fix(release): keep rewritten workspace deps in registry metadata

Background
----------
Installing @razroo/parallel-mcp-postgres@0.1.0-beta.0 from npm could hang
npm's dependency resolver. The registry's package-metadata document listed
"@razroo/parallel-mcp": "file:../.." as the runtime dependency, even though
the published tarball had the correct "^0.4.0" range. When combined with
`pg`'s own transitive deps, npm's `placeDep` loop never terminated
(repeating `silly timing Tried to end timer that doesn't exist: idealTree:#root`
forever). @razroo/parallel-mcp-memory had the same bug in its metadata but
installed fine in isolation (single dep, no cycle to confuse the resolver);
it was still broken as a user-facing signal.

Root cause
----------
The adapter, testkit, and server publish lifecycle used `prepack` +
`postpack`:

    prepack     rewrite "@razroo/parallel-mcp": "file:.." -> "^0.4.x"
    pack        create tarball with the rewritten package.json
    postpack    restore the workspace-path version on disk
    publish     upload the tarball AND read the on-disk package.json for
                the registry metadata document

The tarball was correct (verified: `tar -xOf … package/package.json`),
but `postpack` ran BEFORE the metadata-upload step, so npm sent the
restored `file:..` entry to the registry. Most consumers never noticed
because npm 10 falls back to the tarball for install resolution — but
that fallback couldn't save postgres once `pg`'s transitive graph was in
the mix.

Fix
---
Move the restore from `postpack` to `postpublish` across all four
workspace packages (memory, postgres, testkit, server). `prepack` still
rewrites, the tarball is still correct, and now the on-disk package.json
stays rewritten through the full `npm publish` call — including the
registry-metadata upload. `postpublish` restores the workspace-path
version immediately after publish for local dev.

`pack:check` now manually invokes the postpack script at the end because
`npm pack --dry-run` alone does not trigger `postpublish`.

Version bumps
-------------
- @razroo/parallel-mcp-memory     0.1.0         -> 0.1.1
- @razroo/parallel-mcp-postgres   0.1.0-beta.0  -> 0.1.0-beta.1

npm does not allow republishing over an existing version, even to fix a
corrupt registry document, so these are fresh patch/beta bumps. No
behavior or API changes inside the adapters.

The same fix is applied to @razroo/parallel-mcp-testkit and
@razroo/parallel-mcp-server; their 0.4.0 documents still carry the stale
`file:..` but are not user-visibly broken (install works via tarball
fallback). They will pick up the corrected metadata on the next release
that bumps their versions.

release.yml
-----------
- Publish steps for core, server, and testkit now also skip if the
  version is already on npm, matching the adapter publish steps. Needed
  because this commit re-runs the v0.4.0 release with the same
  core/server/testkit versions but new adapter versions.
- The GitHub-release step now upserts (`gh release upload --clobber`
  when the release already exists, `gh release create` otherwise) so
  re-tagging v0.4.0 does not fail with "release already exists".

CHANGELOG
---------
New "Adapter patch releases" section at the top of CHANGELOG.md
documents the fix, the user-visible symptom, and the two version bumps.

Made-with: Cursor

Author: CharlieGreenman

.github/workflows/release.yml

@@ -105,22 +105,43 @@ jobs:
           PACKAGE_TGZ="$(npm pack --silent | tail -n 1)"
           echo "package_tgz=adapters/memory/${PACKAGE_TGZ}" >> "${GITHUB_OUTPUT}"
 
-      - name: Publish core to npm
+      - name: Publish core to npm (skip if version already published)
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --access public --provenance
+          PACKAGE_VERSION: ${{ steps.version.outputs.package_version }}
+        shell: bash
+        run: |
+          if [[ -n "$(npm view @razroo/parallel-mcp@${PACKAGE_VERSION} version 2>/dev/null)" ]]; then
+            echo "@razroo/parallel-mcp@${PACKAGE_VERSION} already on npm — skipping"
+            exit 0
+          fi
+          npm publish --access public --provenance
 
-      - name: Publish server to npm
+      - name: Publish server to npm (skip if version already published)
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PACKAGE_VERSION: ${{ steps.version.outputs.package_version }}
         working-directory: server
-        run: npm publish --access public --provenance
+        shell: bash
+        run: |
+          if [[ -n "$(npm view @razroo/parallel-mcp-server@${PACKAGE_VERSION} version 2>/dev/null)" ]]; then
+            echo "@razroo/parallel-mcp-server@${PACKAGE_VERSION} already on npm — skipping"
+            exit 0
+          fi
+          npm publish --access public --provenance
 
-      - name: Publish testkit to npm
+      - name: Publish testkit to npm (skip if version already published)
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PACKAGE_VERSION: ${{ steps.version.outputs.package_version }}
         working-directory: testkit
-        run: npm publish --access public --provenance
+        shell: bash
+        run: |
+          if [[ -n "$(npm view @razroo/parallel-mcp-testkit@${PACKAGE_VERSION} version 2>/dev/null)" ]]; then
+            echo "@razroo/parallel-mcp-testkit@${PACKAGE_VERSION} already on npm — skipping"
+            exit 0
+          fi
+          npm publish --access public --provenance
 
       - name: Publish postgres adapter to npm (skip if version already published)
         env:
@@ -148,14 +169,26 @@ jobs:
           fi
           npm publish --access public --provenance
 
