@hitch42/applet 0.1.1-beta.17 → 0.1.1-beta.19

package/dist/_internal/client.js

@@ -1,5 +1,5 @@
 import { i as openCacheDatabase, n as clearAppletQueryCaches, o as sweepExpiredQueryCaches, r as indexedDbPersister, t as cacheTabId } from "../query-cache-CXmAyLv3.js";
-import { QueryClientProvider } from "@tanstack/react-query";
+import { QueryClientProvider, useIsRestoring } from "@tanstack/react-query";
 import { PersistQueryClientProvider } from "@tanstack/react-query-persist-client";
 import { RouterProvider } from "@tanstack/react-router";
 import { createElement, useEffect } from "react";
@@ -130,6 +130,9 @@ async function appletQueryPersistence(appletCode) {
 		return;
 	}
 }
+function RestoredRouter({ router }) {
+	return useIsRestoring() ? null : createElement(RouterProvider, { router });
+}
 function mountApplet(router, appletCode) {
 	const queryClient = router.options.context.queryClient;
 	if (!queryClient) throw new Error("getRouter must provide a QueryClient via createRouter({ context: { queryClient } }).");
@@ -159,7 +162,7 @@ function mountApplet(router, appletCode) {
 				console.error("Could not restore the applet query cache.");
 				sweepWhenIdle();
 			}
-		}, applet) : createElement(QueryClientProvider, { client: queryClient }, applet));
+		}, createElement(RestoredRouter, { router })) : createElement(QueryClientProvider, { client: queryClient }, applet));
 	}).catch((error) => {
 		console.error("Could not initialize the applet query cache.", error);
 		createRoot(root).render(createElement(QueryClientProvider, { client: queryClient }, applet));

package/dist/_internal/server.js

@@ -1,4 +1,4 @@
-import { a as HITCH_ORG_CODE_HEADER, c as HITCH_SCHEDULE_HEADER, d as HITCH_USER_HEADER, f as HITCH_WORKFLOW_HEADER, i as HITCH_ORGANIZATION_HEADER, l as HITCH_SCHEDULE_RUN_HEADER, m as HITCH_WORKFLOW_RUN_HEADER, n as HITCH_APPLET_HEADER, o as HITCH_RELEASE_HEADER, p as HITCH_WORKFLOW_INVOCATION_HEADER, r as HITCH_APPLET_TOKEN_HEADER, u as HITCH_SESSION_HEADER } from "../headers-DkNr9MLJ.js";
+import { a as HITCH_ORG_CODE_HEADER, d as HITCH_SESSION_HEADER, f as HITCH_USER_HEADER, h as HITCH_WORKFLOW_RUN_HEADER, i as HITCH_ORGANIZATION_HEADER, l as HITCH_SCHEDULE_HEADER, m as HITCH_WORKFLOW_INVOCATION_HEADER, n as HITCH_APPLET_HEADER, o as HITCH_PUBLIC_HEADER, p as HITCH_WORKFLOW_HEADER, r as HITCH_APPLET_TOKEN_HEADER, s as HITCH_RELEASE_HEADER, u as HITCH_SCHEDULE_RUN_HEADER } from "../headers-CeRX-Xji.js";
 import { a as getRequestContext, o as runWithRequestContext, r as toMilliseconds, t as MAX_DURATION_MS } from "../workflow-CTo2kZF1.js";
 import { a as errorNote, c as requestIdFrom, i as createNoteLog, r as cloudflareRequestFields, s as publishNote, t as APP_CONTEXT_CHANNEL } from "../log-context-DWznGjfz.js";
 import { a as workflowOutcomeSchema, i as workflowInvocationRequestSchema, n as runWorkflowJournal, r as journalEntrySchema, t as WorkflowFailedError } from "../workflow-engine-BOTzURKM.js";
@@ -174,11 +174,12 @@ function createWorkerEntry(server, options) {
 			} : appletId !== null && token !== null ? {
 				kind: "applet",
 				appletId,
-				token
+				token,
+				public: request.headers.get(HITCH_PUBLIC_HEADER) === "1"
 			} : void 0;
 			if (identity === void 0) return jsonError(401, "missing_identity");
 			log.set({
-				callerType: identity.kind,
+				callerType: identity.kind === "applet" && identity.public ? "public" : identity.kind,
 				callerId: identity.kind === "user" ? `user:${identity.userId}` : `applet:${identity.appletId}`
 			});
 			const bindings = typeof env === "object" && env !== null ? env : {};
@@ -202,6 +203,7 @@ function createWorkerEntry(server, options) {
 				requestId
 			}, async () => {
 				const pathname = new URL(request.url).pathname;
+				if (pathname.startsWith("/api/__hitch/") && identity.kind === "applet" && identity.public) return jsonError(403, "platform_identity_required");
 				if (pathname === "/api/__hitch/telephony/message-received" && request.method === "POST") {
 					log.set({ route: "/api/__hitch/telephony/message-received" });
 					if (identity.kind !== "applet") return jsonError(403, "applet_identity_required");

