@hitch42/applet 0.1.1-beta.14 → 0.1.1-beta.16

package/dist/email-protocol-DqJ6YCiC.d.ts

@@ -1,230 +0,0 @@
-import { ContractProcedure, Meta } from "@orpc/contract";
-import { z } from "zod";
-//#region src/hitch/email.d.ts
-type EmailTags = Record<string, string>;
-type CreateEmailPixelInput = {
-  tags?: EmailTags;
-};
-type CreateEmailPixelOutput = {
-  id: string;
-  url: string;
-};
-type GetEmailTrackerInput = {
-  id: string;
-};
-type MarkEmailTrackerSentInput = {
-  id: string;
-  sentAt?: string;
-};
-type EmailTracker = {
-  id: string;
-  url: string;
-  tags: EmailTags;
-  createdAt: string;
-  sentAt: string | null;
-  firstHitAt: string | null;
-  lastHitAt: string | null;
-};
-type ListEmailTrackersInput = {
-  filter?: EmailTags;
-  sentAt?: {
-    $gte?: string;
-    $lt?: string;
-  };
-  cursor?: string;
-  limit?: number;
-};
-type ListEmailTrackersOutput = {
-  trackers: EmailTracker[];
-  nextCursor: string | null;
-};
-declare const emailTagKeySchema: z.ZodType<string, string>;
-declare const emailTagsSchema: z.ZodType<EmailTags, EmailTags>;
-declare const createEmailPixelInputSchema: z.ZodType<CreateEmailPixelInput, CreateEmailPixelInput>;
-declare const createEmailPixelOutputSchema: z.ZodType<CreateEmailPixelOutput, CreateEmailPixelOutput>;
-declare const getEmailTrackerInputSchema: z.ZodType<GetEmailTrackerInput, GetEmailTrackerInput>;
-declare const markEmailTrackerSentInputSchema: z.ZodType<MarkEmailTrackerSentInput, MarkEmailTrackerSentInput>;
-declare const markEmailTrackerSentBodySchema: z.ZodType<{
-  sentAt?: string;
-}, {
-  sentAt?: string;
-}>;
-declare const emailTrackerSchema: z.ZodType<EmailTracker, EmailTracker>;
-declare const listEmailTrackersInputSchema: z.ZodType<ListEmailTrackersInput, ListEmailTrackersInput>;
-declare const listEmailTrackersOutputSchema: z.ZodType<ListEmailTrackersOutput, ListEmailTrackersOutput>;
-type EmailContract = {
-  mailboxes: {
-    list: ContractProcedure<z.ZodType<void, void>, z.ZodType<HitchEmailMailboxesOutput, HitchEmailMailboxesOutput>, Record<never, never>, Meta>;
-  };
-  threads: {
-    list: ContractProcedure<z.ZodType<ListHitchEmailThreadsInput, ListHitchEmailThreadsInput>, z.ZodType<HitchEmailThreadsOutput, HitchEmailThreadsOutput>, Record<never, never>, Meta>;
-    get: ContractProcedure<z.ZodType<HitchEmailIdInput, HitchEmailIdInput>, z.ZodType<HitchEmailThread, HitchEmailThread>, Record<never, never>, Meta>;
-  };
-  messages: {
-    /** Newest first. Pass threadId to page through one thread. */
-    list: ContractProcedure<z.ZodType<ListHitchEmailMessagesInput, ListHitchEmailMessagesInput>, z.ZodType<HitchEmailMessagesOutput, HitchEmailMessagesOutput>, Record<never, never>, Meta>;
-    get: ContractProcedure<z.ZodType<HitchEmailIdInput, HitchEmailIdInput>, z.ZodType<HitchEmailMessage, HitchEmailMessage>, Record<never, never>, Meta>;
