@lepsto/sdk-app 85.0.0 → 85.0.1

package/README.md

@@ -1,17 +1,49 @@
-# @lessly/sdk-app
+# @lepsto/sdk-app
 
-The Lessly SDK for App is a TypeScript SDK that provides runtime bindings and type-safe generated code for interacting with Lessly Platform APIs and services. This package generates type definitions and client bindings from API catalogs, enabling developers to build applications that consume Lessly platform services with full type safety and autocompletion.
+The Lepsto SDK for App is a TypeScript SDK that provides runtime bindings and type-safe generated code for interacting with Lepsto Platform APIs and services. This package generates type definitions and client bindings from API catalogs, enabling developers to build applications that consume Lepsto platform services with full type safety and autocompletion.
 
 **Note:** The `src/gen` directory contains generated SDK code and should not be edited by hand. Generated files are produced by running `npm run generate` with an API catalog.
 
 The committed `src/gen` is a **convenience snapshot** — it lets the repo type-check, test, and build offline. It is **not** the source of truth: canonical generation happens **at publish time**, when Cloud Build regenerates `src/gen` from the live catalog before publishing. The catalog is **mid-migration**, so the committed snapshot's namespaces (currently `organization` and `playground`) will **grow as platform extensions migrate to `@lessly-platform/tools`** — a namespace only appears once its tools carry a REST binding (tools without one are excluded until migrated). Regenerate the snapshot with `npx tsx scripts/generate.ts <catalog.json> src/gen && npm run sync-exports` against the live catalog (`https://api.lessly.dev/catalog/tools`).
 
+## Package name: `@lepsto/sdk-app` (and legacy `@lessly/sdk-app`)
+
+```sh
+npm i @lepsto/sdk-app
+```
+
+The package is published on public npmjs as **`@lepsto/sdk-app`** and, during the transition,
+**also** as `@lessly/sdk-app` — same build, same version, identical `exports` map. The old name is
+not deprecated.
+
+`package.json` keeps `name: @lessly/sdk-app` on purpose: the dev-console SDK-rebuild Cloud Build
+job derives `PKG` from it (`require('./package.json').name`) for its `npm view` probe and runs
+`npm run publish:npmjs -- --tag <channel>`. The new name is the **derived** tarball.
+
+| Script | Publishes | Contract |
+| --- | --- | --- |
+| `npm run publish:npmjs -- --tag <channel>` | `@lessly/sdk-app` | unchanged; token with write on `@lessly` |
+| `npm run publish:npmjs:lepsto -- --tag <channel>` | `@lepsto/sdk-app` | same args as `publish:npmjs`; token with write on `@lepsto` |
+
+`publish:npmjs:lepsto` (`scripts/publish-alias.ts`) builds once, `npm pack`s, rewrites `name` and `description`
+(the Lepsto text; `package.json` keeps the legacy description for `@lessly/sdk-app`),
+checks every `exports` target is in the tarball, and publishes with `--registry` and
+`--@lepsto:registry` pinned. Run it after `publish:npmjs` against the same checkout so both names
+carry the same version.
+
+**Bootstrap** (`.github/workflows/publish-lepsto.yml`, manual): mirrors already-published legacy
+tarballs instead of rebuilding — `npm pack @lessly/sdk-app@<v>`, rewrite `name` and `description`, drop
+`publishConfig.registry`, publish as `@lepsto/sdk-app@<v>` (`tsx scripts/publish-alias.ts --mirror
+84.0.0:latest,85.0.0:next`). Versions that already exist are skipped. It uses `NPM_BOOTSTRAP_TOKEN`
+and is ready for npm Trusted Publishing (`id-token: write`, npm >= 11.5.1, token only in the publish
+step's env).
+
 ## Usage
 
