@hitch42/applet 0.1.0-beta.10

package/dist/workflow-CTo2kZF1.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/server/identity.ts
+const requestContext = new AsyncLocalStorage();
+function runWithRequestContext(context, fn) {
+	return requestContext.run(context, fn);
+}
+function tryGetRequestContext() {
+	return requestContext.getStore();
+}
+function getRequestContext() {
+	const context = requestContext.getStore();
+	if (context === void 0) throw new Error("Hitch request context is unavailable outside a request.");
+	return context;
+}
+function getIdentityBearer(identity) {
+	return identity.kind === "user" ? identity.sessionToken : identity.token;
+}
+//#endregion
+//#region src/server/workflow.ts
+const DURATION_MULTIPLIERS = {
+	milliseconds: 1,
+	seconds: 1e3,
+	minutes: 6e4,
+	hours: 36e5,
+	days: 864e5,
+	weeks: 6048e5
+};
+const MAX_DURATION_MS = 365 * DURATION_MULTIPLIERS.days;
+const unit = z.number().nonnegative().optional();
+const workflowDurationSchema = z.strictObject({
+	milliseconds: unit,
+	seconds: unit,
+	minutes: unit,
+	hours: unit,
+	days: unit,
+	weeks: unit
+}).refine((duration) => sumMilliseconds(duration) <= MAX_DURATION_MS, "must not exceed 365 days");
+function sumMilliseconds(duration) {
+	return Object.entries(DURATION_MULTIPLIERS).reduce((total, [key, multiplier]) => total + (duration[key] ?? 0) * multiplier, 0);
+}
+function toMilliseconds(duration) {
+	const parsed = workflowDurationSchema.safeParse(duration);
+	if (!parsed.success) throw new Error(`Invalid workflow duration: ${z.prettifyError(parsed.error)}`);
+	return sumMilliseconds(parsed.data);
+}
+function createWorkflow(run) {
+	return { run };
+}
+//#endregion
+export { getRequestContext as a, getIdentityBearer as i, createWorkflow as n, runWithRequestContext as o, toMilliseconds as r, tryGetRequestContext as s, MAX_DURATION_MS as t };

package/dist/workflow-DurM6Fwx.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+//#region src/server/workflow.d.ts
+type WorkflowDuration = {
+  milliseconds?: number;
+  seconds?: number;
+  minutes?: number;
+  hours?: number;
+  days?: number;
+  weeks?: number;
+};
+type WorkflowStep = {
+  do<T>(name: string, fn: () => T | Promise<T>): Promise<T>;
+  do<T>(name: string, options: {
+    retries?: {
+      limit: number;
+      delay: WorkflowDuration;
+      backoff?: "constant" | "linear" | "exponential";
+    };
+  }, fn: () => T | Promise<T>): Promise<T>;
+  sleep(name: string, duration: WorkflowDuration): Promise<void>;
+};
+type WorkflowDefinition<Payload, Result> = {
+  readonly run: (step: WorkflowStep, payload: Payload) => Promise<Result>;
+};
+type AnyWorkflowDefinition = WorkflowDefinition<any, any>;
+declare function createWorkflow<Payload, Result>(run: (step: WorkflowStep, payload: Payload) => Promise<Result>): WorkflowDefinition<Payload, Result>;
+//#endregion
+export { createWorkflow as a, WorkflowStep as i, WorkflowDefinition as n, WorkflowDuration as r, AnyWorkflowDefinition as t };

package/dist/workflow-engine-MogejNfF.js

@@ -0,0 +1,117 @@
+import { z } from "zod";
+//#region src/headers.ts
+const HITCH_USER_HEADER = "x-hitch-user";
+const HITCH_SESSION_HEADER = "x-hitch-session";
+const HITCH_APPLET_HEADER = "x-hitch-applet";
+const HITCH_APPLET_TOKEN_HEADER = "x-hitch-applet-token";
+//#endregion
+//#region src/server/workflow-protocol.ts
+const journalEntrySchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("step"),
+		id: z.string(),
+		name: z.string(),
+		result: z.unknown()
+	}),
+	z.object({
+		kind: z.literal("sleep"),
+		id: z.string(),
+		name: z.string(),
+		until: z.number()
+	}),
+	z.object({
+		kind: z.literal("attempt"),
+		id: z.string(),
+		name: z.string(),
+		error: z.string()
+	}),
+	z.object({
+		kind: z.literal("failed"),
+		id: z.string(),
+		name: z.string(),
+		error: z.string()
+	})
+]);
+const workflowInvocationRequestSchema = z.object({
+	payload: z.unknown(),
+	journal: z.array(journalEntrySchema)
+});
+const workflowOutcomeSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("step"),
+		id: z.string(),
+		name: z.string(),
+		result: z.unknown()
+	}),
+	z.object({
+		kind: z.literal("sleep"),
+		id: z.string(),
+		name: z.string(),
+		until: z.number()
+	}),
+	z.object({
+		kind: z.literal("step_error"),
+		id: z.string(),
+		name: z.string(),
+		message: z.string(),
+		retries: z.object({
+			limit: z.number(),
+			delayMs: z.number(),
+			backoff: z.enum([
+				"constant",
+				"linear",
+				"exponential"
+			])
+		})
+	}),
+	z.object({
+		kind: z.literal("done"),
+		result: z.unknown()
+	}),
+	z.object({
+		kind: z.literal("error"),
+		message: z.string()
+	})
+]);
+//#endregion
+//#region src/server/workflow-engine.ts
