chore: bump version to 0.16.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -98,6 +98,10 @@ tests/
   unit/                # Vitest unit tests
   e2e/                 # Playwright e2e tests (Gherkin-style)
     helpers/fixtures.ts  # Shared authenticatedPage fixture
+website/               # Static landing page (crumbs.bretzel.app)
+  index.html           # Landing page with feature cards, screenshots, deploy section
+  styles.css           # Landing page styles (retro parchment theme)
+  assets/              # Favicon, screenshots
 ```
 
 ## Commands

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   crumbs:
-    image: ghcr.io/bretzel-app/crumbs:0.14.0
+    image: ghcr.io/bretzel-app/crumbs:0.15.0
     container_name: crumbs
     ports:
       - "3000:3000"

package.json

@@ -1,7 +1,7 @@
 {
   "name": "crumbs",
   "private": true,
-  "version": "0.15.0",
+  "version": "0.16.0",
   "type": "module",
   "license": "MIT",
   "author": "Bretzel (https://bretzel.app)",

src/hooks.server.ts

@@ -22,36 +22,31 @@ export const handle: Handle = async ({ event, resolve }) => {
 		return resolve(event);
 	}
 
-	// MCP endpoint: authenticate via Bearer token (API key)
-	if (pathname.startsWith('/api/mcp')) {
+	// API routes: authenticate via Bearer token if present
+	if (pathname.startsWith('/api/')) {
 		const authHeader = event.request.headers.get('authorization');
 		const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
 
-		if (!token) {
-			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
-				status: 401,
-				headers: { 'Content-Type': 'application/json' }
-			});
-		}
+		if (token) {
+			const { valid, userId } = validateApiKey(token);
+			if (!valid || !userId) {
+				return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+					status: 401,
+					headers: { 'Content-Type': 'application/json' }
+				});
+			}
 
-		const { valid, userId } = validateApiKey(token);
-		if (!valid || !userId) {
-			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
-				status: 401,
-				headers: { 'Content-Type': 'application/json' }
-			});
-		}
+			const user = getUserForApiKey(userId);
+			if (!user) {
+				return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+					status: 401,
+					headers: { 'Content-Type': 'application/json' }
+				});
+			}
 
-		const user = getUserForApiKey(userId);
-		if (!user) {
-			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
-				status: 401,
-				headers: { 'Content-Type': 'application/json' }
-			});
+			event.locals.user = user;
+			return resolve(event);
 		}
-
-		event.locals.user = user;
-		return resolve(event);
 	}
 
 	// Check if setup is complete

src/routes/(app)/settings/+layout.svelte

@@ -32,7 +32,7 @@
 						class="flex items-center gap-2 rounded-sm px-3 py-2 text-sm whitespace-nowrap transition-colors {pathname === '/settings/mcp' ? 'bg-[var(--primary)]/15 text-[var(--primary)] font-medium' : 'text-[var(--text)] hover:bg-[var(--bg-base)]'}"
 					>
 						<Cpu size={16} />
-						MCP Server
+						API
 					</a>
 				</li>
 				{#if data.user?.role === 'admin'}

src/routes/(app)/settings/mcp/+page.svelte

@@ -122,7 +122,7 @@ ${mcpJsonConfig}`);
 		<h2 class="text-lg font-semibold text-[var(--text)]">API Keys</h2>
 	</div>
 	<p class="mb-4 text-xs text-[var(--text-muted)]">
-		API keys allow external tools (like Claude Code) to access your notes via the MCP protocol.
+		API keys allow external tools to access your notes via the MCP protocol and the REST API.
 	</p>
 
 	<!-- Create Key Form -->
@@ -229,9 +229,19 @@ ${mcpJsonConfig}`);
 	{/if}
 </section>
 
+<!-- REST API Example -->
+<section class="mb-6 rounded-sm border border-[var(--border-subtle)] bg-[var(--bg-surface)] p-6 shadow-[var(--card-shadow)]">
+	<h2 class="mb-4 text-lg font-semibold text-[var(--text)]">REST API</h2>
+	<p class="mb-3 text-xs text-[var(--text-muted)]">
+		Use your API key to authenticate requests to any <code class="rounded-sm bg-[var(--bg-base)] px-1 py-0.5">/api/*</code> endpoint:
+	</p>
+	<pre class="overflow-x-auto rounded-sm bg-[var(--bg-base)] p-3 text-xs text-[var(--text)]">curl -H "Authorization: Bearer {activeApiKey}" \
+  {baseUrl}/api/notes</pre>
+</section>
+
 <!-- MCP Config Help -->
 <section class="rounded-sm border border-[var(--border-subtle)] bg-[var(--bg-surface)] p-6 shadow-[var(--card-shadow)]">
-	<h2 class="mb-4 text-lg font-semibold text-[var(--text)]">Client Configuration</h2>
+	<h2 class="mb-4 text-lg font-semibold text-[var(--text)]">MCP Client Configuration</h2>
 	<p class="mb-3 text-xs text-[var(--text-muted)]">
 		Add this to your <code class="rounded-sm bg-[var(--bg-base)] px-1 py-0.5">.claude/settings.json</code> (Claude Code):
 	</p>

website/index.html

@@ -145,8 +145,8 @@
 					<div class="feature-icon">
 						<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="4" width="16" height="16" rx="2"/><path d="M9 9h6v6H9z"/><path d="M15 2v2"/><path d="M15 20v2"/><path d="M2 15h2"/><path d="M2 9h2"/><path d="M20 15h2"/><path d="M20 9h2"/><path d="M9 2v2"/><path d="M9 20v2"/></svg>
 					</div>
-					<h3>MCP Server</h3>
-					<p>Built-in AI integration. Connect Claude, Cursor, or any MCP client to read and write your notes.</p>
+					<h3>API & MCP</h3>
+					<p>Full REST API with token auth. Integrate with n8n, Zapier, or scripts. Built-in MCP server for AI tools like Claude and Cursor.</p>
 				</div>
 
 				<!-- Multi-User -->
@@ -253,7 +253,7 @@
 				<li><a href="https://github.com/bretzel-app/crumbs/blob/main/docs/DEPLOYMENT.md" target="_blank" rel="noopener">Docs</a></li>
 				<li><a href="https://github.com/bretzel-app/crumbs/blob/main/LICENSE" target="_blank" rel="noopener">License</a></li>
 			</ul>
-			<span class="footer-version">v0.15.0</span>
+			<span class="footer-version">v0.16.0</span>
 		</div>
 	</footer>