 Create a client with `createLesslyApp`, then call operations through the Proxy namespace tree:
 
 ```ts
-import { createLesslyApp } from '@lessly/sdk-app';
+import { createLesslyApp } from '@lepsto/sdk-app';
 
 const sdk = createLesslyApp({
   baseUrl: 'https://api.lessly.dev', // or a page-relative '/api' in the browser
@@ -52,7 +84,7 @@ operation as a **step**. `src/gen/manifest.gen.ts` exports the whole table, re-e
 package root:
 
 ```ts
-import { compositions } from '@lessly/sdk-app';
+import { compositions } from '@lepsto/sdk-app';
 
 if ('mail_domain_create' in compositions) {
   const step = compositions['mail_domain_create'];
@@ -86,7 +118,7 @@ without the `lessly_csrf` cookie fail before the network with `status: 0` and
 
 ### TanStack Query
 
-Each namespace subpath (`@lessly/sdk-app/<namespace>`) also ships framework-agnostic
+Each namespace subpath (`@lepsto/sdk-app/<namespace>`) also ships framework-agnostic
 query/mutation **option factories** — plain objects, not hooks — usable with any
 TanStack Query adapter (React, Solid, Vue, Svelte). You pass the `sdk` instance
 explicitly:
@@ -97,7 +129,7 @@ import { useQuery, useMutation } from '@tanstack/react-query';
 import {
   organizationConnectorsListQueryOptions,
   organizationProductCreateMutationOptions,
-} from '@lessly/sdk-app/organization';
+} from '@lepsto/sdk-app/organization';
 
 function Connectors() {
   const { data } = useQuery(organizationConnectorsListQueryOptions(sdk, { productId: 'prod_123' }));

package/docs/README.md

@@ -1,16 +1,16 @@
 # Building a Lessly App
 
-This is the entry point for building a Lessly **App** with `@lessly/sdk-app`.
+This is the entry point for building a Lessly **App** with `@lepsto/sdk-app`.
 Read this file first, then `rules.md`, then whichever recipe under `recipes/`
 matches the task in front of you.
 
 This path is stable: every scaffolded app's `AGENTS.md` points agents at
-`node_modules/@lessly/sdk-app/docs/README.md`. It will not move or be renamed.
+`node_modules/@lepsto/sdk-app/docs/README.md` (or `node_modules/@lessly/sdk-app/docs/README.md` under the legacy name). It will not move or be renamed.
 
 ## What an App is
 
 A Lessly **App** is a pure-frontend Module Federation remote built on
-`@lessly/sdk-app`. It ships no backend, no database, and no MCP endpoint — all
+`@lepsto/sdk-app`. It ships no backend, no database, and no MCP endpoint — all
 platform data access goes through the SDK, and all identity/session state is
 handed to it by the shell that hosts it.
 
@@ -25,7 +25,7 @@ does not apply.
 
 - **Frontend-only.** No server process, no database, no MCP endpoint ships with
   an App.
-- **Data only via `@lessly/sdk-app`.** All platform API calls go through the SDK
+- **Data only via `@lepsto/sdk-app`.** All platform API calls go through the SDK
   client (`createLesslyApp`) or its generated query/mutation option factories.
   No direct `fetch` to a platform host, no other HTTP client for platform data.
 - **Auth is ambient.** The hosting shell owns tokens, login, refresh, and
@@ -78,11 +78,11 @@ you need to touch it directly.
 
 ## Keeping this guide current
 
-This guide ships inside `@lessly/sdk-app` itself, so updating the SDK updates
+This guide ships inside `@lepsto/sdk-app` itself, so updating the SDK updates
 the guide in the same step:
 
 ```sh
-npm i @lessly/sdk-app@latest
+npm i @lepsto/sdk-app@latest
 ```
 
