Starting a product

The package registry, which Zynactra libraries a product needs, and the order to set them up.

A Zynactra product is built on the shared libraries rather than beside them: @zynactra/ui for every screen, zynactra/access for every permission check. Both are private and versioned independently; each library's docs show its latest release.

Library	A product uses it for	Packages
UI	Tokens, themes, components and patterns for every screen	`@zynactra/tokens`, `@zynactra/ui`
Access	Who may do what, where: route guards, record checks, list filters, admin screens	`@zynactra/access`, `-drizzle`, `-nest`, `-react`; `github.com/zynactra/access/go`

The registry

The npm packages are on GitHub Packages under the @zynactra scope. Every app that installs them needs this .npmrc:

.npmrc

@zynactra:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

On your machine: export a token with read:packages as GITHUB_TOKEN (gh auth token works if your GitHub CLI login has that scope).
In the app's CI: an org admin gives the app's repository access to each package (package settings, Manage Actions access). The workflow then needs permissions: packages: read and GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}.

Go services fetch github.com/zynactra/access/go from the private repo: set GOPRIVATE=github.com/zynactra/* and give git a token or SSH key that can read it.

The order

The UI foundation

Install @zynactra/ui, pick a theme and mount the providers: UI installation. Read the principles once; they decide most layout questions before they come up.

Access in the backend

Manifests, zaccess gen, Cerbos next to the service, the access schema in your database, then the three checks on every endpoint: Access installation. Do it before the first endpoint that returns someone's data, not after.

Access in the frontend

AccessProvider, useCan and <Can> for controls, and the access settings page for admins.

Claude Code

Commit the plugins for both libraries, so every session builds on them the intended way.

Versions

Each library releases on its own schedule with semver and a changelog (in each library's sidebar). Within a library, packages move together: @zynactra/tokens and @zynactra/ui share a version, as do the four access packages and the Go module. When one library depends on another (the access admin screens on @zynactra/ui), its docs say which versions it needs.

Each package also ships its docs as markdown for the installed version (node_modules/@zynactra/ui/docs/, node_modules/@zynactra/access/docs/), which is what to read when an app is pinned to an older release.