@hitch42/applet 0.1.1-beta.1 → 0.1.1-beta.11

package/dist/_internal/client.js

@@ -1,15 +1,112 @@
-import { createAsyncStoragePersister } from "@tanstack/query-async-storage-persister";
+import { i as openCacheDatabase, n as clearAppletQueryCaches, o as sweepExpiredQueryCaches, r as indexedDbPersister, t as cacheTabId } from "../query-cache-CXmAyLv3.js";
 import { QueryClientProvider } from "@tanstack/react-query";
 import { PersistQueryClientProvider } from "@tanstack/react-query-persist-client";
 import { RouterProvider } from "@tanstack/react-router";
-import { createElement } from "react";
+import { createElement, useEffect } from "react";
 import { createRoot } from "react-dom/client";
+import { RotateCcw } from "lucide-react";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/internal/error-page.tsx
+const STYLES = `
+.hitch-error {
+  position: relative;
+  display: flex;
+  min-height: 100dvh;
+  align-items: center;
+  justify-content: center;
+  overflow: hidden;
+  padding: 3rem 1.5rem;
+  background:
+    radial-gradient(ellipse 80% 50% at 50% -20%, color-mix(in oklch, var(--primary) 12%, transparent), transparent),
+    var(--background);
+  color: var(--foreground);
+  font-family: "Inter Variable", Inter, ui-sans-serif, system-ui, sans-serif;
+}
+.hitch-error__content { width: 100%; max-width: 28rem; text-align: center; }
+.hitch-error__title { margin: 0 0 0.75rem; font-size: 1.875rem; font-weight: 600; letter-spacing: -0.025em; }
+.hitch-error__text { margin: 0 0 2rem; color: var(--muted-foreground); line-height: 1.625; text-wrap: balance; }
+.hitch-error__button {
+  display: inline-flex;
+  width: 100%;
+  align-items: center;
+  justify-content: center;
+  gap: 0.5rem;
+  border: 0;
+  border-radius: calc(var(--radius, 0.625rem) + 4px);
+  padding: 0.75rem 1.5rem;
+  background: var(--primary);
+  color: var(--primary-foreground);
+  font: inherit;
+  font-weight: 500;
+  cursor: pointer;
+  transition: background 150ms;
+}
+.hitch-error__button:hover { background: color-mix(in oklch, var(--primary) 90%, transparent); }
+.hitch-error__button:focus-visible { outline: 2px solid var(--ring, var(--primary)); outline-offset: 2px; }
+.hitch-error__hint { margin: 1rem 0 0; color: var(--muted-foreground); font-size: 0.875rem; }
+.hitch-error__details { margin-top: 1.5rem; color: var(--muted-foreground); font-size: 0.875rem; text-align: left; }
+.hitch-error__details summary { cursor: pointer; text-align: center; }
+.hitch-error__details pre {
+  max-height: 12rem;
+  margin: 0.75rem 0 0;
+  padding: 1rem;
+  overflow: auto;
+  border: 1px solid var(--border);
+  border-radius: var(--radius, 0.625rem);
+  font: 0.75rem/1.5 ui-monospace, monospace;
+  white-space: pre;
+}
+`;
+function AppletErrorPage({ error, onReload }) {
+	useEffect(() => {
+		console.error("The applet failed to render.", error);
+	}, [error]);
+	return /* @__PURE__ */ jsxs("div", {
+		className: "hitch-error",
+		role: "alert",
+		children: [/* @__PURE__ */ jsx("style", { children: STYLES }), /* @__PURE__ */ jsxs("div", {
+			className: "hitch-error__content",
+			children: [
+				/* @__PURE__ */ jsx("h1", {
+					className: "hitch-error__title",
+					children: "We hit a snag"
+				}),
+				/* @__PURE__ */ jsx("p", {
+					className: "hitch-error__text",
+					children: "This applet ran into an unexpected error. Reload to try again."
+				}),
+				/* @__PURE__ */ jsxs("button", {
+					type: "button",
+					className: "hitch-error__button",
+					onClick: onReload,
+					children: [/* @__PURE__ */ jsx(RotateCcw, {
+						size: 16,
+						"aria-hidden": true
+					}), "Reload applet"]
+				}),