 Always use the `@latest` form (not `npm update`) — see `rules.md` APP-007 for

package/docs/recipes/access.md

@@ -15,7 +15,7 @@ is the authority. See APP-012 in `../rules.md`.
 Every client from `createLesslyApp` carries an `access` object:
 
 ```ts
-import { createLesslyApp } from '@lessly/sdk-app';
+import { createLesslyApp } from '@lepsto/sdk-app';
 
 const app = createLesslyApp({ baseUrl: '/api', productId });
 
@@ -80,7 +80,7 @@ drift from the method it is meant to describe; the method cannot.
 ```tsx
 // src/App.tsx
 import { useEffect } from 'react';
-import { createLesslyApp } from '@lessly/sdk-app';
+import { createLesslyApp } from '@lepsto/sdk-app';
 import { TooltipProvider } from '@lessly/ui';
 
 export default function App({ productId }: { productId: string }) {
@@ -117,8 +117,8 @@ refetched on a timer.
 ## 2. `useCan` on primary actions — disable, don't hide
 
 ```tsx
-import { accessReason } from '@lessly/sdk-app';
-import { useAccess, useCan } from '@lessly/sdk-app/react';
+import { accessReason } from '@lepsto/sdk-app';
+import { useAccess, useCan } from '@lepsto/sdk-app/react';
 import { Button, Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@lessly/ui';
 
 function AddDomainButton({ app, onClick }: { app: App; onClick: () => void }) {
@@ -183,7 +183,7 @@ Every App says the same sentence, and both of its values come off the generated
 method:
 
 ```tsx
-import { accessReason } from '@lessly/sdk-app';
+import { accessReason } from '@lepsto/sdk-app';
 
 accessReason(app.mail.domain.create);
 // "Requires level:admin (mail_domain_create). Ask an admin of this product."
@@ -225,12 +225,12 @@ from the catalog when the key is one the SDK knows, but a key with **no** catalo
 entry can only be matched by key pattern — no level grant reaches it, which is
 exactly what the gateway does with an uncatalogued key.
 
-> **On an older SDK.** `accessReason` ships from `@lessly/sdk-app`. On a version
+> **On an older SDK.** `accessReason` ships from `@lepsto/sdk-app`. On a version
 > before it landed, define it locally with exactly this signature and body, then
 > replace it with the import when you upgrade:
 >
 > ```ts
-> import type { Operation } from '@lessly/sdk-app';
+> import type { Operation } from '@lepsto/sdk-app';
 >
 > const ok = (v: unknown): v is string => typeof v === 'string' && v.trim() !== '';
 >
@@ -276,11 +276,11 @@ off the method.
 
 Sometimes there is no method to read `op.level` from: an App test double that has
 to answer `can()` for a key, a runtime probe over keys it was handed. The answer
-is still not a literal and still not a table in the App — `@lessly/sdk-app`
+is still not a literal and still not a table in the App — `@lepsto/sdk-app`
 exports the catalog's own level map:
 
 ```ts
-import { operations, accessReason } from '@lessly/sdk-app';
+import { operations, accessReason } from '@lepsto/sdk-app';
 
 operations['mail_domain_create'];   // 'admin'
 operations['analytics_insight_delete'];  // 'write'
@@ -346,7 +346,7 @@ if (state === 'loading') return <Spinner />;
 if (state === 'error') return <p>Could not load your permissions. <button onClick={reload}>Retry</button></p>;
 ```
 
-React is an **optional peer** of this package: `@lessly/sdk-app/react` is only
+React is an **optional peer** of this package: `@lepsto/sdk-app/react` is only
 loaded if you import it, and installing the SDK does not pull React in.
 
