@hitch42/applet 0.1.0-beta.2

package/dist/auth-DaVK0k5R.js

@@ -0,0 +1,350 @@
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+//#region ../shared/auth/src/store.mts
+const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
+var AuthenticationError = class extends Error {};
+function isErrno(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+async function readJson(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf8"));
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return void 0;
+		throw new Error(`Failed to read ${path}.`, { cause: error });
+	}
+}
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function emptyCredentialStore() {
+	return { instances: {} };
+}
+async function healCredentialStore(credentialsPath, source, store, unrecognizedCount) {
+	const backupPath = `${credentialsPath}.bak`;
+	try {
+		try {
+			await writeFile(backupPath, source, {
+				flag: "wx",
+				mode: 384
+			});
+		} catch (error) {
+			if (!isErrno(error, "EEXIST")) throw error;
+		}
+		await chmod(backupPath, 384);
+		await writeFile(credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+		await chmod(credentialsPath, 384);
+	} catch {
+		console.error(unrecognizedCount === void 0 ? `hitch: failed to heal credential store at ${credentialsPath}; using an empty in-memory store.` : `hitch: failed to heal credential store at ${credentialsPath}; using recognized credentials in memory only.`);
+		return store;
+	}
+	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
+	return store;
+}
+async function readRawCredentialStore(options = {}) {
+	const { credentialsPath } = storePaths(options);
+	let source;
+	try {
+		source = await readFile(credentialsPath, "utf8");
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return emptyCredentialStore();
+		throw new Error(`Failed to read ${credentialsPath}.`, { cause: error });
+	}
+	let value;
+	try {
+		value = JSON.parse(source);
+	} catch {
+		return healCredentialStore(credentialsPath, source, emptyCredentialStore());
+	}
+	if (!isObject(value) || !isObject(value.instances)) return healCredentialStore(credentialsPath, source, emptyCredentialStore());
+	const instances = Object.fromEntries(Object.entries(value.instances).flatMap(([instanceUrl, entry]) => {
+		if (isObject(entry) && typeof entry.organizationId === "string") {
+			const credentials = parseCredentials(entry);
+			return credentials === void 0 ? [] : [[instanceUrl, { [credentials.orgCode]: entry }]];
+		}
+		if (!isObject(entry)) return [];
+		return [[instanceUrl, Object.fromEntries(Object.entries(entry).filter(([orgCode, credentials]) => parseCredentials(credentials)?.orgCode === orgCode))]];
+	}));
+	const reshaped = Object.values(value.instances).some((entry) => !isObject(entry) || typeof entry.organizationId === "string");
+	const countLeaves = (store) => Object.values(store).reduce((total, entry) => total + (isObject(entry) && typeof entry.organizationId !== "string" ? Object.keys(entry).length : 1), 0);
+	const unrecognizedCount = countLeaves(value.instances) - countLeaves(instances);
+	if (!reshaped && unrecognizedCount === 0) return value;
+	return healCredentialStore(credentialsPath, source, { instances }, unrecognizedCount);
+}
+function parseCredentials(value) {
+	if (!isObject(value) || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return;
+	const organization = {
+		organizationId: value.organizationId,
+		orgCode: value.orgCode
+	};
+	if ((value.type === void 0 || value.type === "session") && typeof value.accessToken === "string" && (value.expiresAt === void 0 || typeof value.expiresAt === "number")) return {
+		type: "session",
+		accessToken: value.accessToken,
+		...value.expiresAt === void 0 ? {} : { expiresAt: value.expiresAt },
+		...organization
+	};
+	if (value.type === "apiKey" && typeof value.apiKey === "string") return {
+		type: "apiKey",
+		apiKey: value.apiKey,
+		...organization
+	};
+}
+function normalizeInstanceUrl(instanceUrl) {
+	let url;
+	try {
+		url = new URL(instanceUrl);
+	} catch (error) {
+		throw new Error(`Invalid Hitch instance URL: ${instanceUrl}`, { cause: error });
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Invalid Hitch instance URL protocol: ${url.protocol}`);
+	url.pathname = url.pathname.replace(/\/+$/, "");
+	url.search = "";
+	url.hash = "";
+	return url.toString().replace(/\/$/, "");
+}
+function organizationInstanceUrl(instanceUrl, orgCode) {
+	const url = new URL(normalizeInstanceUrl(instanceUrl));
+	const labels = url.hostname.split(".");
+	if (labels[0] !== "app" || labels.length < 2) return url.toString().replace(/\/$/, "");
+	url.hostname = [orgCode, ...labels.slice(1)].join(".");
+	return url.toString().replace(/\/$/, "");
+}
+function storePaths(options = {}) {
+	const env = options.env ?? process.env;
+	const home = options.homeDir ?? homedir();
+	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
+	return {
+		configDir,
+		cacheDir: join(env.XDG_CACHE_HOME || join(home, ".cache"), "hitch"),
+		configPath: join(configDir, "config.json"),
+		credentialsPath: join(configDir, "credentials.json")
+	};
+}
+async function resolveInstanceUrl(override, options = {}) {
+	if (override !== void 0) return normalizeInstanceUrl(override);