+				/* @__PURE__ */ jsx("p", {
+					className: "hitch-error__hint",
+					children: "If this keeps happening, let your admin know."
+				}),
+				import.meta.env.DEV && /* @__PURE__ */ jsxs("details", {
+					className: "hitch-error__details",
+					children: [/* @__PURE__ */ jsx("summary", { children: "Error details" }), /* @__PURE__ */ jsx("pre", { children: error instanceof Error ? error.stack ?? error.message : String(error) })]
+				})
+			]
+		})]
+	});
+}
+//#endregion
 //#region src/internal/client.ts
 const CACHE_MAX_AGE = 3e5;
 const CACHE_SCOPE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function appletQueryPersistence(appletCode) {
 	const contextPromise = window.__hitchCacheContext;
 	if (!contextPromise) return void 0;
+	const databaseReady = openCacheDatabase().then(() => true, (error) => {
+		console.error("Could not open the applet query cache.", error);
+		return false;
+	});
 	let context;
 	try {
 		context = await contextPromise;
@@ -20,16 +117,10 @@ async function appletQueryPersistence(appletCode) {
 	const cacheScope = typeof context === "object" && context !== null && "cacheScope" in context && typeof context.cacheScope === "string" ? context.cacheScope.trim() : void 0;
 	const cacheBuster = typeof context === "object" && context !== null && "cacheBuster" in context && typeof context.cacheBuster === "string" ? context.cacheBuster.trim() : void 0;
 	if (!cacheScope || !CACHE_SCOPE_PATTERN.test(cacheScope) || !cacheBuster || !CACHE_SCOPE_PATTERN.test(cacheBuster)) return;
+	if (!await databaseReady) return void 0;
 	try {
 		return {
-			persister: createAsyncStoragePersister({
-				storage: window.sessionStorage,
-				key: `hitch:query:${appletCode}:${cacheScope}`,
-				throttleTime: 100,
-				retry: ({ error }) => {
-					console.error("Could not persist the applet query cache.", error);
-				}
-			}),
+			persister: indexedDbPersister(`${appletCode}:${cacheScope}:${cacheTabId()}`),
 			maxAge: CACHE_MAX_AGE,
 			buster: cacheBuster,
 			dehydrateOptions: { shouldDehydrateMutation: () => false }
@@ -44,12 +135,30 @@ function mountApplet(router, appletCode) {
 	if (!queryClient) throw new Error("getRouter must provide a QueryClient via createRouter({ context: { queryClient } }).");
 	const root = document.getElementById("root");
 	if (root === null) throw new Error("Missing #root element in index.html.");
+	router.options.defaultErrorComponent ??= ({ error }) => createElement(AppletErrorPage, {
+		error,
+		onReload: () => {
+			queryClient.clear();
+			clearAppletQueryCaches(appletCode).catch((error) => console.error("Could not clear the applet query cache.", error)).finally(() => window.location.reload());
+		}
+	});
 	const applet = createElement(RouterProvider, { router });
+	const sweepWhenIdle = () => {
+		const sweep = () => {
+			sweepExpiredQueryCaches(CACHE_MAX_AGE).catch((error) => console.error("Could not clear expired applet query caches.", error));
+		};
+		if ("requestIdleCallback" in window) requestIdleCallback(sweep);
+		else setTimeout(sweep, 1e3);
+	};
 	appletQueryPersistence(appletCode).then((persistence) => {
 		createRoot(root).render(persistence ? createElement(PersistQueryClientProvider, {
 			client: queryClient,
 			persistOptions: persistence,
-			onError: () => console.error("Could not restore the applet query cache.")
+			onSuccess: sweepWhenIdle,
+			onError: () => {
+				console.error("Could not restore the applet query cache.");
+				sweepWhenIdle();
+			}
 		}, applet) : createElement(QueryClientProvider, { client: queryClient }, applet));
 	}).catch((error) => {
 		console.error("Could not initialize the applet query cache.", error);