-    send: ContractProcedure<z.ZodType<SendHitchEmailInput, SendHitchEmailInput>, z.ZodType<HitchEmailMessage, HitchEmailMessage>, Record<never, never>, Meta>;
-    raw: ContractProcedure<z.ZodType<HitchEmailIdInput, HitchEmailIdInput>, z.ZodType<HitchEmailRawOutput, HitchEmailRawOutput>, Record<never, never>, Meta>;
-  };
-  attachments: {
-    get: ContractProcedure<z.ZodType<HitchEmailIdInput, HitchEmailIdInput>, z.ZodType<HitchEmailAttachmentOutput, HitchEmailAttachmentOutput>, Record<never, never>, Meta>;
-  };
-  tracking: {
-    createPixel: ContractProcedure<z.ZodType<CreateEmailPixelInput | undefined, CreateEmailPixelInput | undefined>, z.ZodType<CreateEmailPixelOutput, CreateEmailPixelOutput>, Record<never, never>, Meta>;
-    markSent: ContractProcedure<z.ZodType<MarkEmailTrackerSentInput, MarkEmailTrackerSentInput>, z.ZodType<EmailTracker, EmailTracker>, Record<never, never>, Meta>;
-    get: ContractProcedure<z.ZodType<GetEmailTrackerInput, GetEmailTrackerInput>, z.ZodType<EmailTracker, EmailTracker>, Record<never, never>, Meta>;
-    list: ContractProcedure<z.ZodType<ListEmailTrackersInput | undefined, ListEmailTrackersInput | undefined>, z.ZodType<ListEmailTrackersOutput, ListEmailTrackersOutput>, Record<never, never>, Meta>;
-  };
-};
-declare function emailContract(appletCode: string): EmailContract;
-type HitchEmailAddress = {
-  address: string;
-  name: string | null;
-};
-type HitchMailbox = {
-  id: string;
-  address: string;
-  label: string;
-  enabled: boolean;
-  receive: boolean;
-  canRead: boolean;
-  canSend: boolean;
-};
-type HitchEmailAttachment = {
-  id: string;
-  filename: string;
-  contentType: string;
-  sizeBytes: number;
-  contentId: string | null;
-  inline: boolean;
-};
-type HitchEmailMessage = {
-  id: string;
-  mailboxId: string;
-  threadId: string;
-  direction: "inbound" | "outbound";
-  status: "received" | "unknown" | "sent" | "failed";
-  messageId: string | null;
-  inReplyTo: string | null;
-  references: string[];
-  from: HitchEmailAddress;
-  to: HitchEmailAddress[];
-  cc: HitchEmailAddress[];
-  bcc: HitchEmailAddress[];
-  replyTo: HitchEmailAddress[];
-  subject: string;
-  text: string | null;
-  html: string | null;
-  sentAt: string | null;
-  automated: string | null;
-  authentication: {
-    spf: string | null;
-    dkim: string | null;
-    dmarc: string | null;
-  } | null;
-  parseError: string | null;
-  attachments: HitchEmailAttachment[];
-  userId: string | null;
-  appletId: string | null;
-  requestId: string | null;
-  errorDetail: string | null;
-  createdAt: string;
-};
-type HitchEmailThread = {
-  id: string;
-  mailboxId: string;
-  subject: string;
-  messageCount: number;
-  lastMessageAt: string;
-  createdAt: string;
-};
-type ListHitchEmailThreadsInput = {
-  mailboxId?: string;
-  cursor?: string;
-  limit?: number;
-};
