{"protocol":"clank-doc/1","frameworkVersion":"0.8.0","slug":"overview","title":"Clank","description":"Clank is a dependency free, AI first full stack TypeScript framework and open source deployment platform. It combines fine grained reactivity, direct DOM rendering, SSR with node preserving hydration, inference first server functions, built","group":{"id":"project","title":"Project"},"url":"https://docs.clank.run/docs/overview","source":"README.md","headings":["What works","Install","Run it","Documentation","Design principles"],"tableOfContents":[{"id":"what-works","title":"What works","level":2},{"id":"install","title":"Install","level":2},{"id":"run-it","title":"Run it","level":2},{"id":"documentation","title":"Documentation","level":2},{"id":"design-principles","title":"Design principles","level":2}],"markdown":"# Clank\n\nClank is a dependency-free, AI-first full-stack TypeScript framework and open-source deployment platform. It combines fine-grained reactivity, direct DOM rendering, SSR with node-preserving hydration, inference-first server functions, built-in auth, user-owned SQLite documents, live queries, deterministic artifacts, database migrations, and atomic deployment.\n\n“AI-first” does not mean putting a chat box on every page. In Clank, the same application has two first-class interfaces:\n\n- Humans receive accessible HTML, responsive state, forms, navigation, and Tailwind styling.\n- Agents receive named actions with JSON Schema, explicit side-effect and confirmation metadata, and a compact semantic view of the interactive UI.\n\nThe framework itself has no dependencies, dev dependencies, peer dependencies, virtual DOM, runtime compiler, or bundler. Clank's build-time TSX compiler is included; Node 22.16+ supplies the final TypeScript-to-JavaScript transform and consistent built-in SQLite backups.\n\n## What works\n\n| Layer | Features |\n| --- | --- |\n| Reactivity | Signals, lazy computed values, effects with cleanup, batching, rollback transactions, untracked reads, owned roots, deep proxy stores, snapshots, async resources, stream reduction |\n| UI | Typed compiler-powered TSX, automatic reactive expressions and props, keyed lists, stable text nodes, lifecycle/context, forms, dialogs, tabs, disclosures, pagination, directives, `Show`, `For`, `Switch`, lazy components |\n| Forms | Schema validation, typed fields, accessible control/error props, touched/dirty state, cross-field rules, cancellation, server errors, invalid-focus behavior, reset, agent-readable manifests |\n| AI | Web-focused runtime schemas, JSON Schema output, typed actions, authorization, side-effect/confirmation policy, action runners, semantic views, native-label-aware inspect/activate/input surface with secret-value redaction |\n| Routing | Parameters, optional segments, wildcards, repeated query values, async loaders, aborts, guards, redirects, titles, links, history navigation |\n| Full stack | Inferred schemas/documents/arguments/results, branded IDs, query and mutation functions, zero-codegen typed API references |\n| Auth | Email/password sessions, scrypt hashing, secure cookies, CSRF, roles, revocation, default auth UI, SSR boot state |\n| Data | Node's built-in SQLite, JSON documents, declared expression indexes, owned tables, atomic mutations, persisted revisions, dependency-tracked query cache |\n| Live sync | Auth-partitioned Fetch RPC and cache, EventSource streams, session revocation, automatic invalidation, SSR seeding, multi-tab synchronization |\n| SSR | Async string rendering, full-document templates, safe state serialization, CSP nonces, context and keyed lists, marker-based DOM-preserving hydration |\n| Server | Fetch router, security headers, safe CORS, bounded Node HTTP adapter, Host checks, symlink-aware static files, response helpers |\n| Styling | Native `class`, reactive `classList`, style objects, CSS custom properties, Tailwind Play CDN and compiled Tailwind CSS compatibility |\n| Deploy | Full browser console, workspace people/role/invitation administration, activity feed, ingress performance metrics, enforced account/organization/site/domain/release-storage quotas, custom DNS/TLS onboarding, browser-approved CLI auth, deterministic artifacts, encrypted secrets, immutable migrations, SQLite backups, storage-backed readiness, health-gated releases, confirmation-gated release and site deletion, logs, audit, rollback |\n\n## Install\n\nInstall the framework and its `clank` and `clank-platform` commands from the organization scope:\n\n```sh\nnpm install --global @clank.run/framework\nclank --version\n```\n\nGenerated applications declare `@clank.run/framework` as their only dependency. The framework has no transitive packages.\n\n## Run it\n\n```sh\nnpm run check\nnpm run dev\n```\n\nOpen `http://127.0.0.1:4173`. `npm` only runs scripts here; `package.json` installs nothing.\n\nThe development server also exposes several complete application shapes:\n\n- `/examples/commerce/index.html`: catalog, filtering, cart dialog, and checkout form.\n- `/examples/dashboard/index.html`: responsive SaaS admin, tabs, tables, pagination, invitations, and settings.\n- `/examples/booking/index.html`: multi-step dates, room selection, guest details, pricing, and confirmation.\n- `/examples/todo/index.html`: the smallest focused keyed CRUD example.\n\nRun the SSR + SQLite + live-sync example separately:\n\n```sh\nnpm run dev:fullstack\n```\n\nOpen `http://127.0.0.1:4180` in two tabs. A committed mutation in either tab streams a new query snapshot to both. The first response already contains the todo HTML; the client hydrates those exact nodes.