Publish in dependency order

Release every public runtime dependency before the package that imports it.

Read the dependency graph first

@your-scope/quiz-sdk@0.1.0 ├── @your-scope/quiz-contracts@0.1.0 └── arktype@2.2.3

ArkType already exists on npm. Your contracts package does not. If you publish the SDK first, a consumer can download the SDK but installation fails when npm cannot find contracts.

Contracts is publicly downloadable but not the normal user-facing package. Consumers explicitly install the SDK, and their package manager installs contracts transitively.

Open the publication gate deliberately

Remove private: true only from contracts and SDK. Keep it in the API and workspace root.

git diff --check
pnpm test
pnpm typecheck
pnpm --filter @your-scope/quiz-contracts build
pnpm --filter @your-scope/quiz-sdk build
git status --short

Commit the release configuration before publication. pnpm's Git checks expect a clean state, and the commit records exactly what produced the release.

Publish contracts first

cd /absolute/path/to/quiz-sdk/packages/contracts

pwd
pnpm pkg get name version
pnpm publish --dry-run
pnpm publish --access public

Complete 2FA privately. A successful publish creates an immutable registry version. Verify it from the registry:

pnpm view \
  @your-scope/quiz-contracts \
  version dist-tags.latest dist.tarball

Stop after any error

Do not publish the SDK if contracts failed. Read the status code, correct authentication or package metadata, rebuild, and repeat the dry run.

Test the SDK tarball against published contracts

Pack the SDK again after contracts is live. Install that tarball in a clean temporary consumer. This proves the rewritten 0.1.0 dependency resolves from npm.

cd /absolute/path/to/quiz-sdk/packages/sdk

sdk_pack_dir=$(mktemp -d)
pnpm pack --pack-destination "$sdk_pack_dir"

consumer_dir=$(mktemp -d)
cd "$consumer_dir"
pnpm init
pnpm add "$sdk_pack_dir/your-scope-quiz-sdk-0.1.0.tgz"
pnpm list --depth 1

Run the runtime and type smoke tests from lesson eight before continuing.

Publish the SDK from its package directory

cd /absolute/path/to/quiz-sdk/packages/sdk

pwd
pnpm pkg get name version
pnpm publish --dry-run
pnpm publish --access public

The identity check matters because the previous step ended in a temporary consumer directory. Never rely on terminal memory before an irreversible command.

pnpm view \
  @your-scope/quiz-sdk \
  version dist-tags.latest dependencies

Install from the registry as a real user

final_consumer_dir=$(mktemp -d)
cd "$final_consumer_dir"
pnpm init
pnpm add @your-scope/quiz-sdk@0.1.0
pnpm list --depth 1

Repeat the runtime and TypeScript smoke tests. A registry install validates the exact artifact users receive, including registry metadata and transitive version resolution.

Record the release

git tag sdk-v0.1.0
git push origin main --tags

A tag connects the immutable npm version to a source commit. Use a tag pattern that distinguishes packages in a multi-package repository.

Official references

Check your understanding

  1. Why must contracts be published before the SDK?

    Show answer

    The packed SDK depends on a registry version of contracts. Consumers cannot complete installation until that version exists.

  2. Why print the package name immediately before publication?

    Show answer

    Many package and temporary directories contain valid manifests. Printing identity prevents publishing the wrong directory under an unintended name.