+	const envInstanceUrl = (options.env ?? process.env).HITCH_API_URL;
+	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
+	const { configPath } = storePaths(options);
+	const config = await readJson(configPath);
+	if (config === void 0) return DEFAULT_INSTANCE_URL;
+	if (!isObject(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
+	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
+}
+async function readCredentialStore(options = {}) {
+	const store = await readRawCredentialStore(options);
+	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
+		const credentials = parseCredentials(value);
+		return credentials === void 0 ? [] : [[orgCode, credentials]];
+	}))])) };
+}
+async function getCredentialsForOrg(instanceUrl, orgCode, options = {}) {
+	return (await readCredentialStore(options)).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
+}
+function environmentAuth(options) {
+	const apiKey = (options.env ?? process.env).HITCH_API_KEY;
+	return apiKey !== void 0 && apiKey.length > 0 ? {
+		accessToken: apiKey,
+		source: "environment"
+	} : void 0;
+}
+function resolvedStoredAuth(credentials) {
+	return credentials === void 0 ? void 0 : {
+		accessToken: credentials.type === "apiKey" ? credentials.apiKey : credentials.accessToken,
+		credentialType: credentials.type,
+		organizationId: credentials.organizationId,
+		orgCode: credentials.orgCode,
+		source: "store"
+	};
+}
+function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
+	const exact = resolvedStoredAuth(credentialsByOrg[orgCode]);
+	if (exact !== void 0) return exact;
+	const sessions = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "session").filter((credentials, index, all) => all.findIndex(({ accessToken }) => accessToken === credentials.accessToken) === index);
+	if (sessions.length === 1) return resolvedStoredAuth(sessions[0]);
+	if (sessions.length > 1) throw new AuthenticationError(`Multiple sessions are stored. Run hitch login for organization "${orgCode}".`);
+	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
+	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
+}
+async function resolveAuthForOrg(instanceUrl, orgCode, options = {}) {
+	const auth = environmentAuth(options);
+	if (auth !== void 0) return auth;
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = Object.entries((await readCredentialStore(options)).instances).find(([instance]) => instance === normalizedUrl)?.[1];
+	return resolveStoredAuthForOrg(credentialsByOrg ?? {}, orgCode);
+}
+function rejectEnvironmentKey(response, auth) {
+	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
+}
+function bearerToken(credentials) {
+	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
+}
+async function setCredentials(instanceUrl, credentials, options = {}) {
+	const paths = storePaths(options);
+	const store = await readRawCredentialStore(options);
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = store.instances[normalizedUrl];
+	store.instances[normalizedUrl] = {
+		...isObject(credentialsByOrg) ? credentialsByOrg : {},
+		[credentials.orgCode]: credentials
+	};
+	await mkdir(paths.configDir, { recursive: true });
+	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+	await chmod(paths.credentialsPath, 384);
+}
+//#endregion
+//#region ../shared/auth/src/device.mts
+const CLIENT_ID = "hitch-cli";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function defaultOpenUrl(url) {
+	try {
+		const child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+function requiredObject(value, message) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(message);
+	return value;
+}
+async function jsonResponse(response) {
+	try {
+		return requiredObject(await response.json(), "Expected a JSON object response.");
+	} catch (error) {
+		throw new Error(`Invalid JSON response from ${response.url || "Hitch"}.`, { cause: error });
+	}
+}
+async function postJson(fetcher, url, body) {
+	const response = await fetcher(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	return {
+		body: await jsonResponse(response),
+		response
+	};
+}
+function parseDeviceCode(value) {
+	if (typeof value.device_code !== "string" || typeof value.user_code !== "string" || typeof value.verification_uri !== "string" || typeof value.verification_uri_complete !== "string" || typeof value.expires_in !== "number" || value.interval !== void 0 && typeof value.interval !== "number") throw new AuthenticationError("Hitch returned an invalid device authorization response.");
+	return value;
+}
+function parseToken(value) {
+	return typeof value.access_token === "string" && typeof value.token_type === "string" ? value : void 0;
+}
+function parseDeviceOrganization(value) {
+	if (typeof value.organizationId !== "string" || typeof value.orgCode !== "string") throw new AuthenticationError("Hitch returned an invalid device organization response.");
+	return value;
+}
+function parseMe(value) {
+	const person = requiredObject(value.person, "Hitch returned an invalid identity response.");
+	if (typeof person.id !== "string" || typeof person.firstName !== "string" || typeof person.lastName !== "string" || typeof person.email !== "string" || !Array.isArray(value.memberships)) throw new Error("Hitch returned an invalid identity response.");