 ### Actions without a button
@@ -594,9 +594,9 @@ change between the load and the click, and a screen can always be reached
 before the snapshot is.
 
 ```tsx
-import { isAccessDenied } from '@lessly/sdk-app';
+import { isAccessDenied } from '@lepsto/sdk-app';
 import { useQuery } from '@tanstack/react-query';
-import { mailDomainListQueryOptions } from '@lessly/sdk-app/mail';
+import { mailDomainListQueryOptions } from '@lepsto/sdk-app/mail';
 
 function DomainList({ app }: { app: App }) {
   const { data, error, isPending } = useQuery(mailDomainListQueryOptions(app, {}));

package/docs/recipes/local-dev.md

@@ -101,11 +101,11 @@ Update the SDK and `@lessly/app-dev` with the `@latest` form, never `npm
 update`:
 
 ```sh
-npm i @lessly/sdk-app@latest
+npm i @lepsto/sdk-app@latest
 npm i @lessly/app-dev@latest
 ```
 
-`@lessly/sdk-app` and `@lessly/app-dev` are pre-1.0 and pinned with caret
+`@lepsto/sdk-app` and `@lessly/app-dev` are pre-1.0 and pinned with caret
 ranges, so `npm update` never crosses a minor version — and since the SDK
 bumps its minor version whenever the platform ships a new tool, `npm update`
 would never actually deliver those updates (see APP-007).

package/docs/recipes/sdk-usage.md

@@ -1,7 +1,7 @@
 # Recipe: calling the platform API
 
 How to reach Lessly platform data from an App. The normative rule is APP-001
-(all platform data access goes through `@lessly/sdk-app`) and APP-006 (prefer
+(all platform data access goes through `@lepsto/sdk-app`) and APP-006 (prefer
 the generated option factories) — this page shows the *how*.
 
 ## Create the client
@@ -10,7 +10,7 @@ Create one client with `createLesslyApp` and call operations through the
 Proxy namespace tree:
 
 ```ts
-import { createLesslyApp } from '@lessly/sdk-app';
+import { createLesslyApp } from '@lepsto/sdk-app';
 
 const sdk = createLesslyApp({
   baseUrl: 'https://api.lessly.dev',
@@ -35,7 +35,7 @@ await sdk.organization.product.create({ name: 'Acme' });
 - **Page-relative** — `'/lessly-api'`, the path `pnpm dev` proxies through
   (see `recipes/local-dev.md`). It is resolved against the current document via
   `globalThis.location`, so it is **browser-only**: outside a browser the SDK
-  throws a named error (`@lessly/sdk-app: relative baseUrl "/lessly-api" cannot
+  throws a named error (`@lepsto/sdk-app: relative baseUrl "/lessly-api" cannot
   be resolved outside a browser`) instead of an opaque `Invalid URL`. Tests and
   SSR must pass an absolute base.
 
