@hitch42/applet 0.1.0-beta.9 → 0.1.1-beta.10

package/dist/{variables-Bwnr7oxf.js → variables-DT5RyHdH.js}

@@ -1,5 +1,5 @@
-import { n as fetchWithOrgAuth } from "./workspace-XVtM12ZC.js";
-import { t as loadAppletConfig } from "./load-config-BYSxDVAl.js";
+import { n as fetchWithOrgAuth } from "./workspace-D0dnnlxL.js";
+import { t as loadAppletConfig } from "./load-config-xEdTXs0y.js";
 import { t as question } from "./prompt-ChS-grYO.js";
 import { z } from "zod";
 //#region src/variables.ts
@@ -14,12 +14,12 @@ const variableResponseSchema = z.object({ data: variableRowSchema });
 const variablesResponseSchema = z.object({ data: z.array(variableRowSchema) });
 async function getValue(options) {
 	if (options.value !== void 0) return options.value;
-	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new Error("A value is required when stdin is not a TTY.");
+	if (process.stdin.isTTY !== true) throw new Error("A value is required when stdin is not a TTY.");
 	return question("Value: ", true);
 }
 async function confirmLiveChange(code, options) {
 	if (options.yes === true) return;
-	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new Error("Confirmation requires a TTY. Pass -y to continue.");
+	if (process.stdin.isTTY !== true) throw new Error("Confirmation requires a TTY. Pass -y to continue.");
 	const answer = await question(`This modifies the live applet "${code}". Continue? [y/N] `);
 	if (!["y", "yes"].includes(answer.trim().toLowerCase())) throw new Error("Variable change cancelled.");
 }
@@ -45,19 +45,19 @@ function variablesError(status, code, message) {
 	const details = [code, message].filter((value) => value !== void 0).join(": ");
 	return /* @__PURE__ */ new Error(`Variables request failed (${status})${details ? `: ${details}` : ""}.`);
 }
-async function requestForApplet(options, request) {
+async function requestForApplet(request) {
 	const { code, org } = await loadAppletConfig(process.cwd());
 	return {
 		code,
-		response: await fetchWithOrgAuth(org, options, (instanceUrl, accessToken) => request(instanceUrl, accessToken, code))
+		response: await fetchWithOrgAuth(org, (instanceUrl, accessToken) => request(instanceUrl, accessToken, code))
 	};
 }
 async function runVariablesSet(options) {
 	const value = await getValue(options);
 	const manifest = await loadAppletConfig(process.cwd());
 	await confirmLiveChange(manifest.code, options);
-	const fetcher = options.fetch ?? globalThis.fetch;
-	const response = await fetchWithOrgAuth(manifest.org, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
+	const fetcher = globalThis.fetch;
+	const response = await fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
 		method: "PUT",
 		headers: {
 			Authorization: `Bearer ${accessToken}`,
@@ -75,9 +75,9 @@ async function runVariablesSet(options) {
 	const { data } = variableResponseSchema.parse(await response.json());
 	console.log(`Set ${data.key} ${data.secret ? "(secret)" : data.value ?? value} for applet "${manifest.code}".`);
 }
-async function runVariablesList(options) {
-	const fetcher = options.fetch ?? globalThis.fetch;
-	const { code, response } = await requestForApplet(options, (instanceUrl, accessToken, appletCode) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(appletCode)}/variables`, { headers: { Authorization: `Bearer ${accessToken}` } }));
+async function runVariablesList() {
+	const fetcher = globalThis.fetch;
+	const { code, response } = await requestForApplet((instanceUrl, accessToken, appletCode) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(appletCode)}/variables`, { headers: { Authorization: `Bearer ${accessToken}` } }));
 	if (!response.ok) {
 		const { code: errorCode, message } = await readErrorDetails(response);
 		throw variablesError(response.status, errorCode, message);
@@ -92,8 +92,8 @@ async function runVariablesList(options) {
 async function runVariablesDelete(options) {
 	const manifest = await loadAppletConfig(process.cwd());
 	await confirmLiveChange(manifest.code, options);
-	const fetcher = options.fetch ?? globalThis.fetch;
-	const response = await fetchWithOrgAuth(manifest.org, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
+	const fetcher = globalThis.fetch;
+	const response = await fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
 		method: "DELETE",
 		headers: { Authorization: `Bearer ${accessToken}` }
 	}));