package/dist/_internal/log-context.d.ts

@@ -0,0 +1,34 @@
+//#region src/server/log-context.d.ts
+declare const REQUEST_CONTEXT_CHANNEL = "hitch.request.context";
+declare const APP_CONTEXT_CHANNEL = "hitch.request.app";
+declare const isUuid: (value: string | null | undefined) => value is string;
+declare function requestIdFrom(headers: Headers): string;
+declare function publishNote(requestId: string, fields: Record<string, unknown>, channelName?: string): void;
+declare function errorNote(error: unknown): {
+  error: {
+    name: string;
+    message: string;
+    stack?: string;
+    cause?: {
+      name: string;
+      message: string;
+    };
+  };
+};
+declare function cloudflareRequestFields(request: Request): {
+  cfRay: string | undefined;
+  traceparent: string | undefined;
+  colo: string | undefined;
+  country: string | undefined;
+  asn: number | undefined;
+};
+type NoteLog = {
+  set(fields: Record<string, unknown>): void;
+  error(error: unknown): void;
+  getContext(): Record<string, unknown>;
+};
+declare function createNoteLog(initial: {
+  requestId: string;
+} & Record<string, unknown>): NoteLog;
+//#endregion
+export { APP_CONTEXT_CHANNEL, NoteLog, REQUEST_CONTEXT_CHANNEL, cloudflareRequestFields, createNoteLog, errorNote, isUuid, publishNote, requestIdFrom };

package/dist/_internal/log-context.js

@@ -0,0 +1,2 @@
+import { a as errorNote, c as requestIdFrom, i as createNoteLog, n as REQUEST_CONTEXT_CHANNEL, o as isUuid, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-zu8U9Sjm.js";
+export { APP_CONTEXT_CHANNEL, REQUEST_CONTEXT_CHANNEL, cloudflareRequestFields, createNoteLog, errorNote, isUuid, publishNote, requestIdFrom };

package/dist/_internal/server.d.ts

@@ -1,9 +1,13 @@
 import { t as AnyWorkflowDefinition } from "../workflow-DurM6Fwx.js";
+import { d as listEmailTrackersInputSchema, i as createEmailPixelInputSchema, p as markEmailTrackerSentBodySchema, t as TelephonyMessageReceivedEvent } from "../telephony-protocol-D-nf3Gca.js";
 import { z } from "zod";
 //#region src/server/entry.d.ts
 declare function createWorkerEntry(server: {
   router: object;
   workflows?: Record<string, AnyWorkflowDefinition>;
+  telephony?: {
+    onMessageReceived?: (event: TelephonyMessageReceivedEvent) => void | Promise<void>;
+  };
 }, options: {
   code: string;
 }): {
@@ -76,4 +80,13 @@ type ErrorOutcome = {
 declare const workflowOutcomeSchema: z.ZodType<StepOutcome | SleepOutcome | StepErrorOutcome | DoneOutcome | ErrorOutcome>;
 type WorkflowOutcome = z.infer<typeof workflowOutcomeSchema>;
 //#endregion
-export { type JournalEntry, type WorkflowInvocationRequest, type WorkflowOutcome, createWorkerEntry, journalEntrySchema, workflowInvocationRequestSchema, workflowOutcomeSchema };
+//#region src/server/workflow-engine.d.ts
+type Engine = {
+  invoke<T>(name: string, fn: () => Promise<T>): Promise<T>;
+  sleepUntil(name: string, until: Date): Promise<void>;
+  sleep(name: string, milliseconds: number): Promise<void>;
+};
+declare class WorkflowFailedError extends Error {}
+declare function runWorkflowJournal(engine: Engine, invoke: (journal: JournalEntry[]) => Promise<WorkflowOutcome>): Promise<unknown>;
+//#endregion
+export { type Engine, type JournalEntry, WorkflowFailedError, type WorkflowInvocationRequest, type WorkflowOutcome, createEmailPixelInputSchema, createWorkerEntry, journalEntrySchema, listEmailTrackersInputSchema, markEmailTrackerSentBodySchema, runWorkflowJournal, workflowInvocationRequestSchema, workflowOutcomeSchema };