+	const organization = value.organization === void 0 || value.organization === null ? null : requiredObject(value.organization, "Hitch returned an invalid identity response.");
+	if (organization !== null && (typeof organization.id !== "string" || typeof organization.code !== "string")) throw new Error("Hitch returned an invalid identity response.");
+	return {
+		memberships: value.memberships.map((membership) => {
+			const item = requiredObject(membership, "Hitch returned an invalid membership.");
+			if (typeof item.orgId !== "string" || typeof item.code !== "string" || typeof item.name !== "string") throw new Error("Hitch returned an invalid membership.");
+			return item;
+		}),
+		organization,
+		person
+	};
+}
+async function fetchMe(fetcher, instanceUrl, auth) {
+	const response = await fetcher(`${instanceUrl}/api/v1/me`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
+	rejectEnvironmentKey(response, auth);
+	if (auth.credentialType === "apiKey" && response.status === 401) throw new AuthenticationError("API key rejected.");
+	const body = await jsonResponse(response);
+	if (!response.ok) throw new AuthenticationError(typeof body.message === "string" ? body.message : `Failed to load the signed-in identity (${response.status}).`);
+	return parseMe(body);
+}
+async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
+	const deadline = now() + device.expires_in * 1e3;
+	let interval = (device.interval ?? 5) * 1e3;
+	while (now() < deadline) {
+		await sleep(Math.min(interval, deadline - now()));
+		if (now() >= deadline) break;
+		const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/token`, {
+			grant_type: DEVICE_GRANT,
+			device_code: device.device_code,
+			client_id: CLIENT_ID
+		});
+		const token = parseToken(body);
+		if (response.ok && token !== void 0) return token;
+		switch (body.error) {
+			case "authorization_pending": break;
+			case "slow_down":
+				interval += 5e3;
+				break;
+			case "expired_token": throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+			case "access_denied": throw new AuthenticationError("Sign-in was denied.");
+			default: throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Sign-in failed (${response.status}).`);
+		}
+	}
+	throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+}
+async function loginWithDevice(instanceUrl, options = {}) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const now = options.now ?? Date.now;
+	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
+	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
+	const device = parseDeviceCode(body);
+	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
+	(options.print ?? console.log)(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
+	if (!options.noBrowser) try {
+		await (options.openUrl ?? defaultOpenUrl)(verificationUrl);
+	} catch {}
+	const token = await pollForToken(fetcher, instanceUrl, device, now, options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))));
+	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
+	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
+	const organization = parseDeviceOrganization(organizationBody);
+	const me = await fetchMe(fetcher, instanceUrl, {
+		accessToken: token.access_token,
+		credentialType: "session",
+		source: "store"
+	});
+	const membership = me.memberships.find(({ orgId }) => orgId === organization.organizationId);
+	if (membership === void 0) throw new AuthenticationError("The device session is not scoped to a Hitch organization.");
+	const credentials = {
+		type: "session",
+		accessToken: token.access_token,
+		expiresAt: token.expires_in === void 0 ? void 0 : now() + token.expires_in * 1e3,
+		organizationId: organization.organizationId,
+		orgCode: organization.orgCode
+	};
+	await setCredentials(instanceUrl, credentials, options.store);
+	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
+	return {
+		credentials,
+		me,
+		membership
+	};
+}
+//#endregion
+//#region src/auth.ts
+async function fetchWithOrgAuth(orgCode, options, request) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const instanceUrl = await resolveInstanceUrl(void 0, options.store);
+	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
+	const auth = await resolveAuthForOrg(instanceUrl, orgCode, options.store);
+	if (auth !== void 0) {
+		const response = await request(organizationUrl, bearerToken(auth));
+		if (response.status !== 401 && response.status !== 403) return response;
+	}
+	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new Error("not logged in — set HITCH_API_KEY or run in a terminal to log in");
+	await (options.login ?? loginWithDevice)(instanceUrl, {
+		expectedOrg: orgCode,
+		fetch: fetcher,
+		store: options.store
+	});
+	const credentials = await getCredentialsForOrg(instanceUrl, orgCode, options.store);
+	if (credentials === void 0) throw new Error(`login did not provide credentials for organization "${orgCode}"`);
+	return request(organizationUrl, bearerToken(credentials));
+}
+//#endregion
+export { resolveInstanceUrl as i, organizationInstanceUrl as n, resolveAuthForOrg as r, fetchWithOrgAuth as t };