package/dist/vite.d.ts

@@ -1,63 +1,6 @@
-import { o as RegisteredAppletSourceDefinition } from "./manifest-DD_SGkS6.js";
+import { o as RegisteredAppletSourceDefinition } from "./manifest-C6_F4bL8.js";
 import { PluginOption } from "vite";
-//#region ../shared/auth/src/store.d.mts
-interface SessionCredentials {
-  type: "session";
-  accessToken: string;
-  expiresAt?: number;
-  organizationId: string;
-  orgCode: string;
-}
-interface StoreOptions {
-  env?: NodeJS.ProcessEnv;
-  homeDir?: string;
-}
-//#endregion
-//#region ../shared/auth/src/device.d.mts
-interface MeResponse {
-  memberships: Array<{
-    code: string;
-    name: string;
-    orgId: string;
-  }>;
-  organization: {
-    code: string;
-    id: string;
-  } | null;
-  person: {
-    email: string;
-    firstName: string;
-    id: string;
-    lastName: string;
-  };
-}
-interface DeviceLoginOptions {
-  expectedOrg?: string;
-  fetch?: typeof fetch;
-  noBrowser?: boolean;
-  now?: () => number;
-  openUrl?: (url: string) => void | Promise<void>;
-  print?: (message: string) => void;
-  sleep?: (milliseconds: number) => Promise<void>;
-  store?: StoreOptions;
-}
-interface DeviceLoginResult {
-  credentials: SessionCredentials;
-  me: MeResponse;
-  membership: MeResponse["memberships"][number];
-}
-declare function loginWithDevice(instanceUrl: string, options?: DeviceLoginOptions): Promise<DeviceLoginResult>;
-//#endregion
-//#region src/auth.d.ts
-interface OrgAuthOptions {
-  fetch?: typeof fetch;
-  login?: typeof loginWithDevice;
-  stdinIsTTY?: boolean;
-  store?: StoreOptions;
-}
-//#endregion
 //#region src/vite.d.ts
-type AppletOptions = OrgAuthOptions;
-declare function applet<const M extends RegisteredAppletSourceDefinition>(sourceDefinition: M, options?: AppletOptions): PluginOption[];
+declare function applet<const M extends RegisteredAppletSourceDefinition>(sourceDefinition: M): PluginOption[];
 //#endregion
-export { AppletOptions, applet };
+export { applet };

package/dist/vite.js

@@ -1,8 +1,10 @@
 import { n as meSchema } from "./me-BW7Paary.js";
-import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-Bp87Uz0a.js";
-import { a as workflowOutcomeSchema, c as HITCH_SESSION_HEADER, l as HITCH_USER_HEADER, n as runWorkflowJournal } from "./workflow-engine-MogejNfF.js";
-import { c as organizationInstanceUrl, d as resolveInstanceUrl, l as rejectEnvironmentKey, s as bearerToken, t as resolveWorkspaceOrg, u as resolveAuthForOrg } from "./workspace-XVtM12ZC.js";
-import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-CBPnHoqX.js";
+import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-CJSL9GuC.js";
+import { a as openQueryCacheDatabase } from "./query-cache-CXmAyLv3.js";
+import { d as HITCH_USER_HEADER, u as HITCH_SESSION_HEADER } from "./headers-DkNr9MLJ.js";
+import { a as workflowOutcomeSchema, n as runWorkflowJournal } from "./workflow-engine-BOTzURKM.js";
+import { c as bearerToken, d as resolveAuthForOrg, f as resolveInstanceUrl, l as organizationInstanceUrl, t as resolveWorkspaceOrg, u as rejectEnvironmentKey } from "./workspace-D0dnnlxL.js";
+import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-BEIYs17x.js";
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { appendFile, readdir, rm, writeFile } from "node:fs/promises";
@@ -52,7 +54,7 @@ function createDevProxy(options) {
 		[...headers.keys()].filter((name) => REQUEST_DROP.has(name) || name.startsWith("x-hitch-")).forEach((name) => headers.delete(name));
 		headers.set("authorization", `Bearer ${options.token}`);
 		const url = new URL(request.url);
-		const upstream = await (options.fetch ?? globalThis.fetch)(`${options.orgUrl}${url.pathname}${url.search}`, {
+		const upstream = await globalThis.fetch(`${options.orgUrl}${url.pathname}${url.search}`, {
 			method: request.method,
 			headers,
 			body: request.body,
@@ -317,6 +319,20 @@ function clientBootstrapScript(parentOrigin, appletCode) {
       : null
   });
 
