feat(catalog): add AppWeaver managed app

catalog/appweaver.yaml

@@ -0,0 +1,19 @@
+services:
+  appweaver:
+    image: ghcr.io/getappweaver/core:alpine-3e4b413@sha256:de1d200aba4cfc908eb1466fe3a1fea750f07ee9c79edb793b6174212a36613a
+    user: "1000"
+    resources: { cpu: 1, memory: 2Gi }
+    ports:
+      - { name: http, container: 5551, protocol: http, expose: ingress }
+    env:
+      BOT_SETUP_UI_ORIGIN: "https://${HOSTNAME}"
+      BOT_MASTER_PUBKEY: "${master_pubkey}"
+    volumes:
+      - { name: workspace, path: /workspace/appweaver, size: 20Gi, label: files }
+    scratch:
+      - { path: /tmp, size: 256Mi }
+    backup:
+      volume: workspace
+config:
+  - { name: master_pubkey, label: "Master pubkey (64-character lowercase hex)", type: string,
+      required: true, pattern: "[0-9a-f]{64}" }

docs/managed-app-examples.md

@@ -646,6 +646,31 @@ where the image allows it.
 
 ---
 
+## AppWeaver — AI-powered app hub
+
+- **Image:** `ghcr.io/getappweaver/core:alpine` — published from
+  <https://github.com/getappweaver/core>. The Alpine runtime includes Bun,
+  OpenCode, ngit and Piper, but deliberately excludes Chromium, Playwright
+  browsers, Cursor Agent and VNC.
+- **Repo:** <https://github.com/getappweaver/core> — the entrypoint clones the
+  core repository into the persistent workspace on first boot, installs its
+  locked dependencies and starts the setup web UI on port `5551`. The workspace
+  volume retains configuration, credentials, installed apps and app data across
+  image upgrades.
+- **Authentication:** API-key and device-code OpenCode providers work through
+  the setup web UI. A provider that requires a callback to the user's localhost
+  cannot be authenticated without a separate tunnel and should not be selected
+  for a managed deployment.
+- **Setup access:** the order form requires the owner's 64-character lowercase
+  hex Nostr pubkey. AppWeaver receives it as `BOT_MASTER_PUBKEY`; `/setup`
+  requires a matching NIP-98 signature before issuing an in-memory setup
+  session, so the customer does not need access to container logs.
+
+**Document:** [`catalog/appweaver.yaml`](../catalog/appweaver.yaml) —
+`scripts/app-catalog-test.sh catalog/appweaver.yaml` starts it locally.
+
+---
+
 ## Notes on other apps
 
 - **zap-stream-core** — needs raw TCP/UDP ingest (RTMP `1935/tcp`, SRT), i.e.

scripts/app-catalog-test.sh

@@ -40,6 +40,7 @@ app_config() {
         # merely pattern-shaped string would crashloop the container.
         haven) echo "--config owner_npub=npub1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqshp52w2" ;;
         buzz)  echo "--config owner_pubkey=0000000000000000000000000000000000000000000000000000000000000001" ;;
+        appweaver) echo "--config master_pubkey=79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798" ;;
         *)     echo "" ;;
     esac
 }