MotebitChangelog
Where to find what changed across motebit's published packages.
Motebit ships eleven packages to npm — ten Apache-2.0 packages on the public surface and one BSL-1.1 reference runtime. Each carries its own CHANGELOG.md written by Changesets, so "what changed" lives next to the code that changed.
Authoritative sources
| Where | What you find there |
|---|---|
| GitHub Releases | Human-readable release notes, one per published package per version. The right place to browse "what shipped" as a reader. |
Per-package CHANGELOG.md | Machine-maintained, byte-stable record of every release for that package. Linked per-row below. |
.changeset/ directory | In-flight changes that haven't shipped yet — every PR lands a changeset describing the bump. |
Root CHANGELOG.md | Pre-1.0.0 history (entries 0.1.0 through 0.3.0) preserved from before Changesets adoption. Pointer document for everything after. |
The doctrine is one canonical source per synchronization invariant. A root CHANGELOG that duplicated the per-package ones drifted between 0.3.0 and 1.0.0 — so the root file now points at the per-package files instead of competing with them. Drift defense check-changeset-discipline (#43) enforces that every PR ships a substantive changeset.
Published packages
The ten Apache-2.0 packages on the permissive floor:
| Package | npm | Changelog |
|---|---|---|
@motebit/protocol | npm | CHANGELOG |
@motebit/sdk | npm | CHANGELOG |
@motebit/crypto | npm | CHANGELOG |
@motebit/verifier | npm | CHANGELOG |
@motebit/verify | npm | CHANGELOG |
@motebit/crypto-appattest | npm | CHANGELOG |
@motebit/crypto-play-integrity | npm | CHANGELOG |
@motebit/crypto-tpm | npm | CHANGELOG |
@motebit/crypto-webauthn | npm | CHANGELOG |
create-motebit | npm | CHANGELOG |
The BSL-1.1 reference runtime:
Workspace-private packages
The 51 workspace-private packages (everything not in the table above) are pinned to 0.0.0-private per the public-surface doctrine. They have no semver claim and no independent changelog — their behavior changes ship as part of motebit's release cadence, documented in the motebit package's CHANGELOG.md. The Changesets ignore list locks them at the sentinel so internal-dependency bumps can't creep them upward.
Versioning policy
Each published package follows semver 2.0.0. Breaking changes require a major changeset with a non-empty ## Migration section per check-changeset-discipline. The Apache-2.0 packages use check-api-surface to enforce that the type-extracted baseline (packages/<name>/etc/<name>.api.md) cannot drift without an explicit major bump. The motebit CLI uses check-cli-surface against apps/cli/etc/cli-surface.json for the operator-facing surface (subcommands, flags, exit codes, paths).
The eleven packages all currently sit at 1.0.0 — the coordinated initial release.