@clawnify/app 0.2.1 → 0.2.2

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { DiscoveryOptions, OpenAPIHono } from '@clawnify/routes';
-export { DiscoverableApp, DiscoveryOptions, OpenAPIHono, createRoute, describeRoutes, mountDiscovery, z } from '@clawnify/routes';
+export { DEFAULT_PAGE_LIMIT, DiscoverableApp, DiscoveryOptions, MAX_PAGE_LIMIT, OpenAPIHono, PageParams, PageQuery, createRoute, describeRoutes, mountDiscovery, pageParams, pagedResponse, z } from '@clawnify/routes';
 import { Env } from 'hono';
 
 /**

package/dist/index.js

@@ -6,7 +6,12 @@ import {
   createRoute,
   z,
   mountDiscovery as mountDiscovery2,
-  describeRoutes
+  describeRoutes,
+  PageQuery,
+  pageParams,
+  pagedResponse,
+  DEFAULT_PAGE_LIMIT,
+  MAX_PAGE_LIMIT
 } from "@clawnify/routes";
 
 // src/identity.ts
@@ -68,13 +73,18 @@ function createApp(opts = {}) {
   return app;
 }
 export {
+  DEFAULT_PAGE_LIMIT,
+  MAX_PAGE_LIMIT,
   OpenAPIHono2 as OpenAPIHono,
+  PageQuery,
   caller,
   createApp,
   createRoute,
   describeRoutes,
   mountDiscovery2 as mountDiscovery,
   orgId,
+  pageParams,
+  pagedResponse,
   user,
   z
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/identity.ts"],"sourcesContent":["/**\n * @clawnify/app — the standard Clawnify app skeleton in one call.\n *\n * `createApp(opts)` returns a fully-wired OpenAPIHono with every always-required,\n * cross-cutting concern pre-baked, so an app's server file is just imports +\n * routes + `export default app`:\n *\n *   import { createApp, createRoute, z } from \"@clawnify/app\";\n *   const app = createApp<Env>({ title: \"CRM App\", version: \"1.0.0\" });\n *   app.openapi(listContacts, handler);\n *   export default app;\n *\n * What it bakes in — the boilerplate every app used to re-write in its server\n * file, and could forget:\n *   • OpenAPIHono construction (typed to your Env).\n *   • Database init — `initDB(c.env)` middleware on every request. @clawnify/db\n *     auto-detects the D1 binding (production WfP) or the Storage capability\n *     binding (Dynamic Workers preview), so handlers can query immediately.\n *   • API discovery — `mountDiscovery` serves GET /api/openapi.json (the machine\n *     contract) and GET /llms.txt (the lean agent index), generated from the\n *     live routes so they can't drift.\n *   • Identity — `user(c)` / `orgId(c)` / `caller(c)` read the platform-injected\n *     `X-Clawnify-*` headers, so an app never hand-parses them (see identity.ts).\n *\n * The point: a new always-required concern is added HERE once and every app\n * inherits it on the next rebuild — instead of a line each agent must remember\n * to write (and a build gate to enforce) in every app.\n */\nimport { OpenAPIHono, mountDiscovery, type DiscoveryOptions } from \"@clawnify/routes\";\nimport { initDB } from \"@clawnify/db\";\nimport type { Env } from \"hono\";\n\n// One routing import for app authors: everything needed to declare routes and\n// build the app comes from @clawnify/app. These are re-exports of the same\n// @hono/zod-openapi primitives @clawnify/routes exposes — never reimplemented —\n// so route creation, discovery, and construction all live behind one import.\nexport {\n  OpenAPIHono,\n  createRoute,\n  z,\n  mountDiscovery,\n  describeRoutes,\n} from \"@clawnify/routes\";\nexport type { DiscoveryOptions, DiscoverableApp } from \"@clawnify/routes\";\n\n// Identity of the caller, read from the platform-injected headers. Apps never\n// authenticate anyone themselves — see identity.ts.