package/dist/applet.js

@@ -99,23 +99,23 @@ async function main() {
 	const noLogFlags = values.run === void 0 && values.filter === void 0 && values.level === void 0 && values.limit === void 0 && values.live === void 0 && values.search === void 0 && values.since === void 0;
 	const noModeFlags = values["client-only"] === void 0 && values["server-only"] === void 0;
 	if (positionals.length === 1 && positionals[0] === "bootstrap" && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BGQ_bP44.js")).runBootstrap({ install: values["no-install"] !== true });
+		await (await import("./init-DT0faD-q.js")).runBootstrap({ install: values["no-install"] !== true });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "generate" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./generate-C9bWqdaB.js")).runGenerate();
+		await (await import("./generate-Df29-UJm.js")).runGenerate();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "build" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./build-ueR7XjZT.js")).runBuild();
+		await (await import("./build-DpkWOvd2.js")).runBuild();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "deploy" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./deploy-Da93able.js")).runDeploy({});
+		await (await import("./deploy-DODTE8ri.js")).runDeploy({});
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "init" && noModeFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BGQ_bP44.js")).runInit(positionals[1], {
+		await (await import("./init-DT0faD-q.js")).runInit(positionals[1], {
 			commit: values["no-commit"] !== true,
 			git: values["no-git"] !== true,
 			install: values["no-install"] !== true
@@ -123,7 +123,7 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "new" && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BGQ_bP44.js")).runNew({
+		await (await import("./init-DT0faD-q.js")).runNew({
 			code: positionals[1],
 			clientOnly: values["client-only"],
 			install: values["no-install"] !== true,
@@ -132,7 +132,7 @@ async function main() {
 		return;
 	}
 	if ((positionals.length === 1 || positionals.length === 2) && positionals[0] === "logs" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags) {
-		await (await import("./logs-DOkT5ots.js")).runLogs({
+		await (await import("./logs-CEIikWzV.js")).runLogs({
 			code: positionals[1],
 			filter: values.filter,
 			run: values.run,
@@ -145,14 +145,14 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 3 && positionals[0] === "schedules" && positionals[1] === "run" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags && values.secret === void 0) {
-		await (await import("./schedules-D6-3v-Az.js")).runSchedule({
+		await (await import("./schedules-B7xNl9oy.js")).runSchedule({
 			code: positionals[2],
 			yes: values.yes
 		});
 		return;
 	}
 	if ((positionals.length === 3 || positionals.length === 4) && positionals[0] === "variables" && positionals[1] === "set" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags) {
-		await (await import("./variables-BSFZnLxY.js")).runVariablesSet({
+		await (await import("./variables-DCbLJBr0.js")).runVariablesSet({
 			key: positionals[2],
 			secret: values.secret,
 			value: positionals[3],
@@ -161,11 +161,11 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "variables" && positionals[1] === "list" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./variables-BSFZnLxY.js")).runVariablesList();
+		await (await import("./variables-DCbLJBr0.js")).runVariablesList();
 		return;
 	}
 	if (positionals.length === 3 && positionals[0] === "variables" && positionals[1] === "delete" && values["no-install"] === void 0 && noModeFlags && noGitFlags && values.secret === void 0 && noLogFlags) {
-		await (await import("./variables-BSFZnLxY.js")).runVariablesDelete({
+		await (await import("./variables-DCbLJBr0.js")).runVariablesDelete({
 			key: positionals[2],
 			yes: values.yes
 		});

package/dist/{lazy-client-x0DCI98S.js → batch-_ZjAg-Kk.js}

@@ -48,17 +48,4 @@ function withBatchRecorder(target, contract) {
 	} });
 }
 //#endregion
-//#region src/lazy-client.ts
-function createLazyClientProxy(build) {
-	let client;
-	const at = (path) => new Proxy(() => void 0, {
-		get: (_target, property) => at([...path, property]),
-		apply: (_target, _thisArg, args) => {
-			client ??= build();
-			return path.reduce((value, property) => value[property], client)(...args);
-		}
-	});
-	return at([]);
-}
-//#endregion
-export { withBatchRecorder as n, createLazyClientProxy as t };
+export { withBatchRecorder as t };

package/dist/{build-XHoa_sJL.js → build-DkKTiIu7.js}

@@ -1,4 +1,4 @@
-import { i as prepareAppletProjects, r as prepareAppletProject } from "./project-CCVqCCgU.js";
+import { i as prepareAppletProjects, r as prepareAppletProject } from "./project-CWVwic2C.js";
 import { rm } from "node:fs/promises";
 import { resolve } from "node:path";
 import { spawn } from "node:child_process";

package/dist/build-DpkWOvd2.js

@@ -0,0 +1,2 @@
+import { i as runBuild } from "./build-DkKTiIu7.js";
+export { runBuild };

package/dist/client/hitch/client.d.ts

@@ -0,0 +1,2 @@
+import { t as hitch } from "../../hitch-client--qZVa2KM.js";
+export { hitch };

package/dist/client/hitch/client.js

@@ -0,0 +1,2 @@
+import { t as hitch } from "../../hitch-client-Cw-WZ_8v.js";
+export { hitch };

package/dist/client/hitch/phone.d.ts

@@ -0,0 +1,2 @@
+import { t as usePhone } from "../../use-phone-M7c_HsB7.js";
+export { usePhone };

package/dist/client/hitch/phone.js

@@ -0,0 +1,2 @@
+import { t as usePhone } from "../../use-phone-ug4B5gQp.js";
+export { usePhone };

package/dist/client/hitch.d.ts

@@ -0,0 +1,3 @@
+import { t as hitch } from "../hitch-client--qZVa2KM.js";
+import { i as createPhone, n as Phone, r as PhoneState, t as usePhone } from "../use-phone-M7c_HsB7.js";
+export { type Phone, type PhoneState, createPhone, hitch, usePhone };

package/dist/client/hitch.js

@@ -0,0 +1,3 @@
+import { t as hitch } from "../hitch-client-Cw-WZ_8v.js";
+import { n as createPhone, t as usePhone } from "../use-phone-ug4B5gQp.js";
+export { createPhone, hitch, usePhone };

package/dist/{react → client/react}/markdown-editor.d.ts

@@ -1,2 +1,2 @@
-import { n as MarkdownEditorProps, r as MarkdownEditorFiles, t as MarkdownEditor } from "../markdown-editor-BmEaBzd7.js";
+import { n as MarkdownEditorProps, r as MarkdownEditorFiles, t as MarkdownEditor } from "../../markdown-editor-BmEaBzd7.js";
 export { MarkdownEditor, type MarkdownEditorFiles, MarkdownEditorProps };

package/dist/client/react/markdown-editor.js

@@ -0,0 +1,2 @@
+import { t as MarkdownEditor } from "../../markdown-editor-C5mLHGqu.js";
+export { MarkdownEditor };

package/dist/client/react/markdown.d.ts

@@ -0,0 +1,2 @@
+import { n as MarkdownFiles, r as MarkdownProps, t as Markdown } from "../../markdown-DSHOQIOb.js";
+export { Markdown, MarkdownFiles, MarkdownProps };

package/dist/client/react/markdown.js

@@ -0,0 +1,2 @@
+import { t as Markdown } from "../../markdown-CwlqzBtP.js";
+export { Markdown };

package/dist/{react.d.ts → client/react.d.ts}

@@ -1,3 +1,3 @@
-import { n as MarkdownFiles, r as MarkdownProps, t as Markdown } from "./markdown-DSHOQIOb.js";
-import { n as MarkdownEditorProps, r as MarkdownEditorFiles, t as MarkdownEditor } from "./markdown-editor-BmEaBzd7.js";
+import { n as MarkdownFiles, r as MarkdownProps, t as Markdown } from "../markdown-DSHOQIOb.js";
+import { n as MarkdownEditorProps, r as MarkdownEditorFiles, t as MarkdownEditor } from "../markdown-editor-BmEaBzd7.js";
 export { Markdown, MarkdownEditor, type MarkdownEditorFiles, type MarkdownEditorProps, type MarkdownFiles, type MarkdownProps };

