# Releasing

`dsh-statecore` depends on `statecore-mcp` from npm. When a release needs an
engine-side addition (the way `0.2.0` needs `statecore-mcp@0.3.0`'s
`MemoryBackend.digestNow()`), the engine publish must land first — during
development the dependency may temporarily read `file:../StateCore/apps/mcp`
(sibling checkout), and the release swaps it back to a published semver.

Both publishes are human-gated (npm OTP; no CI automation performs them). Run
them in this order.

## 1. Publish `statecore-mcp` (StateCore repo, when the release needs it)

In the `StateCore` sibling checkout:

```sh
git checkout main && git pull
pnpm install --frozen-lockfile
pnpm run db:generate
pnpm run build            # rebuilds packages/db, packages/core, packages/prompts, apps/mcp
pnpm --filter statecore-mcp test
cd apps/mcp
npm publish --otp=<code>  # prepublishOnly runs `pnpm run bundle` (tsup). Since statecore-mcp
                            # 1.0.0 there is no postinstall and nothing to copy: the package
                            # is dist/ + README + server.json. Public access is npm's default
                            # for an unscoped package name, so no --access flag is needed.
```

Verify the publish landed before continuing: `npm view statecore-mcp version`
should print the new version.

## 2. Swap the dependency and publish `dsh-statecore`

In this repo:

```sh
# package.json: replace any file: path with the real semver range, e.g.
#   "statecore-mcp": "file:../StateCore/apps/mcp"  ->  "^0.3.0"
pnpm install                # resolves the published tarball; lockfile updates
npm run lint && npm test    # both green against the published dependency
npm run build
git commit -am "release: <version> (statecore-mcp@^<engine version>)"
git push
npm publish --otp=<code>    # public, unscoped publish by default — no --access flag
```

Verify: `npm view dsh-statecore version` prints the new version, and a fresh
`npm install dsh-statecore` in an empty directory outside both repos pulls the
published `statecore-mcp` as a transitive dependency (no `file:` path inside
`node_modules/dsh-statecore/package.json`).

## 3. After both land

- Confirm CI is green on the pushed commit. The workflow installs from npm
  and additionally builds the sibling StateCore checkout (both Prisma clients
  generated) for source-linked coverage.
- Update the README compatibility matrix if the dsh rc pin moved.

## Announcing

Discord/Discussions posts and any other public announcement are human-gated
and out of scope for this repository's automation — this document only covers
the `npm publish` steps and their prerequisite dependency swap.