-type ListHitchEmailMessagesInput = {
-  mailboxId?: string;
-  address?: string;
-  threadId?: string;
-  direction?: "inbound" | "outbound";
-  since?: string;
-  until?: string;
-  cursor?: string;
-  limit?: number;
-};
-type SendHitchEmailInput = {
-  mailboxId: string;
-  to?: string[];
-  cc?: string[];
-  bcc?: string[];
-  subject?: string;
-  text?: string;
-  html?: string;
-  replyToMessageId?: string;
-  attachmentFileIds?: string[];
-  requestId?: string;
-};
-type HitchEmailIdInput = {
-  id: string;
-};
-type HitchEmailMailboxesOutput = {
-  data: HitchMailbox[];
-};
-type HitchEmailThreadsOutput = {
-  data: HitchEmailThread[];
-  nextCursor: string | null;
-};
-type HitchEmailMessagesOutput = {
-  data: HitchEmailMessage[];
-  nextCursor: string | null;
-};
-type HitchEmailRawOutput = {
-  url: string;
-};
-type HitchEmailAttachmentOutput = {
-  url: string;
-  filename: string;
-  contentType: string;
-  sizeBytes: number;
-};
-declare const hitchEmailAddressSchema: z.ZodType<HitchEmailAddress, HitchEmailAddress>;
-declare const hitchMailboxSchema: z.ZodType<HitchMailbox, HitchMailbox>;
-declare const hitchEmailAttachmentSchema: z.ZodType<HitchEmailAttachment, HitchEmailAttachment>;
-declare const hitchEmailMessageSchema: z.ZodType<HitchEmailMessage, HitchEmailMessage>;
-declare const hitchEmailThreadSchema: z.ZodType<HitchEmailThread, HitchEmailThread>;
-declare const listHitchEmailMailboxesOutputSchema: z.ZodType<HitchEmailMailboxesOutput, HitchEmailMailboxesOutput>;
-declare const listHitchEmailThreadsOutputSchema: z.ZodType<HitchEmailThreadsOutput, HitchEmailThreadsOutput>;
-declare const listHitchEmailMessagesOutputSchema: z.ZodType<HitchEmailMessagesOutput, HitchEmailMessagesOutput>;
-declare const getHitchEmailRawOutputSchema: z.ZodType<HitchEmailRawOutput, HitchEmailRawOutput>;
-declare const getHitchEmailAttachmentOutputSchema: z.ZodType<HitchEmailAttachmentOutput, HitchEmailAttachmentOutput>;
-declare const hitchEmailIdInputSchema: z.ZodType<HitchEmailIdInput, HitchEmailIdInput>;
-declare const listHitchEmailThreadsInputSchema: z.ZodType<ListHitchEmailThreadsInput, ListHitchEmailThreadsInput>;
-declare const listHitchEmailMessagesInputSchema: z.ZodType<ListHitchEmailMessagesInput, ListHitchEmailMessagesInput>;
-declare const sendHitchEmailInputSchema: z.ZodType<SendHitchEmailInput, SendHitchEmailInput>;
-//#endregion
-//#region src/server/telephony-protocol.d.ts
-/** Handle events at least once and without order. Use eventId for idempotency.
- * Read the message with hitch.telephony.messages.get({ id: messageId }). */
-type TelephonyMessageReceivedEvent = {
-  eventId: string;
-  type: "message.received";
-  messageId: string;
-  numberId: string;
-  occurredAt: string;
-};
-//#endregion
-//#region src/server/email-protocol.d.ts
-/** Handle events at least once and without order. Use eventId for idempotency.