+  // Opened here so it is ready by the time the applet module restores its
+  // query cache. A failure is reported when the module reads the promise.
+  Object.defineProperty(window, "__hitchCacheDatabase", {
+    configurable: false,
+    writable: false,
+    value: window.parent !== window && parentOrigin !== null
+      ? (function () {
+          var database = (${openQueryCacheDatabase.toString()})();
+          database.catch(function () {});
+          return database;
+        })()
+      : null
+  });
+
   function applyTheme(theme) {
     document.documentElement.classList.toggle("dark", theme === "dark");
   }
@@ -421,7 +437,7 @@ function clientBootstrapScript(parentOrigin, appletCode) {
   });
 })();`;
 }
-function applet(sourceDefinition, options = {}) {
+function applet(sourceDefinition) {
 	const parsedSourceDefinition = appletSourceDefinitionSchema.safeParse(sourceDefinition);
 	if (!parsedSourceDefinition.success) {
 		const raw = sourceDefinition;
@@ -458,7 +474,7 @@ function applet(sourceDefinition, options = {}) {
 		const routesDirectory = resolve(resolvedRoot, "src/client/routes");
 		const hasClient = existsSync(routesDirectory);
 		const hasServer = existsSync(resolve(resolvedRoot, "src/server/main.ts"));
-		if (!hasServer && parsedDefinition.data.telephony?.events.length) throw new Error("An applet with telephony events must have src/server/main.ts.");
+		if (!hasServer && parsedDefinition.data.telephony?.events?.length) throw new Error("An applet with telephony events must have src/server/main.ts.");
 		if (!hasServer && (parsedDefinition.data.schedules?.length ?? 0) > 0) throw new Error("An applet with schedules must have src/server/main.ts.");
 		const legacyMain = resolve(resolvedRoot, "src/client/main.tsx");
 		const indexHtml = resolve(resolvedRoot, "index.html");
@@ -489,6 +505,11 @@ function applet(sourceDefinition, options = {}) {
 		org: resolveWorkspaceOrg(callerRoot),
 		...parsedDefinition.data
 	});
+	const clsxFromCn = {
+		name: "hitch-clsx",
+		resolveId: (id) => id === "clsx" ? "\0hitch:clsx" : void 0,
+		load: (id) => id === "\0hitch:clsx" ? "export { clsx, clsx as default } from \"cn\";" : void 0
+	};
 	const orchestrator = {
 		name: "hitch-applet",
 		enforce: "pre",
@@ -508,9 +529,9 @@ function applet(sourceDefinition, options = {}) {
 				});
 				clearedOutDir = true;
 			}
-			if (environment.command === "build") themeStylesheetUrl = `${organizationInstanceUrl(await resolveInstanceUrl(void 0, options.store), manifest.org)}/theme.css`;
-			if (environment.command === "build" && manifest.objects.length > 0) {
-				contractSync ??= syncContract(resolve(root, ".hitch"), manifest, options);
+			if (environment.command === "build") themeStylesheetUrl = `${organizationInstanceUrl(await resolveInstanceUrl(), manifest.org)}/theme.css`;
+			if (environment.command === "build") {
+				contractSync ??= syncContract(resolve(root, ".hitch"), manifest);
 				await contractSync;
 			}
 			const hasHitchGen = existsSync(resolve(root, ".hitch/index.ts"));
@@ -526,12 +547,12 @@ function applet(sourceDefinition, options = {}) {
 				hasHitchGen ? void 0 : writeRegisterDeclaration(resolve(root, ".hitch"))
 			]);
 			if (environment.command === "serve" && environment.mode !== "test" && environment.isPreview !== true) {
-				const instanceUrl = await resolveInstanceUrl(void 0, options.store);
+				const instanceUrl = await resolveInstanceUrl();
 				const orgUrl = organizationInstanceUrl(instanceUrl, manifest.org);
-				const auth = await resolveAuthForOrg(instanceUrl, manifest.org, options.store);
+				const auth = await resolveAuthForOrg(instanceUrl, manifest.org);
 				if (auth === void 0) throw new Error("Not logged in. Run applet login.");
 				const token = bearerToken(auth);
-				const meResponse = await (options.fetch ?? globalThis.fetch)(`${orgUrl}/api/v1/me`, { headers: { authorization: `Bearer ${token}` } });
+				const meResponse = await globalThis.fetch(`${orgUrl}/api/v1/me`, { headers: { authorization: `Bearer ${token}` } });
 				rejectEnvironmentKey(meResponse, auth);
 				if (meResponse.status === 401) throw new Error("Your login expired. Run applet login.");
 				if (!meResponse.ok) throw new Error(`Hitch returned ${meResponse.status} for /api/v1/me.`);
@@ -540,7 +561,6 @@ function applet(sourceDefinition, options = {}) {
 					orgUrl,
 					token,
 					source: auth.source,
-					fetch: options.fetch,
 					warn: (message) => devLogger?.warn(message),
 					intercept: (request) => devWorkflows?.handle(request)
 				});
@@ -585,8 +605,18 @@ function applet(sourceDefinition, options = {}) {
 					}
 				}
 			}
+			if (environment.mode === "test") {
+				const colocated = (await readdir(resolve(root, "src"), { recursive: true })).filter((path) => /\.(test|spec)\.[cm]?[jt]sx?$/.test(path));
+				if (colocated.length > 0) throw new Error(`Applet tests run only from the test folder. Move ${colocated.map((path) => `src/${path}`).join(", ")} to test/.`);
+			}
 			return {
 				base: `/${manifest.code}/`,
+				test: { include: ["test/**/*.test.{ts,tsx}"] },
+				resolve: { alias: {
+					"clsx/lite": "cn/lite",
+					"tailwind-merge": "cn"
+				} },
+				optimizeDeps: { rolldownOptions: { plugins: [clsxFromCn] } },
 				...hasServer && { environments: { worker: { build: { rollupOptions: { output: { codeSplitting: false } } } } } }
 			};
 		},
@@ -777,9 +807,14 @@ function applet(sourceDefinition, options = {}) {
 		...plugin,
 		apply: ((_config, { mode }) => mode !== "test")
 	}));
+	const hasClientSource = existsSync(resolve("src/client/routes"));
 	return [
 		orchestrator,
-		...existsSync(resolve("src/client/routes")) ? [tanstackRouter({
+		{
+			...clsxFromCn,
+			enforce: "pre"
+		},
+		...hasClientSource ? [tanstackRouter({
 			generatedRouteTree: ".hitch/routeTree.gen.ts",
 			routesDirectory: "src/client/routes",
 			routeFileIgnorePattern: "__root",

