@hitch42/applet 0.1.1-beta.15 → 0.1.1-beta.17

package/dist/_internal/log-context.d.ts

@@ -19,8 +19,6 @@ declare function cloudflareRequestFields(request: Request): {
   cfRay: string | undefined;
   traceparent: string | undefined;
   colo: string | undefined;
-  country: string | undefined;
-  asn: number | undefined;
 };
 type NoteLog = {
   set(fields: Record<string, unknown>): void;

package/dist/_internal/log-context.js

@@ -1,2 +1,2 @@
-import { a as errorNote, c as requestIdFrom, i as createNoteLog, n as REQUEST_CONTEXT_CHANNEL, o as isUuid, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-zu8U9Sjm.js";
+import { a as errorNote, c as requestIdFrom, i as createNoteLog, n as REQUEST_CONTEXT_CHANNEL, o as isUuid, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-DWznGjfz.js";
 export { APP_CONTEXT_CHANNEL, REQUEST_CONTEXT_CHANNEL, cloudflareRequestFields, createNoteLog, errorNote, isUuid, publishNote, requestIdFrom };

package/dist/_internal/server.d.ts

@@ -1,5 +1,5 @@
 import { t as AnyWorkflowDefinition } from "../workflow-DurM6Fwx.js";
-import { I as markEmailTrackerSentBodySchema, k as listEmailTrackersInputSchema, m as createEmailPixelInputSchema, n as TelephonyMessageReceivedEvent, t as EmailMessageReceivedEvent } from "../email-protocol-DqJ6YCiC.js";
+import { d as ListEmailTrackersInput, n as TelephonyMessageReceivedEvent, r as CreateEmailPixelInput, t as EmailMessageReceivedEvent } from "../email-protocol-B9u_dh2p.js";
 import { z } from "zod";
 //#region src/server/entry.d.ts
 declare function createWorkerEntry(server: {
@@ -92,4 +92,13 @@ type Engine = {
 declare class WorkflowFailedError extends Error {}
 declare function runWorkflowJournal(engine: Engine, invoke: (journal: JournalEntry[]) => Promise<WorkflowOutcome>): Promise<unknown>;
 //#endregion
+//#region src/hitch/email-schemas.d.ts
+declare const createEmailPixelInputSchema: z.ZodType<CreateEmailPixelInput, CreateEmailPixelInput>;
+declare const markEmailTrackerSentBodySchema: z.ZodType<{
+  sentAt?: string;
+}, {
+  sentAt?: string;
+}>;
+declare const listEmailTrackersInputSchema: z.ZodType<ListEmailTrackersInput, ListEmailTrackersInput>;
+//#endregion
 export { type Engine, type JournalEntry, WorkflowFailedError, type WorkflowInvocationRequest, type WorkflowOutcome, createEmailPixelInputSchema, createWorkerEntry, journalEntrySchema, listEmailTrackersInputSchema, markEmailTrackerSentBodySchema, runWorkflowJournal, workflowInvocationRequestSchema, workflowOutcomeSchema };

