chore(deps): update @passiveintent/core to latest version in demo pac…

.github/workflows/post-publish-lockfile.yml

@@ -0,0 +1,42 @@
+name: post-publish / refresh lockfile
+
+# Runs after a release tag is pushed. Resolves "latest" in demo package.json
+# files to the newly published version and commits the updated lock file,
+# so npm ci never fails on the next CI run.
+
+permissions:
+  contents: write
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  refresh-lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Refresh lock file
+        run: npm install --package-lock-only
+
+      - name: Commit if changed
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git diff --quiet package-lock.json || (
+            git add package-lock.json &&
+            git commit -m "chore: refresh lock file after ${GITHUB_REF_NAME} publish"
+          )
+
+      - name: Push
+        run: git push origin main

PUBLISHING.md

@@ -51,25 +51,36 @@ npm version patch
 - `package-lock.json`
 - `CHANGELOG.md`
 
-Update these only when needed for compatibility or StackBlitz:
-
-- `demo/package.json`
-- `demo-react/package.json`
+Do **not** change `demo/package.json` or `demo-react/package.json` — both use `"latest"` which always resolves to the newest published version automatically.
 
 ## Demo / StackBlitz Rules
 
-- minor or patch core release: no `demo/package.json` change is needed because `@passiveintent/core` is already `^1.0.0`, which accepts later `1.x` versions
-- minor or patch React release: no `demo-react/package.json` change is needed because both package ranges are already `^1.0.0`
-- major core release: update `demo/package.json` to `@passiveintent/core@^X.0.0`
-- major React release: update `demo-react/package.json` to `@passiveintent/core@^X.0.0` and `@passiveintent/react@^X.0.0`
-- if `@passiveintent/react` starts requiring a newer minimum core minor, update `demo-react/package.json` and `packages/react/package.json` to that minimum compatible range
+Both demos pin their dependencies to `"latest"`:
+
+```json
+"@passiveintent/core": "latest"
+"@passiveintent/react": "latest"
+```
+
+This means:
+
+- No `demo/package.json` or `demo-react/package.json` changes are ever needed on release
+- StackBlitz always installs the newest published version
+- The only required post-publish step is refreshing `package-lock.json` (see below), so `npm ci` in CI resolves to the new version instead of the previously locked one
 
-Practical rule:
+**After every publish**, run:
 
-- StackBlitz does not care about the demo app's own `version`
-- StackBlitz only cares that the dependency ranges in `demo/package.json` and `demo-react/package.json` can resolve the published npm packages
-- for normal `1.x` minor and patch releases, the existing `^1.0.0` ranges are enough
-- only change the demo dependency ranges when the published package compatibility range changes
+```bash
+npm install --package-lock-only
+git add package-lock.json
+git commit -m "chore: refresh lock file after vX.Y.Z publish"
+```
+
+If you forget this step, CI will fail with:
+
+```text
+npm error Missing: @passiveintent/core@X.Y.Z from lock file
+```
 
 ## Release Checks
 

demo-react/package.json

@@ -10,8 +10,8 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@passiveintent/core": "^1.0.0",
-    "@passiveintent/react": "^1.0.0",
+    "@passiveintent/core": "latest",
+    "@passiveintent/react": "latest",
     "react": "^19.2.4",
     "react-dom": "^19.2.4"
   },

demo/package.json

@@ -10,7 +10,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
-    "@passiveintent/core": "^1.0.0"
+    "@passiveintent/core": "latest"
   },
   "devDependencies": {
     "typescript": "^5.6.3",