the exact checked-out version:

```sh
npm login
npm publish --access public
npm view @deepseek-ai/fullstack-expert version
```

Do not republish a version that already exists. npm versions are immutable; bump the patch version for corrections.

The GitHub release workflow contains an opt-in `publish-npm` job. Enable it only after configuring npm trusted publishing or the repository's secret/token setup according to your npm organization policy and setting the repository variable `NPM_PUBLISH_ENABLED=true`. The current workflow deliberately does not assume a secret or silently publish from arbitrary tags.

## Post-release smoke test

After npm publication, verify the public artifact from a clean temporary consumer:

```sh
consumer="$(mktemp -d)"
trap 'rm -rf "$consumer"' EXIT
cd "$consumer"
npm init -y >/dev/null
npm install @deepseek-ai/fullstack-expert@0.1.1
node -e "import('@deepseek-ai/fullstack-expert').then(({ name }) => { if (name !== 'fullstack-expert') process.exit(1); console.log(name) })"
```

Then install that exact version into a disposable Harness profile and confirm `dsh --profile <name> --dump-config` contains the `fullstack-expert` row.