package/dist/client/react.js

@@ -0,0 +1,3 @@
+import { t as Markdown } from "../markdown-CwlqzBtP.js";
+import { t as MarkdownEditor } from "../markdown-editor-C5mLHGqu.js";
+export { Markdown, MarkdownEditor };

package/dist/client.d.ts

@@ -1,48 +1,7 @@
-import { d as RegisteredRouter, l as RegisteredContract, u as RegisteredManifest } from "./manifest-BSUtHbu-.js";
-import { t as NarrowContract } from "./contract-D9wEvxGI.js";
-import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
-import { o as WithFilesUpload } from "./upload-D_kkmne_.js";
+import { d as RegisteredRouter } from "./manifest-BBHD_EY9.js";
+import { t as ExactRouterUtils } from "./query-utils-zz9pVjgp.js";
 import { RouterClient } from "@orpc/server";
-import { ContractRouterClient } from "@orpc/contract";
-import { NestedClient } from "@orpc/client";
-import { RouterUtils } from "@orpc/tanstack-query";
-//#region src/query-utils.d.ts
-type Exact<Expected, Actual> = Actual extends symbol ? Actual : Actual extends Expected ? Actual extends readonly unknown[] ? Actual : Actual extends object ? NonNullable<Expected> extends object ? { [Key in keyof Actual]: Key extends keyof NonNullable<Expected> ? Exact<NonNullable<Expected>[Key], Actual[Key]> : never; } : Actual : Actual : never;
-type QueryOptionsFunction<Utils> = Extract<Utils extends {
-  queryOptions: infer Function;
-} ? Function : never, (...args: never[]) => unknown>;
-type QueryOptionsArgument<Utils> = NonNullable<Parameters<QueryOptionsFunction<Utils>>[0]>;
-type ExactOptions<Input, Options> = Options extends {
-  input: infer Actual;
-} ? Options & {
-  input: Exact<Input, Actual>;
-} : Options extends {
-  input?: infer Actual;
-} ? Options & {
-  input?: Exact<Input, Actual>;
-} : Options;
-type QueryOptionsResult<Utils, Options> = Options & Omit<ReturnType<QueryOptionsFunction<Utils>>, keyof Options>;
-type ExactQueryOptions<Utils, Input> = <Options extends QueryOptionsArgument<Utils> = QueryOptionsArgument<Utils>>(...rest: undefined extends Input ? [options?: ExactOptions<Input, Options>] : [options: ExactOptions<Input, Options>]) => QueryOptionsResult<Utils, Options>;
-type ClientTree = NestedClient<Record<never, never>>;
-type ExactRouterUtils<Client extends ClientTree> = Client extends ((...args: infer Arguments) => unknown) ? Omit<RouterUtils<Client>, "queryOptions"> & {
-  queryOptions: ExactQueryOptions<RouterUtils<Client>, Arguments[0]>;
-} : Omit<RouterUtils<Client>, keyof Client> & { [Key in keyof Client]: Client[Key] extends ClientTree ? ExactRouterUtils<Client[Key]> : never; };
-//#endregion
 //#region src/author/client.d.ts
-type AuthorContract = NarrowContract<RegisteredContract, RegisteredManifest>;
-type BaseHitchClient = ContractRouterClient<AuthorContract>;
-type AuthorHitchClient = WithBatchRecorder<BaseHitchClient>;
-type BaseHitchUtils = ExactRouterUtils<BaseHitchClient>;
-type AuthorHitchUtils = AuthorHitchClient extends {
-  batch: infer Batch;
-} ? BaseHitchUtils extends {
-  batch: infer BatchUtils;
-} ? Omit<BaseHitchUtils, "batch"> & {
-  batch: Omit<BatchUtils, "call"> & {
-    call: Batch;
-  };
-} : BaseHitchUtils : BaseHitchUtils;
-declare const hitch: WithFilesUpload<AuthorHitchUtils>;
 declare const api: ExactRouterUtils<RouterClient<RegisteredRouter>>;
 //#endregion
-export { api, hitch };
+export { api };

package/dist/client.js

@@ -1,17 +1,7 @@
-import { n as withFilesUpload, r as getRegisteredHitchContract } from "./upload-DRbVhuDm.js";
-import { n as withBatchRecorder, t as createLazyClientProxy } from "./lazy-client-x0DCI98S.js";
+import { t as createLazyClientProxy } from "./lazy-client-CwIzYAoE.js";
 import { createORPCClient } from "@orpc/client";
-import { OpenAPILink } from "@orpc/openapi-client/fetch";
 import { createTanstackQueryUtils } from "@orpc/tanstack-query";
 import { RPCLink } from "@orpc/client/fetch";
-//#region src/hitch/browser.ts
-function createHitchClient(contract) {
-	return createLazyClientProxy(() => createORPCClient(new OpenAPILink(contract, {
-		url: `${location.origin}/api`,
-		fetch: (request, init) => globalThis.fetch(request, init)
-	})));
-}
-//#endregion
 //#region src/client.ts
 function createClient(...[options]) {
 	const clientOptions = options;
@@ -26,13 +16,6 @@ function createClient(...[options]) {
 }
 //#endregion
 //#region src/author/client.ts
-function buildClientHitch() {
-	const contract = getRegisteredHitchContract();
-	if (contract === void 0) throw new Error("`hitch` is unavailable: run `applet generate` first. The framework imports your .hitch automatically at build; in plain node import your .hitch once before calling hitch.");
-	return withBatchRecorder(createHitchClient(contract), contract);
-}
-const hitchClient = createLazyClientProxy(buildClientHitch);
-const hitch = withFilesUpload(createTanstackQueryUtils(hitchClient), () => hitchClient.files);
 const api = createTanstackQueryUtils(createClient());
 //#endregion
-export { api, hitch };
+export { api };

package/dist/{contract-BbOj5EB7.js → contract-BeKz1Qcs.js}

@@ -17,7 +17,12 @@ function pruneContract(contract, manifest) {
 		}
 		return [manifestObject.code, pruned];
 	}));
-	return Object.assign({}, contract, { records });
+	const platform = Object.assign({}, contract);
+	if (manifest.public === true) {
+		delete platform.email;
+		delete platform.telephony;
+	}
+	return Object.assign(platform, { records });
 }
 //#endregion
 export { pruneContract as t };