\n\nRun the auth-first reference app:\n\n```sh\nnpm run dev:auth\n```\n\nOpen `http://127.0.0.1:4181`, create an account, and sign into that account from a second browser. Registration, secure sessions, a synchronized profile, create/rename/complete/remove todo operations, per-user data isolation, SSR, Tailwind, and live synchronization are already wired. The complete source and Tailscale instructions are in [`examples/auth-todo`](examples/auth-todo).\n\nCreate and deploy a new authenticated app:\n\n```sh\nclank login\nclank create my-app\ncd my-app\nnpm install\nclank doctor\nclank deploy\n```\n\n`clank login` uses `https://clank.run` by default. Run bare `clank` for the interactive template launcher, or use `clank create my-site --template=minimal` for the smaller starter. The generated app installs only Clank, which has no transitive dependencies, and includes `README.md` plus an agent-ready `AGENTS.md`. The first deploy creates and links the site automatically. The CLI builds locally without a shell, vendors the exact Clank runtime, verifies every path and SHA-256 digest, applies ordered SQLite migrations behind a backup, health-checks the candidate, and restores the previous release automatically on failure. `clank deploy --dry-run` performs the complete local artifact check without login or network access.\n\nTo develop the open-source control plane itself, run `npm run dev:platform` and use `clank login --server=http://127.0.0.1:4200`. The explicit loopback override is for local platform development, not the normal hosted workflow.\n\nThe smallest application is:\n\n```tsx\nimport { computed, render, signal } from \"./dist/index.js\";\n\nconst count = signal(0);\nconst label = computed(() => `Count: ${count.value}`);\n\nfunction App() {\n  return (\n    <button\n      class=\"rounded-full bg-slate-900 px-4 py-2 text-white\"\n      onClick={() => count.value++}\n      agentId=\"increment\"\n      agentLabel=\"Increase count\"\n    >\n      {label.value}\n    </button>\n  );\n}\n\nrender(document.querySelector(\"#app\")!, <App />);\n```\n\n## Documentation\n\n- [Documentation website](https://docs.clank.run) — searchable, responsive, and available as Markdown, JSON, `llms.txt`, and a complete agent corpus\n- [Documentation site source](docs-site/README.md)\n- [Getting started](docs/getting-started.md)\n- [Reactivity](docs/reactivity.md)\n- [Rendering and components](docs/rendering.md)\n- [Forms](docs/forms.md)\n- [Headless UI behavior](docs/ui.md)\n- [Performance model](docs/performance.md)\n- [AI-first contracts](docs/ai-first.md)\n- [AI application blueprints](docs/blueprints.md)\n- [Authentication, MFA, passkeys, and recovery](docs/authentication.md)\n- [Organizations, RBAC, invitations, and scoped tokens](docs/organizations.md)\n- [Service drivers for files, email, jobs, and webhooks](docs/services.md)\n- [Structured logs, traces, metrics, and health](docs/observability.md)\n- [Encrypted backups and disaster recovery](docs/recovery.md)\n- [Durable distributed deployment and agent fencing](docs/distributed-deployment.md)\n- [Managed ingress, custom domains, and external PostgreSQL](docs/data-plane.md)\n- [ASVS-oriented security verification](docs/security-asvs.md)\n- [Threat model](docs/threat-model.md)\n- [Chaos and failure testing](docs/chaos-testing.md)\n- [Public beta readiness](docs/public-beta.md)\n- [Application recipes for humans and agents](docs/application-recipes.md)\n- [Packaged-release conformance](docs/conformance.md)\n- [Code and product audit](docs/code-audit.md)\n- [Maintenance and release certification](docs/maintenance.md)\n- [Release process](docs/releases.md)\n- [Authentication](docs/auth.md)\n- [Security and deployment](docs/security.md)\n- [Deployment platform](docs/deployment-platform.md)\n- [Deployment dashboard, quotas, metrics, and custom domains](docs/platform-dashboard.md)\n- [Deployment CLI](docs/cli.md)\n- [Renaming from Proact](docs/renaming-from-proact.md)\n- [SQLite migrations](docs/migrations.md)\n- [Database revisions and correctness](docs/database.md)\n- [Platform security](docs/platform-security.md)\n- [Self-hosting](docs/self-hosting.md)\n- [Railway production deployment](docs/railway.md)\n- [Routing](docs/routing.md)\n- [Server primitives](docs/server.md)\n- [Full-stack SSR, SQLite, and live sync](docs/full-stack.md)\n- [Tailwind CSS](docs/tailwind.md)\n- [Architecture](docs/architecture.md)\n- [API reference](docs/api-reference.md)\n\n## Design principles\n\n1. **Inference should flow from runtime contracts.** Declare a validator once; TypeScript derives documents, IDs, function inputs, outputs, and clients while agents receive the equivalent JSON Schema.\n2. **Fine-grained updates beat tree rerenders.** Components establish bindings once; signals update only the dependent region or property.\n3. **The platform is the dependency.** Clank uses DOM, Fetch, URL, AbortController, Proxy, Web History, and Node primitives directly.\n4. **Simple code should stay simple.** A component is a function, state is an object with `.value`, and UI is ordinary HTML structure.\n5. **Dangerous behavior must be legible.** Actions declare side effects, confirmation expectations, validation, and authorization at their boundary.\n6. **Private data should be private by construction.** Auth-required functions and owned tables make the safe path the short path.\n7. **Deployment should be a verifiable transaction.** Build inputs, artifact contents, migration history, activation, failure recovery, and rollback are explicit and auditable.\n\nClank is MIT licensed.\n\nThe official npm package is `@clank.run/framework`; the installed executables are `clank` and `clank-platform`. The npm organization provides a verified namespace for future Clank packages, while the unrelated unscoped `clank` package remains a different project.\n"}