fix(vscode): publish as aet-tum.apollon-extension

`vsce publish` rejected `aet-tum.apollon-vscode`:

    The extension 'apollon-vscode' already exists in the Marketplace.
    Please use a different 'name' in the package.json file

The Marketplace reserves an extension name across all publishers, not per
publisher. `apollon-vscode` is held by `tumaet.apollon-vscode`, an abandoned
0.0.17 listing from ls1intum/apollon-vscode -- the archived repository this
workspace replaced. Freeing it would mean deleting the extension 38 people
still have installed.

`aet-tum.apollon-extension` is the listing this project already owns, from
the same archived repository. Publishing to it is an update rather than a
create, so the name conflict cannot arise, and its installs receive 5.1.1.

package.json `name` is simultaneously the pnpm workspace name, the git tag
prefix and the Marketplace extension name, so the rename reaches the root
scripts, the changesets `fixed` group, both workflows and the docs. The
`apollon-vscode-*` CSS classes and the webview's control ids are not the
package name and stay as they are.

Verified: pnpm resolves `apollon-extension` and the lockfile is unchanged
(importers are keyed by path); `changeset status` accepts the `fixed` group
and rejects the stale name with a ValidationError, so the entry is
load-bearing; lint, typecheck, build:all and 44/44 tests pass; `vsce package`
emits apollon-extension-5.1.1.vsix carrying `aet-tum.apollon-extension`;
`vsce show aet-tum.apollon-extension` resolves the listing, so vsce updates
it; the marketplace query the check job runs reports publish=true for 5.1.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/config.json

@@ -4,7 +4,7 @@
   "access": "public",
   "baseBranch": "main",
   "fixed": [
-    ["@tumaet/apollon", "@tumaet/webapp", "@tumaet/server", "apollon-vscode"]
+    ["@tumaet/apollon", "@tumaet/webapp", "@tumaet/server", "apollon-extension"]
   ],
   "updateInternalDependencies": "patch",
   "privatePackages": { "version": true, "tag": false },

.github/workflows/pr-health-checks.yml

@@ -196,13 +196,13 @@ jobs:
         run: pnpm run build:lib
 
       - name: Typecheck extension host + webview
-        run: pnpm --filter apollon-vscode run typecheck
+        run: pnpm --filter apollon-extension run typecheck
 
       - name: Run extension unit tests
-        run: pnpm --filter apollon-vscode run test
+        run: pnpm --filter apollon-extension run test
 
       - name: Build extension host + webview
-        run: pnpm --filter apollon-vscode run build:all
+        run: pnpm --filter apollon-extension run build:all
 
   # Root `pnpm run test` covers only the library. The server's vitest suite
   # (incl. the PDF-conversion regression test) spawns the compiled worker and

.github/workflows/release-vscode-extension.yml

@@ -124,7 +124,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - run: pnpm --filter @tumaet/apollon run build
-      - run: pnpm --filter apollon-vscode run build:all
+      - run: pnpm --filter apollon-extension run build:all
 
       - name: Install vsce (sandboxed)
         run: |

AGENTS.md

@@ -16,7 +16,7 @@ A pnpm + Vite monorepo (the server compiles with `tsc`, not Vite).
 - **`library/`** — `@tumaet/apollon`, the embeddable React editor, published to npm. Native HTML + Base UI primitives (`@base-ui/react`) styled via `--apollon-*` CSS variables; `lucide-react` icons; Yjs collaboration — the live-cursor/presence layer lives here ([`collaboration.md`](docs/library/api/collaboration.md)).
 - **`standalone/webapp/`** — `@tumaet/webapp` (private). React + Vite + Tailwind; Capacitor for iOS/Android.
 - **`standalone/server/`** — `@tumaet/server` (private). Express + Redis Stack (RedisJSON diagram storage + version history).
-- **`vscode-extension/`** — `apollon-vscode`, the extension host, with a nested `webview/` sub-package (`@tumaet/vscode-webview`). Unscoped because the VS Code Marketplace forbids a scope in an extension name.
+- **`vscode-extension/`** — `apollon-extension`, the extension host, with a nested `webview/` sub-package (`@tumaet/vscode-webview`). Unscoped because the VS Code Marketplace forbids a scope in an extension name.
 - **`docs/`** — `@tumaet/docs` (private), the Docusaurus site (`user/` · `library/` · `contributor/`).
 - **`ops/`** — runbooks and legal/DSMS material; not part of any release.
 

