Version Packages

[github-actions]

Why

Publish the pending Changesets as reviewed package releases.

Generated from main dc7d42d00409b82bcc1e0994bafc5f444e0cd3b8 by yarn changeset:version:release. See the package manifests and changelogs in Files changed for the release contents.

Merging this PR publishes through the existing trusted-publishing workflow. Viewer remains an alpha. Approve any waiting GitHub Actions runs before merging.

[kvz]

Release complete on 5b2b55031efbeb1feefb5412afcb2dc92d78d311.

• Viewer 0.0.3 is published under alpha, and its GitHub release is marked prerelease. npm's existing latest remains 0.0.1.
• Node, Types, Zod and the legacy transloadit wrapper are 5.0.1; MCP is 0.4.1. All six exact versions were independently checked in the public registry. Utils remains 4.9.0.
• Release and main CI are green. Publication used trusted publishing, not a local/manual npm publish.
• An isolated registry consumer passes five tests for React ThumbHash rendering, repeated authorization, version-pinned download redirects, both Zod parsers and Node receipt recovery. Neither Next nor Sharp is installed. An immutable reinstall also passes.
• The first workflow attempt exposed a registry-visibility race: npm accepted Viewer but said it was still processing; Changesets queried too soon and attempted the already-staged version, receiving E409. Once all six versions were visibly published, the same job was retried; it skipped every published package and completed its tag pass. No version was changed, unpublished or retagged to work around this. The legacy wrapper's GitHub release page was completed from the already-created, verified tag.

Narrow follow-up: add a bounded registry-readiness wait after the alpha publish and before handing off to Changesets. Test accepted-but-not-yet-visible metadata, timeout and non-404 errors red-first; never blindly retry a publish. Evidence: attempt 1 at 16:04–16:05 UTC, recovery attempt 2 at 16:10–16:11 UTC. This follow-up is not hidden in the released product patch.

Convex #33 is switching to these exact registry versions and removing preview vendoring. Its merge/deployment permission is separate because main automatically deploys the wedding demo.