package/dist/batch-Qa4B4-Yp.d.ts

@@ -0,0 +1,30 @@
+import { AnyContractRouter } from "@orpc/contract";
+//#region src/hitch/batch.d.ts
+type BatchVerb = "create" | "update" | "delete" | "updateWhere";
+type BatchTxRecords<Records> = { [Code in keyof Records]: { [Verb in keyof Records[Code] & BatchVerb]: Records[Code][Verb] extends ((...args: infer Args) => unknown) ? (input: Args[0]) => void : never; }; };
+type BatchTx<T> = T extends {
+  records: infer Records;
+} ? BatchTxRecords<Records> : never;
+type BatchRecorderOptions = {
+  dryRun?: boolean;
+  idempotencyKey?: string;
+};
+type BatchRecorderCall<T, Batch> = Batch extends ((...args: infer _Args) => infer Result) ? (record: (tx: BatchTx<T>) => void | Promise<void>, options?: BatchRecorderOptions) => Result : never;
+type WithBatchRecorder<T> = T extends {
+  records: unknown;
+  batch: infer Batch;
+} ? Omit<T, "batch"> & {
+  /**
+   * Record record writes inside `record` and send them as one atomic batch.
+   *
+   * The callback receives a `tx` whose `create` / `update` / `updateWhere` /
+   * `delete` calls are buffered, not sent immediately; the whole batch runs
+   * in a single transaction when the callback resolves.
+   *
+   * @remarks A batch may contain at most **100** requests. More than that is
+   * rejected with a `400` before any write runs.
+   */
+  batch: BatchRecorderCall<T, Batch> & Batch;
+} : T;
+//#endregion
+export { WithBatchRecorder as t };

package/dist/build-BRkmrUcj.js

@@ -0,0 +1,74 @@
+import { r as prepareAppletProject } from "./project-CEmDnlKa.js";
+import { rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { spawn } from "node:child_process";
+//#region src/build.ts
+function isMissingFile(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function runPnpm(args, cwd) {
+	await new Promise((resolveRun, rejectRun) => {
+		let finished = false;
+		const child = spawn("pnpm", args, {
+			cwd,
+			stdio: "inherit"
+		});
+		child.once("error", (error) => {
+			finished = true;
+			rejectRun(isMissingFile(error) ? /* @__PURE__ */ new Error("pnpm was not found. Install pnpm, then run applet build again.") : error);
+		});
+		child.once("close", (code) => {
+			if (finished) return;
+			finished = true;
+			if (code === 0) {
+				resolveRun();
+				return;
+			}
+			rejectRun(/* @__PURE__ */ new Error(`pnpm ${args.join(" ")} failed${code === null ? "." : ` with exit code ${code}.`}`));
+		});
+	});
+}
+async function buildApplet(changesetId, outDir = ".hitch/dist") {
+	const appletRoot = process.cwd();
+	const { workspaceRoot } = await prepareAppletProject(appletRoot);
+	await rm(resolve(appletRoot, ".hitch"), {
+		force: true,
+		recursive: true
+	});
+	await runPnpm(["install"], workspaceRoot);
+	await new Promise((resolveBuild, rejectBuild) => {
+		let finished = false;
+		const child = spawn("pnpm", [
+			"exec",
+			"vite",
+			"build",
+			"--outDir",
+			outDir
+		], {
+			cwd: appletRoot,
+			stdio: "inherit",
+			env: {
+				...process.env,
+				...changesetId === void 0 ? {} : { HITCH_CHANGESET_ID: changesetId }
+			}
+		});
+		child.once("error", (error) => {
+			finished = true;
+			rejectBuild(isMissingFile(error) ? /* @__PURE__ */ new Error("pnpm was not found. Install pnpm, then run applet build again.") : error);
+		});
+		child.once("close", (code) => {
+			if (finished) return;
+			finished = true;
+			if (code === 0) {
+				resolveBuild();
+				return;
+			}
+			rejectBuild(/* @__PURE__ */ new Error(`pnpm exec vite build failed${code === null ? "." : ` with exit code ${code}.`}`));
+		});
+	});
+}
+async function runBuild(options = {}) {
+	await buildApplet(options.changesetId);
+}
+//#endregion
+export { runBuild as n, buildApplet as t };