\nexport { user, orgId, caller } from \"./identity\";\nexport type { AppUser, Caller, RequestLike } from \"./identity\";\n\nexport interface CreateAppOptions extends DiscoveryOptions {\n  /**\n   * Wire the per-request database middleware (`initDB(c.env)` on `*`). Default\n   * true — every Clawnify app has a D1 / Storage binding. Set false only for the\n   * rare app with no database.\n   */\n  db?: boolean;\n  /**\n   * Mount GET /api/openapi.json + GET /llms.txt discovery. Default true. Set\n   * false only if the app deliberately opts out of API discovery.\n   */\n  discovery?: boolean;\n}\n\n/**\n * Create a fully-wired Clawnify app.\n *\n * `E` is your Hono env — `{ Bindings: { DB: D1Database, ... } }` — pass it so\n * route handlers get a typed `c.env`. Everything after this call is your app's\n * own routes and business logic:\n *\n *   const app = createApp<Env>({ title: \"CRM App\", version: \"1.0.0\" });\n *   app.openapi(route, handler);\n *   export default app;\n */\nexport function createApp<E extends Env = Env>(\n  opts: CreateAppOptions = {},\n): OpenAPIHono<E> {\n  const app = new OpenAPIHono<E>();\n\n  if (opts.db !== false) {\n    app.use(\"*\", async (c, next) => {\n      // @clawnify/db reads the DB (D1) or Storage binding off the env and caches\n      // the Drizzle client for this request. Safe to call on every request.\n      initDB(c.env as unknown as Parameters<typeof initDB>[0]);\n      await next();\n    });\n  }\n\n  if (opts.discovery !== false) {\n    mountDiscovery(app, opts);\n  }\n\n  return app;\n}\n","/**\n * Identity — who is calling this app.\n *\n * The platform authenticates the caller at the perimeter (app-router, the\n * app-supervisor preview tier, or the /v1/apps/:id/proxy API) and injects a\n * *fresh* set of `X-Clawnify-*` headers. Any client-supplied `X-Clawnify-*` is\n * stripped first, so these headers cannot be spoofed and an app can trust them\n * directly.\n *\n * Apps therefore never authenticate anyone themselves: never read\n * `Authorization`, never parse a cookie, never verify a JWT. Read these\n * helpers instead.\n *\n *   import { user, orgId, caller } from \"@clawnify/app\";\n *\n *   app.openapi(route, (c) => {\n *     const u = user(c);                       // null when the caller isn't a person\n *     return c.json({ hello: u?.name ?? \"there\", org: orgId(c) });\n *   });\n */\n\n/**\n * Minimal shape this module needs — Hono's `Context` satisfies it structurally,\n * so `user(c)` works in any handler regardless of the app's Env generics.\n */\nexport interface RequestLike {\n  req: { header(name: string): string | undefined };\n}\n\n/**\n * What kind of principal is calling.\n *\n * Only `user`, `api` and `agent` carry a human identity; the rest are machine\n * or anonymous callers, for which `user()` returns null.\n *\n * | Value           | Who                                                        |\n * |-----------------|------------------------------------------------------------|\n * | `user`          | a signed-in person in a browser                             |\n * | `api`           | a person via the REST API / CLI / MCP (their own token)     |\n * | `agent`         | the org's OpenClaw agent calling the app's API              |\n * | `agent-browser` | the agent driving a real browser on its VPS                 |\n * | `public`        | an unauthenticated visitor on a declared public route       |\n * | `bypass`        | platform-internal fetch (build/screenshot)                  |\n * | `system`        | the build pipeline                                          |\n * | `app`           | another app in the same org (or a headless org-token caller)|\n */\nexport type Caller =\n  | \"user\"\n  | \"api\"\n  | \"agent\"\n  | \"agent-browser\"\n  | \"public\"\n  | \"bypass\"\n  | \"system\"\n  | \"app\";\n\nconst CALLERS = new Set<Caller>([\n  \"user\",\n  \"api\",\n  \"agent\",\n  \"agent-browser\",\n  \"public\",\n  \"bypass\",\n  \"system\",\n  \"app\",\n]);\n\n/** The signed-in person behind a request. */\nexport interface AppUser {\n  /** Supabase user id — the stable key to store on rows (`created_by`). */\n  id: string;\n  email: string | null;\n  /** Display name, e.g. \"Ada Lovelace\". Null if the account has no name set. */\n  name: string | null;\n  /** Profile picture URL (https). Null if the account has no avatar. */\n  avatarUrl: string | null;\n  /**\n   * Best-effort split of `name` — a HEURISTIC, not platform data.\n   *\n   * The platform stores one `full_name`; there is no real given/family split\n   * behind it. This takes the first whitespace-separated token, which is wrong\n   * for many names (mononyms, multi-word given names, family-name-first\n   * cultures). Use it for a friendly greeting (\"Hi, Ada\"), never as a stored\n   * field or a record of someone's legal name — persist `name` instead.\n   */\n  firstName: string | null;\n  /** Remainder of `name` after the first token. Same heuristic caveat. */\n  lastName: string | null;\n}\n\nfunction read(c: RequestLike, name: string): string | null {\n  const v = c.req.header(name);\n  if (v === undefined) return null;\n  const trimmed = v.trim();\n  return trimmed === \"\" ? null : trimmed;\n}\n\nfunction splitName(name: string | null): Pick<AppUser, \"firstName\" | \"lastName\"> {\n  if (!name) return { firstName: null, lastName: null };\n  const parts = name.split(/\\s+/).filter(Boolean);\n  if (parts.length === 0) return { firstName: null, lastName: null };\n  if (parts.length === 1) return { firstName: parts[0], lastName: null };\n  return { firstName: parts[0], lastName: parts.slice(1).join(\" \") };\n}\n\n/**\n * What kind of principal is calling.\n *\n * Defaults to `\"public\"` — the least-privileged value — when the header is\n * missing or unrecognised, which happens when the app is reached outside the\n * platform perimeter (local `pnpm dev`). Gate privileged behaviour on an\n * explicit check (`caller(c) === \"user\"`), never on \"not public\".\n */\nexport function caller(c: RequestLike): Caller {\n  const v = read(c, \"X-Clawnify-Caller\");\n  return v && CALLERS.has(v as Caller) ? (v as Caller) : \"public\";\n}\n\n/**\n * The organization this request belongs to — the tenant key. Scope every query\n * by it.\n *\n * Present for `user`, `api`, `agent` and `app` callers. **Null** for\n * `agent-browser`, `public` and `bypass` — those reach the app through the\n * perimeter without an org-scoped identity — and null outside the platform.\n *\n * Treat null as \"no access\", never as a wildcard: a query filtered on a null\n * org must return nothing, not everything.\n */\nexport function orgId(c: RequestLike): string | null {\n  return read(c, \"X-Clawnify-Org-Id\");\n}\n\n/**\n * The person behind this request, or `null` when the caller isn't one.