+var WorkflowFailedError = class extends Error {};
+async function runWorkflowJournal(engine, invoke) {
+	const journal = [];
+	for (let index = 1;; index += 1) {
+		const outcome = await engine.invoke(`invoke ${index}`, () => invoke(journal));
+		switch (outcome.kind) {
+			case "step":
+				journal.push(outcome);
+				break;
+			case "sleep":
+				journal.push(outcome);
+				await engine.sleepUntil(`sleep ${index}`, new Date(outcome.until));
+				break;
+			case "step_error": {
+				const attempts = 1 + journal.filter((entry) => entry.kind === "attempt" && entry.id === outcome.id).length;
+				journal.push({
+					kind: "attempt",
+					id: outcome.id,
+					name: outcome.name,
+					error: outcome.message
+				});
+				if (attempts > outcome.retries.limit) {
+					journal.push({
+						kind: "failed",
+						id: outcome.id,
+						name: outcome.name,
+						error: outcome.message
+					});
+					break;
+				}
+				await engine.sleep(`retry ${index}`, outcome.retries.delayMs * (outcome.retries.backoff === "exponential" ? 2 ** (attempts - 1) : outcome.retries.backoff === "linear" ? attempts : 1));
+				break;
+			}
+			case "done": return outcome.result;
+			case "error": throw new WorkflowFailedError(outcome.message);
+		}
+	}
+}
+//#endregion
+export { workflowOutcomeSchema as a, HITCH_SESSION_HEADER as c, workflowInvocationRequestSchema as i, HITCH_USER_HEADER as l, runWorkflowJournal as n, HITCH_APPLET_HEADER as o, journalEntrySchema as r, HITCH_APPLET_TOKEN_HEADER as s, WorkflowFailedError as t };

package/dist/workspace-DruAZPmV.js

@@ -0,0 +1,390 @@
+import { createRequire } from "node:module";
+import { existsSync } from "node:fs";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+//#region ../shared/auth/src/store.mts
+const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
+var AuthenticationError = class extends Error {};
+function isErrno(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+async function readJson(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf8"));
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return void 0;
+		throw new Error(`Failed to read ${path}.`, { cause: error });
+	}
+}
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function emptyCredentialStore() {
+	return { instances: {} };
+}
+async function healCredentialStore(credentialsPath, source, store, unrecognizedCount) {
+	const backupPath = `${credentialsPath}.bak`;
+	try {
+		try {
+			await writeFile(backupPath, source, {
+				flag: "wx",
+				mode: 384
+			});
+		} catch (error) {
+			if (!isErrno(error, "EEXIST")) throw error;
+		}
+		await chmod(backupPath, 384);
+		await writeFile(credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+		await chmod(credentialsPath, 384);
+	} catch {
+		console.error(unrecognizedCount === void 0 ? `hitch: failed to heal credential store at ${credentialsPath}; using an empty in-memory store.` : `hitch: failed to heal credential store at ${credentialsPath}; using recognized credentials in memory only.`);
+		return store;
+	}
+	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
+	return store;
+}
+async function readRawCredentialStore(options = {}) {
+	const { credentialsPath } = storePaths(options);
+	let source;
+	try {
+		source = await readFile(credentialsPath, "utf8");
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return emptyCredentialStore();
+		throw new Error(`Failed to read ${credentialsPath}.`, { cause: error });
+	}
+	let value;
+	try {
+		value = JSON.parse(source);
+	} catch {
+		return healCredentialStore(credentialsPath, source, emptyCredentialStore());
+	}
+	if (!isObject(value) || !isObject(value.instances)) return healCredentialStore(credentialsPath, source, emptyCredentialStore());
+	const instances = Object.fromEntries(Object.entries(value.instances).flatMap(([instanceUrl, entry]) => {
+		if (isObject(entry) && typeof entry.organizationId === "string") {
+			const credentials = parseCredentials(entry);
+			return credentials === void 0 ? [] : [[instanceUrl, { [credentials.orgCode]: entry }]];
+		}
+		if (!isObject(entry)) return [];
+		return [[instanceUrl, Object.fromEntries(Object.entries(entry).filter(([orgCode, credentials]) => parseCredentials(credentials)?.orgCode === orgCode))]];
+	}));
+	const reshaped = Object.values(value.instances).some((entry) => !isObject(entry) || typeof entry.organizationId === "string");
+	const countLeaves = (store) => Object.values(store).reduce((total, entry) => total + (isObject(entry) && typeof entry.organizationId !== "string" ? Object.keys(entry).length : 1), 0);
+	const unrecognizedCount = countLeaves(value.instances) - countLeaves(instances);
+	if (!reshaped && unrecognizedCount === 0) return value;