package/dist/{workflow-engine-MogejNfF.js → workflow-engine-BOTzURKM.js}

@@ -1,10 +1,4 @@
 import { z } from "zod";
-//#region src/headers.ts
-const HITCH_USER_HEADER = "x-hitch-user";
-const HITCH_SESSION_HEADER = "x-hitch-session";
-const HITCH_APPLET_HEADER = "x-hitch-applet";
-const HITCH_APPLET_TOKEN_HEADER = "x-hitch-applet-token";
-//#endregion
 //#region src/server/workflow-protocol.ts
 const journalEntrySchema = z.discriminatedUnion("kind", [
 	z.object({
@@ -114,4 +108,4 @@ async function runWorkflowJournal(engine, invoke) {
 	}
 }
 //#endregion
-export { workflowOutcomeSchema as a, HITCH_SESSION_HEADER as c, workflowInvocationRequestSchema as i, HITCH_USER_HEADER as l, runWorkflowJournal as n, HITCH_APPLET_HEADER as o, journalEntrySchema as r, HITCH_APPLET_TOKEN_HEADER as s, WorkflowFailedError as t };
+export { workflowOutcomeSchema as a, workflowInvocationRequestSchema as i, runWorkflowJournal as n, journalEntrySchema as r, WorkflowFailedError as t };