package/dist/_internal/server.js

@@ -1,80 +1,18 @@
-import { o as runWithRequestContext, r as toMilliseconds, t as MAX_DURATION_MS } from "../workflow-CTo2kZF1.js";
+import { c as listEmailTrackersInputSchema, t as createEmailPixelInputSchema, u as markEmailTrackerSentBodySchema } from "../email-DBTVhNB_.js";
+import { a as HITCH_ORG_CODE_HEADER, c as HITCH_SCHEDULE_HEADER, d as HITCH_USER_HEADER, f as HITCH_WORKFLOW_HEADER, i as HITCH_ORGANIZATION_HEADER, l as HITCH_SCHEDULE_RUN_HEADER, m as HITCH_WORKFLOW_RUN_HEADER, n as HITCH_APPLET_HEADER, o as HITCH_RELEASE_HEADER, p as HITCH_WORKFLOW_INVOCATION_HEADER, r as HITCH_APPLET_TOKEN_HEADER, u as HITCH_SESSION_HEADER } from "../headers-DkNr9MLJ.js";
+import { a as getRequestContext, o as runWithRequestContext, r as toMilliseconds, t as MAX_DURATION_MS } from "../workflow-CTo2kZF1.js";
+import { a as errorNote, c as requestIdFrom, i as createNoteLog, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-zu8U9Sjm.js";
+import { a as workflowOutcomeSchema, i as workflowInvocationRequestSchema, n as runWorkflowJournal, r as journalEntrySchema, t as WorkflowFailedError } from "../workflow-engine-BOTzURKM.js";
 import { z } from "zod";
 import { RPCHandler } from "@orpc/server/fetch";
-//#region src/headers.ts
-const HITCH_USER_HEADER = "x-hitch-user";
-const HITCH_SESSION_HEADER = "x-hitch-session";
-const HITCH_APPLET_HEADER = "x-hitch-applet";
-const HITCH_APPLET_TOKEN_HEADER = "x-hitch-applet-token";
-//#endregion
-//#region src/server/workflow-protocol.ts
-const journalEntrySchema = z.discriminatedUnion("kind", [
-	z.object({
-		kind: z.literal("step"),
-		id: z.string(),
-		name: z.string(),
-		result: z.unknown()
-	}),
-	z.object({
-		kind: z.literal("sleep"),
-		id: z.string(),
-		name: z.string(),
-		until: z.number()
-	}),
-	z.object({
-		kind: z.literal("attempt"),
-		id: z.string(),
-		name: z.string(),
-		error: z.string()
-	}),
-	z.object({
-		kind: z.literal("failed"),
-		id: z.string(),
-		name: z.string(),
-		error: z.string()
-	})
-]);
-const workflowInvocationRequestSchema = z.object({
-	payload: z.unknown(),
-	journal: z.array(journalEntrySchema)
+//#region src/server/telephony-protocol.ts
+const telephonyMessageReceivedEventSchema = z.object({
+	eventId: z.string(),
+	type: z.literal("message.received"),
+	messageId: z.string(),
+	numberId: z.string(),
+	occurredAt: z.iso.datetime()
 });
-const workflowOutcomeSchema = z.discriminatedUnion("kind", [
-	z.object({
-		kind: z.literal("step"),
-		id: z.string(),
-		name: z.string(),
-		result: z.unknown()
-	}),
-	z.object({
-		kind: z.literal("sleep"),
-		id: z.string(),
-		name: z.string(),
-		until: z.number()
-	}),
-	z.object({
-		kind: z.literal("step_error"),
-		id: z.string(),
-		name: z.string(),
-		message: z.string(),
-		retries: z.object({
-			limit: z.number(),
-			delayMs: z.number(),
-			backoff: z.enum([
-				"constant",
-				"linear",
-				"exponential"
-			])
-		})
-	}),
-	z.object({
-		kind: z.literal("done"),
-		result: z.unknown()
-	}),
-	z.object({
-		kind: z.literal("error"),
-		message: z.string()
-	})
-]);
 //#endregion
 //#region src/server/workflow-run.ts
 const MAX_RESULT_SIZE = 1048576;
@@ -180,53 +118,119 @@ function jsonError(status, error) {
 function createWorkerEntry(server, options) {
 	const candidate = server;
 	if (typeof candidate !== "object" || candidate === null || !("router" in candidate)) throw new Error(SERVER_EXPORT_ERROR);
-	const handler = new RPCHandler(server.router);
+	const handler = new RPCHandler(server.router, { clientInterceptors: [async (options) => {
+		getRequestContext().log.set({