+	return healCredentialStore(credentialsPath, source, { instances }, unrecognizedCount);
+}
+function parseCredentials(value) {
+	if (!isObject(value) || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return;
+	const organization = {
+		organizationId: value.organizationId,
+		orgCode: value.orgCode
+	};
+	if ((value.type === void 0 || value.type === "session") && typeof value.accessToken === "string" && (value.expiresAt === void 0 || typeof value.expiresAt === "number")) return {
+		type: "session",
+		accessToken: value.accessToken,
+		...value.expiresAt === void 0 ? {} : { expiresAt: value.expiresAt },
+		...organization
+	};
+	if (value.type === "apiKey" && typeof value.apiKey === "string") return {
+		type: "apiKey",
+		apiKey: value.apiKey,
+		...organization
+	};
+}
+function normalizeInstanceUrl(instanceUrl) {
+	let url;
+	try {
+		url = new URL(instanceUrl);
+	} catch (error) {
+		throw new Error(`Invalid Hitch instance URL: ${instanceUrl}`, { cause: error });
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Invalid Hitch instance URL protocol: ${url.protocol}`);
+	url.pathname = url.pathname.replace(/\/+$/, "");
+	url.search = "";
+	url.hash = "";
+	return url.toString().replace(/\/$/, "");
+}
+function organizationInstanceUrl(instanceUrl, orgCode) {
+	const url = new URL(normalizeInstanceUrl(instanceUrl));
+	const labels = url.hostname.split(".");
+	if (labels[0] !== "app" || labels.length < 2) return url.toString().replace(/\/$/, "");
+	url.hostname = [orgCode, ...labels.slice(1)].join(".");
+	return url.toString().replace(/\/$/, "");
+}
+function storePaths(options = {}) {
+	const env = options.env ?? process.env;
+	const home = options.homeDir ?? homedir();
+	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
+	return {
+		configDir,
+		cacheDir: join(env.XDG_CACHE_HOME || join(home, ".cache"), "hitch"),
+		configPath: join(configDir, "config.json"),
+		credentialsPath: join(configDir, "credentials.json")
+	};
+}
+async function resolveInstanceUrl(override, options = {}) {
+	if (override !== void 0) return normalizeInstanceUrl(override);
+	const envInstanceUrl = (options.env ?? process.env).HITCH_API_URL;
+	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
+	const { configPath } = storePaths(options);
+	const config = await readJson(configPath);
+	if (config === void 0) return DEFAULT_INSTANCE_URL;
+	if (!isObject(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
+	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
+}
+async function readCredentialStore(options = {}) {
+	const store = await readRawCredentialStore(options);
+	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
+		const credentials = parseCredentials(value);
+		return credentials === void 0 ? [] : [[orgCode, credentials]];
+	}))])) };
+}
+async function getCredentialsForOrg(instanceUrl, orgCode, options = {}) {
+	return (await readCredentialStore(options)).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
+}
+function environmentAuth(options) {
+	const apiKey = (options.env ?? process.env).HITCH_API_KEY;
+	return apiKey !== void 0 && apiKey.length > 0 ? {
+		accessToken: apiKey,
+		source: "environment"
+	} : void 0;
+}
+function resolvedStoredAuth(credentials) {
+	return credentials === void 0 ? void 0 : {
+		accessToken: credentials.type === "apiKey" ? credentials.apiKey : credentials.accessToken,
+		credentialType: credentials.type,
+		organizationId: credentials.organizationId,
+		orgCode: credentials.orgCode,
+		source: "store"
+	};
+}
+function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
+	const exact = resolvedStoredAuth(credentialsByOrg[orgCode]);
+	if (exact !== void 0) return exact;
+	const sessions = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "session").filter((credentials, index, all) => all.findIndex(({ accessToken }) => accessToken === credentials.accessToken) === index);
+	if (sessions.length === 1) return resolvedStoredAuth(sessions[0]);
+	if (sessions.length > 1) throw new AuthenticationError(`Multiple sessions are stored. Run hitch login for organization "${orgCode}".`);
+	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
+	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
+}
+async function resolveAuthForOrg(instanceUrl, orgCode, options = {}) {
+	const auth = environmentAuth(options);
+	if (auth !== void 0) return auth;
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = Object.entries((await readCredentialStore(options)).instances).find(([instance]) => instance === normalizedUrl)?.[1];
+	return resolveStoredAuthForOrg(credentialsByOrg ?? {}, orgCode);
+}
+function rejectEnvironmentKey(response, auth) {
+	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
+}
+function bearerToken(credentials) {