package/dist/_internal/server.js

@@ -1,10 +1,9 @@
-import { C as markEmailTrackerSentBodySchema, g as listEmailTrackersInputSchema, t as createEmailPixelInputSchema } from "../email-WA4jnzZ0.js";
 import { a as HITCH_ORG_CODE_HEADER, c as HITCH_SCHEDULE_HEADER, d as HITCH_USER_HEADER, f as HITCH_WORKFLOW_HEADER, i as HITCH_ORGANIZATION_HEADER, l as HITCH_SCHEDULE_RUN_HEADER, m as HITCH_WORKFLOW_RUN_HEADER, n as HITCH_APPLET_HEADER, o as HITCH_RELEASE_HEADER, p as HITCH_WORKFLOW_INVOCATION_HEADER, r as HITCH_APPLET_TOKEN_HEADER, u as HITCH_SESSION_HEADER } from "../headers-DkNr9MLJ.js";
 import { a as getRequestContext, o as runWithRequestContext, r as toMilliseconds, t as MAX_DURATION_MS } from "../workflow-CTo2kZF1.js";
-import { a as errorNote, c as requestIdFrom, i as createNoteLog, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-zu8U9Sjm.js";
+import { a as errorNote, c as requestIdFrom, i as createNoteLog, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-DWznGjfz.js";
 import { a as workflowOutcomeSchema, i as workflowInvocationRequestSchema, n as runWorkflowJournal, r as journalEntrySchema, t as WorkflowFailedError } from "../workflow-engine-BOTzURKM.js";
-import { z } from "zod";
 import { RPCHandler } from "@orpc/server/fetch";
+import { z } from "zod";
 //#region src/server/telephony-protocol.ts
 const telephonyMessageReceivedEventSchema = z.object({
 	eventId: z.string(),
@@ -258,4 +257,19 @@ function createWorkerEntry(server, options) {
 	} };
 }
 //#endregion
+//#region src/hitch/email-schemas.ts
+const emailTagKeySchema = z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/);
+const emailTagsSchema = z.record(emailTagKeySchema, z.string().min(1).max(200)).refine((tags) => Object.keys(tags).length <= 10);
+const createEmailPixelInputSchema = z.object({ tags: emailTagsSchema.optional() }).strict();
+const markEmailTrackerSentBodySchema = z.object({ sentAt: z.iso.datetime({ offset: true }).optional() }).strict();
+const listEmailTrackersInputSchema = z.object({
+	filter: emailTagsSchema.optional(),
+	sentAt: z.object({
+		$gte: z.iso.datetime({ offset: true }).optional(),
+		$lt: z.iso.datetime({ offset: true }).optional()
+	}).strict().optional(),
+	cursor: z.uuid().optional(),
+	limit: z.number().int().min(1).max(200).optional()
+}).strict();
+//#endregion
 export { WorkflowFailedError, createEmailPixelInputSchema, createWorkerEntry, journalEntrySchema, listEmailTrackersInputSchema, markEmailTrackerSentBodySchema, runWorkflowJournal, workflowInvocationRequestSchema, workflowOutcomeSchema };