package/dist/build-CMluoV6q.js

@@ -0,0 +1,2 @@
+import { n as runBuild } from "./build-BRkmrUcj.js";
+export { runBuild };

package/dist/client.d.ts

@@ -0,0 +1,48 @@
+import { f as RegisteredContract, m as RegisteredRouter, p as RegisteredManifest } from "./manifest-BQCAxATS.js";
+import { t as NarrowContract } from "./contract-DMrpbaLJ.js";
+import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
+import { o as WithFilesUpload } from "./upload-YbRKEqR6.js";
+import { RouterClient } from "@orpc/server";
+import { ContractRouterClient } from "@orpc/contract";
+import { NestedClient } from "@orpc/client";
+import { RouterUtils } from "@orpc/tanstack-query";
+//#region src/query-utils.d.ts
+type Exact<Expected, Actual> = Actual extends symbol ? Actual : Actual extends Expected ? Actual extends readonly unknown[] ? Actual : Actual extends object ? NonNullable<Expected> extends object ? { [Key in keyof Actual]: Key extends keyof NonNullable<Expected> ? Exact<NonNullable<Expected>[Key], Actual[Key]> : never; } : Actual : Actual : never;
+type QueryOptionsFunction<Utils> = Extract<Utils extends {
+  queryOptions: infer Function;
+} ? Function : never, (...args: never[]) => unknown>;
+type QueryOptionsArgument<Utils> = NonNullable<Parameters<QueryOptionsFunction<Utils>>[0]>;
+type ExactOptions<Input, Options> = Options extends {
+  input: infer Actual;
+} ? Options & {
+  input: Exact<Input, Actual>;
+} : Options extends {
+  input?: infer Actual;
+} ? Options & {
+  input?: Exact<Input, Actual>;
+} : Options;
+type QueryOptionsResult<Utils, Options> = Options & Omit<ReturnType<QueryOptionsFunction<Utils>>, keyof Options>;
+type ExactQueryOptions<Utils, Input> = <Options extends QueryOptionsArgument<Utils> = QueryOptionsArgument<Utils>>(...rest: undefined extends Input ? [options?: ExactOptions<Input, Options>] : [options: ExactOptions<Input, Options>]) => QueryOptionsResult<Utils, Options>;
+type ClientTree = NestedClient<Record<never, never>>;
+type ExactRouterUtils<Client extends ClientTree> = Client extends ((...args: infer Arguments) => unknown) ? Omit<RouterUtils<Client>, "queryOptions"> & {
+  queryOptions: ExactQueryOptions<RouterUtils<Client>, Arguments[0]>;
+} : Omit<RouterUtils<Client>, keyof Client> & { [Key in keyof Client]: Client[Key] extends ClientTree ? ExactRouterUtils<Client[Key]> : never; };
+//#endregion
+//#region src/author/client.d.ts
+type AuthorContract = NarrowContract<RegisteredContract, RegisteredManifest>;
+type BaseHitchClient = ContractRouterClient<AuthorContract>;
+type AuthorHitchClient = WithBatchRecorder<BaseHitchClient>;
+type BaseHitchUtils = ExactRouterUtils<BaseHitchClient>;
+type AuthorHitchUtils = AuthorHitchClient extends {
+  batch: infer Batch;
+} ? BaseHitchUtils extends {
+  batch: infer BatchUtils;
+} ? Omit<BaseHitchUtils, "batch"> & {
+  batch: Omit<BatchUtils, "call"> & {
+    call: Batch;
+  };
+} : BaseHitchUtils : BaseHitchUtils;
+declare const hitch: WithFilesUpload<AuthorHitchUtils>;
+declare const api: ExactRouterUtils<RouterClient<RegisteredRouter>>;
+//#endregion
+export { api, hitch };