\n *\n * Null for `agent-browser`, `public`, `bypass`, `system` and `app` — five of\n * the eight caller types — so always handle the null case rather than assuming\n * a user is present:\n *\n *   const u = user(c);\n *   const label = u ? u.name ?? u.email : \"Automated\";\n */\nexport function user(c: RequestLike): AppUser | null {\n  const id = read(c, \"X-Clawnify-User-Id\");\n  if (!id) return null;\n\n  const name = read(c, \"X-Clawnify-User-Name\");\n  return {\n    id,\n    email: read(c, \"X-Clawnify-User-Email\"),\n    name,\n    avatarUrl: read(c, \"X-Clawnify-User-Avatar\"),\n    ...splitName(name),\n  };\n}\n"],"mappings":";AA4BA,SAAS,aAAa,sBAA6C;AACnE,SAAS,cAAc;AAOvB;AAAA,EACE,eAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,OACK;;;ACcP,IAAM,UAAU,oBAAI,IAAY;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAyBD,SAAS,KAAK,GAAgB,MAA6B;AACzD,QAAM,IAAI,EAAE,IAAI,OAAO,IAAI;AAC3B,MAAI,MAAM,OAAW,QAAO;AAC5B,QAAM,UAAU,EAAE,KAAK;AACvB,SAAO,YAAY,KAAK,OAAO;AACjC;AAEA,SAAS,UAAU,MAA8D;AAC/E,MAAI,CAAC,KAAM,QAAO,EAAE,WAAW,MAAM,UAAU,KAAK;AACpD,QAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,OAAO,OAAO;AAC9C,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,WAAW,MAAM,UAAU,KAAK;AACjE,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,WAAW,MAAM,CAAC,GAAG,UAAU,KAAK;AACrE,SAAO,EAAE,WAAW,MAAM,CAAC,GAAG,UAAU,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE;AACnE;AAUO,SAAS,OAAO,GAAwB;AAC7C,QAAM,IAAI,KAAK,GAAG,mBAAmB;AACrC,SAAO,KAAK,QAAQ,IAAI,CAAW,IAAK,IAAe;AACzD;AAaO,SAAS,MAAM,GAA+B;AACnD,SAAO,KAAK,GAAG,mBAAmB;AACpC;AAYO,SAAS,KAAK,GAAgC;AACnD,QAAM,KAAK,KAAK,GAAG,oBAAoB;AACvC,MAAI,CAAC,GAAI,QAAO;AAEhB,QAAM,OAAO,KAAK,GAAG,sBAAsB;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,OAAO,KAAK,GAAG,uBAAuB;AAAA,IACtC;AAAA,IACA,WAAW,KAAK,GAAG,wBAAwB;AAAA,IAC3C,GAAG,UAAU,IAAI;AAAA,EACnB;AACF;;;ADhFO,SAAS,UACd,OAAyB,CAAC,GACV;AAChB,QAAM,MAAM,IAAI,YAAe;AAE/B,MAAI,KAAK,OAAO,OAAO;AACrB,QAAI,IAAI,KAAK,OAAO,GAAG,SAAS;AAG9B,aAAO,EAAE,GAA8C;AACvD,YAAM,KAAK;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,KAAK,cAAc,OAAO;AAC5B,mBAAe,KAAK,IAAI;AAAA,EAC1B;AAEA,SAAO;AACT;","names":["OpenAPIHono","mountDiscovery"]}
+{"version":3,"sources":["../src/index.ts","../src/identity.ts"],"sourcesContent":["/**\n * @clawnify/app — the standard Clawnify app skeleton in one call.\n *\n * `createApp(opts)` returns a fully-wired OpenAPIHono with every always-required,\n * cross-cutting concern pre-baked, so an app's server file is just imports +\n * routes + `export default app`:\n *\n *   import { createApp, createRoute, z } from \"@clawnify/app\";\n *   const app = createApp<Env>({ title: \"CRM App\", version: \"1.0.0\" });\n *   app.openapi(listContacts, handler);\n *   export default app;\n *\n * What it bakes in — the boilerplate every app used to re-write in its server\n * file, and could forget:\n *   • OpenAPIHono construction (typed to your Env).\n *   • Database init — `initDB(c.env)` middleware on every request. @clawnify/db\n *     auto-detects the D1 binding (production WfP) or the Storage capability\n *     binding (Dynamic Workers preview), so handlers can query immediately.\n *   • API discovery — `mountDiscovery` serves GET /api/openapi.json (the machine\n *     contract) and GET /llms.txt (the lean agent index), generated from the\n *     live routes so they can't drift.\n *   • Identity — `user(c)` / `orgId(c)` / `caller(c)` read the platform-injected\n *     `X-Clawnify-*` headers, so an app never hand-parses them (see identity.ts).\n *\n * The point: a new always-required concern is added HERE once and every app\n * inherits it on the next rebuild — instead of a line each agent must remember\n * to write (and a build gate to enforce) in every app.