letterpress

# Releasing

One `vX.Y.Z` tag identifies the Hex package, `@letterpress/language`, and
`@letterpress/svelte`. The workflow builds all three artifacts once, verifies
their hashes, installs those exact tarballs in throwaway Hex/npm consumers,
and only then enters the protected `release` environment.

Before the first release, configure protected `main` and `v*` rules, a
reviewer-protected `release` environment, a least-privilege npm automation
token, and a least-privilege Hex API key. Store registry credentials only as
secrets available to the protected release environment.

The local dry run is:

```bash
pnpm test:release
pnpm check:release
node scripts/release.mjs build --allow-untagged --artifact-dir dist/release
node scripts/release.mjs smoke --allow-untagged --artifact-dir dist/release
node scripts/release.mjs publish --allow-untagged --artifact-dir dist/release --dry-run
```

For the first release, remove the placeholder changelog and let GitOps create
the initial history in the release commit. Update the Mix and both npm package
versions together. Remove the pre-release notices from `README.md`,
`docs/guides/quickstart.md`, and `SECURITY.md`. Dispatch a dry-run workflow from
that commit before pushing the tag.

Publication is resumable. Before the first registry write, the orchestrator
checks every target. Existing versions are skipped only when their bytes match
the release manifest; conflicting bytes abort the run. Never move or recreate
a release tag after partial publication.