How to release a new version — Dokumentasi

Releases use Changesets with one fixed group, so every @samveys/* package always has the same version.

With every pull request that users would notice, add a changeset:
sh
```
pnpm changeset
```
Pick the bump by the compatibility promise:
- patch for fixes;
- minor for new features and deprecations;
- major only for removals of APIs that were deprecated in an earlier minor.

To deprecate an API, keep it working and wrap it so it warns once per process with a stable code:

import { deprecated } from '@samveys/core'

/** @deprecated Use `newApi()`. Removed in 2.0.0. */
export const oldApi = deprecated({ code: 'SVS_DEP001', message: 'oldApi() is deprecated; use newApi().', removedIn: '2.0.0' }, newApi)

Codes are never reused. List each one in the release notes.

The release manager runs pnpm changeset version. Every package moves to the same new version, and each gets its own CHANGELOG.md.
CI must be green (.gitea/workflows/ci.yml): typecheck, lint, licences, code owners, the type-check and startup budgets, the test suite, the database engines when the runner has Docker, and the 85 % coverage gate.
Commit the version change, tag it and push both:
sh
```
git commit -am "chore(release): 1.2.0"
git tag -a v1.2.0 -m "v1.2.0"
git push && git push origin v1.2.0
```
The tag runs .gitea/workflows/publish.yml, which builds every package and publishes it to the Gitea npm registry (owner sadata, access: restricted) with the repository secret NPM_TOKEN (a token with the package write permission). Versions that already exist are skipped, so a re-run is safe. To rehearse without uploading, run the workflow by hand with dry_run set to true.
Apps install from the registry: svs new writes @samveys:registry=https://registry.sadata.dev/api/packages/sadata/npm/ in the project .npmrc. The sadata organization is public, so packages install without a token, while the samveys repository stays private (Gitea grants package read access by the owner's visibility, not the repository's). If the organization is made private again, a token is needed: never in the project .npmrc (pnpm ignores credentials there), but in ~/.npmrc as //registry.sadata.dev/api/packages/sadata/npm/:_authToken=${SAMVEYS_NPM_TOKEN}, in the generated CI through the SAMVEYS_NPM_TOKEN secret, and in Docker as a build secret. Do not send an empty or wrong token to the public registry: it answers 401.
Before tagging, scripts/publish-paths.test.ts checks that every published exports and bin path is built and shipped; to see what a package really contains, pnpm build then pnpm pack in its folder.

Support window (proposal):

Each major gets 18 months of bug fixes and 2 years of security fixes.
Each major supports one minimum Node.js LTS (26 for 1.x).