- * Read the message with hitch.email.messages.get({ id: messageId }). */
-type EmailMessageReceivedEvent = {
-  eventId: string;
-  type: "message.received";
-  messageId: string;
-  mailboxId: string;
-  threadId: string;
-  occurredAt: string;
-};
-//#endregion
-export { listEmailTrackersOutputSchema as A, hitchEmailAddressSchema as C, hitchEmailThreadSchema as D, hitchEmailMessageSchema as E, listHitchEmailThreadsOutputSchema as F, markEmailTrackerSentBodySchema as I, markEmailTrackerSentInputSchema as L, listHitchEmailMessagesInputSchema as M, listHitchEmailMessagesOutputSchema as N, hitchMailboxSchema as O, listHitchEmailThreadsInputSchema as P, sendHitchEmailInputSchema as R, getHitchEmailRawOutputSchema as S, hitchEmailIdInputSchema as T, emailTagKeySchema as _, HitchEmailAddress as a, getEmailTrackerInputSchema as b, HitchEmailThread as c, ListHitchEmailMessagesInput as d, ListHitchEmailThreadsInput as f, emailContract as g, createEmailPixelOutputSchema as h, EmailTracker as i, listHitchEmailMailboxesOutputSchema as j, listEmailTrackersInputSchema as k, HitchMailbox as l, createEmailPixelInputSchema as m, TelephonyMessageReceivedEvent as n, HitchEmailAttachment as o, SendHitchEmailInput as p, EmailContract as r, HitchEmailMessage as s, EmailMessageReceivedEvent as t, ListEmailTrackersOutput as u, emailTagsSchema as v, hitchEmailAttachmentSchema as w, getHitchEmailAttachmentOutputSchema as x, emailTrackerSchema as y };

package/dist/generate-CtbF9Zxd.js

@@ -1,2 +0,0 @@
-import { n as runGenerate } from "./generate-CORu1X2X.js";
-export { runGenerate };

package/dist/load-config-BeQZ2yOa.js

@@ -1,27 +0,0 @@
-import { r as appletSourceDefinitionSchema } from "./manifest-CuY3ICpN.js";
-import { t as resolveWorkspaceOrg } from "./workspace-D0dnnlxL.js";
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-import { loadConfigFromFile } from "vite";
-//#region src/typegen/load-config.ts
-async function loadAppletSourceDefinition(root) {
-	const path = resolve(root, "applet.manifest.ts");
-	if (!existsSync(path)) throw new Error(`No applet manifest found at ${path}.`);
-	const loaded = await loadConfigFromFile({
-		command: "build",
-		mode: "production"
-	}, path, root);
-	if (loaded === null) throw new Error(`No applet manifest found at ${path}.`);
-	const parsed = appletSourceDefinitionSchema.safeParse(loaded.config);
-	if (!parsed.success) throw new Error(`Invalid applet manifest at ${loaded.path}: ${parsed.error.message}`);
-	return parsed.data;
-}
-async function loadAppletConfig(root) {
-	const { dependencies: _dependencies, devDependencies: _devDependencies, ...definition } = await loadAppletSourceDefinition(root);
-	return {
-		org: resolveWorkspaceOrg(root),
-		...definition
-	};
-}
-//#endregion
-export { loadAppletSourceDefinition as n, loadAppletConfig as t };

package/dist/me-BW7Paary.js

@@ -1,32 +0,0 @@
-import { oc } from "@orpc/contract";
-import { z } from "zod";
-//#region src/hitch/me.ts
-const personSchema = z.object({
-	id: z.uuid(),
-	firstName: z.string(),
-	lastName: z.string(),
-	email: z.email()
-});
-const membershipSchema = z.object({
-	orgId: z.uuid(),
-	code: z.string(),
-	name: z.string(),
-	iconFileId: z.uuid().nullable(),
-	role: z.enum(["member", "owner"]),
-	capabilities: z.array(z.string())
-});
-const meSchema = z.object({
-	person: personSchema,
-	memberships: z.array(membershipSchema),
-	organization: z.object({
-		id: z.uuid(),
-		code: z.string()
-	}).nullable(),
-	multiOrg: z.boolean()
-});
-const meContract = { get: oc.route({
-	method: "GET",
-	path: "/v1/me"
-}).input(z.void()).output(meSchema) };
-//#endregion
-export { meSchema as n, meContract as t };

package/dist/workspace-D0dnnlxL.js

@@ -1,385 +0,0 @@
-import { createRequire } from "node:module";
-import { existsSync } from "node:fs";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { basename, dirname, join, resolve } from "node:path";
-import { spawn } from "node:child_process";
-import { homedir } from "node:os";
-//#region ../shared/auth/src/store.mts
-const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
-var AuthenticationError = class extends Error {};
-function isErrno(error, code) {