package/dist/{workspace-XVtM12ZC.js → workspace-D0dnnlxL.js}

@@ -45,8 +45,8 @@ async function healCredentialStore(credentialsPath, source, store, unrecognizedC
 	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
 	return store;
 }
-async function readRawCredentialStore(options = {}) {
-	const { credentialsPath } = storePaths(options);
+async function readRawCredentialStore() {
+	const { credentialsPath } = storePaths();
 	let source;
 	try {
 		source = await readFile(credentialsPath, "utf8");
@@ -113,9 +113,9 @@ function organizationInstanceUrl(instanceUrl, orgCode) {
 	url.hostname = [orgCode, ...labels.slice(1)].join(".");
 	return url.toString().replace(/\/$/, "");
 }
-function storePaths(options = {}) {
-	const env = options.env ?? process.env;
-	const home = options.homeDir ?? homedir();
+function storePaths() {
+	const env = process.env;
+	const home = homedir();
 	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
 	return {
 		configDir,
@@ -124,28 +124,28 @@ function storePaths(options = {}) {
 		credentialsPath: join(configDir, "credentials.json")
 	};
 }
-async function resolveInstanceUrl(override, options = {}) {
+async function resolveInstanceUrl(override) {
 	if (override !== void 0) return normalizeInstanceUrl(override);
-	const envInstanceUrl = (options.env ?? process.env).HITCH_API_URL;
+	const envInstanceUrl = process.env.HITCH_API_URL;
 	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
-	const { configPath } = storePaths(options);
+	const { configPath } = storePaths();
 	const config = await readJson(configPath);
 	if (config === void 0) return DEFAULT_INSTANCE_URL;
 	if (!isObject(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
 	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
 }
-async function readCredentialStore(options = {}) {
-	const store = await readRawCredentialStore(options);
+async function readCredentialStore() {
+	const store = await readRawCredentialStore();
 	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
 		const credentials = parseCredentials(value);
 		return credentials === void 0 ? [] : [[orgCode, credentials]];
 	}))])) };
 }
-async function getCredentialsForOrg(instanceUrl, orgCode, options = {}) {
-	return (await readCredentialStore(options)).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
+async function getCredentialsForOrg(instanceUrl, orgCode) {
+	return (await readCredentialStore()).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
 }
-function environmentAuth(options) {
-	const apiKey = (options.env ?? process.env).HITCH_API_KEY;
+function environmentAuth() {
+	const apiKey = process.env.HITCH_API_KEY;
 	return apiKey !== void 0 && apiKey.length > 0 ? {
 		accessToken: apiKey,
 		source: "environment"
@@ -169,11 +169,11 @@ function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
 	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
 	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
 }
-async function resolveAuthForOrg(instanceUrl, orgCode, options = {}) {
-	const auth = environmentAuth(options);
+async function resolveAuthForOrg(instanceUrl, orgCode) {
+	const auth = environmentAuth();
 	if (auth !== void 0) return auth;
 	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
-	const credentialsByOrg = Object.entries((await readCredentialStore(options)).instances).find(([instance]) => instance === normalizedUrl)?.[1];
+	const credentialsByOrg = Object.entries((await readCredentialStore()).instances).find(([instance]) => instance === normalizedUrl)?.[1];
 	return resolveStoredAuthForOrg(credentialsByOrg ?? {}, orgCode);
 }
 function rejectEnvironmentKey(response, auth) {
@@ -182,9 +182,9 @@ function rejectEnvironmentKey(response, auth) {
 function bearerToken(credentials) {
 	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
 }
-async function setCredentials(instanceUrl, credentials, options = {}) {
-	const paths = storePaths(options);
-	const store = await readRawCredentialStore(options);
+async function setCredentials(instanceUrl, credentials) {
+	const paths = storePaths();
+	const store = await readRawCredentialStore();
 	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
 	const credentialsByOrg = store.instances[normalizedUrl];
 	store.instances[normalizedUrl] = {
@@ -291,17 +291,17 @@ async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
 	throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
 }
 async function loginWithDevice(instanceUrl, options = {}) {
-	const fetcher = options.fetch ?? globalThis.fetch;
-	const now = options.now ?? Date.now;
+	const fetcher = globalThis.fetch;
+	const now = Date.now;
 	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
 	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
 	const device = parseDeviceCode(body);
 	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
-	(options.print ?? console.log)(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
+	console.log(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
 	if (!options.noBrowser) try {
-		await (options.openUrl ?? defaultOpenUrl)(verificationUrl);
+		defaultOpenUrl(verificationUrl);
 	} catch {}