package/dist/{contract-D9wEvxGI.d.ts → contract-CJv-n1l3.d.ts}

@@ -1,4 +1,4 @@
-import { n as AppletManifest } from "./manifest-BSUtHbu-.js";
+import { n as AppletManifest } from "./manifest-BBHD_EY9.js";
 import { AnyContractRouter } from "@orpc/contract";
 //#region src/hitch/contract.d.ts
 type ManifestObjectFor<Manifest, Code> = Manifest extends {
@@ -15,7 +15,9 @@ type Capability<ManifestObject, Key extends "canCreate" | "canDelete" | "readWri
 type NarrowProcedures<Procedures, ManifestObject> = Omit<Procedures, (true extends Capability<ManifestObject, "canCreate"> ? never : "create") | (true extends Capability<ManifestObject, "canDelete"> ? never : "delete") | (Capability<ManifestObject, "readWrite"> extends readonly [] ? "update" | "updateWhere" : never)>;
 type NarrowContract<Contract, Manifest> = Contract extends {
   records: infer Records;
-} ? Omit<Contract, "records"> & {
+} ? Omit<Contract, "records" | (Manifest extends {
+  public: true;
+} ? "email" | "telephony" : never)> & {
   records: { [Code in keyof Records & ManifestObjectCodes<Manifest>]: NarrowProcedures<Records[Code], ManifestObjectFor<Manifest, Code>>; };
 } : Contract;
 declare function pruneContract<const Contract extends AnyContractRouter, const Manifest extends AppletManifest>(contract: Contract, manifest: Manifest): NarrowContract<Contract, Manifest>;

package/dist/{deploy-Da93able.js → deploy-DODTE8ri.js}

@@ -1,7 +1,7 @@
 import { n as readWorkspaceConfig } from "./workspace-8yqXsvce.js";
 import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
 import { a as loadGitHubActionsSources, n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-B5-mH-YW.js";
-import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-XHoa_sJL.js";
+import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-DkKTiIu7.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";

package/dist/{generate-BV_emZgy.js → generate-8yyxKRSz.js}

@@ -1,8 +1,8 @@
 import { a as organizationInstanceUrl, c as resolveInstanceUrl } from "./store-B8N_8JIN.js";
 import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
-import { t as loadAppletConfig } from "./load-config-Dkr2VxZN.js";
+import { t as loadAppletConfig } from "./load-config-BYrBjPlr.js";
 import { i as loadGitHubActionsBuildInputs, n as githubActionsContext } from "./ci-B5-mH-YW.js";
-import { r as prepareAppletProject } from "./project-CCVqCCgU.js";
+import { r as prepareAppletProject } from "./project-CWVwic2C.js";
 import { createRequire } from "node:module";
 import { isContractProcedure, minifyContractRouter } from "@orpc/contract";
 import { randomUUID } from "node:crypto";
@@ -308,17 +308,16 @@ function guardManifestForSpec(spec, manifest) {
 }
 //#endregion
 //#region src/typegen/register.ts
-function registerFile(catalog, options) {
+function registerFile(catalog, options, publicApplet) {
 	const catalogType = catalog === void 0 ? "type Catalog = Record<string, string>;" : `type Catalog = {
 ${Object.entries(catalog).map(([objectCode, attributeCodes]) => `  ${JSON.stringify(objectCode)}: ${attributeCodes.map((code) => JSON.stringify(code)).join(" | ") || "never"};`).join("\n")}
 };`;
-	return `// Generated by @hitch42/applet — do not edit.
-import type manifest from "./manifest.gen.ts";
-${options.hasServer ? "import type server from \"../src/server/main.ts\";\nimport type * as serverModule from \"../src/server/main.ts\";\n" : ""}${options.hasClient ? "import type { Route as indexRoute } from \"../src/client/routes/index.tsx\";\n" : ""}${options.hasServer ? "import type { AnyRouter } from \"@orpc/server\";\n" : ""}${options.hasClient ? "import type { AnyRoute } from \"@tanstack/react-router\";\n" : ""}${options.hasServer ? "import type { WorkflowDefinition } from \"@hitch42/applet/server\";\nimport type { TelephonyMessageReceivedEvent, EmailMessageReceivedEvent } from \"@hitch42/applet\";\n" : ""}
-${catalogType}
-
-type Expect<T extends true> = T;
-${options.hasServer ? `type ServerWorkflows = typeof serverModule extends {
+	const serverSourceImport = options.hasServer ? "import type server from \"../src/server/main.ts\";\nimport type * as serverModule from \"../src/server/main.ts\";\n" : "";
+	const clientSourceImport = options.hasClient ? "import type { Route as indexRoute } from \"../src/client/routes/index.tsx\";\n" : "";
+	const serverTypeImports = options.hasServer ? "import type { AnyRouter } from \"@orpc/server\";\n" : "";
+	const clientTypeImports = options.hasClient ? "import type { AnyRoute } from \"@tanstack/react-router\";\n" : "";
+	const workflowImport = options.hasServer ? "import type { WorkflowDefinition } from \"@hitch42/applet/server\";\nimport type { TelephonyMessageReceivedEvent, EmailMessageReceivedEvent } from \"@hitch42/applet\";\n" : "";
+	const serverCheck = options.hasServer ? `type ServerWorkflows = typeof serverModule extends {
   workflows: infer Workflows extends Record<string, WorkflowDefinition<any, any>>;
 }
   ? Workflows
@@ -340,10 +339,21 @@ type _SrcServerWorkflowsMustBeNamedExport = Expect<
       : false
     : true
 >;
-` : ""}${options.hasClient ? `type _SrcClientRoutesIndexMustExportARoute = Expect<
+` : "";
+	const clientCheck = options.hasClient ? `type _SrcClientRoutesIndexMustExportARoute = Expect<
   typeof indexRoute extends AnyRoute ? true : false
 >;
-` : ""}
+` : "";
+	return `// Generated by @hitch42/applet — do not edit.
+import type manifest from "./manifest.gen.ts";
+${serverSourceImport}${clientSourceImport}${serverTypeImports}${clientTypeImports}${workflowImport}
+${catalogType}
+
+type Expect<T extends true> = T;
+${serverCheck}${publicApplet && options.hasServer ? `type _PublicAppletsCannotDefineWorkflows = Expect<keyof ServerWorkflows extends never ? true : false>;
+type _PublicAppletsCannotHandleEmail = Expect<"email" extends keyof typeof server ? false : true>;
+type _PublicAppletsCannotHandleTelephony = Expect<"telephony" extends keyof typeof server ? false : true>;
+` : ""}${clientCheck}
 declare module "@hitch42/applet" {
   interface HitchRegister {
     catalog: Catalog;
@@ -354,12 +364,12 @@ ${options.hasServer ? `    router: (typeof server)["router"];
 }
 `;
 }
-async function writeRegisterDeclaration(outDir, catalog) {
+async function writeRegisterDeclaration(outDir, catalog, publicApplet = false) {
 	await mkdir(resolve(outDir), { recursive: true });
 	await writeFile(resolve(outDir, "register.ts"), registerFile(catalog, {
 		hasClient: existsSync(resolve(outDir, "../src/client/routes/index.tsx")),
 		hasServer: existsSync(resolve(outDir, "../src/server/main.ts"))
-	}));
+	}, publicApplet));
 }
 //#endregion
 //#region src/typegen/generate.ts
@@ -480,7 +490,7 @@ async function writeContractFiles(outDir, manifest, spec) {
 	const preparedSpec = prepareRecordSpec(spec, manifest);
 	await generateContract(preparedSpec, outDir);
 	await writeManifestGen(outDir, manifest);
-	await writeRegisterDeclaration(outDir, catalog);
+	await writeRegisterDeclaration(outDir, catalog, manifest.public === true);
 	const hasBatch = Object.hasOwn(preparedSpec.paths, "/v1/batch");
 	await writeFile(resolve(outDir, "index.ts"), `// Generated by applet generate — do not edit.
 import { emailContract, filesContract as files, meContract as me, pruneContract, registerHitchContract, teamsContract as teams, telephonyContract as telephony } from "@hitch42/applet";