+			route: `/api/${options.path.join("/")}`,
+			procedure: options.path.join("/")
+		});
+		try {
+			return await options.next();
+		} catch (error) {
+			publishNote(getRequestContext().requestId, errorNote(error), APP_CONTEXT_CHANNEL);
+			throw error;
+		}
+	}] });
 	return { async fetch(request, env) {
-		const userId = request.headers.get(HITCH_USER_HEADER);
-		const sessionToken = request.headers.get(HITCH_SESSION_HEADER);
-		const appletId = request.headers.get(HITCH_APPLET_HEADER);
-		const token = request.headers.get(HITCH_APPLET_TOKEN_HEADER);
-		const identity = userId !== null && sessionToken !== null ? {
-			kind: "user",
-			userId,
-			sessionToken
-		} : appletId !== null && token !== null ? {
-			kind: "applet",
-			appletId,
-			token
-		} : void 0;
-		if (identity === void 0) return jsonError(401, "missing_identity");
-		const bindings = typeof env === "object" && env !== null ? env : {};
-		if (typeof bindings.HITCH_API_URL !== "string") return jsonError(500, "missing_api_binding");
-		const service = typeof bindings.HITCH === "object" && bindings.HITCH !== null ? bindings.HITCH : void 0;
-		const apiFetch = typeof service?.fetch === "function" ? service.fetch.bind(bindings.HITCH) : globalThis.fetch.bind(globalThis);
-		return runWithRequestContext({
-			identity,
+		const url = new URL(request.url);
+		const requestId = requestIdFrom(request.headers);
+		const log = createNoteLog({
+			requestId,
+			service: "hitch-applet",
+			operation: "http.request",
+			callerType: "anonymous",
 			appletCode: options.code,
-			api: {
-				baseUrl: bindings.HITCH_API_URL,
-				fetch: apiFetch
-			}
-		}, async () => {
-			const pathname = new URL(request.url).pathname;
-			if (pathname.startsWith(WORKFLOW_PATH_PREFIX)) {
-				const parsed = await request.json().then((body) => workflowInvocationRequestSchema.safeParse(body)).catch(() => void 0);
-				if (parsed === void 0 || !parsed.success) return jsonError(400, "malformed_request");
-				const code = decodeURIComponent(pathname.slice(23));
-				const workflows = server.workflows ?? {};
-				const definition = Object.hasOwn(workflows, code) ? workflows[code] : void 0;
-				return Response.json(definition === void 0 ? {
-					kind: "error",
-					message: `Unknown workflow "${code}".`
-				} : await runWorkflowInvocation(definition, parsed.data));
-			}
-			const result = await handler.handle(request, {
-				context: {},
-				prefix: "/api"
-			});
-			return result.matched ? result.response : new Response(null, { status: 404 });
+			host: request.headers.get("x-hitch-request-host") ?? url.host,
+			orgCode: request.headers.get(HITCH_ORG_CODE_HEADER),
+			hitchOrganization: request.headers.get(HITCH_ORGANIZATION_HEADER),
+			hitchApplet: request.headers.get(HITCH_APPLET_HEADER),
+			hitchRelease: request.headers.get(HITCH_RELEASE_HEADER),
+			scheduleCode: request.headers.get(HITCH_SCHEDULE_HEADER),
+			hitchRun: request.headers.get(HITCH_WORKFLOW_RUN_HEADER),
+			workflowCode: request.headers.get(HITCH_WORKFLOW_HEADER),
+			workflowInvocation: request.headers.get(HITCH_WORKFLOW_INVOCATION_HEADER),
+			userAgent: request.headers.get("user-agent"),
+			contentType: request.headers.get("content-type"),
+			method: request.method,
+			...cloudflareRequestFields(request)
 		});
+		try {
+			const userId = request.headers.get(HITCH_USER_HEADER);
+			const sessionToken = request.headers.get(HITCH_SESSION_HEADER);
+			const appletId = request.headers.get(HITCH_APPLET_HEADER);
+			const token = request.headers.get(HITCH_APPLET_TOKEN_HEADER);
+			const identity = userId !== null && sessionToken !== null ? {