package/dist/applet.js

@@ -90,7 +90,7 @@ async function main() {
 		strict: true
 	});
 	if (positionals.length === 1 && positionals[0] === "login" && Object.keys(values).every((key) => key === "no-browser")) {
-		await (await import("./login-CUx3TmFQ.js")).runLogin({ noBrowser: values["no-browser"] });
+		await (await import("./login-CceGvlMi.js")).runLogin({ noBrowser: values["no-browser"] });
 		return;
 	}
 	if (values["no-browser"] !== void 0) throw new Error(usage);
@@ -99,23 +99,23 @@ async function main() {
 	const noLogFlags = values.run === void 0 && values.filter === void 0 && values.level === void 0 && values.limit === void 0 && values.live === void 0 && values.search === void 0 && values.since === void 0;
 	const noModeFlags = values["client-only"] === void 0 && values["server-only"] === void 0;
 	if (positionals.length === 1 && positionals[0] === "bootstrap" && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-Dw7GEI5v.js")).runBootstrap({ install: values["no-install"] !== true });
+		await (await import("./init-BGQ_bP44.js")).runBootstrap({ install: values["no-install"] !== true });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "generate" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./generate-WYS-jtPH.js")).runGenerate();
+		await (await import("./generate-C9bWqdaB.js")).runGenerate();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "build" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./build-D7FDW8iC.js")).runBuild();
+		await (await import("./build-ueR7XjZT.js")).runBuild();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "deploy" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./deploy-D5SBBd-j.js")).runDeploy({});
+		await (await import("./deploy-Da93able.js")).runDeploy({});
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "init" && noModeFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-Dw7GEI5v.js")).runInit(positionals[1], {
+		await (await import("./init-BGQ_bP44.js")).runInit(positionals[1], {
 			commit: values["no-commit"] !== true,
 			git: values["no-git"] !== true,
 			install: values["no-install"] !== true
@@ -123,7 +123,7 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "new" && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-Dw7GEI5v.js")).runNew({
+		await (await import("./init-BGQ_bP44.js")).runNew({
 			code: positionals[1],
 			clientOnly: values["client-only"],
 			install: values["no-install"] !== true,
@@ -132,7 +132,7 @@ async function main() {
 		return;
 	}
 	if ((positionals.length === 1 || positionals.length === 2) && positionals[0] === "logs" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags) {
-		await (await import("./logs-BySh9fnH.js")).runLogs({
+		await (await import("./logs-DOkT5ots.js")).runLogs({
 			code: positionals[1],
 			filter: values.filter,
 			run: values.run,
@@ -145,14 +145,14 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 3 && positionals[0] === "schedules" && positionals[1] === "run" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags && values.secret === void 0) {
-		await (await import("./schedules-B_p9U-vM.js")).runSchedule({
+		await (await import("./schedules-D6-3v-Az.js")).runSchedule({
 			code: positionals[2],
 			yes: values.yes
 		});
 		return;
 	}
 	if ((positionals.length === 3 || positionals.length === 4) && positionals[0] === "variables" && positionals[1] === "set" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags) {
-		await (await import("./variables-D9nEFyOK.js")).runVariablesSet({
+		await (await import("./variables-BSFZnLxY.js")).runVariablesSet({
 			key: positionals[2],
 			secret: values.secret,
 			value: positionals[3],
@@ -161,11 +161,11 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "variables" && positionals[1] === "list" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./variables-D9nEFyOK.js")).runVariablesList();
+		await (await import("./variables-BSFZnLxY.js")).runVariablesList();
 		return;
 	}
 	if (positionals.length === 3 && positionals[0] === "variables" && positionals[1] === "delete" && values["no-install"] === void 0 && noModeFlags && noGitFlags && values.secret === void 0 && noLogFlags) {
-		await (await import("./variables-D9nEFyOK.js")).runVariablesDelete({
+		await (await import("./variables-BSFZnLxY.js")).runVariablesDelete({
 			key: positionals[2],
 			yes: values.yes
 		});

package/dist/auth-D3CrCtZq.js

@@ -0,0 +1,21 @@
+import { a as organizationInstanceUrl, c as resolveInstanceUrl, i as getCredentialsForOrg, o as rejectEnvironmentKey, r as bearerToken, s as resolveAuthForOrg, t as AuthenticationError } from "./store-B8N_8JIN.js";
+import { t as loginWithDevice } from "./device-BgIfytaR.js";
+import "./workspace-8yqXsvce.js";
+//#region src/auth.ts
+async function fetchWithOrgAuth(orgCode, request) {
+	const instanceUrl = await resolveInstanceUrl();
+	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
+	const auth = await resolveAuthForOrg(instanceUrl, orgCode);
+	if (auth !== void 0) {
+		const response = await request(organizationUrl, bearerToken(auth));
+		rejectEnvironmentKey(response, auth);
+		if (response.status !== 401) return response;
+	}
+	if (process.stdin.isTTY !== true) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
+	await loginWithDevice(instanceUrl, { expectedOrg: orgCode });
+	const credentials = await getCredentialsForOrg(instanceUrl, orgCode);
+	if (credentials === void 0) throw new Error(`login did not provide credentials for organization "${orgCode}"`);
+	return request(organizationUrl, bearerToken(credentials));
+}
+//#endregion
+export { fetchWithOrgAuth as t };