SECURITY.md

@@ -10,11 +10,11 @@ We aim to acknowledge reports within 5 working days and to coordinate a fix and
 
 Only the latest minor of each major is supported with security fixes.
 
-| Package                                              | Supported        |
-| ---------------------------------------------------- | ---------------- |
-| `@tumaet/apollon` (npm)                              | `4.x`            |
-| Standalone Docker images (server + webapp)           | latest `vX.Y.Z`  |
-| `aet-tum.apollon-vscode` (VS Marketplace / Open VSX) | latest published |
+| Package                                                 | Supported        |
+| ------------------------------------------------------- | ---------------- |
+| `@tumaet/apollon` (npm)                                 | `4.x`            |
+| Standalone Docker images (server + webapp)              | latest `vX.Y.Z`  |
+| `aet-tum.apollon-extension` (VS Marketplace / Open VSX) | latest published |
 
 Older majors are end-of-life and will not receive backports.
 

docs/contributor/deployment/npm-publishing.md

@@ -8,24 +8,24 @@ description: How the three independently versioned Apollon artifacts ship — np
 
 Three independently versioned artifacts, each with its own release workflow:
 
-| Artifact                                             | Version source                            | Tag                     | Workflow                       |
-| ---------------------------------------------------- | ----------------------------------------- | ----------------------- | ------------------------------ |
-| `@tumaet/apollon` (npm)                              | `library/package.json`                    | `@tumaet/apollon@X.Y.Z` | `release-library.yml`          |
-| Standalone Docker images                             | `standalone/{webapp,server}/package.json` | `vX.Y.Z`                | `release-standalone.yml`       |
-| `aet-tum.apollon-vscode` (VS Marketplace + Open VSX) | `vscode-extension/package.json`           | `apollon-vscode@X.Y.Z`  | `release-vscode-extension.yml` |
+| Artifact                                                | Version source                            | Tag                       | Workflow                       |
+| ------------------------------------------------------- | ----------------------------------------- | ------------------------- | ------------------------------ |
+| `@tumaet/apollon` (npm)                                 | `library/package.json`                    | `@tumaet/apollon@X.Y.Z`   | `release-library.yml`          |
+| Standalone Docker images                                | `standalone/{webapp,server}/package.json` | `vX.Y.Z`                  | `release-standalone.yml`       |
+| `aet-tum.apollon-extension` (VS Marketplace + Open VSX) | `vscode-extension/package.json`           | `apollon-extension@X.Y.Z` | `release-vscode-extension.yml` |
 
 Standalone starts at `4.2.18` (the library version at the time of the release-pipeline switchover). Future `vX.Y.Z` tags advance from there and do not collide with legacy tags.
 
-All three tracks are versioned by [Changesets](https://github.com/changesets/changesets), and all three share one number: `@tumaet/apollon`, the standalone pair and `apollon-vscode` sit in a single `fixed` group (`.changeset/config.json`), so a release advances them together. The publish workflows trigger automatically when their version changes on `main`. There is **one** manual step per release: merge the version PR.
+All three tracks are versioned by [Changesets](https://github.com/changesets/changesets), and all three share one number: `@tumaet/apollon`, the standalone pair and `apollon-extension` sit in a single `fixed` group (`.changeset/config.json`), so a release advances them together. The publish workflows trigger automatically when their version changes on `main`. There is **one** manual step per release: merge the version PR.
 