\n */\nimport { OpenAPIHono, mountDiscovery, type DiscoveryOptions } from \"@clawnify/routes\";\nimport { initDB } from \"@clawnify/db\";\nimport type { Env } from \"hono\";\n\n// One routing import for app authors: everything needed to declare routes and\n// build the app comes from @clawnify/app. These are re-exports of the same\n// @hono/zod-openapi primitives @clawnify/routes exposes — never reimplemented —\n// so route creation, discovery, and construction all live behind one import.\nexport {\n  OpenAPIHono,\n  createRoute,\n  z,\n  mountDiscovery,\n  describeRoutes,\n  PageQuery,\n  pageParams,\n  pagedResponse,\n  DEFAULT_PAGE_LIMIT,\n  MAX_PAGE_LIMIT,\n} from \"@clawnify/routes\";\nexport type { DiscoveryOptions, DiscoverableApp, PageParams } from \"@clawnify/routes\";\n\n// Identity of the caller, read from the platform-injected headers. Apps never\n// authenticate anyone themselves — see identity.ts.\nexport { user, orgId, caller } from \"./identity\";\nexport type { AppUser, Caller, RequestLike } from \"./identity\";\n\nexport interface CreateAppOptions extends DiscoveryOptions {\n  /**\n   * Wire the per-request database middleware (`initDB(c.env)` on `*`). Default\n   * true — every Clawnify app has a D1 / Storage binding. Set false only for the\n   * rare app with no database.\n   */\n  db?: boolean;\n  /**\n   * Mount GET /api/openapi.json + GET /llms.txt discovery. Default true. Set\n   * false only if the app deliberately opts out of API discovery.\n   */\n  discovery?: boolean;\n}\n\n/**\n * Create a fully-wired Clawnify app.\n *\n * `E` is your Hono env — `{ Bindings: { DB: D1Database, ... } }` — pass it so\n * route handlers get a typed `c.env`. Everything after this call is your app's\n * own routes and business logic:\n *\n *   const app = createApp<Env>({ title: \"CRM App\", version: \"1.0.0\" });\n *   app.openapi(route, handler);\n *   export default app;\n */\nexport function createApp<E extends Env = Env>(\n  opts: CreateAppOptions = {},\n): OpenAPIHono<E> {\n  const app = new OpenAPIHono<E>();\n\n  if (opts.db !== false) {\n    app.use(\"*\", async (c, next) => {\n      // @clawnify/db reads the DB (D1) or Storage binding off the env and caches\n      // the Drizzle client for this request. Safe to call on every request.\n      initDB(c.env as unknown as Parameters<typeof initDB>[0]);\n      await next();\n    });\n  }\n\n  if (opts.discovery !== false) {\n    mountDiscovery(app, opts);\n  }\n\n  return app;\n}\n","/**\n * Identity — who is calling this app.\n *\n * The platform authenticates the caller at the perimeter (app-router, the\n * app-supervisor preview tier, or the /v1/apps/:id/proxy API) and injects a\n * *fresh* set of `X-Clawnify-*` headers. Any client-supplied `X-Clawnify-*` is\n * stripped first, so these headers cannot be spoofed and an app can trust them\n * directly.\n *\n * Apps therefore never authenticate anyone themselves: never read\n * `Authorization`, never parse a cookie, never verify a JWT. Read these\n * helpers instead.\n *\n *   import { user, orgId, caller } from \"@clawnify/app\";\n *\n *   app.openapi(route, (c) => {\n *     const u = user(c);                       // null when the caller isn't a person\n *     return c.json({ hello: u?.name ?? \"there\", org: orgId(c) });\n *   });\n */\n\n/**\n * Minimal shape this module needs — Hono's `Context` satisfies it structurally,\n * so `user(c)` works in any handler regardless of the app's Env generics.