-	const token = await pollForToken(fetcher, instanceUrl, device, now, options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))));
+	const token = await pollForToken(fetcher, instanceUrl, device, now, (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
 	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
 	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
 	const organization = parseDeviceOrganization(organizationBody);
@@ -319,7 +319,7 @@ async function loginWithDevice(instanceUrl, options = {}) {
 		organizationId: organization.organizationId,
 		orgCode: organization.orgCode
 	};
-	await setCredentials(instanceUrl, credentials, options.store);
+	await setCredentials(instanceUrl, credentials);
 	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
 	return {
 		credentials,
@@ -356,23 +356,18 @@ function findWorkspaceConfig(cwd) {
 }
 //#endregion
 //#region src/auth.ts
-async function fetchWithOrgAuth(orgCode, options, request) {
-	const fetcher = options.fetch ?? globalThis.fetch;
-	const instanceUrl = await resolveInstanceUrl(void 0, options.store);
+async function fetchWithOrgAuth(orgCode, request) {
+	const instanceUrl = await resolveInstanceUrl();
 	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
-	const auth = await resolveAuthForOrg(instanceUrl, orgCode, options.store);
+	const auth = await resolveAuthForOrg(instanceUrl, orgCode);
 	if (auth !== void 0) {
 		const response = await request(organizationUrl, bearerToken(auth));
 		rejectEnvironmentKey(response, auth);
 		if (response.status !== 401) return response;
 	}
-	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
-	await (options.login ?? loginWithDevice)(instanceUrl, {
-		expectedOrg: orgCode,
-		fetch: fetcher,
-		store: options.store
-	});
-	const credentials = await getCredentialsForOrg(instanceUrl, orgCode, options.store);
+	if (process.stdin.isTTY !== true) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
+	await loginWithDevice(instanceUrl, { expectedOrg: orgCode });
+	const credentials = await getCredentialsForOrg(instanceUrl, orgCode);
 	if (credentials === void 0) throw new Error(`login did not provide credentials for organization "${orgCode}"`);
 	return request(organizationUrl, bearerToken(credentials));
 }
@@ -387,4 +382,4 @@ function resolveWorkspaceOrg(appletRoot) {
 	throw new Error(`No Hitch workspace found for ${appletRoot}. An applet must live at <workspace>/applets/<code> with hitch.config.ts in the workspace root.`);
 }
 //#endregion
-export { loginWithDevice as a, organizationInstanceUrl as c, resolveInstanceUrl as d, readWorkspaceConfig as i, rejectEnvironmentKey as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, bearerToken as s, resolveWorkspaceOrg as t, resolveAuthForOrg as u };
+export { loginWithDevice as a, bearerToken as c, resolveAuthForOrg as d, resolveInstanceUrl as f, readWorkspaceConfig as i, organizationInstanceUrl as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, DEFAULT_INSTANCE_URL as s, resolveWorkspaceOrg as t, rejectEnvironmentKey as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hitch42/applet",
-  "version": "0.1.0-beta.9",
+  "version": "0.1.1-beta.10",
   "license": "MIT",
   "bin": {
     "applet": "./dist/applet.js"
@@ -42,10 +42,15 @@
     "./_internal/server": {
       "source": "./src/internal/server.ts",
       "default": "./dist/_internal/server.js"
+    },
+    "./_internal/log-context": {
+      "source": "./src/server/log-context.ts",
+      "default": "./dist/_internal/log-context.js"
     }
   },
   "dependencies": {
     "@cloudflare/vite-plugin": "^1.51.1",
+    "@fontsource-variable/geist-mono": "^5.3.0",
     "@fontsource-variable/inter": "^5.3.0",
     "@hey-api/openapi-ts": "0.0.0-next-20260824173136",
     "@orpc/client": "^1.15.0",
@@ -53,7 +58,6 @@
     "@orpc/openapi-client": "^1.15.0",
     "@orpc/tanstack-query": "^1.15.0",
     "@tailwindcss/vite": "^4.3.0",
-    "@tanstack/query-async-storage-persister": "5.101.4",
     "@tanstack/react-query-persist-client": "5.101.4",
     "@tanstack/router-cli": "^1.167.24",
     "@tanstack/router-plugin": "^1.168.23",
@@ -64,23 +68,26 @@
     "@tiptap/extension-table": "^3.30.3",
     "@tiptap/extensions": "^3.30.3",
     "@tiptap/markdown": "^3.30.3",
+    "@tiptap/pm": "^3.30.3",
     "@tiptap/react": "^3.30.3",
     "@tiptap/starter-kit": "^3.30.3",
     "@vitejs/plugin-react": "^6.0.3",
     "class-variance-authority": "^0.7.1",
-    "clsx": "^2.1.1",
+    "cn": "^0.4.0",
     "croner": "^10.0.1",
     "lucide-react": "^1.33.0",
     "oxc-transform-react": "^0.149.0",
+    "oxfmt": "^0.72.0",
+    "oxlint": "^1.87.0",
+    "oxlint-tsgolint": "^7.0.2003",
     "react-aria-components": "^1.20.0",
     "shadcn": "^4.16.1",
+    "smol-toml": "^1.9.0",
     "streamdown": "^2.6.0",
-    "tailwind-merge": "^3.6.0",
     "tailwindcss": "^4.3.0",
     "tw-animate-css": "^1.4.0",
     "vite": "8.3.0",
     "vitest": "4.1.11",
-    "wrangler": "^4.120.0",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
@@ -105,6 +112,6 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org",
-    "tag": "beta"
+    "tag": "latest"
   }
 }