package/dist/generate-Df29-UJm.js

@@ -0,0 +1,2 @@
+import { r as runGenerate } from "./generate-8yyxKRSz.js";
+export { runGenerate };

package/dist/{headers-DkNr9MLJ.js → headers-CeRX-Xji.js}

@@ -4,6 +4,7 @@ const HITCH_SESSION_HEADER = "x-hitch-session";
 const HITCH_APPLET_HEADER = "x-hitch-applet";
 const HITCH_APPLET_CODE_HEADER = "x-hitch-applet-code";
 const HITCH_APPLET_TOKEN_HEADER = "x-hitch-applet-token";
+const HITCH_PUBLIC_HEADER = "x-hitch-public";
 const HITCH_SCHEDULE_RUN_HEADER = "x-hitch-schedule-run";
 const HITCH_SCHEDULE_HEADER = "x-hitch-schedule";
 const HITCH_ORG_CODE_HEADER = "x-hitch-org-code";
@@ -14,4 +15,4 @@ const HITCH_WORKFLOW_RUN_HEADER = "x-hitch-workflow-run";
 const HITCH_WORKFLOW_HEADER = "x-hitch-workflow";
 const HITCH_WORKFLOW_INVOCATION_HEADER = "x-hitch-workflow-invocation";
 //#endregion
-export { HITCH_ORG_CODE_HEADER as a, HITCH_SCHEDULE_HEADER as c, HITCH_USER_HEADER as d, HITCH_WORKFLOW_HEADER as f, HITCH_ORGANIZATION_HEADER as i, HITCH_SCHEDULE_RUN_HEADER as l, HITCH_WORKFLOW_RUN_HEADER as m, HITCH_APPLET_HEADER as n, HITCH_RELEASE_HEADER as o, HITCH_WORKFLOW_INVOCATION_HEADER as p, HITCH_APPLET_TOKEN_HEADER as r, HITCH_REQUEST_HOST_HEADER as s, HITCH_APPLET_CODE_HEADER as t, HITCH_SESSION_HEADER as u };
+export { HITCH_ORG_CODE_HEADER as a, HITCH_REQUEST_HOST_HEADER as c, HITCH_SESSION_HEADER as d, HITCH_USER_HEADER as f, HITCH_WORKFLOW_RUN_HEADER as h, HITCH_ORGANIZATION_HEADER as i, HITCH_SCHEDULE_HEADER as l, HITCH_WORKFLOW_INVOCATION_HEADER as m, HITCH_APPLET_HEADER as n, HITCH_PUBLIC_HEADER as o, HITCH_WORKFLOW_HEADER as p, HITCH_APPLET_TOKEN_HEADER as r, HITCH_RELEASE_HEADER as s, HITCH_APPLET_CODE_HEADER as t, HITCH_SCHEDULE_RUN_HEADER as u };

package/dist/hitch-client--qZVa2KM.d.ts

@@ -0,0 +1,23 @@
+import { l as RegisteredContract, u as RegisteredManifest } from "./manifest-BBHD_EY9.js";
+import { t as NarrowContract } from "./contract-CJv-n1l3.js";
+import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
+import { o as WithFilesUpload } from "./upload-D_kkmne_.js";
+import { t as ExactRouterUtils } from "./query-utils-zz9pVjgp.js";
+import { ContractRouterClient } from "@orpc/contract";
+//#region src/author/hitch-client.d.ts
+type AuthorContract = NarrowContract<RegisteredContract, RegisteredManifest>;
+type BaseHitchClient = ContractRouterClient<AuthorContract>;
+type AuthorHitchClient = WithBatchRecorder<BaseHitchClient>;
+type BaseHitchUtils = ExactRouterUtils<BaseHitchClient>;
+type AuthorHitchUtils = AuthorHitchClient extends {
+  batch: infer Batch;
+} ? BaseHitchUtils extends {
+  batch: infer BatchUtils;
+} ? Omit<BaseHitchUtils, "batch"> & {
+  batch: Omit<BatchUtils, "call"> & {
+    call: Batch;
+  };
+} : BaseHitchUtils : BaseHitchUtils;
+declare const hitch: WithFilesUpload<AuthorHitchUtils>;
+//#endregion
+export { hitch as t };