+	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
+}
+async function setCredentials(instanceUrl, credentials, options = {}) {
+	const paths = storePaths(options);
+	const store = await readRawCredentialStore(options);
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = store.instances[normalizedUrl];
+	store.instances[normalizedUrl] = {
+		...isObject(credentialsByOrg) ? credentialsByOrg : {},
+		[credentials.orgCode]: credentials
+	};
+	await mkdir(paths.configDir, { recursive: true });
+	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+	await chmod(paths.credentialsPath, 384);
+}
+//#endregion
+//#region ../shared/auth/src/device.mts
+const CLIENT_ID = "hitch-cli";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function defaultOpenUrl(url) {
+	try {
+		const child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+function requiredObject(value, message) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(message);
+	return value;
+}
+async function jsonResponse(response) {
+	try {
+		return requiredObject(await response.json(), "Expected a JSON object response.");
+	} catch (error) {
+		throw new Error(`Invalid JSON response from ${response.url || "Hitch"}.`, { cause: error });
+	}
+}
+async function postJson(fetcher, url, body) {
+	const response = await fetcher(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	return {
+		body: await jsonResponse(response),
+		response
+	};
+}
+function parseDeviceCode(value) {
+	if (typeof value.device_code !== "string" || typeof value.user_code !== "string" || typeof value.verification_uri !== "string" || typeof value.verification_uri_complete !== "string" || typeof value.expires_in !== "number" || value.interval !== void 0 && typeof value.interval !== "number") throw new AuthenticationError("Hitch returned an invalid device authorization response.");
+	return value;
+}
+function parseToken(value) {
+	return typeof value.access_token === "string" && typeof value.token_type === "string" ? value : void 0;
+}
+function parseDeviceOrganization(value) {
+	if (typeof value.organizationId !== "string" || typeof value.orgCode !== "string") throw new AuthenticationError("Hitch returned an invalid device organization response.");
+	return value;
+}
+function parseMe(value) {
+	const person = requiredObject(value.person, "Hitch returned an invalid identity response.");
+	if (typeof person.id !== "string" || typeof person.firstName !== "string" || typeof person.lastName !== "string" || typeof person.email !== "string" || !Array.isArray(value.memberships)) throw new Error("Hitch returned an invalid identity response.");
+	const organization = value.organization === void 0 || value.organization === null ? null : requiredObject(value.organization, "Hitch returned an invalid identity response.");
+	if (organization !== null && (typeof organization.id !== "string" || typeof organization.code !== "string")) throw new Error("Hitch returned an invalid identity response.");
+	return {
+		memberships: value.memberships.map((membership) => {
+			const item = requiredObject(membership, "Hitch returned an invalid membership.");
+			if (typeof item.orgId !== "string" || typeof item.code !== "string" || typeof item.name !== "string") throw new Error("Hitch returned an invalid membership.");
+			return item;
+		}),
+		organization,
+		person
+	};
+}
+async function fetchMe(fetcher, instanceUrl, auth) {
+	const response = await fetcher(`${instanceUrl}/api/v1/me`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
+	rejectEnvironmentKey(response, auth);
+	if (auth.credentialType === "apiKey" && response.status === 401) throw new AuthenticationError("API key rejected.");
+	const body = await jsonResponse(response);
+	if (!response.ok) throw new AuthenticationError(typeof body.message === "string" ? body.message : `Failed to load the signed-in identity (${response.status}).`);
+	return parseMe(body);
+}
+async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
+	const deadline = now() + device.expires_in * 1e3;
+	let interval = (device.interval ?? 5) * 1e3;
+	while (now() < deadline) {
+		await sleep(Math.min(interval, deadline - now()));
+		if (now() >= deadline) break;
+		const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/token`, {
+			grant_type: DEVICE_GRANT,
+			device_code: device.device_code,
+			client_id: CLIENT_ID
+		});
+		const token = parseToken(body);
+		if (response.ok && token !== void 0) return token;
+		switch (body.error) {
+			case "authorization_pending": break;
+			case "slow_down":
+				interval += 5e3;
+				break;
+			case "expired_token": throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+			case "access_denied": throw new AuthenticationError("Sign-in was denied.");