 The cost of that group is worth naming: a changeset touching only the extension still bumps and republishes the library and the standalone images at the new version, with identical content. A `linked` group would avoid that at the price of the numbers drifting apart. One product number was the deliberate trade.
 
-`apollon-vscode` ships to the VS Marketplace, never to npm. Nothing publishes it there today — `release.yml` runs Changesets in version-only mode — and a `publish` input must never be added to it.
+`apollon-extension` ships to the VS Marketplace, never to npm. Nothing publishes it there today — `release.yml` runs Changesets in version-only mode — and a `publish` input must never be added to it.
 
 The per-PR side is Changesets: authors run `pnpm changeset` on every user-visible PR to record a changelog entry with its bump type (see [Release notes](/contributor/development/release-notes)). On every push to `main`, `release.yml` runs [`changesets/action`](https://github.com/changesets/action) in **version-only** mode (no `publish` input — the bespoke `release-*.yml` workflows own publishing) and opens or updates a single **Version Packages** PR. That PR runs `pnpm changeset:version`, which:
 
 - consumes the accumulated `.changeset/*.md` files and bumps `@tumaet/apollon` and the paired `@tumaet/webapp` + `@tumaet/server` from the **declared** bump types — no human picks a bump;
-- bumps `@tumaet/apollon`, the standalone pair and `apollon-vscode` to one shared version, taking the largest bump any of them earned. `scripts/cascade-standalone-bump.mjs` still runs first and raises the standalone's floor to the library's bump; inside a `fixed` group that floor is already met, so it is a safety net rather than the mechanism. Because the group is fixed, a bump earned by **any** member raises all of them — a standalone-only or extension-only change does drag the library up, which is the price of one product number. So a library change always ships to npm **and** as a comparable Docker release **and** as a Marketplace release from the same merge;
+- bumps `@tumaet/apollon`, the standalone pair and `apollon-extension` to one shared version, taking the largest bump any of them earned. `scripts/cascade-standalone-bump.mjs` still runs first and raises the standalone's floor to the library's bump; inside a `fixed` group that floor is already met, so it is a safety net rather than the mechanism. Because the group is fixed, a bump earned by **any** member raises all of them — a standalone-only or extension-only change does drag the library up, which is the price of one product number. So a library change always ships to npm **and** as a comparable Docker release **and** as a Marketplace release from the same merge;
 - regenerates every `CHANGELOG.md`, rewrites the pinned `@tumaet/apollon@X.Y.Z` CDN URLs (via `scripts/sync-library-version.mjs`), and refreshes the lockfile.
 