+				kind: "user",
+				userId,
+				sessionToken
+			} : appletId !== null && token !== null ? {
+				kind: "applet",
+				appletId,
+				token
+			} : void 0;
+			if (identity === void 0) return jsonError(401, "missing_identity");
+			log.set({
+				callerType: identity.kind,
+				callerId: identity.kind === "user" ? `user:${identity.userId}` : `applet:${identity.appletId}`
+			});
+			const bindings = typeof env === "object" && env !== null ? env : {};
+			if (typeof bindings.HITCH_API_URL !== "string") return jsonError(500, "missing_api_binding");
+			const service = typeof bindings.HITCH === "object" && bindings.HITCH !== null ? bindings.HITCH : void 0;
+			const apiFetch = typeof service?.fetch === "function" ? service.fetch.bind(bindings.HITCH) : globalThis.fetch.bind(globalThis);
+			const invocationId = identity.kind === "applet" ? request.headers.get(HITCH_SCHEDULE_RUN_HEADER) : null;
+			if (invocationId) log.set({
+				operation: "applet.schedule.procedure",
+				hitchType: "schedule",
+				hitchInvocation: invocationId
+			});
+			return await runWithRequestContext({
+				identity,
+				appletCode: options.code,
+				api: {
+					baseUrl: bindings.HITCH_API_URL,
+					fetch: apiFetch
+				},
+				log,
+				requestId
+			}, async () => {
+				const pathname = new URL(request.url).pathname;
+				if (pathname === "/api/__hitch/telephony/message-received" && request.method === "POST") {
+					log.set({ route: "/api/__hitch/telephony/message-received" });
+					if (identity.kind !== "applet") return jsonError(403, "applet_identity_required");
+					const parsed = await request.json().then((body) => telephonyMessageReceivedEventSchema.safeParse(body)).catch(() => void 0);
+					if (!parsed?.success) return jsonError(400, "malformed_request");
+					const onMessageReceived = server.telephony?.onMessageReceived;
+					if (!onMessageReceived) return jsonError(404, "no_telephony_handler");
+					try {
+						await onMessageReceived(parsed.data);
+						return Response.json({ ok: true });
+					} catch (error) {
+						publishNote(requestId, errorNote(error), APP_CONTEXT_CHANNEL);
+						return jsonError(500, error instanceof Error ? error.message : String(error));
+					}
+				}
+				if (pathname.startsWith(WORKFLOW_PATH_PREFIX)) {
+					log.set({ route: `${WORKFLOW_PATH_PREFIX}:code` });
+					const parsed = await request.json().then((body) => workflowInvocationRequestSchema.safeParse(body)).catch(() => void 0);
+					if (parsed === void 0 || !parsed.success) return jsonError(400, "malformed_request");
+					const code = decodeURIComponent(pathname.slice(23));
+					const workflows = server.workflows ?? {};
+					const definition = Object.hasOwn(workflows, code) ? workflows[code] : void 0;
+					return Response.json(definition === void 0 ? {
+						kind: "error",
+						message: `Unknown workflow "${code}".`
+					} : await runWorkflowInvocation(definition, parsed.data));
+				}
+				const result = await handler.handle(request, {
+					context: {},
+					prefix: "/api"
+				});
+				return result.matched ? result.response : new Response(null, { status: 404 });
+			});
+		} catch (error) {
+			publishNote(requestId, errorNote(error), APP_CONTEXT_CHANNEL);
+			throw error;
+		}
 	} };
 }
 //#endregion
-export { createWorkerEntry, journalEntrySchema, workflowInvocationRequestSchema, workflowOutcomeSchema };
+export { WorkflowFailedError, createEmailPixelInputSchema, createWorkerEntry, journalEntrySchema, listEmailTrackersInputSchema, markEmailTrackerSentBodySchema, runWorkflowJournal, workflowInvocationRequestSchema, workflowOutcomeSchema };