@@ -56,7 +56,7 @@ Every failed call throws a typed `LesslyApiError` with `status`, `code`, and
 distinguish platform-defined failure reasons:
 
 ```ts
-import { LesslyApiError } from '@lessly/sdk-app';
+import { LesslyApiError } from '@lepsto/sdk-app';
 
 try {
   await sdk.organization.product.create({ name: 'Acme' });
@@ -80,7 +80,7 @@ retry and no hidden token refresh — re-establish the session, or supply
 
 ## Prefer the generated query/mutation option factories
 
-Each namespace subpath (`@lessly/sdk-app/<namespace>`) ships framework-agnostic
+Each namespace subpath (`@lepsto/sdk-app/<namespace>`) ships framework-agnostic
 query/mutation **option factories** — plain objects, not hooks — usable with
 any TanStack Query adapter (React, Solid, Vue, Svelte). You pass the `sdk`
 instance explicitly:
@@ -91,7 +91,7 @@ import { useQuery, useMutation } from '@tanstack/react-query';
 import {
   organizationConnectorsListQueryOptions,
   organizationProductCreateMutationOptions,
-} from '@lessly/sdk-app/organization';
+} from '@lepsto/sdk-app/organization';
 
 function Connectors() {
   const { data } = useQuery(organizationConnectorsListQueryOptions(sdk, { productId: 'prod_123' }));
@@ -111,14 +111,14 @@ await queryClient.ensureQueryData(organizationConnectorsListQueryOptions(sdk, {
 Prefer these factories over hand-rolling calls against `sdk.<namespace>...`
 directly (APP-006): they keep query keys, request shapes, and cache
 invalidation consistent with the published API surface, and stay in sync with
-it automatically when you run `npm i @lessly/sdk-app@latest`.
+it automatically when you run `npm i @lepsto/sdk-app@latest`.
 
 ## Namespaces and subpath imports
 
 The SDK is organized by namespace (currently `organization` and `playground`).
 Call operations off `sdk.<namespace>.<resource>.<action>(...)`, and import that
 namespace's option factories from the matching subpath,
-`@lessly/sdk-app/<namespace>` — not the package root. This keeps each App's
+`@lepsto/sdk-app/<namespace>` — not the package root. This keeps each App's
 bundle limited to the namespaces it actually uses.
 
 Some operations belong to the namespace itself rather than to a resource under
@@ -130,7 +130,7 @@ autocomplete) for which shape a given operation takes.
 
 The available namespaces track the live catalog and **grow as platform
 extensions migrate to `@lessly-platform/tools`** — a namespace appears here only once its
-tools carry a REST binding. Run `npm i @lessly/sdk-app@latest` to pick up newly
+tools carry a REST binding. Run `npm i @lepsto/sdk-app@latest` to pick up newly
 migrated namespaces. To see exactly what a given version exposes, check its
 subpaths in `package.json` `exports`, or the `manifest.gen.ts` namespace list.
 
@@ -143,8 +143,8 @@ stream from an App (APP-001) — it derives `ws(s)://` from your `baseUrl`, open
 the socket, and hands back a small handle:
 
 ```ts
-import { createLesslyApp } from '@lessly/sdk-app';
-import { playgroundWsEchoConnect } from '@lessly/sdk-app/playground';
+import { createLesslyApp } from '@lepsto/sdk-app';
+import { playgroundWsEchoConnect } from '@lepsto/sdk-app/playground';
 
 const sdk = createLesslyApp({ baseUrl: 'https://api.lessly.dev', productId: 'prod_123' });
 

package/docs/rules.md

@@ -1,6 +1,6 @@
 # App Rules
 
-Normative rules for building a Lessly App on `@lessly/sdk-app`. Read this
+Normative rules for building a Lessly App on `@lepsto/sdk-app`. Read this
 before writing code; see `README.md` for the map of the rest of the guide.
 
 Severity (RFC 2119): **MUST** blocks merge, **SHOULD** is a strong
@@ -15,10 +15,10 @@ rationale, and examples.
 
 ---
 
-### APP-001 (MUST) — All platform data access goes through `@lessly/sdk-app`
+### APP-001 (MUST) — All platform data access goes through `@lepsto/sdk-app`
 
 Every read or write to a Lessly platform API MUST go through a
-`@lessly/sdk-app` client created with `createLesslyApp`, or through the
+`@lepsto/sdk-app` client created with `createLesslyApp`, or through the
 generated `*QueryOptions`/`*MutationOptions` factories built on top of it. An
 App MUST NOT `fetch` a platform host directly, and MUST NOT use any other HTTP
 client to reach platform data.
@@ -39,7 +39,7 @@ service the App integrates) is outside this rule.
 ### APP-002 (MUST) — Frontend-only
 
 An App MUST NOT ship a backend service, a database, or an MCP endpoint. All
-of its logic runs in the browser, built on `@lessly/sdk-app` and the Module
+of its logic runs in the browser, built on `@lepsto/sdk-app` and the Module
 Federation contract below. If a feature needs server-side state or a
 service-to-service call, it belongs in an extension, not an App.
 
