feat: changesets-based release automation

.changeset/README.md

@@ -0,0 +1,19 @@
+# Changesets
+
+Releases are automated with [changesets](https://github.com/changesets/changesets).
+
+- PRs that change anything under `packages/` should include a changeset: run
+  `pnpm changeset`, pick the affected packages and bump levels, and commit the
+  generated file. Docs/CI-only changes don't need one.
+- On every push to `main`, CI maintains a **Version Packages** PR carrying all
+  pending bumps and changelogs. Merging that PR publishes to npm, tags, and
+  creates GitHub Releases. Merge it whenever a release should go out.
+- All packages are 0.x: a **patch** is the normal bump; a **minor** signals a
+  breaking change (it escapes consumers' `^` ranges).
+- Packages that runtime-depend on a bumped package are patch-bumped
+  automatically — don't add changesets for them.
+- Internal `peerDependencies` use hand-maintained bounded ranges (e.g.
+  `">=0.3.0 <0.4.0"`), never `workspace:` protocol. If your change makes a
+  package require a newer version of an internal peer, move that window in the
+  same PR. See `docs/openui-release-management.md` in the design docs repo for
+  the full rationale.

.changeset/bounded-internal-peer-ranges.md

@@ -0,0 +1,9 @@
+---
+"@openuidev/assistant-ui": patch
+"@openuidev/devtools": patch
+---
+
+Internal `@openuidev/*` peer dependencies now declare bounded
+tested-compatibility ranges (e.g. `">=0.3.0 <0.4.0"`) instead of `workspace:`
+ranges, so a mismatched pair is caught at install time instead of failing at
+runtime.

.changeset/config.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "thesysdev/openui" }],
+  "commit": false,
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "fixed": [
+    [
+      "@openuidev/lang-core",
+      "@openuidev/react-lang",
+      "@openuidev/svelte-lang",
+      "@openuidev/vue-lang"
+    ],
+    ["@openuidev/react-headless", "@openuidev/react-ui"]
+  ],
+  "linked": [],
+  "ignore": [],
+  "privatePackages": { "version": false, "tag": false },
+  "bumpVersionsWithWorkspaceProtocolOnly": true
+}

.changeset/lang-family-release-automation.md

@@ -0,0 +1,10 @@
+---
+"@openuidev/lang-core": minor
+"@openuidev/react-lang": minor
+"@openuidev/svelte-lang": minor
+"@openuidev/vue-lang": minor
+---
+
+Adopt automated release management via changesets. The lang-family packages
+(`lang-core`, `react-lang`, `svelte-lang`, `vue-lang`) now version together as
+a fixed group; this release unifies them on a single version line.

.changeset/react-email-bounded-peer-range.md

@@ -0,0 +1,8 @@
+---
+"@openuidev/react-email": minor
+---
+
+`@openuidev/react-lang` peer dependency now declares a bounded
+tested-compatibility range (`">=0.3.0 <0.4.0"`) instead of an exact pin.
+Minor (breaking) because the new floor excludes react-lang 0.2.x: upgrade
+react-lang together with react-email.

.changeset/ui-pair-release-automation.md

@@ -0,0 +1,8 @@
+---
+"@openuidev/react-headless": minor
+"@openuidev/react-ui": minor
+---
+
+Adopt automated release management via changesets. `react-headless` and
+`react-ui` now version together as a fixed group; this release unifies them on
+a single version line.

.github/workflows/build-js.yml

@@ -24,7 +24,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build packages
-        run: pnpm --filter "./packages/**" --workspace-concurrency=1 run build
+        run: pnpm run build:packages
         env:
           NODE_OPTIONS: --max-old-space-size=6144
 

.github/workflows/changeset-check.yml

@@ -0,0 +1,23 @@
+name: Changeset check
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  changeset-check:
+    # Informational only — warnings land in the job summary, the job never fails.
+    runs-on: ubuntu-latest
+    if: github.head_ref != 'changeset-release/main'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Analyze changesets
+        # Belt-and-braces with the script's own try/catch: this check must
+        # never block a PR, even if the script crashes.
+        continue-on-error: true
+        run: node scripts/changeset-check.mjs "origin/${{ github.base_ref }}"

.github/workflows/publish-npm-package.yml

@@ -1,3 +1,8 @@
+# DEPRECATED: superseded by release.yml (changesets). This publishes whatever
+# version is on main with no bump, tag, or changelog, and the manifests now
+# carry peer ranges written for the changesets release train — publishing a
+# package through this path can ship peer requirements that don't exist on npm
+# yet. Scheduled for deletion after the first automated release succeeds.
 name: Publish NPM packages
 
 permissions:

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+concurrency: release
+
+permissions:
+  contents: write # push the changeset-release branch, create tags + GitHub Releases
+  pull-requests: write # maintain the Version Packages PR
+  id-token: write # npm OIDC trusted publishing
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history: @changesets/changelog-github links commits/PRs
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: "https://registry.npmjs.org"
+          cache: pnpm
+          cache-dependency-path: "pnpm-lock.yaml"
+
+      # CRITICAL: npm 11.5.1+ required for trusted publishing
+      - name: Install npm 11.6.4
+        run: npm install -g npm@11.6.4
+
+      - name: Install dependencies
+        # --ignore-scripts skips the workspace packages' prepare builds; the
+        # version path never needs artifacts and the publish path builds
+        # explicitly via release:publish.
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Create Version Packages PR or publish
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
+        with:
+          # The action execs this without a shell, so compound commands must
+          # live in a package.json script.
+          version: pnpm run version:ci
+          publish: pnpm run release:publish
+          createGithubReleases: true
+          title: "chore: version packages"
+          commit: "chore: version packages"
+        env:
+          # GITHUB_TOKEN-pushed branches trigger no workflows: the Version
+          # Packages PR runs zero CI. Swap in a PAT/GitHub App token here if
+          # CI on that PR (or required status checks on main) is needed.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Same build-memory headroom as build-js.yml
+          NODE_OPTIONS: --max-old-space-size=6144
+        # Note: npm provenance is generated automatically with trusted
+        # publishing; each package must have this workflow registered as a
+        # trusted publisher on npmjs.com.