package/dist/{build-BkhBHdMs.js → build-XHoa_sJL.js}

@@ -1,4 +1,4 @@
-import { i as prepareAppletProjects, r as prepareAppletProject } from "./project-NcWw8SwL.js";
+import { i as prepareAppletProjects, r as prepareAppletProject } from "./project-CCVqCCgU.js";
 import { rm } from "node:fs/promises";
 import { resolve } from "node:path";
 import { spawn } from "node:child_process";

package/dist/build-ueR7XjZT.js

@@ -0,0 +1,2 @@
+import { i as runBuild } from "./build-XHoa_sJL.js";
+export { runBuild };

package/dist/{ci-BKw14X2h.js → ci-B5-mH-YW.js}

@@ -1,4 +1,4 @@
-import { f as resolveInstanceUrl } from "./workspace-D0dnnlxL.js";
+import { c as resolveInstanceUrl } from "./store-B8N_8JIN.js";
 //#region src/ci.ts
 function githubActionsContext() {
 	const env = process.env;

package/dist/client.d.ts

@@ -1,7 +1,7 @@
-import { f as RegisteredContract, m as RegisteredRouter, p as RegisteredManifest } from "./manifest-ARAy2HP7.js";
-import { t as NarrowContract } from "./contract-CZdT22tB.js";
+import { d as RegisteredRouter, l as RegisteredContract, u as RegisteredManifest } from "./manifest-BSUtHbu-.js";
+import { t as NarrowContract } from "./contract-D9wEvxGI.js";
 import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
-import { o as WithFilesUpload } from "./upload-DKZzz5kW.js";
+import { o as WithFilesUpload } from "./upload-D_kkmne_.js";
 import { RouterClient } from "@orpc/server";
 import { ContractRouterClient } from "@orpc/contract";
 import { NestedClient } from "@orpc/client";

package/dist/contract-BbOj5EB7.js

@@ -0,0 +1,23 @@
+//#region src/hitch/contract.ts
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function pruneContract(contract, manifest) {
+	if (!isObject(contract) || !isObject(contract.records)) throw new Error("Hitch contract must contain a \"records\" router.");
+	const contractRecords = contract.records;
+	const records = Object.fromEntries(manifest.objects.map((manifestObject) => {
+		const procedures = contractRecords[manifestObject.code];
+		if (!isObject(procedures)) throw new Error(`Hitch contract object "${manifestObject.code}" is missing.`);
+		const pruned = { ...procedures };
+		if (!manifestObject.canCreate) delete pruned.create;
+		if (!manifestObject.canDelete) delete pruned.delete;
+		if (manifestObject.readWrite.length === 0) {
+			delete pruned.update;
+			delete pruned.updateWhere;
+		}
+		return [manifestObject.code, pruned];
+	}));
+	return Object.assign({}, contract, { records });
+}
+//#endregion
+export { pruneContract as t };

package/dist/{contract-CZdT22tB.d.ts → contract-D9wEvxGI.d.ts}

@@ -1,4 +1,4 @@
-import { n as AppletManifest } from "./manifest-ARAy2HP7.js";
+import { n as AppletManifest } from "./manifest-BSUtHbu-.js";
 import { AnyContractRouter } from "@orpc/contract";
 //#region src/hitch/contract.d.ts
 type ManifestObjectFor<Manifest, Code> = Manifest extends {