package/scaffold/.agents/skills/hitch-applets/SKILL.md

@@ -28,6 +28,10 @@ This file holds the common rules. Read each matching reference before you edit a
 
 For attribute types, filters, and API limits, read `../hitch-data/SKILL.md`. To inspect or change Hitch data and settings from the shell, read `../hitch-cli/SKILL.md`.
 
+Read `../tanstack-router/SKILL.md` for route work and `../tanstack-query/SKILL.md` for query and cache work.
+Read `../react-best-practices/SKILL.md` for React performance and `../web-design-guidelines/SKILL.md` for requested interface reviews.
+Follow the Hitch applet rules for SDK-owned configuration, providers, and generated files.
+
 ## Work with the workspace
 
 - Run package commands with `pnpm`.
@@ -53,14 +57,15 @@ For attribute types, filters, and API limits, read `../hitch-data/SKILL.md`. To
 - The preview lasts until you select Exit or close the tab.
 - A pending `requiresChangeset` schema is not available in dev. Deploy to test it.
 - Run `pnpm --dir applets/<code> run deploy` only when the user requests a deployment.
-- Edit only `hitch.config.ts`, `applet.manifest.ts`, files in `src`, and `.gitignore` rules below the generated block.
-- Treat all other workspace files as generated output. The applet CLI replaces them. It creates `.github/workflows/hitch.yml` only when the file is absent. To stop it, set `githubWorkflow: false` in `hitch.config.ts` and delete the file.
+- The CLI creates missing MCP files and adds missing Hitch and Chrome DevTools entries. Existing entries and other settings belong to the user.
+- The applet CLI replaces its generated support files. It creates `.github/workflows/hitch.yml` only when the file is absent. To stop it, set `githubWorkflow: false` in `hitch.config.ts` and delete the file.
 - Remember that generation refreshes the local theme copy. Deployed applets load the public org theme from its Hitch `.com` URL.
 
 ## Use Vite and Vitest
 
 - Import configuration APIs from `vite`.
 - Import test APIs from `vitest`.
+- Put tests in the applet's `test` folder and name them `*.test.ts` or `*.test.tsx`. Vitest does not run test files in other folders.
 - Do not edit `vite.config.ts`. The applet CLI rewrites it. Do not add another Vite config.
 - Add applet packages to `dependencies` or `devDependencies` in `applet.manifest.ts`.
 
@@ -132,6 +137,25 @@ Read `references/files.md` before download links, attachment attributes, or serv
 - Include the applet type filter during diagnosis. Without it, Cloudflare invocation entries can hide the useful applet entries. For a workflow run, use `--run <id>` or `--filter '{"type":"workflow"}'` instead.
 - Do not log secrets, tokens, or personal data.
 