package/dist/applet.js

@@ -2,17 +2,22 @@
 import { parseArgs } from "node:util";
 //#region bin/applet.ts
 const usage = `Usage:
+  applet login [--no-browser]
   applet init <org> [--no-commit | --no-git] [--no-install]
   applet bootstrap [--no-install]
   applet new <code> [--client-only | --server-only] [--no-install]
-  applet generate [--changeset <id>]
-  applet build [--changeset <id>]
-  applet deploy [--changeset <id>]
+  applet generate
+  applet build
+  applet deploy
   applet logs [code] [--since <duration>] [--limit <count>]
                      [--search <text>] [--level <level>] [--filter <json>] [--run <id>] [--live]
   applet variables set <KEY> [value] [--secret] [-y | --yes]
   applet variables list
   applet variables delete <KEY> [-y | --yes]
+  applet schedules run <code> [-y | --yes]
+
+Login options:
+  --no-browser      Print the sign-in URL without opening a browser.
 
 Init options:
   --no-commit        Do not create the initial commit
@@ -27,14 +32,14 @@ New options:
 Bootstrap options:
   --no-install       Do not run pnpm install
 
-Generate options:
-  --changeset <id>    Generate against the schema this pending changeset
-                      would produce. The build honours HITCH_CHANGESET_ID.
+Schema changesets:
+  Set requiresChangeset in applet.manifest.ts to generate, build, and deploy
+  against a pending changeset. The release goes live when the changeset
+  applies in Hitch. After it applies, the field uses the live schema.
 
-Deploy options:
-  --changeset <id>    Deploy against a pending schema changeset. The build
-                      generates against its schema and the release promotes
-                      when the changeset applies. Manifest mismatches warn.
+Run applet deploy in the workspace root to deploy every applet. In GitHub
+Actions it skips an applet when neither its folder nor any file outside
+applets/ changed since its current CI release.
 
 Logs options:
   --since <duration>  Show logs from this period. Default: 1h. Maximum: 7d.
@@ -51,18 +56,25 @@ Variables options:
   --secret            Store the value as a secret.
   -y, --yes           Skip the live applet confirmation.
 