package/dist/{deploy-D5SBBd-j.js → deploy-Da93able.js}

@@ -1,6 +1,7 @@
-import { i as readWorkspaceConfig, n as fetchWithOrgAuth } from "./workspace-D0dnnlxL.js";
-import { a as loadGitHubActionsSources, n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-BKw14X2h.js";
-import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-BkhBHdMs.js";
+import { n as readWorkspaceConfig } from "./workspace-8yqXsvce.js";
+import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
+import { a as loadGitHubActionsSources, n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-B5-mH-YW.js";
+import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-XHoa_sJL.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
@@ -2545,6 +2546,28 @@ async function deployApplet(appletRoot, options, logPrefix = "", sourceHash) {
 	if (result.unset_variables?.length) console.warn(`${logPrefix}Warning: declared variables not set: ${result.unset_variables.join(", ")}. Set them with applet variables set.`);
 	return result;
 }
+function buildConcurrency() {
+	const value = process.env.APPLET_BUILD_CONCURRENCY;
+	if (value === void 0) return Infinity;
+	if (/^[1-9]\d*$/.test(value)) return Number(value);
+	console.warn(`Ignoring APPLET_BUILD_CONCURRENCY=${JSON.stringify(value)}: it must be a positive integer. Building every applet at once.`);
+	return Infinity;
+}
+function semaphore(limit) {
+	let active = 0;
+	const waiting = [];
+	return async (task) => {
+		if (active < limit) active++;
+		else await new Promise((resolve) => waiting.push(resolve));
+		try {
+			return await task();
+		} finally {
+			const next = waiting.shift();
+			if (next === void 0) active--;
+			else next();
+		}
+	};
+}
 async function workspaceAppletRoots(workspaceRoot) {
 	const appletsDir = resolve(workspaceRoot, "applets");
 	const roots = (await readdir(appletsDir, { withFileTypes: true }).catch((error) => {
@@ -2606,9 +2629,10 @@ async function runDeploy(options) {
 	if (selectedRoots.length === 0) return;
 	if (options.dist === void 0) await prepareWorkspaceBuild(root, appletRoots);
 	const interactive = github === void 0 && process.stdin.isTTY === true;
+	const buildSlot = semaphore(buildConcurrency());
 	const deploy = async (appletRoot) => {
 		const logPrefix = `[${relative(root, appletRoot)}] `;
-		if (options.dist === void 0) await buildPreparedApplet(appletRoot, ".hitch/dist", interactive ? "" : logPrefix);
+		if (options.dist === void 0) await buildSlot(() => buildPreparedApplet(appletRoot, ".hitch/dist", interactive ? "" : logPrefix));
 		await deployApplet(appletRoot, {
 			...options,
 			dist: options.dist ?? ".hitch/dist"