-	return error instanceof Error && "code" in error && error.code === code;
-}
-async function readJson(path) {
-	try {
-		return JSON.parse(await readFile(path, "utf8"));
-	} catch (error) {
-		if (isErrno(error, "ENOENT")) return void 0;
-		throw new Error(`Failed to read ${path}.`, { cause: error });
-	}
-}
-function isObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function emptyCredentialStore() {
-	return { instances: {} };
-}
-async function healCredentialStore(credentialsPath, source, store, unrecognizedCount) {
-	const backupPath = `${credentialsPath}.bak`;
-	try {
-		try {
-			await writeFile(backupPath, source, {
-				flag: "wx",
-				mode: 384
-			});
-		} catch (error) {
-			if (!isErrno(error, "EEXIST")) throw error;
-		}
-		await chmod(backupPath, 384);
-		await writeFile(credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
-		await chmod(credentialsPath, 384);
-	} catch {
-		console.error(unrecognizedCount === void 0 ? `hitch: failed to heal credential store at ${credentialsPath}; using an empty in-memory store.` : `hitch: failed to heal credential store at ${credentialsPath}; using recognized credentials in memory only.`);
-		return store;
-	}
-	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
-	return store;
-}
-async function readRawCredentialStore() {
-	const { credentialsPath } = storePaths();
-	let source;
-	try {
-		source = await readFile(credentialsPath, "utf8");
-	} catch (error) {
-		if (isErrno(error, "ENOENT")) return emptyCredentialStore();
-		throw new Error(`Failed to read ${credentialsPath}.`, { cause: error });
-	}
-	let value;
-	try {
-		value = JSON.parse(source);
-	} catch {
-		return healCredentialStore(credentialsPath, source, emptyCredentialStore());
-	}
-	if (!isObject(value) || !isObject(value.instances)) return healCredentialStore(credentialsPath, source, emptyCredentialStore());
-	const instances = Object.fromEntries(Object.entries(value.instances).flatMap(([instanceUrl, entry]) => {
-		if (isObject(entry) && typeof entry.organizationId === "string") {
-			const credentials = parseCredentials(entry);
-			return credentials === void 0 ? [] : [[instanceUrl, { [credentials.orgCode]: entry }]];
-		}
-		if (!isObject(entry)) return [];
-		return [[instanceUrl, Object.fromEntries(Object.entries(entry).filter(([orgCode, credentials]) => parseCredentials(credentials)?.orgCode === orgCode))]];
-	}));
-	const reshaped = Object.values(value.instances).some((entry) => !isObject(entry) || typeof entry.organizationId === "string");
-	const countLeaves = (store) => Object.values(store).reduce((total, entry) => total + (isObject(entry) && typeof entry.organizationId !== "string" ? Object.keys(entry).length : 1), 0);
-	const unrecognizedCount = countLeaves(value.instances) - countLeaves(instances);
-	if (!reshaped && unrecognizedCount === 0) return value;
-	return healCredentialStore(credentialsPath, source, { instances }, unrecognizedCount);
-}
-function parseCredentials(value) {
-	if (!isObject(value) || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return;
-	const organization = {
-		organizationId: value.organizationId,
-		orgCode: value.orgCode
-	};
-	if ((value.type === void 0 || value.type === "session") && typeof value.accessToken === "string" && (value.expiresAt === void 0 || typeof value.expiresAt === "number")) return {
-		type: "session",
-		accessToken: value.accessToken,
-		...value.expiresAt === void 0 ? {} : { expiresAt: value.expiresAt },
-		...organization
-	};
-	if (value.type === "apiKey" && typeof value.apiKey === "string") return {
-		type: "apiKey",
-		apiKey: value.apiKey,
-		...organization
-	};
-}
-function normalizeInstanceUrl(instanceUrl) {
-	let url;
-	try {
-		url = new URL(instanceUrl);
-	} catch (error) {
-		throw new Error(`Invalid Hitch instance URL: ${instanceUrl}`, { cause: error });
-	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Invalid Hitch instance URL protocol: ${url.protocol}`);
-	url.pathname = url.pathname.replace(/\/+$/, "");
-	url.search = "";
-	url.hash = "";
-	return url.toString().replace(/\/$/, "");
-}
-function organizationInstanceUrl(instanceUrl, orgCode) {
-	const url = new URL(normalizeInstanceUrl(instanceUrl));