\n */\nexport interface RequestLike {\n  req: { header(name: string): string | undefined };\n}\n\n/**\n * What kind of principal is calling.\n *\n * Only `user`, `api` and `agent` carry a human identity; the rest are machine\n * or anonymous callers, for which `user()` returns null.\n *\n * | Value           | Who                                                        |\n * |-----------------|------------------------------------------------------------|\n * | `user`          | a signed-in person in a browser                             |\n * | `api`           | a person via the REST API / CLI / MCP (their own token)     |\n * | `agent`         | the org's OpenClaw agent calling the app's API              |\n * | `agent-browser` | the agent driving a real browser on its VPS                 |\n * | `public`        | an unauthenticated visitor on a declared public route       |\n * | `bypass`        | platform-internal fetch (build/screenshot)                  |\n * | `system`        | the build pipeline                                          |\n * | `app`           | another app in the same org (or a headless org-token caller)|\n */\nexport type Caller =\n  | \"user\"\n  | \"api\"\n  | \"agent\"\n  | \"agent-browser\"\n  | \"public\"\n  | \"bypass\"\n  | \"system\"\n  | \"app\";\n\nconst CALLERS = new Set<Caller>([\n  \"user\",\n  \"api\",\n  \"agent\",\n  \"agent-browser\",\n  \"public\",\n  \"bypass\",\n  \"system\",\n  \"app\",\n]);\n\n/** The signed-in person behind a request. */\nexport interface AppUser {\n  /** Supabase user id — the stable key to store on rows (`created_by`). */\n  id: string;\n  email: string | null;\n  /** Display name, e.g. \"Ada Lovelace\". Null if the account has no name set. */\n  name: string | null;\n  /** Profile picture URL (https). Null if the account has no avatar. */\n  avatarUrl: string | null;\n  /**\n   * Best-effort split of `name` — a HEURISTIC, not platform data.\n   *\n   * The platform stores one `full_name`; there is no real given/family split\n   * behind it. This takes the first whitespace-separated token, which is wrong\n   * for many names (mononyms, multi-word given names, family-name-first\n   * cultures). Use it for a friendly greeting (\"Hi, Ada\"), never as a stored\n   * field or a record of someone's legal name — persist `name` instead.\n   */\n  firstName: string | null;\n  /** Remainder of `name` after the first token. Same heuristic caveat. */\n  lastName: string | null;\n}\n\nfunction read(c: RequestLike, name: string): string | null {\n  const v = c.req.header(name);\n  if (v === undefined) return null;\n  const trimmed = v.trim();\n  return trimmed === \"\" ? null : trimmed;\n}\n\nfunction splitName(name: string | null): Pick<AppUser, \"firstName\" | \"lastName\"> {\n  if (!name) return { firstName: null, lastName: null };\n  const parts = name.split(/\\s+/).filter(Boolean);\n  if (parts.length === 0) return { firstName: null, lastName: null };\n  if (parts.length === 1) return { firstName: parts[0], lastName: null };\n  return { firstName: parts[0], lastName: parts.slice(1).join(\" \") };\n}\n\n/**\n * What kind of principal is calling.\n *\n * Defaults to `\"public\"` — the least-privileged value — when the header is\n * missing or unrecognised, which happens when the app is reached outside the\n * platform perimeter (local `pnpm dev`). Gate privileged behaviour on an\n * explicit check (`caller(c) === \"user\"`), never on \"not public\".