package/dist/device-BgIfytaR.js

@@ -0,0 +1,135 @@
+import { l as setCredentials, o as rejectEnvironmentKey, t as AuthenticationError } from "./store-B8N_8JIN.js";
+import { spawn } from "node:child_process";
+//#region ../shared/auth/src/device.mts
+const CLIENT_ID = "hitch-cli";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function defaultOpenUrl(url) {
+	try {
+		const child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+function requiredObject(value, message) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(message);
+	return value;
+}
+async function jsonResponse(response) {
+	try {
+		return requiredObject(await response.json(), "Expected a JSON object response.");
+	} catch (error) {
+		throw new Error(`Invalid JSON response from ${response.url || "Hitch"}.`, { cause: error });
+	}
+}
+async function postJson(fetcher, url, body) {
+	const response = await fetcher(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	return {
+		body: await jsonResponse(response),
+		response
+	};
+}
+function parseDeviceCode(value) {
+	if (typeof value.device_code !== "string" || typeof value.user_code !== "string" || typeof value.verification_uri !== "string" || typeof value.verification_uri_complete !== "string" || typeof value.expires_in !== "number" || value.interval !== void 0 && typeof value.interval !== "number") throw new AuthenticationError("Hitch returned an invalid device authorization response.");
+	return value;
+}
+function parseToken(value) {
+	return typeof value.access_token === "string" && typeof value.token_type === "string" ? value : void 0;
+}
+function parseDeviceOrganization(value) {
+	if (typeof value.organizationId !== "string" || typeof value.orgCode !== "string") throw new AuthenticationError("Hitch returned an invalid device organization response.");
+	return value;
+}
+function parseMe(value) {
+	const person = requiredObject(value.person, "Hitch returned an invalid identity response.");
+	if (typeof person.id !== "string" || typeof person.firstName !== "string" || typeof person.lastName !== "string" || typeof person.email !== "string" || !Array.isArray(value.memberships)) throw new Error("Hitch returned an invalid identity response.");
+	const organization = value.organization === void 0 || value.organization === null ? null : requiredObject(value.organization, "Hitch returned an invalid identity response.");
+	if (organization !== null && (typeof organization.id !== "string" || typeof organization.code !== "string")) throw new Error("Hitch returned an invalid identity response.");
+	return {
+		memberships: value.memberships.map((membership) => {
+			const item = requiredObject(membership, "Hitch returned an invalid membership.");
+			if (typeof item.orgId !== "string" || typeof item.code !== "string" || typeof item.name !== "string") throw new Error("Hitch returned an invalid membership.");
+			return item;
+		}),
+		organization,
+		person
+	};
+}
+async function fetchMe(fetcher, instanceUrl, auth) {
+	const response = await fetcher(`${instanceUrl}/api/v1/me`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
+	rejectEnvironmentKey(response, auth);
+	if (auth.credentialType === "apiKey" && response.status === 401) throw new AuthenticationError("API key rejected.");
+	const body = await jsonResponse(response);
+	if (!response.ok) throw new AuthenticationError(typeof body.message === "string" ? body.message : `Failed to load the signed-in identity (${response.status}).`);
+	return parseMe(body);
+}
+async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
+	const deadline = now() + device.expires_in * 1e3;
+	let interval = (device.interval ?? 5) * 1e3;
+	while (now() < deadline) {
+		await sleep(Math.min(interval, deadline - now()));
+		if (now() >= deadline) break;
+		const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/token`, {
+			grant_type: DEVICE_GRANT,
+			device_code: device.device_code,
+			client_id: CLIENT_ID
+		});
+		const token = parseToken(body);
+		if (response.ok && token !== void 0) return token;
+		switch (body.error) {
+			case "authorization_pending": break;
+			case "slow_down":
+				interval += 5e3;
+				break;
+			case "expired_token": throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+			case "access_denied": throw new AuthenticationError("Sign-in was denied.");
+			default: throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Sign-in failed (${response.status}).`);
+		}
+	}
+	throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+}
+async function loginWithDevice(instanceUrl, options = {}) {
+	const fetcher = globalThis.fetch;
+	const now = Date.now;
+	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
+	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
+	const device = parseDeviceCode(body);
+	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
+	console.log(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
+	if (!options.noBrowser) try {
+		defaultOpenUrl(verificationUrl);
+	} catch {}
+	const token = await pollForToken(fetcher, instanceUrl, device, now, (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
+	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
+	const organization = parseDeviceOrganization(organizationBody);
+	const me = await fetchMe(fetcher, instanceUrl, {
+		accessToken: token.access_token,
+		credentialType: "session",
+		source: "store"
+	});
+	const membership = me.memberships.find(({ orgId }) => orgId === organization.organizationId);
+	if (membership === void 0) throw new AuthenticationError("The device session is not scoped to a Hitch organization.");
+	const credentials = {
+		type: "session",
+		accessToken: token.access_token,
+		expiresAt: token.expires_in === void 0 ? void 0 : now() + token.expires_in * 1e3,
+		organizationId: organization.organizationId,
+		orgCode: organization.orgCode
+	};
+	await setCredentials(instanceUrl, credentials);
+	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
+	return {
+		credentials,
+		me,
+		membership
+	};
+}
+//#endregion
+export { loginWithDevice as t };