-CI: set HITCH_API_KEY (and HITCH_API_URL for a non-default instance).`;
+Schedules options:
+  -y, --yes           Skip the schedule confirmation.
+
+Login: applet login selects the organization from hitch.config.ts and shares
+credentials with hitch login.
+CI: set HITCH_API_KEY (and HITCH_API_URL for a non-default instance).
+GitHub Actions: generate, build, and deploy use the job's OIDC token instead of
+a key. Grant the job id-token: write.`;
 async function main() {
 	const { positionals, values } = parseArgs({
 		allowPositionals: true,
 		options: {
-			changeset: { type: "string" },
 			"client-only": { type: "boolean" },
 			filter: { type: "string" },
 			run: { type: "string" },
 			level: { type: "string" },
 			limit: { type: "string" },
 			live: { type: "boolean" },
+			"no-browser": { type: "boolean" },
 			"no-commit": { type: "boolean" },
 			"no-git": { type: "boolean" },
 			"no-install": { type: "boolean" },
@@ -77,36 +89,41 @@ async function main() {
 		},
 		strict: true
 	});
+	if (positionals.length === 1 && positionals[0] === "login" && Object.keys(values).every((key) => key === "no-browser")) {
+		await (await import("./login-CUx3TmFQ.js")).runLogin({ noBrowser: values["no-browser"] });
+		return;
+	}
+	if (values["no-browser"] !== void 0) throw new Error(usage);
 	const noGitFlags = values["no-commit"] === void 0 && values["no-git"] === void 0;
 	const noVariableFlags = values.secret === void 0 && values.yes === void 0;
 	const noLogFlags = values.run === void 0 && values.filter === void 0 && values.level === void 0 && values.limit === void 0 && values.live === void 0 && values.search === void 0 && values.since === void 0;
 	const noModeFlags = values["client-only"] === void 0 && values["server-only"] === void 0;
-	if (positionals.length === 1 && positionals[0] === "bootstrap" && values.changeset === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BS1Y-eNL.js")).runBootstrap({ install: values["no-install"] !== true });
+	if (positionals.length === 1 && positionals[0] === "bootstrap" && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
+		await (await import("./init-6oGPM46R.js")).runBootstrap({ install: values["no-install"] !== true });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "generate" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./generate-6Nbt7uii.js")).runGenerate({ changesetId: values.changeset });
+		await (await import("./generate-Dox-OYt6.js")).runGenerate();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "build" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./build-CEku1lyb.js")).runBuild({ changesetId: values.changeset });
+		await (await import("./build-Bh_S5BUv.js")).runBuild();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "deploy" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./deploy-D3BGDqgC.js")).runDeploy({ changesetId: values.changeset });
+		await (await import("./deploy-wGYjwXrx.js")).runDeploy({});
 		return;
 	}
-	if (positionals.length === 2 && positionals[0] === "init" && values.changeset === void 0 && noModeFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BS1Y-eNL.js")).runInit(positionals[1], {
+	if (positionals.length === 2 && positionals[0] === "init" && noModeFlags && noVariableFlags && noLogFlags) {
+		await (await import("./init-6oGPM46R.js")).runInit(positionals[1], {
 			commit: values["no-commit"] !== true,
 			git: values["no-git"] !== true,
 			install: values["no-install"] !== true
 		});
 		return;
 	}
-	if (positionals.length === 2 && positionals[0] === "new" && values.changeset === void 0 && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BS1Y-eNL.js")).runNew({
+	if (positionals.length === 2 && positionals[0] === "new" && noGitFlags && noVariableFlags && noLogFlags) {
+		await (await import("./init-6oGPM46R.js")).runNew({
 			code: positionals[1],
 			clientOnly: values["client-only"],
 			install: values["no-install"] !== true,
@@ -114,8 +131,8 @@ async function main() {
 		});
 		return;
 	}
-	if ((positionals.length === 1 || positionals.length === 2) && positionals[0] === "logs" && values.changeset === void 0 && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags) {
-		await (await import("./logs-m00pzr_O.js")).runLogs({
+	if ((positionals.length === 1 || positionals.length === 2) && positionals[0] === "logs" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags) {
+		await (await import("./logs-DSjuEN0Q.js")).runLogs({
 			code: positionals[1],
 			filter: values.filter,
 			run: values.run,
@@ -127,8 +144,15 @@ async function main() {
 		});
 		return;
 	}
-	if ((positionals.length === 3 || positionals.length === 4) && positionals[0] === "variables" && values.changeset === void 0 && positionals[1] === "set" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags) {
-		await (await import("./variables-CP7Ce3Np.js")).runVariablesSet({
+	if (positionals.length === 3 && positionals[0] === "schedules" && positionals[1] === "run" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags && values.secret === void 0) {
+		await (await import("./schedules-C8_Svr4h.js")).runSchedule({
+			code: positionals[2],
+			yes: values.yes
+		});
+		return;
+	}
+	if ((positionals.length === 3 || positionals.length === 4) && positionals[0] === "variables" && positionals[1] === "set" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags) {
+		await (await import("./variables-DT5RyHdH.js")).runVariablesSet({
 			key: positionals[2],
 			secret: values.secret,
 			value: positionals[3],
@@ -136,12 +160,12 @@ async function main() {
 		});
 		return;
 	}
-	if (positionals.length === 2 && positionals[0] === "variables" && values.changeset === void 0 && positionals[1] === "list" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./variables-CP7Ce3Np.js")).runVariablesList({});
+	if (positionals.length === 2 && positionals[0] === "variables" && positionals[1] === "list" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
+		await (await import("./variables-DT5RyHdH.js")).runVariablesList();
 		return;
 	}
-	if (positionals.length === 3 && positionals[0] === "variables" && values.changeset === void 0 && positionals[1] === "delete" && values["no-install"] === void 0 && noModeFlags && noGitFlags && values.secret === void 0 && noLogFlags) {
-		await (await import("./variables-CP7Ce3Np.js")).runVariablesDelete({
+	if (positionals.length === 3 && positionals[0] === "variables" && positionals[1] === "delete" && values["no-install"] === void 0 && noModeFlags && noGitFlags && values.secret === void 0 && noLogFlags) {
+		await (await import("./variables-DT5RyHdH.js")).runVariablesDelete({
 			key: positionals[2],
 			yes: values.yes
 		});