+## Add request context with `log.set()`
+
+Each server request gets one request entry with the route, status, outcome, CPU time, and wall time. Add facts about the request to that entry:
+
+```ts
+import { log } from "@hitch42/applet/server";
+
+log.set({ invoiceId, processedCount });
+```
+
+- Set the IDs, counts, and decisions that explain what the request did. One entry with many fields is easier to filter than many `console.log` lines.
+- A later call replaces an earlier value with the same top-level key.
+- To fail a request, throw. The request entry records the error and its stack.
+- To record a problem that the code recovered from, set a field, for example `log.set({ fallbackUsed: true })`.
+- Use `console.<level>` for a separate line with its own level.
+- Outside a request, for example at module scope, `log.set()` warns and drops the fields.
+- A single call larger than 16 KB is dropped. The entry then shows `noteDropped`.
+- Run `pnpm --dir applets/<code> exec applet logs --filter '{"type":"invocation"}'` to read request entries. The CLI prints the fields and any error stack.
+
 ## Verify changes
 
 Run these commands from the workspace root before deployment:
@@ -139,6 +163,8 @@ Run these commands from the workspace root before deployment:
 ```sh
 pnpm --dir applets/<code> run generate
 pnpm --dir applets/<code> run typecheck
+pnpm --dir applets/<code> run fmt
+pnpm --dir applets/<code> run lint
 pnpm --dir applets/<code> run test # Only when the applet contains tests.
 pnpm --dir applets/<code> run build
 ```
@@ -150,7 +176,7 @@ If a command fails, report the exact blocker. Do not deploy as a verification st
 ## Deploy from GitHub
 
 - A push to the production branch runs `applet deploy` in the workspace root through GitHub Actions.
-- An applet deploys when its own folder changed since its current CI release. Every applet deploys when a file outside `applets/` changed. An applet without a CI release always deploys. An applet also deploys when CI cannot load the commit of its current release.
+- An applet deploys when its folder or a file outside `applets/` differs from its current release, including a local `applet deploy`. Uncommitted and untracked files count. Gitignored files do not count. An applet whose current release has no source hash always deploys.
 - The deploy skips other applets and logs the reason. A skip is expected, not a failure.
 - A schema change in Hitch alone does not trigger CI.
 - Do not import from a sibling applet folder. The change check does not follow such imports.

package/scaffold/.agents/skills/hitch-applets/references/manifest.md

@@ -83,6 +83,14 @@ Each object entry has five required fields.
 - `readOnly` lists attribute codes that the applet can read but cannot write.
 - `readWrite` lists attribute codes that the applet can read and write.
 
+Set `optional: true` when the applet works for a viewer without access to this object.
+List codes from `readOnly` or `readWrite` in `optionalAttributes` when some viewers cannot see their values.
+Typegen makes these record fields nullable for every viewer.
+These fields never grant or remove access.
+They matter when an org shares the applet with a connected organisation.
+Hitch refuses a share if the connected org lacks access to a required object.
+Hitch also refuses a share if a required object lists a required user attribute outside `optionalAttributes`.
+
 - Use the applet code format for each object code.
 - Do not declare the same object code more than once.
 - Use the applet code format for each attribute code.

package/scaffold/.agents/skills/hitch-applets/references/markdown.md

@@ -15,6 +15,8 @@ import { MarkdownEditor } from "@hitch42/applet/react";
 <MarkdownEditor value={value} onChange={setValue} files={hitch.files} />;
 ```
 
+Pass `autoFocus` to put the cursor at the end of the text when the editor mounts. It is off by default, so the editor never takes focus from another field.
+
 The editor uploads pasted or dropped images. It stores each image as `![name](hitch-file://<file-id>)`.
 
 The `files` value must supply both `upload(file)` and `download(id)`. The editor uses `download(id)` to show stored Hitch images.

package/scaffold/.agents/skills/hitch-applets/references/records.md

@@ -142,6 +142,8 @@ Each aggregate can have its own `filter` with the same syntax as the top-level `
 The array form returns `keys` and `labels` arrays per group.
 The object form orders category groups by an aggregate value (top-N by value).
 The array form orders each dimension by key; `limit` selects the first N distinct keys in that order. It does not support top-N by value.
+Grouped results include `truncated`. When it is `true`, the limit omitted groups.
+Narrow the filter or split the query.
 
 ```ts
 const totals = await hitch.records.deals.aggregate({