 The GitHub Release body for each track is built from that `CHANGELOG.md` section (via `scripts/extract-changelog.mjs`), **regrouped by category** — Features, Bug Fixes, Performance, … — from each entry's Conventional Commit type (resolved from the commit SHA via git; full history is checked out for this, falling back to the semver bump when git can't resolve it) instead of the raw `### Minor/Patch Changes` bump headings (see [Release notes](/contributor/development/release-notes#how-your-change-gets-grouped)); it falls back to GitHub's auto-generated notes only when a version carried no changeset. PR Health Checks also run `sync-library-version.mjs --check`, so a CDN-URL drift can never merge — run `pnpm sync:version` locally to fix one.
@@ -36,7 +36,7 @@ The GitHub Release body for each track is built from that `CHANGELOG.md` section
 2. On merge:
    - `release-library.yml` fires when `library/package.json` changes: builds with pnpm, packs the tarball with `pnpm pack`, publishes with `npm publish` for OIDC trusted publishing + provenance (pnpm does not yet support OIDC trusted publishing natively — tracked in [pnpm#9812](https://github.com/pnpm/pnpm/issues/9812)). Tags `@tumaet/apollon@X.Y.Z` → GitHub Release. Skipped if the version is already on npm.
    - `release-standalone.yml` fires after the push-to-main Docker build succeeds: retag `sha-<commit>` → `X.Y.Z` → cosign-sign → tag `vX.Y.Z` → GitHub Release. Staging is already running the same digest under the `sha-<commit>` tag from the push-to-main deploy, so no second deploy is needed. Skipped if a release for that version already exists.
-   - `release-vscode-extension.yml` fires when the `version` in `vscode-extension/package.json` changes: builds the library + extension, packages the VSIX, attests it via sigstore (`actions/attest-build-provenance`), then publishes to the VS Marketplace (`vsce`) and, when `OVSX_PAT` is set, to Open VSX (`ovsx`) — both gated on the `vscode-marketplace` environment. Tags `apollon-vscode@X.Y.Z` → GitHub Release with the VSIX attached. Any other edit to the manifest, including the `publisher` and `name` that decide the Marketplace identity, is picked up by the next release rather than triggering one; publish it with a `workflow_dispatch`.
+   - `release-vscode-extension.yml` fires when the `version` in `vscode-extension/package.json` changes: builds the library + extension, packages the VSIX, attests it via sigstore (`actions/attest-build-provenance`), then publishes to the VS Marketplace (`vsce`) and, when `OVSX_PAT` is set, to Open VSX (`ovsx`) — both gated on the `vscode-marketplace` environment. Tags `apollon-extension@X.Y.Z` → GitHub Release with the VSIX attached. Any other edit to the manifest, including the `publisher` and `name` that decide the Marketplace identity, is picked up by the next release rather than triggering one; publish it with a `workflow_dispatch`.
 3. Promote standalone to production: Actions → **Deploy to Production** → `image-tag: X.Y.Z`.
 
 ## Verify a Docker image signature
@@ -57,9 +57,9 @@ cosign verify \
 
 ### VS Marketplace + Open VSX (vscode-extension)
 
-The extension publishes as `aet-tum.apollon-vscode`, from the `publisher` and `name` fields of `vscode-extension/package.json`. `aet-tum` is the organization's publisher — the one that also owns `aet-tum.iris-thaumantias`.
+The extension publishes as `aet-tum.apollon-extension`, from the `publisher` and `name` fields of `vscode-extension/package.json`. `aet-tum` is the organization's publisher — the one that also owns `aet-tum.iris-thaumantias`.
 
-- **Azure DevOps PAT** (required): create at `https://dev.azure.com/<your-org>/_usersSettings/tokens` with scope `Marketplace → Manage`, organization "All accessible organizations". Max lifetime is 1 year — calendar a rotation reminder. The PAT's account must be a member of the `aet-tum` publisher: a token that is valid but not a member fails with `Access Denied … needs the following permission(s) on the resource /aet-tum/apollon-vscode`. Check with `vsce verify-pat aet-tum`; the release workflow runs the same command before it uploads anything.
+- **Azure DevOps PAT** (required): create at `https://dev.azure.com/<your-org>/_usersSettings/tokens` with scope `Marketplace → Manage`, organization "All accessible organizations". Max lifetime is 1 year — calendar a rotation reminder. The PAT's account must be a member of the `aet-tum` publisher: a token that is valid but not a member fails with `Access Denied … needs the following permission(s) on the resource /aet-tum/apollon-extension`. Check with `vsce verify-pat aet-tum`; the release workflow runs the same command before it uploads anything.
 - **Open VSX PAT** (optional): create at `https://open-vsx.org/user-settings/tokens`. When `OVSX_PAT` is unset the release skips Open VSX and publishes to the Marketplace alone; the workflow logs a notice and stays green. The namespace `aet-tum` must exist on Open VSX — verify at `https://open-vsx.org/namespace/aet-tum`, and if it is missing run `ovsx create-namespace aet-tum -p <PAT>` once locally.
 - **GitHub Environment `vscode-marketplace`**:
   - Settings → Environments → New environment → name `vscode-marketplace`.