release: publish dsh-resend-mcp to npm and a public mirror #2

New issue

Closed

opened 2026-10-22 19:06:31 +00:00 by dsh · 2 comments

dsh commented

2026-10-22 19:06:31 +00:00

Owner

Context

The plugin installs via a local path or packed tarball. Resend's docs and external users need a public artifact (npm package and/or public repository) before outreach. The current environment has no npm credentials and the Forgejo repo is private.

Acceptance criteria

Decide distribution: npm package dsh-resend-mcp, public GitHub mirror, or both.
Ensure the published tarball contains lib/, locale/, icon.svg, cordis.patch.yml, README, LICENSE, and no secrets.
Tag v0.1.0 and attach release notes (install command, credential setup, presets).
Verify install from the public artifact on a clean profile.
Update README install section and docs/outreach.md links.

Blocked by

npm auth / public infrastructure access (not available in the implementing session).

## Context The plugin installs via a local path or packed tarball. Resend's docs and external users need a public artifact (npm package and/or public repository) before outreach. The current environment has no npm credentials and the Forgejo repo is private. ## Acceptance criteria - [ ] Decide distribution: npm package `dsh-resend-mcp`, public GitHub mirror, or both. - [ ] Ensure the published tarball contains `lib/`, `locale/`, `icon.svg`, `cordis.patch.yml`, README, LICENSE, and no secrets. - [ ] Tag `v0.1.0` and attach release notes (install command, credential setup, presets). - [ ] Verify install from the public artifact on a clean profile. - [ ] Update README install section and `docs/outreach.md` links. ## Blocked by - npm auth / public infrastructure access (not available in the implementing session).

dsh referenced this issue

2026-10-23 00:57:34 +00:00

ci: add Forgejo Actions workflow for tests and pack #1

dsh commented

2026-10-23 00:57:35 +00:00

Author

Owner

Forgejo can host npm packages, and it now does.

Done (2026-10-23):

.forgejo/workflows/publish.yml publishes on v* tags only, after checking that the tag equals v + package.json version.
Uses repository secret NPM_TOKEN (Forgejo token with write:package). Note: Forgejo 17 does not expose a gitea/automatic token context; the workflow schema rejects it, so the secret is required.
dsh-resend-mcp@0.1.0 published from tag v0.1.0 (commit 98e6e23); package appears under dsh-plugins in the registry.
Forgejo release v0.1.0 — initial release created.
docs/publishing.md explains the flow for non-npm people, including token scopes, unscoped-vs-scoped registries, and troubleshooting.

Still open:

npmjs account + granular token for a truly public one-line install (dsh plugin add dsh-resend-mcp).
Public mirror or public repo, since the Forgejo repo is private and its packages are not anonymously installable.
Install-from-registry verification on a clean profile (overlaps #5).

The Forgejo registry is useful as an internal artifact and a rehearsal, but it does not unblock outreach to Resend by itself.

Forgejo can host npm packages, and it now does. **Done (2026-10-23):** - `.forgejo/workflows/publish.yml` publishes on `v*` tags only, after checking that the tag equals `v` + `package.json` version. - Uses repository secret `NPM_TOKEN` (Forgejo token with `write:package`). Note: Forgejo 17 does not expose a `gitea`/automatic token context; the workflow schema rejects it, so the secret is required. - `dsh-resend-mcp@0.1.0` published from tag `v0.1.0` (commit `98e6e23`); package appears under `dsh-plugins` in the registry. - Forgejo release `v0.1.0 — initial release` created. - `docs/publishing.md` explains the flow for non-npm people, including token scopes, unscoped-vs-scoped registries, and troubleshooting. **Still open:** - npmjs account + granular token for a truly public one-line install (`dsh plugin add dsh-resend-mcp`). - Public mirror or public repo, since the Forgejo repo is private and its packages are not anonymously installable. - Install-from-registry verification on a clean profile (overlaps #5). The Forgejo registry is useful as an internal artifact and a rehearsal, but it does not unblock outreach to Resend by itself.

dsh commented

2026-10-23 10:24:42 +00:00

Author

Owner

npmjs publishing is live.

Tag v0.1.0 (moved to dcefcd8) published dsh-resend-mcp@0.1.0 through .forgejo/workflows/publish-npmjs.yml and NPMJS_TOKEN.
npm view dsh-resend-mcp version → 0.1.0; public page: https://www.npmjs.com/package/dsh-resend-mcp
Downloaded tarball has 13 files (same contents as the Forgejo build); no secrets.
publish.yml now skips a version already present, so re-running a tag is safe.
Clean-profile install from npmjs succeeded:
DSH_HOME=<tmp> dsh plugin --profile clean add dsh-resend-mcp@0.1.0 → real 0.1.0 directory.
DSH's runtime resolver supplies the peers from the installation scope (schemastery 3.18.5, dsh-tools/dsh-mcp-client 0.2.0-rc.2, @modelcontextprotocol/client 2.0.0); the profile loads without skipped bundles.
The live web profile was switched from the link: checkout to the npmjs install; it needs one Host restart to load it.

The public source mirror is split into #7. Closing this issue as the npm package part is done.

npmjs publishing is live. - Tag `v0.1.0` (moved to `dcefcd8`) published `dsh-resend-mcp@0.1.0` through `.forgejo/workflows/publish-npmjs.yml` and `NPMJS_TOKEN`. - `npm view dsh-resend-mcp version` → `0.1.0`; public page: https://www.npmjs.com/package/dsh-resend-mcp - Downloaded tarball has 13 files (same contents as the Forgejo build); no secrets. - `publish.yml` now skips a version already present, so re-running a tag is safe. - Clean-profile install from npmjs succeeded: `DSH_HOME=<tmp> dsh plugin --profile clean add dsh-resend-mcp@0.1.0` → real `0.1.0` directory. - DSH's runtime resolver supplies the peers from the installation scope (`schemastery` 3.18.5, `dsh-tools`/`dsh-mcp-client` 0.2.0-rc.2, `@modelcontextprotocol/client` 2.0.0); the profile loads without skipped bundles. - The live `web` profile was switched from the `link:` checkout to the npmjs install; it needs one Host restart to load it. The public source mirror is split into #7. Closing this issue as the npm package part is done.

dsh closed this issue

2026-10-23 10:25:04 +00:00