package/dist/email-protocol-B9u_dh2p.d.ts

@@ -0,0 +1,202 @@
+import { ContractProcedure, Meta, Schema } from "@orpc/contract";
+import { z } from "zod";
+//#region src/hitch/email.d.ts
+type EmailTags = Record<string, string>;
+type CreateEmailPixelInput = {
+  tags?: EmailTags;
+};
+type CreateEmailPixelOutput = {
+  id: string;
+  url: string;
+};
+type GetEmailTrackerInput = {
+  id: string;
+};
+type MarkEmailTrackerSentInput = {
+  id: string;
+  sentAt?: string;
+};
+type EmailTracker = {
+  id: string;
+  url: string;
+  tags: EmailTags;
+  createdAt: string;
+  sentAt: string | null;
+  firstHitAt: string | null;
+  lastHitAt: string | null;
+};
+type ListEmailTrackersInput = {
+  filter?: EmailTags;
+  sentAt?: {
+    $gte?: string;
+    $lt?: string;
+  };
+  cursor?: string;
+  limit?: number;
+};
+type ListEmailTrackersOutput = {
+  trackers: EmailTracker[];
+  nextCursor: string | null;
+};
+type EmailContract = {
+  mailboxes: {
+    list: ContractProcedure<Schema<void, void>, Schema<HitchEmailMailboxesOutput, HitchEmailMailboxesOutput>, Record<never, never>, Meta>;
+  };
+  threads: {
+    list: ContractProcedure<Schema<ListHitchEmailThreadsInput, ListHitchEmailThreadsInput>, Schema<HitchEmailThreadsOutput, HitchEmailThreadsOutput>, Record<never, never>, Meta>;
+    get: ContractProcedure<Schema<HitchEmailIdInput, HitchEmailIdInput>, Schema<HitchEmailThread, HitchEmailThread>, Record<never, never>, Meta>;
+  };
+  messages: {
+    /** Newest first. Pass threadId to page through one thread. */
+    list: ContractProcedure<Schema<ListHitchEmailMessagesInput, ListHitchEmailMessagesInput>, Schema<HitchEmailMessagesOutput, HitchEmailMessagesOutput>, Record<never, never>, Meta>;
+    get: ContractProcedure<Schema<HitchEmailIdInput, HitchEmailIdInput>, Schema<HitchEmailMessage, HitchEmailMessage>, Record<never, never>, Meta>;
+    send: ContractProcedure<Schema<SendHitchEmailInput, SendHitchEmailInput>, Schema<HitchEmailMessage, HitchEmailMessage>, Record<never, never>, Meta>;
+    raw: ContractProcedure<Schema<HitchEmailIdInput, HitchEmailIdInput>, Schema<HitchEmailRawOutput, HitchEmailRawOutput>, Record<never, never>, Meta>;
+  };
+  attachments: {
+    get: ContractProcedure<Schema<HitchEmailIdInput, HitchEmailIdInput>, Schema<HitchEmailAttachmentOutput, HitchEmailAttachmentOutput>, Record<never, never>, Meta>;
+  };
+  tracking: {
+    createPixel: ContractProcedure<Schema<CreateEmailPixelInput | undefined, CreateEmailPixelInput | undefined>, Schema<CreateEmailPixelOutput, CreateEmailPixelOutput>, Record<never, never>, Meta>;
+    markSent: ContractProcedure<Schema<MarkEmailTrackerSentInput, MarkEmailTrackerSentInput>, Schema<EmailTracker, EmailTracker>, Record<never, never>, Meta>;
+    get: ContractProcedure<Schema<GetEmailTrackerInput, GetEmailTrackerInput>, Schema<EmailTracker, EmailTracker>, Record<never, never>, Meta>;
+    list: ContractProcedure<Schema<ListEmailTrackersInput | undefined, ListEmailTrackersInput | undefined>, Schema<ListEmailTrackersOutput, ListEmailTrackersOutput>, Record<never, never>, Meta>;
+  };
+};
+declare function emailContract(appletCode: string): EmailContract;
+type HitchEmailAddress = {
+  address: string;
+  name: string | null;
+};
+type HitchMailbox = {
+  id: string;
+  address: string;
+  label: string;
+  enabled: boolean;
+  receive: boolean;
+  canRead: boolean;
+  canSend: boolean;
+};
+type HitchEmailAttachment = {
