howone 0.2.3 → 0.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "howone",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "private": false,
   "description": "HowOne command line tools for creating app templates.",
   "type": "module",

package/templates/vite/.howone/skills/howone/01-architect/01-app-generation.md

@@ -126,10 +126,10 @@ Defaults: "my/private" → own; public catalog only when fields are safe; share
 
 | Need | Client | Provider |
 |---|---|---|
-| HowOne AI, uploads, or authenticated/private entities | default `createClient` | `HowOneProvider auth="required"`; hosted login |
-| Custom HowOne login UI | `auth: 'custom'`, real OTP/OAuth token flow | `HowOneProvider auth="none"`; app guards routes |
-| External IdP | headless + adapter | `HowOneProvider auth="required"`; adapter owns token |
-| Manifest-approved public entities only | default client or `auth: 'none'` | `HowOneProvider auth="optional"` |
+| HowOne AI, uploads, or authenticated/private entities | default `createClient` | `<HowOneProvider client={howone}>`; hosted guard is inherited |
+| Custom HowOne login UI | `auth: 'custom'`, real OTP/OAuth token flow | `<HowOneProvider client={howone}>`; custom guard is inherited |
+| External IdP | headless + adapter | `<HowOneProvider client={howone}>`; adapter owns token |
+| Manifest-approved public entities only | `auth: 'none'` or explicit public client | `<HowOneProvider client={howone}>` with no required guard |
 | No HowOne runtime | no client required | no Provider required |
 
 Keep default HowOne brand control unless user asks to hide. Resolve identity through the SDK track
@@ -142,7 +142,8 @@ When the final app uses any `@howone/sdk` runtime surface—including a synced e
 public entities, uploads, auth, user/session APIs, or raw SDK requests:
 
 1. Initialize the single app client in `src/lib/sdk.ts` with the generated project/env configuration.
-2. Import that SDK module before `HowOneProvider` so the Provider sees the selected auth environment.
+2. Import that SDK module before `HowOneProvider` and pass the composed client so the Provider sees
+   the selected environment and instance-scoped auth state.
 3. Keep `HowOneProvider` around the rendered application root. This is required for every active
    HowOne SDK runtime, including public-only entity applications; replacing scaffold UI must not
    remove it.
@@ -175,8 +176,8 @@ without default) need explicit user alignment before applying the final patch.
 1. Read architecture + **catalog** (feasibility) + contract rules; use playbooks when they match.
 2. Apply one complete capability patch → `sync_ai_artifacts`.
 3. External workflow create/update per workflow-operations reference; keep job/request IDs from tool results.
-4. Wait for the terminal result. A successful update promotes its new workflow ID in the backend capability version.
-5. Run `sync_ai_artifacts` again, then read `{appRoot}/.howone/ai/manifest.json`.
+4. Treat submission as asynchronous pending work, not a pause boundary. Continue independent app source, UI, persistence, and state implementation instead of ending the run to wait.
+5. After the terminal result becomes available, run `sync_ai_artifacts` again, then read `{appRoot}/.howone/ai/manifest.json`. A successful update promotes its new workflow ID in the backend capability version.
 6. Stop AI design. Read SDK references only if implementing app calls.
 7. If persistence required: entity workflow after output contract is fixed.