package/dist/hitch-client-Cw-WZ_8v.js

@@ -0,0 +1,24 @@
+import { n as withFilesUpload, r as getRegisteredHitchContract } from "./upload-DRbVhuDm.js";
+import { t as withBatchRecorder } from "./batch-_ZjAg-Kk.js";
+import { t as createLazyClientProxy } from "./lazy-client-CwIzYAoE.js";
+import { createORPCClient } from "@orpc/client";
+import { OpenAPILink } from "@orpc/openapi-client/fetch";
+import { createTanstackQueryUtils } from "@orpc/tanstack-query";
+//#region src/hitch/browser.ts
+function createHitchClient(contract) {
+	return createLazyClientProxy(() => createORPCClient(new OpenAPILink(contract, {
+		url: `${location.origin}/api`,
+		fetch: (request, init) => globalThis.fetch(request, init)
+	})));
+}
+//#endregion
+//#region src/author/hitch-client.ts
+function buildClientHitch() {
+	const contract = getRegisteredHitchContract();
+	if (contract === void 0) throw new Error("`hitch` is unavailable: run `applet generate` first. The framework imports your .hitch automatically at build; in plain node import your .hitch once before calling hitch.");
+	return withBatchRecorder(createHitchClient(contract), contract);
+}
+const hitchClient = createLazyClientProxy(buildClientHitch);
+const hitch = withFilesUpload(createTanstackQueryUtils(hitchClient), () => hitchClient.files);
+//#endregion
+export { hitch as t };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AppletSourceDefinition, c as RegisteredCatalog, d as RegisteredRouter, f as RegisteredVariableKeys, h as registerHitchContract, i as AppletPackages, l as RegisteredContract, m as RegisteredWorkflows, n as AppletManifest, o as RegisteredAppletSourceDefinition, p as RegisteredVariables, r as AppletManifestObject, s as HitchRegister, t as AppletDefinition, u as RegisteredManifest } from "./manifest-BSUtHbu-.js";
-import { n as pruneContract, t as NarrowContract } from "./contract-D9wEvxGI.js";
+import { a as AppletSourceDefinition, c as RegisteredCatalog, d as RegisteredRouter, f as RegisteredVariableKeys, h as registerHitchContract, i as AppletPackages, l as RegisteredContract, m as RegisteredWorkflows, n as AppletManifest, o as RegisteredAppletSourceDefinition, p as RegisteredVariables, r as AppletManifestObject, s as HitchRegister, t as AppletDefinition, u as RegisteredManifest } from "./manifest-BBHD_EY9.js";
+import { n as pruneContract, t as NarrowContract } from "./contract-CJv-n1l3.js";
 import { a as UploadedHitchFile, c as filesContract, i as UploadProgress, n as FilesUpload, r as UploadFileOptions, s as uploadFile, t as FilesClient } from "./upload-D_kkmne_.js";
 import { a as EmailTracker, c as HitchEmailMessage, f as ListEmailTrackersOutput, g as emailContract, h as SendHitchEmailInput, i as EmailContract, l as HitchEmailThread, m as ListHitchEmailThreadsInput, n as TelephonyMessageReceivedEvent, o as HitchEmailAddress, p as ListHitchEmailMessagesInput, s as HitchEmailAttachment, t as EmailMessageReceivedEvent, u as HitchMailbox } from "./email-protocol-B9u_dh2p.js";
 import { ContractProcedure, Meta, Schema } from "@orpc/contract";

package/dist/index.js

@@ -1,5 +1,5 @@
 import { i as registerHitchContract, t as uploadFile } from "./upload-DRbVhuDm.js";
-import { t as pruneContract } from "./contract-BbOj5EB7.js";
+import { t as pruneContract } from "./contract-BeKz1Qcs.js";
 import { oc, type } from "@orpc/contract";
 //#region src/hitch/email.ts
 function emailContract(appletCode) {

package/dist/{init-BGQ_bP44.js → init-DT0faD-q.js}

@@ -1,8 +1,8 @@
 import { c as resolveInstanceUrl, s as resolveAuthForOrg } from "./store-B8N_8JIN.js";
 import { n as readWorkspaceConfig } from "./workspace-8yqXsvce.js";
-import { r as runGenerate } from "./generate-BV_emZgy.js";
-import { n as loadAppletSourceDefinition, o as APPLET_CODE_PATTERN, s as ORG_CODE_PATTERN } from "./load-config-Dkr2VxZN.js";
-import { a as writeAppletSupport, n as loadCliManifest, o as writeWorkspaceSupport, t as assertWorkspaceCli } from "./project-CCVqCCgU.js";
+import { r as runGenerate } from "./generate-8yyxKRSz.js";
+import { n as loadAppletSourceDefinition, o as APPLET_CODE_PATTERN, s as ORG_CODE_PATTERN } from "./load-config-BYrBjPlr.js";
+import { a as writeAppletSupport, n as loadCliManifest, o as writeWorkspaceSupport, t as assertWorkspaceCli } from "./project-CWVwic2C.js";
 import { access, cp, mkdir, readdir, writeFile } from "node:fs/promises";
 import { relative, resolve } from "node:path";
 import { spawn } from "node:child_process";

package/dist/lazy-client-CwIzYAoE.js

@@ -0,0 +1,14 @@
+//#region src/lazy-client.ts
+function createLazyClientProxy(build) {
+	let client;
+	const at = (path) => new Proxy(() => void 0, {
+		get: (_target, property) => at([...path, property]),
+		apply: (_target, _thisArg, args) => {
+			client ??= build();
+			return path.reduce((value, property) => value[property], client)(...args);
+		}
+	});
+	return at([]);
+}
+//#endregion
+export { createLazyClientProxy as t };

package/dist/{load-config-Dkr2VxZN.js → load-config-BYrBjPlr.js}

@@ -77,6 +77,7 @@ const appletManifestShape = {
 	name: nameSchema,
 	code: codeSchema,
 	requiresChangeset: z.uuid().optional(),
+	public: z.boolean().optional(),
 	telephony: z.strictObject({
 		read: z.boolean().optional(),
 		send: z.boolean().optional(),
@@ -110,17 +111,30 @@ const checkDuplicateCodes = (manifest, context) => {
 		]
 	});
 };
-const appletManifestSchema = z.strictObject(appletManifestShape).superRefine(checkDuplicateCodes);
+const checkPublicFields = (manifest, context) => {
+	if (!manifest.public) return;
+	[
+		"schedules",
+		"email",
+		"telephony"
+	].filter((field) => manifest[field] !== void 0).forEach((field) => context.addIssue({
+		code: "custom",
+		message: `Public applets cannot declare ${field}.`,
+		path: [field]
+	}));
+};
+const appletManifestSchema = z.strictObject(appletManifestShape).superRefine(checkDuplicateCodes).superRefine(checkPublicFields);
 z.strictObject({
 	name: appletManifestShape.name,
 	code: appletManifestShape.code,
 	requiresChangeset: appletManifestShape.requiresChangeset,
+	public: appletManifestShape.public,
 	telephony: appletManifestShape.telephony,
 	email: appletManifestShape.email,
 	schedules: appletManifestShape.schedules,
 	variables: appletManifestShape.variables,
 	objects: appletManifestShape.objects
-}).superRefine(checkDuplicateCodes);
+}).superRefine(checkDuplicateCodes).superRefine(checkPublicFields);
 const packageVersionsSchema = z.record(z.string().min(1), z.string().min(1)).readonly();
 const RESERVED_APPLET_PACKAGES = /* @__PURE__ */ new Set([
 	"@fontsource-variable/geist-mono",
@@ -188,6 +202,7 @@ const appletSourceDefinitionSchema = z.strictObject({
 	name: appletManifestShape.name,
 	code: appletManifestShape.code,
 	requiresChangeset: appletManifestShape.requiresChangeset,
+	public: appletManifestShape.public,
 	telephony: appletManifestShape.telephony,
 	email: appletManifestShape.email,
 	schedules: appletManifestShape.schedules,
@@ -198,6 +213,7 @@ const appletSourceDefinitionSchema = z.strictObject({
 }).superRefine((manifest, context) => {
 	checkDuplicateCodes(manifest, context);
 	checkSourcePackages(manifest, context);
+	checkPublicFields(manifest, context);
 });
 //#endregion
 //#region src/workspace.ts