-	const labels = url.hostname.split(".");
-	if (labels[0] !== "app" || labels.length < 2) return url.toString().replace(/\/$/, "");
-	url.hostname = [orgCode, ...labels.slice(1)].join(".");
-	return url.toString().replace(/\/$/, "");
-}
-function storePaths() {
-	const env = process.env;
-	const home = homedir();
-	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
-	return {
-		configDir,
-		cacheDir: join(env.XDG_CACHE_HOME || join(home, ".cache"), "hitch"),
-		configPath: join(configDir, "config.json"),
-		credentialsPath: join(configDir, "credentials.json")
-	};
-}
-async function resolveInstanceUrl(override) {
-	if (override !== void 0) return normalizeInstanceUrl(override);
-	const envInstanceUrl = process.env.HITCH_API_URL;
-	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
-	const { configPath } = storePaths();
-	const config = await readJson(configPath);
-	if (config === void 0) return DEFAULT_INSTANCE_URL;
-	if (!isObject(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
-	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
-}
-async function readCredentialStore() {
-	const store = await readRawCredentialStore();
-	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
-		const credentials = parseCredentials(value);
-		return credentials === void 0 ? [] : [[orgCode, credentials]];
-	}))])) };
-}
-async function getCredentialsForOrg(instanceUrl, orgCode) {
-	return (await readCredentialStore()).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
-}
-function environmentAuth() {
-	const apiKey = process.env.HITCH_API_KEY;
-	return apiKey !== void 0 && apiKey.length > 0 ? {
-		accessToken: apiKey,
-		source: "environment"
-	} : void 0;
-}
-function resolvedStoredAuth(credentials) {
-	return credentials === void 0 ? void 0 : {
-		accessToken: credentials.type === "apiKey" ? credentials.apiKey : credentials.accessToken,
-		credentialType: credentials.type,
-		organizationId: credentials.organizationId,
-		orgCode: credentials.orgCode,
-		source: "store"
-	};
-}
-function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
-	const exact = resolvedStoredAuth(credentialsByOrg[orgCode]);
-	if (exact !== void 0) return exact;
-	const sessions = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "session").filter((credentials, index, all) => all.findIndex(({ accessToken }) => accessToken === credentials.accessToken) === index);
-	if (sessions.length === 1) return resolvedStoredAuth(sessions[0]);
-	if (sessions.length > 1) throw new AuthenticationError(`Multiple sessions are stored. Run hitch login for organization "${orgCode}".`);
-	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
-	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
-}
-async function resolveAuthForOrg(instanceUrl, orgCode) {
-	const auth = environmentAuth();
-	if (auth !== void 0) return auth;
-	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
-	const credentialsByOrg = Object.entries((await readCredentialStore()).instances).find(([instance]) => instance === normalizedUrl)?.[1];
-	return resolveStoredAuthForOrg(credentialsByOrg ?? {}, orgCode);
-}
-function rejectEnvironmentKey(response, auth) {
-	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
-}
-function bearerToken(credentials) {
-	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
-}
-async function setCredentials(instanceUrl, credentials) {
-	const paths = storePaths();
-	const store = await readRawCredentialStore();
-	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
-	const credentialsByOrg = store.instances[normalizedUrl];
-	store.instances[normalizedUrl] = {
-		...isObject(credentialsByOrg) ? credentialsByOrg : {},
-		[credentials.orgCode]: credentials
-	};
-	await mkdir(paths.configDir, { recursive: true });
-	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
-	await chmod(paths.credentialsPath, 384);
-}
-//#endregion
-//#region ../shared/auth/src/device.mts
-const CLIENT_ID = "hitch-cli";
-const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-function defaultOpenUrl(url) {
-	try {
-		const child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
-			detached: true,
-			stdio: "ignore"
-		});
-		child.on("error", () => void 0);
-		child.unref();
