# Releasing

This repository is pre-1.0. Workspace packages remain private until a
deliberate release change flips that policy. Never publish from a dirty tree
or from an unreviewed generated-output diff.

## Preflight

From a committed release branch, verify the frozen versions, generated output,
package manifests, and packed artifacts:

```bash
vp check
vp test
vp run check-goldens
vp run check-pack-manifests
vp run build
vp run --no-cache check-clean-worktree
```

`vp run build` includes the recursive package build and packed-artifact smoke
checks. The clean-worktree guard is intentionally uncached and should be the
last pre-publish check. Also review the release notes, provider support
matrix, security notes, and known limitations.

## Publish order

When the release owner deliberately changes all publishable manifests from
private to public and assigns one shared version, publish in dependency
order:

1. `@klyro/core`
2. `@klyro/catalog` and `@klyro/renderer-compose`
3. `@klyro/platform-node`
4. `@klyro/cli`

Use the repository's configured npm account, public access policy, 2FA, and
provenance/SBOM controls where available. Publish each package with the
workspace package manager, wait for its registry metadata to become
available, and verify that the next package resolves the released dependency
versions.

## Post-publish verification

From a clean temporary directory, verify the published CLI through the
supported entry points (`npm`, `npx`, and `pnpm dlx`) and run:

```bash
klyro --help
klyro --version
klyro validate --config klyro.yaml
klyro plan --config klyro.yaml
klyro generate --config klyro.yaml --out ./generated
```

Inspect the generated project, run `docker compose config` when Docker is
available, and confirm that no secret values entered the source, artifacts,
or diagnostics.

Tag the exact commit only after these checks pass. Do not reuse a published
version for a correction; follow the registry's deprecation policy and
publish a new version instead.