package/dist/{logs-DOkT5ots.js → logs-CEIikWzV.js}

@@ -1,6 +1,6 @@
 import { n as readWorkspaceConfig } from "./workspace-8yqXsvce.js";
 import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
-import { o as APPLET_CODE_PATTERN, r as resolveWorkspaceOrg, t as loadAppletConfig } from "./load-config-Dkr2VxZN.js";
+import { o as APPLET_CODE_PATTERN, r as resolveWorkspaceOrg, t as loadAppletConfig } from "./load-config-BYrBjPlr.js";
 import { z } from "zod";
 //#region src/logs.ts
 const LOG_LEVELS = [

package/dist/{manifest-BSUtHbu-.d.ts → manifest-BBHD_EY9.d.ts}

@@ -34,6 +34,7 @@ interface AppletManifest {
   code: string;
   /** This code needs the schema as of this changeset. */
   requiresChangeset?: string;
+  public?: boolean;
   telephony?: {
     read?: boolean;
     send?: boolean;
@@ -78,13 +79,22 @@ type RouterSchedulePaths<R, Prefix extends string = ""> = R extends AnyProcedure
 type RegisteredSchedulePath = HitchRegister extends {
   router: infer R extends AnyRouter;
 } ? RouterSchedulePaths<R> : string;
-type RegisteredAppletManifest = Omit<AppletManifest, "objects" | "schedules"> & {
+type RegisteredAppletManifestFields = Omit<AppletManifest, "objects" | "schedules"> & {
   schedules?: readonly (Omit<NonNullable<AppletManifest["schedules"]>[number], "path"> & {
     path: RegisteredSchedulePath;
   })[];
   objects: readonly RegisteredAppletManifestObject[];
 };
-type RegisteredAppletDefinition = Omit<RegisteredAppletManifest, "org">;
+type RegisteredAppletManifest = (RegisteredAppletManifestFields & {
+  public?: false;
+}) | (Omit<RegisteredAppletManifestFields, "public" | "schedules" | "email" | "telephony"> & {
+  public: true;
+  schedules?: never;
+  email?: never;
+  telephony?: never;
+});
+type DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;
+type RegisteredAppletDefinition = DistributiveOmit<RegisteredAppletManifest, "org">;
 type RegisteredAppletSourceDefinition = RegisteredAppletDefinition & AppletPackages;
 //#endregion
 export { AppletSourceDefinition as a, RegisteredCatalog as c, RegisteredRouter as d, RegisteredVariableKeys as f, registerHitchContract as h, AppletPackages as i, RegisteredContract as l, RegisteredWorkflows as m, AppletManifest as n, RegisteredAppletSourceDefinition as o, RegisteredVariables as p, AppletManifestObject as r, HitchRegister as s, AppletDefinition as t, RegisteredManifest as u };

package/dist/{project-CCVqCCgU.js → project-CWVwic2C.js}

@@ -1,6 +1,6 @@
 import { a as organizationInstanceUrl, n as DEFAULT_INSTANCE_URL } from "./store-B8N_8JIN.js";
 import { n as readWorkspaceConfig } from "./workspace-8yqXsvce.js";
-import { n as loadAppletSourceDefinition } from "./load-config-Dkr2VxZN.js";
+import { n as loadAppletSourceDefinition } from "./load-config-BYrBjPlr.js";
 import { z } from "zod";
 import { existsSync } from "node:fs";
 import { cp, mkdir, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
@@ -204,7 +204,7 @@ minimumReleaseAgeExclude:
   - "@hitch42/*"
 `;
 }
-const OXLINT_CONFIG = `{
+const oxlintConfigFile = (publicOverrides = "") => `{
   "$schema": "./node_modules/oxlint/configuration_schema.json",
   "plugins": ["eslint", "typescript", "unicorn", "import", "node"],
   "options": { "typeAware": true, "typeCheck": true },
@@ -248,18 +248,42 @@ const OXLINT_CONFIG = `{
           { "assertFunctionNames": ["expect", "expect*", "assert", "assert.*", "assert*"] }
         ]
       }
-    }
+    }${publicOverrides}
   ]
 }
 `;
+async function oxlintConfig(root) {
+	const appletsRoot = resolve(root, "applets");
+	const applets = existsSync(appletsRoot) ? await readdir(appletsRoot, { withFileTypes: true }) : [];
+	const publicApplets = (await Promise.all(applets.filter((applet) => applet.isDirectory() && existsSync(resolve(appletsRoot, applet.name, "applet.manifest.ts"))).map(async (applet) => {
+		return (await loadAppletSourceDefinition(resolve(appletsRoot, applet.name))).public === true ? applet.name : null;
+	}))).filter((code) => code !== null).sort();
+	return oxlintConfigFile(publicApplets.map((name) => `,
+    {
+      "files": [${JSON.stringify(`applets/${name}/**`)}],
+      "rules": {
+        "eslint/no-restricted-imports": [
+          "error",
+          {
+            "paths": [
+              {
+                "name": "@hitch42/applet/client/hitch",
+                "message": "Public applets have no Hitch client SDK. Call your server procedures with api from @hitch42/applet/client."
+              }
+            ]
+          }
+        ]
+      }
+    }`).join(""));
+}
 async function oxfmtConfig(root) {
 	const appletsRoot = resolve(root, "applets");
 	const overrides = (existsSync(appletsRoot) ? await readdir(appletsRoot) : []).filter((code) => existsSync(resolve(appletsRoot, code, "src/client/styles/globals.css"))).sort().map((code) => `
     {
-      "files": ["applets/${code}/**"],
+      "files": [${JSON.stringify(`applets/${code}/**`)}],
       "options": {
         "sortTailwindcss": {
-          "stylesheet": "applets/${code}/src/client/styles/globals.css",
+          "stylesheet": ${JSON.stringify(`applets/${code}/src/client/styles/globals.css`)},
           "functions": ["cn", "cva"]
         }
       }
@@ -331,6 +355,7 @@ async function writeWorkspaceSupport(root, config, cli) {
 	await ensureAgentConfigs(root, config.org);
 	const deployWorkflowTarget = resolve(root, ".github/workflows/hitch.yml");
 	const agents = await readFile(new URL("../scaffold/AGENTS.md", import.meta.url), "utf8");
+	const [lintConfig, formatConfig] = await Promise.all([oxlintConfig(root), oxfmtConfig(root)]);
 	await Promise.all([
 		mkdir(resolve(root, ".agents/skills"), { recursive: true }),
 		mkdir(resolve(root, ".claude/skills"), { recursive: true }),
@@ -346,8 +371,8 @@ async function writeWorkspaceSupport(root, config, cli) {
 		writeFile(resolve(root, "pnpm-workspace.yaml"), workspaceFile(resolvedCli)),
 		config.githubWorkflow === false || existsSync(deployWorkflowTarget) ? void 0 : cp(new URL("../scaffold/.github/workflows/hitch.yml", import.meta.url), deployWorkflowTarget),
 		writeFile(resolve(root, ".node-version"), "24\n"),
-		writeFile(resolve(root, ".oxlintrc.json"), OXLINT_CONFIG),
-		oxfmtConfig(root).then((config) => writeFile(resolve(root, ".oxfmtrc.json"), config)),
+		writeFile(resolve(root, ".oxlintrc.json"), lintConfig),
+		writeFile(resolve(root, ".oxfmtrc.json"), formatConfig),
 		writeGitignore(root),
 		writeFile(resolve(root, "AGENTS.md"), agents)
 	]);
@@ -506,7 +531,7 @@ export default defineConfig({
     "jsx": "react-jsx",
     "types": ["vite/client", "node"],
     "paths": {
-      "@/*": ["./src/*"]
+      "@/*": ["./src/*"]${definition.public === true ? ",\n      \"@hitch42/applet/client/hitch\": [\"./node_modules/@hitch42/applet/types/public-applet-client-hitch.d.ts\"]" : ""}
     }
   },
   "include": [