CONTRIBUTING.md

@@ -66,6 +66,11 @@ Before opening a pull request, please make sure that:
 - Documentation or examples are updated when public behavior changes.
 - Relevant lint, test, and build commands have been run.
 - Any skipped checks are explained in the pull request description.
+- If the change affects a published package under `packages/`, a changeset is
+  included: run `pnpm changeset`, pick the affected packages and bump levels
+  (patch for fixes and compatible changes; minor for breaking changes — all
+  packages are 0.x), and commit the generated file. Releases are automated
+  from these; see [`.changeset/README.md`](./.changeset/README.md).
 
 ## Bug Reports
 

package.json

@@ -6,13 +6,18 @@
   "description": "A full-stack, renderer-agnostic Generative UI framework with a streaming-first language, official React support, and community integrations for other frameworks",
   "main": "index.js",
   "scripts": {
-    "test": "pnpm -r run test"
+    "test": "pnpm -r run test",
+    "build:packages": "pnpm --filter \"./packages/**\" --workspace-concurrency=1 run build",
+    "version:ci": "changeset version && pnpm install --lockfile-only",
+    "release:publish": "node scripts/verify-peer-windows.mjs && pnpm run build:packages && pnpm changeset publish"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
+    "@changesets/changelog-github": "^1.0.0",
+    "@changesets/cli": "^3.0.1",
     "@typescript-eslint/eslint-plugin": "catalog:",
     "eslint": "catalog:",
     "eslint-config-prettier": "catalog:",

packages/assistant-ui/package.json

@@ -79,9 +79,9 @@
   "author": "engineering@thesys.dev",
   "peerDependencies": {
     "@assistant-ui/react": "^0.15.0",
-    "@openuidev/react-headless": "workspace:^",
-    "@openuidev/react-lang": "workspace:^",
-    "@openuidev/react-ui": "workspace:^",
+    "@openuidev/react-headless": ">=0.14.0 <0.15.0",
+    "@openuidev/react-lang": ">=0.3.0 <0.4.0",
+    "@openuidev/react-ui": ">=0.14.0 <0.15.0",
     "ai": "^6.0.0 || ^7.0.0",
     "react": "catalog:",
     "react-dom": "catalog:",
@@ -95,6 +95,9 @@
   },
   "devDependencies": {
     "@assistant-ui/react": "^0.15.13",
+    "@openuidev/react-headless": "workspace:^",
+    "@openuidev/react-lang": "workspace:^",
+    "@openuidev/react-ui": "workspace:^",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
     "ai": "^6.0.236",

packages/browser-bundle/package.json

@@ -49,6 +49,7 @@
   "bugs": {
     "url": "https://github.com/thesysdev/openui/issues"
   },
+  "//": "openuidev deps are inlined into the IIFE at build time, but stay runtime dependencies (not devDependencies) on purpose: changesets cascade-releases this bundle when react-lang/react-ui release.",
   "dependencies": {
     "@openuidev/react-lang": "workspace:^",
     "@openuidev/react-ui": "workspace:^",

packages/devtools/package.json

@@ -40,8 +40,8 @@
     "ci": "pnpm run lint:check && pnpm run format:check"
   },
   "peerDependencies": {
-    "@openuidev/observability": "workspace:^",
-    "@openuidev/react-lang": "workspace:^",
+    "@openuidev/observability": ">=0.0.4 <0.1.0",
+    "@openuidev/react-lang": ">=0.3.0 <0.4.0",
     "react": "catalog:",
     "react-dom": "catalog:"
   },

packages/react-email/package.json

@@ -42,7 +42,7 @@
     "@react-email/components": "^0.0.41"
   },
   "peerDependencies": {
-    "@openuidev/react-lang": "workspace:*",
+    "@openuidev/react-lang": ">=0.3.0 <0.4.0",
     "react": "catalog:",
     "react-dom": "catalog:",
     "zod": "catalog:"
@@ -53,6 +53,7 @@
     "directory": "packages/react-email"
   },
   "devDependencies": {
+    "@openuidev/react-lang": "workspace:^",
     "@types/react": "catalog:",
     "typescript": "catalog:"
   }

packages/react-ui/package.json

@@ -109,8 +109,8 @@
     "ci": "pnpm run lint:check && pnpm run format:check && pnpm run test"
   },
   "peerDependencies": {
-    "@openuidev/react-headless": "workspace:^",
-    "@openuidev/react-lang": "workspace:^",
+    "@openuidev/react-headless": ">=0.14.0 <0.15.0",
+    "@openuidev/react-lang": ">=0.3.0 <0.4.0",
     "react": "catalog:",
     "react-dom": "catalog:",
     "zustand": "catalog:",
@@ -150,6 +150,8 @@
   },
   "devDependencies": {
     "@chromatic-com/storybook": "^3.2.4",
+    "@openuidev/react-headless": "workspace:^",
+    "@openuidev/react-lang": "workspace:^",
     "@storybook/addon-essentials": "^8.5.3",
     "@storybook/addon-interactions": "^8.5.3",
     "@storybook/addon-styling-webpack": "^1.0.1",