Install and use

1. Configure GitHub Packages

Commit only the package scope mapping in the consumer repository:

@lemn-ltd:registry=https://npm.pkg.github.com

Keep authentication in the user’s ~/.npmrc; never commit a token:

//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

2. Install exact compatible releases

For an SSR application:

pnpm add @lemn-ltd/brand-contract@1.0.0 @lemn-ltd/brand-runtime@0.1.1 @lemn-ltd/ui@0.4.0

For an authorized authoring host, add Studio separately:

pnpm add @lemn-ltd/brand-studio@2.0.0

Never use latest, a range, branch, URL, workspace:*, link:, or a relative cross-repository path in a published consumer.

3. Import public LEMN entrypoints

import { Button, Card, componentCatalog } from "@lemn-ltd/ui";
import "@lemn-ltd/ui/styles.css";

Load styles once at the application root. Do not deep-import src, dist, component internals, or an upstream provider.

4. Apply branding before render

Components never parse source branding JSON. A trusted server resolves one published Workspace branding version, verifies its signed minimal mode projection and canonical projection hash, and injects selected-mode CSS, preloads, scope attributes, and bootstrap before the first branded markup. The full compiled object remains private to publication storage. Follow the SSR branding runbook and use @lemn-ltd/brand-runtime; do not recreate verification in product code.

5. Keep platform concerns outside UI

The host owns API clients, fetching, routing, authentication, global state, internationalization, analytics, persistence, Workspace routing, cookies, and product policy. Pass controlled values and actions to components and blocks.