package/dist/client.js

@@ -0,0 +1,38 @@
+import { n as withFilesUpload, r as getRegisteredHitchContract } from "./upload-DRbVhuDm.js";
+import { n as withBatchRecorder, t as createLazyClientProxy } from "./lazy-client-x0DCI98S.js";
+import { createORPCClient } from "@orpc/client";
+import { OpenAPILink } from "@orpc/openapi-client/fetch";
+import { createTanstackQueryUtils } from "@orpc/tanstack-query";
+import { RPCLink } from "@orpc/client/fetch";
+//#region src/hitch/browser.ts
+function createHitchClient(contract) {
+	return createLazyClientProxy(() => createORPCClient(new OpenAPILink(contract, {
+		url: `${location.origin}/api`,
+		fetch: (request, init) => globalThis.fetch(request, init)
+	})));
+}
+//#endregion
+//#region src/client.ts
+function createClient(...[options]) {
+	const clientOptions = options;
+	return createLazyClientProxy(() => {
+		const base = clientOptions?.base ?? `${import.meta.env.BASE_URL}api`;
+		const origin = typeof location === "undefined" ? "http://localhost" : location.origin;
+		return createORPCClient(new RPCLink({
+			url: new URL(base, origin),
+			fetch: (request, init) => (clientOptions?.fetch ?? globalThis.fetch)(request, init)
+		}));
+	});
+}
+//#endregion
+//#region src/author/client.ts
+function buildClientHitch() {
+	const contract = getRegisteredHitchContract();
+	if (contract === void 0) throw new Error("`hitch` is unavailable: run `applet generate` first. The framework imports your .hitch automatically at build; in plain node import your .hitch once before calling hitch.");
+	return withBatchRecorder(createHitchClient(contract), contract);
+}
+const hitchClient = createLazyClientProxy(buildClientHitch);
+const hitch = withFilesUpload(createTanstackQueryUtils(hitchClient), () => hitchClient.files);
+const api = createTanstackQueryUtils(createClient());
+//#endregion
+export { api, hitch };

package/dist/contract-DMrpbaLJ.d.ts

@@ -0,0 +1,23 @@
+import { n as AppletManifest } from "./manifest-BQCAxATS.js";
+import { AnyContractRouter } from "@orpc/contract";
+//#region src/hitch/contract.d.ts
+type ManifestObjectFor<Manifest, Code> = Manifest extends {
+  objects: readonly (infer Object)[];
+} ? Object extends {
+  code: infer ObjectCode;
+} ? Code extends ObjectCode ? Object : never : never : never;
+type ManifestObjectCodes<Manifest> = Manifest extends {
+  objects: readonly (infer Object)[];
+} ? Object extends {
+  code: infer Code extends PropertyKey;
+} ? Code : never : never;
+type Capability<ManifestObject, Key extends "canCreate" | "canDelete" | "readWrite"> = ManifestObject extends Record<Key, infer Value> ? Value : never;
+type NarrowProcedures<Procedures, ManifestObject> = Omit<Procedures, (true extends Capability<ManifestObject, "canCreate"> ? never : "create") | (true extends Capability<ManifestObject, "canDelete"> ? never : "delete") | (Capability<ManifestObject, "readWrite"> extends readonly [] ? "update" | "updateWhere" : never)>;
+type NarrowContract<Contract, Manifest> = Contract extends {
+  records: infer Records;
+} ? Omit<Contract, "records"> & {
+  records: { [Code in keyof Records & ManifestObjectCodes<Manifest>]: NarrowProcedures<Records[Code], ManifestObjectFor<Manifest, Code>>; };
+} : Contract;
+declare function pruneContract<const Contract extends AnyContractRouter, const Manifest extends AppletManifest>(contract: Contract, manifest: Manifest): NarrowContract<Contract, Manifest>;
+//#endregion
+export { pruneContract as n, NarrowContract as t };