\n */\nexport function caller(c: RequestLike): Caller {\n  const v = read(c, \"X-Clawnify-Caller\");\n  return v && CALLERS.has(v as Caller) ? (v as Caller) : \"public\";\n}\n\n/**\n * The organization this request belongs to — the tenant key. Scope every query\n * by it.\n *\n * Present for `user`, `api`, `agent` and `app` callers. **Null** for\n * `agent-browser`, `public` and `bypass` — those reach the app through the\n * perimeter without an org-scoped identity — and null outside the platform.\n *\n * Treat null as \"no access\", never as a wildcard: a query filtered on a null\n * org must return nothing, not everything.\n */\nexport function orgId(c: RequestLike): string | null {\n  return read(c, \"X-Clawnify-Org-Id\");\n}\n\n/**\n * The person behind this request, or `null` when the caller isn't one.\n *\n * Null for `agent-browser`, `public`, `bypass`, `system` and `app` — five of\n * the eight caller types — so always handle the null case rather than assuming\n * a user is present:\n *\n *   const u = user(c);\n *   const label = u ? u.name ?? u.email : \"Automated\";\n */\nexport function user(c: RequestLike): AppUser | null {\n  const id = read(c, \"X-Clawnify-User-Id\");\n  if (!id) return null;\n\n  const name = read(c, \"X-Clawnify-User-Name\");\n  return {\n    id,\n    email: read(c, \"X-Clawnify-User-Email\"),\n    name,\n    avatarUrl: read(c, \"X-Clawnify-User-Avatar\"),\n    ...splitName(name),\n  };\n}\n"],"mappings":";AA4BA,SAAS,aAAa,sBAA6C;AACnE,SAAS,cAAc;AAOvB;AAAA,EACE,eAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACSP,IAAM,UAAU,oBAAI,IAAY;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAyBD,SAAS,KAAK,GAAgB,MAA6B;AACzD,QAAM,IAAI,EAAE,IAAI,OAAO,IAAI;AAC3B,MAAI,MAAM,OAAW,QAAO;AAC5B,QAAM,UAAU,EAAE,KAAK;AACvB,SAAO,YAAY,KAAK,OAAO;AACjC;AAEA,SAAS,UAAU,MAA8D;AAC/E,MAAI,CAAC,KAAM,QAAO,EAAE,WAAW,MAAM,UAAU,KAAK;AACpD,QAAM,QAAQ,KAAK,MAAM,KAAK,EAAE,OAAO,OAAO;AAC9C,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,WAAW,MAAM,UAAU,KAAK;AACjE,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,WAAW,MAAM,CAAC,GAAG,UAAU,KAAK;AACrE,SAAO,EAAE,WAAW,MAAM,CAAC,GAAG,UAAU,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE;AACnE;AAUO,SAAS,OAAO,GAAwB;AAC7C,QAAM,IAAI,KAAK,GAAG,mBAAmB;AACrC,SAAO,KAAK,QAAQ,IAAI,CAAW,IAAK,IAAe;AACzD;AAaO,SAAS,MAAM,GAA+B;AACnD,SAAO,KAAK,GAAG,mBAAmB;AACpC;AAYO,SAAS,KAAK,GAAgC;AACnD,QAAM,KAAK,KAAK,GAAG,oBAAoB;AACvC,MAAI,CAAC,GAAI,QAAO;AAEhB,QAAM,OAAO,KAAK,GAAG,sBAAsB;AAC3C,SAAO;AAAA,IACL;AAAA,IACA,OAAO,KAAK,GAAG,uBAAuB;AAAA,IACtC;AAAA,IACA,WAAW,KAAK,GAAG,wBAAwB;AAAA,IAC3C,GAAG,UAAU,IAAI;AAAA,EACnB;AACF;;;AD3EO,SAAS,UACd,OAAyB,CAAC,GACV;AAChB,QAAM,MAAM,IAAI,YAAe;AAE/B,MAAI,KAAK,OAAO,OAAO;AACrB,QAAI,IAAI,KAAK,OAAO,GAAG,SAAS;AAG9B,aAAO,EAAE,GAA8C;AACvD,YAAM,KAAK;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,KAAK,cAAc,OAAO;AAC5B,mBAAe,KAAK,IAAI;AAAA,EAC1B;AAEA,SAAO;AACT;","names":["OpenAPIHono","mountDiscovery"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawnify/app",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The standard Clawnify app skeleton in one call. createApp() returns a fully-wired OpenAPIHono with D1/Storage init + /api/openapi.json + /llms.txt discovery pre-baked, so an app is just imports + routes + export.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,8 +23,8 @@
     "dist"
   ],
   "dependencies": {
-    "@clawnify/db": "^0.4.1",
-    "@clawnify/routes": "^0.2.2"
+    "@clawnify/routes": "^0.3.0",
+    "@clawnify/db": "^0.4.2"
   },
   "peerDependencies": {
     "@hono/zod-openapi": ">=0.18 <1",