+  id: string;
+  filename: string;
+  contentType: string;
+  sizeBytes: number;
+  contentId: string | null;
+  inline: boolean;
+};
+type HitchEmailMessage = {
+  id: string;
+  mailboxId: string;
+  threadId: string;
+  direction: "inbound" | "outbound";
+  status: "received" | "unknown" | "sent" | "failed";
+  messageId: string | null;
+  inReplyTo: string | null;
+  references: string[];
+  from: HitchEmailAddress;
+  to: HitchEmailAddress[];
+  cc: HitchEmailAddress[];
+  bcc: HitchEmailAddress[];
+  replyTo: HitchEmailAddress[];
+  subject: string;
+  text: string | null;
+  html: string | null;
+  sentAt: string | null;
+  automated: string | null;
+  authentication: {
+    spf: string | null;
+    dkim: string | null;
+    dmarc: string | null;
+  } | null;
+  parseError: string | null;
+  attachments: HitchEmailAttachment[];
+  userId: string | null;
+  appletId: string | null;
+  requestId: string | null;
+  errorDetail: string | null;
+  createdAt: string;
+};
+type HitchEmailThread = {
+  id: string;
+  mailboxId: string;
+  subject: string;
+  messageCount: number;
+  lastMessageAt: string;
+  createdAt: string;
+};
+type ListHitchEmailThreadsInput = {
+  mailboxId?: string;
+  cursor?: string;
+  limit?: number;
+};
+type ListHitchEmailMessagesInput = {
+  mailboxId?: string;
+  address?: string;
+  threadId?: string;
+  direction?: "inbound" | "outbound";
+  since?: string;
+  until?: string;
+  cursor?: string;
+  limit?: number;
+};
+type SendHitchEmailInput = {
+  mailboxId: string;
+  to?: string[];
+  cc?: string[];
+  bcc?: string[];
+  subject?: string;
+  text?: string;
+  html?: string;
+  replyToMessageId?: string;
+  attachmentFileIds?: string[];
+  requestId?: string;
+};
+type HitchEmailIdInput = {
+  id: string;
+};
+type HitchEmailMailboxesOutput = {
+  data: HitchMailbox[];
+};
+type HitchEmailThreadsOutput = {
+  data: HitchEmailThread[];
+  nextCursor: string | null;
+};
+type HitchEmailMessagesOutput = {
+  data: HitchEmailMessage[];
+  nextCursor: string | null;
+};
+type HitchEmailRawOutput = {
+  url: string;
+};
+type HitchEmailAttachmentOutput = {
+  url: string;
+  filename: string;
+  contentType: string;
+  sizeBytes: number;
+};
+//#endregion
+//#region src/server/telephony-protocol.d.ts
+/** Handle events at least once and without order. Use eventId for idempotency.
+ * Read the message with hitch.telephony.messages.get({ id: messageId }). */
+type TelephonyMessageReceivedEvent = {
+  eventId: string;
+  type: "message.received";
+  messageId: string;
+  numberId: string;
+  occurredAt: string;
+};
+//#endregion
+//#region src/server/email-protocol.d.ts
+/** Handle events at least once and without order. Use eventId for idempotency.
+ * Read the message with hitch.email.messages.get({ id: messageId }). */
+type EmailMessageReceivedEvent = {
+  eventId: string;
+  type: "message.received";
+  messageId: string;
+  mailboxId: string;
+  threadId: string;
+  occurredAt: string;
+};
+//#endregion
+export { EmailTracker as a, HitchEmailMessage as c, ListEmailTrackersInput as d, ListEmailTrackersOutput as f, emailContract as g, SendHitchEmailInput as h, EmailContract as i, HitchEmailThread as l, ListHitchEmailThreadsInput as m, TelephonyMessageReceivedEvent as n, HitchEmailAddress as o, ListHitchEmailMessagesInput as p, CreateEmailPixelInput as r, HitchEmailAttachment as s, EmailMessageReceivedEvent as t, HitchMailbox as u };