-      - name: Create GitHub release
+      - name: Create or update GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
         run: |
-          gh release create "${GITHUB_REF_NAME}" \
-            "${{ steps.pack_core.outputs.package_tgz }}" \
-            "${{ steps.pack_server.outputs.package_tgz }}" \
-            "${{ steps.pack_testkit.outputs.package_tgz }}" \
-            "${{ steps.pack_postgres.outputs.package_tgz }}" \
-            "${{ steps.pack_memory.outputs.package_tgz }}" \
-            --generate-notes
+          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
+            echo "Release ${GITHUB_REF_NAME} exists — uploading assets with --clobber"
+            gh release upload "${GITHUB_REF_NAME}" \
+              "${{ steps.pack_core.outputs.package_tgz }}" \
+              "${{ steps.pack_server.outputs.package_tgz }}" \
+              "${{ steps.pack_testkit.outputs.package_tgz }}" \
+              "${{ steps.pack_postgres.outputs.package_tgz }}" \
+              "${{ steps.pack_memory.outputs.package_tgz }}" \
+              --clobber
+          else
+            gh release create "${GITHUB_REF_NAME}" \
+              "${{ steps.pack_core.outputs.package_tgz }}" \
+              "${{ steps.pack_server.outputs.package_tgz }}" \
+              "${{ steps.pack_testkit.outputs.package_tgz }}" \
+              "${{ steps.pack_postgres.outputs.package_tgz }}" \
+              "${{ steps.pack_memory.outputs.package_tgz }}" \
+              --generate-notes
+          fi

CHANGELOG.md

@@ -8,6 +8,30 @@ and [Semantic Versioning](https://semver.org/spec/v2.0.0.html). All three
 workspace packages share a single version line: a release tagged `vX.Y.Z`
 publishes all three at the same version.
 
+## Adapter patch releases — 2026-04-18
+
+### `@razroo/parallel-mcp-memory@0.1.1` + `@razroo/parallel-mcp-postgres@0.1.0-beta.1`
+
+- **Fix**: `npm install @razroo/parallel-mcp-postgres@0.1.0-beta.0` could hang
+  in npm's dependency resolver because the registry metadata document for that
+  release still listed `"@razroo/parallel-mcp": "file:../.."` as a runtime
+  dependency. The published tarball already contained the correct rewritten
+  `"^0.4.0"` range, but npm resolves from the registry document first when it
+  has to reconcile other deps (e.g. `pg`), and the workspace-path entry sent
+  it into an infinite `placeDep` loop. Root cause: the adapter publish
+  lifecycle ran `postpack` between `pack` and the metadata upload, restoring
+  the original workspace-path dependency on disk before npm read it for the
+  registry document. Both adapters now run the restore script from
+  `postpublish` instead, so the rewritten `package.json` stays in place
+  through the registry upload. The same fix is mirrored in
+  `@razroo/parallel-mcp-server` and `@razroo/parallel-mcp-testkit`, which
+  were unaffected in practice (their consumers fall through to the tarball)
+  but were carrying the same stale workspace-path in their registry
+  documents.
+- No behavior or API changes inside the adapter code. Republishing under new
+  patch/beta numbers because npm does not allow re-publishing over an
+  existing version, even to fix a broken registry document.
+
 ## [0.4.0] - 2026-04-18
 
 ### Added

adapters/memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@razroo/parallel-mcp-memory",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Minimal in-memory AsyncParallelMcpStore reference adapter for @razroo/parallel-mcp",
   "license": "MIT",
   "type": "module",
@@ -37,9 +37,9 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "prepack": "node ./scripts/prepack.mjs",
-    "postpack": "node ./scripts/postpack.mjs",
+    "postpublish": "node ./scripts/postpack.mjs",
     "prepublishOnly": "npm run check && npm test && npm run build",
-    "pack:check": "npm run prepublishOnly && npm pack --dry-run"
+    "pack:check": "npm run prepublishOnly && npm pack --dry-run; node ./scripts/postpack.mjs"
   },
   "keywords": [
     "mcp",

adapters/postgres/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@razroo/parallel-mcp-postgres",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.1",
   "description": "Postgres adapter for @razroo/parallel-mcp — full AsyncParallelMcpStore implementation",
   "license": "MIT",
   "type": "module",
@@ -41,9 +41,9 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "prepack": "node ./scripts/prepack.mjs",
-    "postpack": "node ./scripts/postpack.mjs",
+    "postpublish": "node ./scripts/postpack.mjs",
     "prepublishOnly": "npm run check && npm test && npm run build",
-    "pack:check": "npm run prepublishOnly && npm pack --dry-run"
+    "pack:check": "npm run prepublishOnly && npm pack --dry-run; node ./scripts/postpack.mjs"
   },
   "keywords": [
     "mcp",

package-lock.json

@@ -45,9 +45,9 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "prepack": "node ./scripts/prepack.mjs",
-    "postpack": "node ./scripts/postpack.mjs",
+    "postpublish": "node ./scripts/postpack.mjs",
     "prepublishOnly": "npm run check && npm test && npm run build",
-    "pack:check": "npm run prepublishOnly && npm pack --dry-run"
+    "pack:check": "npm run prepublishOnly && npm pack --dry-run; node ./scripts/postpack.mjs"
   },
   "keywords": [
     "mcp",

server/package.json

@@ -37,9 +37,9 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "prepack": "node ./scripts/prepack.mjs",
-    "postpack": "node ./scripts/postpack.mjs",
+    "postpublish": "node ./scripts/postpack.mjs",
     "prepublishOnly": "npm run check && npm test && npm run build",
-    "pack:check": "npm run prepublishOnly && npm pack --dry-run"
+    "pack:check": "npm run prepublishOnly && npm pack --dry-run; node ./scripts/postpack.mjs"
   },
   "keywords": [
     "mcp",