@@ -101,7 +101,7 @@ federation, through the `./App` props.
 ### APP-006 (SHOULD) — Use the generated query/mutation option factories
 
 Prefer the generated `*QueryOptions`/`*MutationOptions` factories
-(`@lessly/sdk-app/<namespace>`) over hand-rolling request paths against the
+(`@lepsto/sdk-app/<namespace>`) over hand-rolling request paths against the
 SDK client directly. They keep query keys, request shapes, and cache
 invalidation consistent with the published API surface, and stay in sync with
 it automatically on upgrade.
@@ -112,10 +112,10 @@ Bump the manifest `version` on every release. Keep the SDK and this guide
 current with:
 
 ```sh
-npm i @lessly/sdk-app@latest
+npm i @lepsto/sdk-app@latest
 ```
 
-Use this exact `@latest` form — not `npm update`. `@lessly/sdk-app` is
+Use this exact `@latest` form — not `npm update`. `@lepsto/sdk-app` is
 pre-1.0 and pinned with a caret range, so `npm update` never crosses a minor
 version; since this SDK also bumps its minor version whenever the platform
 ships a new tool, `npm update` would never actually deliver those updates.
@@ -336,7 +336,7 @@ still fail registration.
 
 An App SHOULD reflect the caller's access in its UI: **disable, with a reason**
 (not hide) a primary action the caller cannot perform, using `useCan` from
-`@lessly/sdk-app/react` or `app.access.can()` directly, and render a 403 that
+`@lepsto/sdk-app/react` or `app.access.can()` directly, and render a 403 that
 `isAccessDenied()` recognises as a **neutral empty state** rather than an error.
 That reason MUST live on a `Tooltip` wrapper around the disabled control, never
 on a native `title=` of the control itself: the base `buttonVariants` carry
@@ -353,7 +353,7 @@ That reason MUST be exactly one sentence, the same in every App:
 
 — e.g. `Requires level:admin (mail_domain_create). Ask an admin of this product.`
 Both values MUST be read from the generated method, never written as literals.
-`@lessly/sdk-app` exports `accessReason(op)`, which is that sentence; an App
+`@lepsto/sdk-app` exports `accessReason(op)`, which is that sentence; an App
 SHOULD use it rather than assembling the text itself.
 
 Where a control has only an operation key and no generated method to point at,
@@ -383,7 +383,7 @@ the App, not a literal, and never a rule of thumb about verbs — `analytics_*_d
 is `write` while `mail_domain_create` is `admin`, and only the catalog knows.
 
 Where there is no method to read from — a test double, a runtime probe over keys
-it was handed — the App MUST NOT hand-type the level either. `@lessly/sdk-app`
+it was handed — the App MUST NOT hand-type the level either. `@lepsto/sdk-app`
 exports `operations`, the catalog's own level map
 (`Readonly<Record<string, ToolLevel>>`, keyed by operation key), regenerated at
 publish time from the live catalog; read the level from it. A key it does not

package/package.json

@@ -1,6 +1,15 @@
 {
   "name": "@lepsto/sdk-app",
-  "version": "85.0.0",
+  "description": "The Lepsto SDK for App is a TypeScript SDK that provides runtime bindings and type-safe generated code for interacting with Lepsto Platform APIs and services. This package generates type definitions and client bindings from API catalogs, enabling developers to build applications that consume Lepsto platform services with full type safety and autocompletion.",
+  "version": "85.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lepsto/lepsto-sdk-app.git"
+  },
+  "homepage": "https://github.com/lepsto/lepsto-sdk-app#readme",
+  "bugs": {
+    "url": "https://github.com/lepsto/lepsto-sdk-app/issues"
+  },
   "type": "module",
   "sideEffects": false,
   "engines": {
@@ -22,6 +31,7 @@
     "build": "npm run sync-exports && tsup && tsx scripts/emit-dts.ts",
     "prepublishOnly": "npm run build",
     "publish:npmjs": "npm publish --registry https://registry.npmjs.org/ --@lessly:registry=https://registry.npmjs.org/",
+    "publish:npmjs:lepsto": "tsx scripts/publish-alias.ts",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },