Installation and compatibility
Install a coherent published package set, choose optional adapters, and match runtime and transport requirements.
The site renderer is @lenso/docs@0.1.0; its initializer is create-lenso-docs@0.1.0. Both exact versions exist in npm. They are independent documentation packages and do not select a Lenso runtime release.
Start with published Core
Quickstart uses Bun 1.4.2 and an actual published artifact:
bun add --exact @lenso/core@0.2.0Retain one bun.lock. Core alone starts ordinary services; it requires neither Engine nor Web. Its browser entry provides safe declarations/helpers, not startApp or a browser service runtime. Configuration, logger contracts and application instanceId are exported by this release.
Add only the entry you need. For CLI tooling:
bun add --dev --exact @lenso/cli@0.19.0bunx --no-install lenso help --jsonFor a Web transport, the package and both protocol peers must match:
bun add --exact @lenso/web@0.2.0 @orpc/client@2.0.0-beta.42 @orpc/server@2.0.0-beta.42Installing Web does not select ingress, authentication or object policy. Web, Auth, database and Manage explain their optional adapters and peer requirements.
Verified package matrix
The regular npm registry metadata, exact tarballs, integrity, public exports and source declarations were checked on 2026-10-08, against source 549b9870acb6af239faf79245179a4f1f7e60cdb. These are published artifacts, rather than a promise inferred from a source merge:
| Packages | Exact version | Main boundary |
|---|---|---|
@lenso/core, @lenso/engine | 0.2.0 | Runtime and build-time lifetimes are separate |
@lenso/cli | 0.19.0 | Independently versioned; trusted app modules and explicit operations |
@lenso/web, @lenso/auth, @lenso/workers | 0.2.0 | Host-specific public entries and explicit evidence |
@lenso/db, @lenso/storage | 0.1.1 | Consume Core ^0.2.0; native resources and migrations stay application-owned |
@lenso/tasks, @lenso/manage, @lenso/mcp | 0.2.0 | Durable jobs, finite operations and stdio exposure are different contracts |
@lenso/log, @lenso/otel | 0.2.0 | Optional host logging/telemetry; no collector or query service |
The API index and artifact inventory list actual exports, peers and integrity. oRPC remains exact prerelease 2.0.0-beta.42. Current Drizzle examples use ORM 0.45.3 and Kit 0.31.11. Respect each adapter's declared peers; an optional peer means install it when importing that adapter, not that its functionality works without the peer.
Older Core 0.1.0 lacked config subpaths; Web 0.1.0 used oRPC 1.15.5 and lacked /bun. Do not mix those artifacts with this matrix or a v2 client. CLI has no 0.1.0 release. Upgrade gives migration checks.
Run the maintained examples
The complete Notes/Tasks applications live in the reviewed source checkout. Their workspace scripts require built framework packages; an independent app consuming npm packages does not require this checkout.
git clone https://github.com/LioRael/lenso.git lenso-examplescd lenso-examplesgit checkout 549b9870acb6af239faf79245179a4f1f7e60cdbbun install --frozen-lockfilebun run buildbun devUse the checkout's declared Bun 1.4.2. bun dev starts greeting on loopback and prints its actual URL. Notes, Tasks and Workers require their own explicit database, migration, identity or binding setup. See examples; do not assume greeting startup configures them.
From a second terminal at that checkout root:
bun run cli inspect greeting greet --root examples/greeting --jsonbun run cli call greeting greet '{"name":"Ada"}' --root examples/greeting --jsonInspect imports trusted configuration without application setup. Call validates input, starts the entire application, supplies the trusted operation binding and stops it. See CLI for effects and failures.
Host compatibility and manual use
| Host | Suitable entries | Boundary |
|---|---|---|
| Bun | Core, Engine/CLI, Bun DB/storage/listener, PostgreSQL task worker | Verified with Bun 1.4.2; host owns process supervision |
| Workers | Core, Workers, D1, R2, Fetch | Per-request graph; no Bun filesystem/sockets or Engine dev |
| Browser/React | Type-only contracts, browser declarations, Web client | No DB providers, server secrets or startApp in client bundles |
| Documentation site | Node 26.10+, generated Next application | Static out/, independent from application runtime |
Public exports are the import boundary. Auth exports migration asset subpaths. Storage and Tasks SQL assets ship, but do not have migration export subpaths; Tasks exposes migratePostgresTaskQueue through /postgres. Do not invent deep imports. Review Files and Tasks for migration ownership.
Applications may use native Fetch, Drizzle, storage clients or OpenTelemetry directly. Engine conventions and config sources can be replaced without forcing Web. The maintained templates currently use vendor/ package archives; follow their explicit packing instructions in a new directory rather than expecting an application-create command. Keep archives, overrides and indirect Core/Engine dependencies coherent. Never substitute latest, framework deep imports or handwritten framework code.