Lifecycle

@lemn-ltd/ui follows SemVer for the published package.

• PATCH: bug fixes, internal implementation fixes, docs corrections, and non-breaking visual polish.
• MINOR: new components, new exports, new variants, additive props, and non-breaking behavior.
• MAJOR: removed exports, renamed props, changed semantics, or visual/behavior changes that require consumer migration.

Release ownership

Feature authors or agents add a changeset to describe the release intent. The release automation turns merged changesets into a release metadata commit that updates packages/ui/package.json and packages/ui/CHANGELOG.md.

All Changesets operations use the catalogued pnpm changeset ... wrapper. The wrapper guards version before mutation. pnpm exec changeset version invokes the dependency binary outside package-script governance and is not a supported release path.

The production workflow completes its non-mutating, scoped Cloudflare account API token preflight before Changesets can version, push, or publish anything. The token has only Workers Scripts: Edit on Account Lemn DEV and Zone: Read on Zone le-mn.com. It then captures the release commit SHA and deploys that exact SHA and package version. The same main-only guard protects direct CLI entrypoints, so credentials in a feature checkout cannot authorize a version, package publication, or deploy.

CI publishes the package only when an authenticated GitHub Packages version list omits the exact generated version and package scope matches repository ownership. An unverifiable registry state fails closed before publication.

Commands

pnpm changeset:add
pnpm version:packages
pnpm release

Run production mutation commands only from main. pnpm publish:ui builds the package, then prepublishOnly requires all export targets and completes the strict tarball install, TypeScript, and Vite consumer smoke before npm can publish immutable package metadata.

Use prerelease versions only for explicit staged rollouts.