# Release checklist

Published versions: 0.2.0, 0.2.1, 0.3.0. Current release: 0.4.0 (tag `v0.4.0`).

The repository URL is configured as
`https://github.com/mrbeandev/dsh-short-tool-ids`. The package is licensed under
MIT. `prepublishOnly` still stops a publish if the license is missing or
`UNLICENSED`. Publish while logged into the npm account that owns the package.

1. Choose the package name/scope and verify npm availability/ownership.
2. Distribution license: MIT (done; LICENSE and package.json agree).
3. Confirm the repository, bugs and homepage metadata in package.json.
4. Review the supported DSH range (`TESTED_DSH_VERSIONS` / `SUPPORTED_DSH_RANGE`
   in `index.mjs`) and keep the README "Supported DSH versions" table in step.
5. Run `npm test`, then `npm run test:integration` with DSH_TEST_HARNESS_ENTRY set,
   once per tested DSH version (see LOCAL-SETUP.md).
6. Verify the Settings → Short tool-call IDs tab and a real session using the
   packed tarball in an isolated DSH_HOME, on the newest and oldest tested DSH.
7. Run `npm run pack:check` and inspect every packed file: no credentials, private
   session history, machine-local patch, cache or absolute user paths. Synthetic
   regression tests and source/build scripts are intentionally included.
8. Bump the version. Publish only on explicit owner instruction.

After those gates are complete, publish the public package with:

```bash
npm publish --access public
```

Users can then install it into the Web profile with:

```bash
dsh plugin --profile web add dsh-short-tool-ids
```

`prepublishOnly` refuses publication if the distribution license is missing or
`UNLICENSED`. The repository metadata is already configured.
No build system is required for the current server-side ESM sources. Any browser
entry must be built and verified before including it in the package's files list.