-	} catch {}
-}
-function requiredObject(value, message) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(message);
-	return value;
-}
-async function jsonResponse(response) {
-	try {
-		return requiredObject(await response.json(), "Expected a JSON object response.");
-	} catch (error) {
-		throw new Error(`Invalid JSON response from ${response.url || "Hitch"}.`, { cause: error });
-	}
-}
-async function postJson(fetcher, url, body) {
-	const response = await fetcher(url, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(body)
-	});
-	return {
-		body: await jsonResponse(response),
-		response
-	};
-}
-function parseDeviceCode(value) {
-	if (typeof value.device_code !== "string" || typeof value.user_code !== "string" || typeof value.verification_uri !== "string" || typeof value.verification_uri_complete !== "string" || typeof value.expires_in !== "number" || value.interval !== void 0 && typeof value.interval !== "number") throw new AuthenticationError("Hitch returned an invalid device authorization response.");
-	return value;
-}
-function parseToken(value) {
-	return typeof value.access_token === "string" && typeof value.token_type === "string" ? value : void 0;
-}
-function parseDeviceOrganization(value) {
-	if (typeof value.organizationId !== "string" || typeof value.orgCode !== "string") throw new AuthenticationError("Hitch returned an invalid device organization response.");
-	return value;
-}
-function parseMe(value) {
-	const person = requiredObject(value.person, "Hitch returned an invalid identity response.");
-	if (typeof person.id !== "string" || typeof person.firstName !== "string" || typeof person.lastName !== "string" || typeof person.email !== "string" || !Array.isArray(value.memberships)) throw new Error("Hitch returned an invalid identity response.");
-	const organization = value.organization === void 0 || value.organization === null ? null : requiredObject(value.organization, "Hitch returned an invalid identity response.");
-	if (organization !== null && (typeof organization.id !== "string" || typeof organization.code !== "string")) throw new Error("Hitch returned an invalid identity response.");
-	return {
-		memberships: value.memberships.map((membership) => {
-			const item = requiredObject(membership, "Hitch returned an invalid membership.");
-			if (typeof item.orgId !== "string" || typeof item.code !== "string" || typeof item.name !== "string") throw new Error("Hitch returned an invalid membership.");
-			return item;
-		}),
-		organization,
-		person
-	};
-}
-async function fetchMe(fetcher, instanceUrl, auth) {
-	const response = await fetcher(`${instanceUrl}/api/v1/me`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
-	rejectEnvironmentKey(response, auth);
-	if (auth.credentialType === "apiKey" && response.status === 401) throw new AuthenticationError("API key rejected.");
-	const body = await jsonResponse(response);
-	if (!response.ok) throw new AuthenticationError(typeof body.message === "string" ? body.message : `Failed to load the signed-in identity (${response.status}).`);
-	return parseMe(body);
-}
-async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
-	const deadline = now() + device.expires_in * 1e3;
-	let interval = (device.interval ?? 5) * 1e3;
-	while (now() < deadline) {
-		await sleep(Math.min(interval, deadline - now()));
-		if (now() >= deadline) break;
-		const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/token`, {
-			grant_type: DEVICE_GRANT,
-			device_code: device.device_code,
-			client_id: CLIENT_ID
-		});
-		const token = parseToken(body);
-		if (response.ok && token !== void 0) return token;
-		switch (body.error) {
-			case "authorization_pending": break;
-			case "slow_down":
-				interval += 5e3;
-				break;
-			case "expired_token": throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
-			case "access_denied": throw new AuthenticationError("Sign-in was denied.");
-			default: throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Sign-in failed (${response.status}).`);
-		}
-	}
-	throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
-}
-async function loginWithDevice(instanceUrl, options = {}) {
-	const fetcher = globalThis.fetch;