+			default: throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Sign-in failed (${response.status}).`);
+		}
+	}
+	throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+}
+async function loginWithDevice(instanceUrl, options = {}) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const now = options.now ?? Date.now;
+	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
+	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
+	const device = parseDeviceCode(body);
+	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
+	(options.print ?? console.log)(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
+	if (!options.noBrowser) try {
+		await (options.openUrl ?? defaultOpenUrl)(verificationUrl);
+	} catch {}
+	const token = await pollForToken(fetcher, instanceUrl, device, now, options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))));
+	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
+	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
+	const organization = parseDeviceOrganization(organizationBody);
+	const me = await fetchMe(fetcher, instanceUrl, {
+		accessToken: token.access_token,
+		credentialType: "session",
+		source: "store"
+	});
+	const membership = me.memberships.find(({ orgId }) => orgId === organization.organizationId);
+	if (membership === void 0) throw new AuthenticationError("The device session is not scoped to a Hitch organization.");
+	const credentials = {
+		type: "session",
+		accessToken: token.access_token,
+		expiresAt: token.expires_in === void 0 ? void 0 : now() + token.expires_in * 1e3,
+		organizationId: organization.organizationId,
+		orgCode: organization.orgCode
+	};
+	await setCredentials(instanceUrl, credentials, options.store);
+	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
+	return {
+		credentials,
+		me,
+		membership
+	};
+}
+//#endregion
+//#region ../shared/auth/src/workspace.mts
+const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const require = createRequire(import.meta.url);
+function readWorkspaceConfig(dir) {
+	const path = resolve(dir, "hitch.config.ts");
+	if (!existsSync(path)) return void 0;
+	let module;
+	try {
+		module = require(path);
+	} catch (error) {
+		throw new Error(`Failed to load ${path}.`, { cause: error });
+	}
+	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
+	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new Error(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
+	const githubWorkflow = "githubWorkflow" in config ? config.githubWorkflow : void 0;
+	if (githubWorkflow !== void 0 && typeof githubWorkflow !== "boolean") throw new Error(`Invalid Hitch config in ${path}: "githubWorkflow" must be a boolean.`);
+	return {
+		sdk: config.sdk,
+		org: config.org,
+		githubWorkflow
+	};
+}
+function findWorkspaceConfig(cwd) {
+	const appletsDir = dirname(cwd);
+	return readWorkspaceConfig(cwd) ?? (basename(appletsDir) === "applets" ? readWorkspaceConfig(dirname(appletsDir)) : void 0);
+}
+//#endregion
+//#region src/auth.ts
+async function fetchWithOrgAuth(orgCode, options, request) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const instanceUrl = await resolveInstanceUrl(void 0, options.store);
+	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
+	const auth = await resolveAuthForOrg(instanceUrl, orgCode, options.store);
+	if (auth !== void 0) {
+		const response = await request(organizationUrl, bearerToken(auth));
+		rejectEnvironmentKey(response, auth);
+		if (response.status !== 401) return response;
+	}
+	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
+	await (options.login ?? loginWithDevice)(instanceUrl, {
+		expectedOrg: orgCode,
+		fetch: fetcher,
+		store: options.store
+	});
+	const credentials = await getCredentialsForOrg(instanceUrl, orgCode, options.store);
+	if (credentials === void 0) throw new Error(`login did not provide credentials for organization "${orgCode}"`);
+	return request(organizationUrl, bearerToken(credentials));
+}
+//#endregion
+//#region src/workspace.ts
+function resolveWorkspaceOrg(appletRoot) {
+	const appletsDir = dirname(appletRoot);
+	if (basename(appletsDir) === "applets") {
+		const config = readWorkspaceConfig(dirname(appletsDir));
+		if (config !== void 0) return config.org;
+	}
+	throw new Error(`No Hitch workspace found for ${appletRoot}. An applet must live at <workspace>/applets/<code> with hitch.config.ts in the workspace root.`);
+}
+//#endregion
+export { loginWithDevice as a, bearerToken as c, resolveAuthForOrg as d, resolveInstanceUrl as f, readWorkspaceConfig as i, organizationInstanceUrl as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, DEFAULT_INSTANCE_URL as s, resolveWorkspaceOrg as t, rejectEnvironmentKey as u };