# Release guide

## 1. Prepare

1. Update the version in `package.json` and `extension/manifest.json`.
2. Run `npm ci` and `npm run build`.
3. Confirm `npm run check` reports that every generated install copy matches
   `shared/`.

## 2. Verify

Run the repository gates:

```sh
npm run check
npm run test:browser
npm run package:extension
```

For native verification, integrate into the pinned Harness checkout, run its
Host and Client builds, start `pnpm dsh web`, and then run:

```sh
npm run capture
```

The capture job tests the sidebar launcher, live controls, persistence after
reload, and the wide-window Settings stacking regression before regenerating
the committed PNG/GIF gallery. Visually review every file in
`docs/screenshots/`.

## 3. Publish GitHub artifacts

Commit the source and generated gallery, push the tag `vX.Y.Z`, then create a
GitHub Release. Attach `release/open-sea-skin-extension-X.Y.Z.zip`, generated by
`npm run package:extension`, and `open-sea-skin-X.Y.Z.tgz`, generated by
`npm pack`. The tarball is the self-contained DSH marketplace bundle; the
repository source also contains the static and native-source installers.

Release notes should identify the tested Harness commit, describe migrations,
and remind static-install users to run `install-skin.sh --update` after a
Harness upgrade.

## 4. Publish the DSH Desktop package

The repository root is also the npm package consumed by DSH Desktop's managed
plugin installer. It is deliberately public and has `publishConfig.access`
set to `public`; `prepublishOnly` rebuilds and verifies every generated DSH
asset before npm accepts the package.

For a manual first publish, authenticate with the npm account that owns the
package and run:

```sh
npm login
npm publish --access public
```

For repeatable releases, add an `NPM_TOKEN` repository secret and publish a
GitHub Release whose tag matches the version in `package.json`. The workflow
in `.github/workflows/npm-publish.yml` publishes only release events or an
explicit manual dispatch, never ordinary pushes or pull requests. The manual
dispatch also supports publishing an already-existing release tag such as
`v1.2.2`. After npm finishes indexing, DSH Desktop can install the exact
published version; GitHub-tag installation remains a working fallback.

## 5. Optional Chrome Web Store submission

Upload the same extension ZIP through a Chrome Web Store developer account.
The listing privacy answers are: no data collection or sale; no remote code;
`storage` saves preferences; loopback host access skins a locally running
Harness. Keep [privacy.md](privacy.md) linked from the listing and retain the
three.js MIT and Geist OFL notices in the package.