-	const now = Date.now;
-	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
-	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
-	const device = parseDeviceCode(body);
-	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
-	console.log(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
-	if (!options.noBrowser) try {
-		defaultOpenUrl(verificationUrl);
-	} catch {}
-	const token = await pollForToken(fetcher, instanceUrl, device, now, (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
-	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
-	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
-	const organization = parseDeviceOrganization(organizationBody);
-	const me = await fetchMe(fetcher, instanceUrl, {
-		accessToken: token.access_token,
-		credentialType: "session",
-		source: "store"
-	});
-	const membership = me.memberships.find(({ orgId }) => orgId === organization.organizationId);
-	if (membership === void 0) throw new AuthenticationError("The device session is not scoped to a Hitch organization.");
-	const credentials = {
-		type: "session",
-		accessToken: token.access_token,
-		expiresAt: token.expires_in === void 0 ? void 0 : now() + token.expires_in * 1e3,
-		organizationId: organization.organizationId,
-		orgCode: organization.orgCode
-	};
-	await setCredentials(instanceUrl, credentials);
-	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
-	return {
-		credentials,
-		me,
-		membership
-	};
-}
-//#endregion
-//#region ../shared/auth/src/workspace.mts
-const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-const require = createRequire(import.meta.url);
-function readWorkspaceConfig(dir) {
-	const path = resolve(dir, "hitch.config.ts");
-	if (!existsSync(path)) return void 0;
-	let module;
-	try {
-		module = require(path);
-	} catch (error) {
-		throw new Error(`Failed to load ${path}.`, { cause: error });
-	}
-	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
-	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new Error(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
-	const githubWorkflow = "githubWorkflow" in config ? config.githubWorkflow : void 0;
-	if (githubWorkflow !== void 0 && typeof githubWorkflow !== "boolean") throw new Error(`Invalid Hitch config in ${path}: "githubWorkflow" must be a boolean.`);
-	return {
-		sdk: config.sdk,
-		org: config.org,
-		githubWorkflow
-	};
-}
-function findWorkspaceConfig(cwd) {
-	const appletsDir = dirname(cwd);
-	return readWorkspaceConfig(cwd) ?? (basename(appletsDir) === "applets" ? readWorkspaceConfig(dirname(appletsDir)) : void 0);
-}
-//#endregion
-//#region src/auth.ts
-async function fetchWithOrgAuth(orgCode, request) {
-	const instanceUrl = await resolveInstanceUrl();
-	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
-	const auth = await resolveAuthForOrg(instanceUrl, orgCode);
-	if (auth !== void 0) {
-		const response = await request(organizationUrl, bearerToken(auth));
-		rejectEnvironmentKey(response, auth);
-		if (response.status !== 401) return response;
-	}
-	if (process.stdin.isTTY !== true) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
-	await loginWithDevice(instanceUrl, { expectedOrg: orgCode });
-	const credentials = await getCredentialsForOrg(instanceUrl, orgCode);
-	if (credentials === void 0) throw new Error(`login did not provide credentials for organization "${orgCode}"`);
-	return request(organizationUrl, bearerToken(credentials));
-}
-//#endregion
-//#region src/workspace.ts
-function resolveWorkspaceOrg(appletRoot) {
-	const appletsDir = dirname(appletRoot);
-	if (basename(appletsDir) === "applets") {
-		const config = readWorkspaceConfig(dirname(appletsDir));
-		if (config !== void 0) return config.org;
-	}
-	throw new Error(`No Hitch workspace found for ${appletRoot}. An applet must live at <workspace>/applets/<code> with hitch.config.ts in the workspace root.`);
-}
-//#endregion
-export { loginWithDevice as a, bearerToken as c, resolveAuthForOrg as d, resolveInstanceUrl as f, readWorkspaceConfig as i, organizationInstanceUrl as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, DEFAULT_INSTANCE_URL as s, resolveWorkspaceOrg as t, rejectEnvironmentKey as u };