Comic toon look + leaderboard scope fix

.npmrc

@@ -0,0 +1 @@
+@dev0zzz.tessera.at:registry=https://registry.tessera.at

Dockerfile

@@ -1,13 +1,13 @@
 # Build stage: compile the Vite/TS app
 FROM node:22-alpine AS build
 # Pinned, NOT pnpm@11: a floating major picks up whatever 11.x is newest at
-# build time. 11.11 tightened the allowBuilds matcher to require a package's
-# full specifier (tarball URL + commit hash) instead of its name, which breaks
-# the tessera-sdk entry in pnpm-workspace.yaml. Keep this in lockstep with
-# package.json's packageManager field.
+# build time and has broken this build before (11.11 tightened the allowBuilds
+# matcher). Keep this in lockstep with package.json's packageManager field.
 RUN npm install -g pnpm@11.5.2
 WORKDIR /app
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+# .npmrc must be here BEFORE install: it maps @dev0zzz.tessera.at to
+# registry.tessera.at — without it pnpm 404s on the SDK against npmjs
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
 RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build

package.json

@@ -16,7 +16,7 @@
     "@atproto/oauth-client-browser": "^0.4.8",
     "@fontsource/orbitron": "^5.2.8",
     "@fontsource/share-tech-mono": "^5.2.7",
-    "@tesseraat/sdk": "^0.10.2",
+    "@dev0zzz.tessera.at/sdk": "^0.10.3",
     "three": "^0.169.0"
   },
   "devDependencies": {

pnpm-workspace.yaml

@@ -2,3 +2,5 @@ allowBuilds:
   core-js: true
   esbuild: false
   cbor-extract: false
+minimumReleaseAgeExclude:
+  - '@dev0zzz.tessera.at/sdk@0.10.3'

public/client-metadata.json

@@ -3,7 +3,7 @@
   "client_name": "SKYTESS",
   "client_uri": "https://skytess.tessera.at",
   "redirect_uris": ["https://skytess.tessera.at/"],
-  "scope": "atproto transition:generic",
+  "scope": "atproto repo:at.tessera.skytess.score",
   "grant_types": ["authorization_code", "refresh_token"],
   "response_types": ["code"],
   "token_endpoint_auth_method": "none",

src/game/auth.test.ts

@@ -0,0 +1,15 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { OAUTH_SCOPE } from './auth'
+
+// Dev (loopback client_id) takes its scope from auth.ts, prod from the hosted
+// client-metadata.json. If they drift apart, score writes fail only at OAuth
+// time with "Missing required scope repo:..." — exactly the bug this guards.
+describe('oauth scope', () => {
+  it('client-metadata.json matches the scope requested by the app', () => {
+    const meta = JSON.parse(
+      readFileSync(new URL('../../public/client-metadata.json', import.meta.url), 'utf8')
+    ) as { scope: string }
+    expect(meta.scope).toBe(OAUTH_SCOPE)
+  })
+})

src/game/auth.ts

@@ -1,12 +1,18 @@
-import { createBrowserAuth, type AuthState } from '@tesseraat/sdk/auth-browser'
+import { createBrowserAuth, type AuthState } from '@dev0zzz.tessera.at/sdk/auth-browser'
 
 // Thin app-side shim: the atproto OAuth flow (loopback dev client, hosted
 // client-metadata in prod, passkey-direct signIn) lives in
-// @tesseraat/sdk/auth-browser — extracted from this file. Only the skytess
+// @dev0zzz.tessera.at/sdk/auth-browser — extracted from this file. Only the skytess
 // client_id is app-specific.
 
+/** Granular repo scope for the leaderboard writes (putRecord = create+update).
+ *  Dev loopback clients get it via the scope option; prod reads it from
+ *  public/client-metadata.json — auth.test.ts asserts both stay in sync. */
+export const OAUTH_SCOPE = 'atproto repo:at.tessera.skytess.score'
+
 const auth = createBrowserAuth({
   clientId: 'https://skytess.tessera.at/client-metadata.json',
+  scope: OAUTH_SCOPE,
 })
 
 export type { AuthState }

src/game/ui.ts

@@ -1,4 +1,4 @@
-import { ZapAbortError, openZap } from '@tesseraat/sdk/zaps'
+import { ZapAbortError, openZap } from '@dev0zzz.tessera.at/sdk/zaps'
 import type { Level } from '../schema/level'
 import { TILE_COLORS, THEMES } from '../render/themes'
 import { medalFor, nextTarget, MEDAL_ICON, MEDAL_LABEL, type MedalTargets } from './medals'