Release flow

The release source of truth is .changeset/config.json, .changeset/pre.json, .github/workflows/release.yml, and the release tasks in vite.config.ts.

Publishable workspaces

All other workspaces are private. These five packages are one Changesets fixed group and always publish at the same stable version, including no-code bumps.

Add a Changeset

When a PR changes consumer-facing behavior in a public package:

vp run changeset

Select the affected package, choose the semver change, and describe the user impact. Do not edit package.json versions in a feature PR.

Version and publish

On pushes to master, the release workflow opens a version PR when pending Changesets exist. Merging that PR publishes through the protected npm environment's granular NPM_TOKEN.

The workflow aligns the fixed group's latest dist-tags after publishing. Historical alpha artifacts and tags remain immutable audit history. Treat the workflow itself as the authority if this process changes.

Consumer versioning

Pin exact versions and keep installed public Capxul packages on one version:

CAPXUL_VERSION="$(npm view @capxul/sdk dist-tags.latest)"
npm install --save-exact @capxul/sdk@"$CAPXUL_VERSION" @capxul/sdk-react@"$CAPXUL_VERSION" @capxul/observability@"$CAPXUL_VERSION"

Check capability status before upgrading. npm versions are immutable: repair a bad publish with a new version, never by replacing an existing one.

Break-glass release

The named local release task is for an intentional operator-controlled fallback after verification and versioning:

vp run release:local

A specifically ruled integration release adds --allow-any-branch only after asserting the reviewed clean branch and exact green SHA.

Do not bypass the full gate, publish unversioned feature work, or infer that a successful package build proves registry installation or live behavior.