package/dist/query-utils-zz9pVjgp.d.ts

@@ -0,0 +1,25 @@
+import { NestedClient } from "@orpc/client";
+import { RouterUtils } from "@orpc/tanstack-query";
+//#region src/query-utils.d.ts
+type Exact<Expected, Actual> = Actual extends symbol ? Actual : Actual extends Expected ? Actual extends readonly unknown[] ? Actual : Actual extends object ? NonNullable<Expected> extends object ? { [Key in keyof Actual]: Key extends keyof NonNullable<Expected> ? Exact<NonNullable<Expected>[Key], Actual[Key]> : never; } : Actual : Actual : never;
+type QueryOptionsFunction<Utils> = Extract<Utils extends {
+  queryOptions: infer Function;
+} ? Function : never, (...args: never[]) => unknown>;
+type QueryOptionsArgument<Utils> = NonNullable<Parameters<QueryOptionsFunction<Utils>>[0]>;
+type ExactOptions<Input, Options> = Options extends {
+  input: infer Actual;
+} ? Options & {
+  input: Exact<Input, Actual>;
+} : Options extends {
+  input?: infer Actual;
+} ? Options & {
+  input?: Exact<Input, Actual>;
+} : Options;
+type QueryOptionsResult<Utils, Options> = Options & Omit<ReturnType<QueryOptionsFunction<Utils>>, keyof Options>;
+type ExactQueryOptions<Utils, Input> = <Options extends QueryOptionsArgument<Utils> = QueryOptionsArgument<Utils>>(...rest: undefined extends Input ? [options?: ExactOptions<Input, Options>] : [options: ExactOptions<Input, Options>]) => QueryOptionsResult<Utils, Options>;
+type ClientTree = NestedClient<Record<never, never>>;
+type ExactRouterUtils<Client extends ClientTree> = Client extends ((...args: infer Arguments) => unknown) ? Omit<RouterUtils<Client>, "queryOptions"> & {
+  queryOptions: ExactQueryOptions<RouterUtils<Client>, Arguments[0]>;
+} : Omit<RouterUtils<Client>, keyof Client> & { [Key in keyof Client]: Client[Key] extends ClientTree ? ExactRouterUtils<Client[Key]> : never; };
+//#endregion
+export { ExactRouterUtils as t };

package/dist/{schedules-D6-3v-Az.js → schedules-B7xNl9oy.js}

@@ -1,4 +1,4 @@
-import { t as loadAppletConfig } from "./load-config-Dkr2VxZN.js";
+import { t as loadAppletConfig } from "./load-config-BYrBjPlr.js";
 import { t as question } from "./prompt-ChS-grYO.js";
 import { RPCLink } from "@orpc/client/fetch";
 import { readFile } from "node:fs/promises";

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 import { a as createWorkflow, i as WorkflowStep, n as WorkflowDefinition, r as WorkflowDuration } from "./workflow-DurM6Fwx.js";
-import { l as RegisteredContract, m as RegisteredWorkflows, p as RegisteredVariables, u as RegisteredManifest } from "./manifest-BSUtHbu-.js";
-import { t as NarrowContract } from "./contract-D9wEvxGI.js";
+import { l as RegisteredContract, m as RegisteredWorkflows, p as RegisteredVariables, u as RegisteredManifest } from "./manifest-BBHD_EY9.js";
+import { t as NarrowContract } from "./contract-CJv-n1l3.js";
 import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
 import { o as WithFilesUpload } from "./upload-D_kkmne_.js";
 import { ContractRouterClient } from "@orpc/contract";
@@ -44,8 +44,11 @@ declare const log: {
 //#region src/author/server.d.ts
 type AuthorContract = NarrowContract<RegisteredContract, RegisteredManifest>;
 type AuthorHitchClient = WithBatchRecorder<ContractRouterClient<AuthorContract>>;
-declare const hitch: WithFilesUpload<AuthorHitchClient> & {
+type AuthorHitch = WithFilesUpload<AuthorHitchClient> & (RegisteredManifest extends {
+  public: true;
+} ? {} : {
   workflows: WorkflowsClient<RegisteredWorkflows>;
-};
+});
+declare const hitch: AuthorHitch;
 //#endregion
 export { type AppletEnv, type WorkflowDefinition, type WorkflowDuration, type WorkflowStep, createWorkflow, env, hitch, log };

package/dist/server.js

@@ -1,8 +1,9 @@
 import { n as withFilesUpload, r as getRegisteredHitchContract } from "./upload-DRbVhuDm.js";
-import { t as HITCH_APPLET_CODE_HEADER } from "./headers-DkNr9MLJ.js";
+import { t as HITCH_APPLET_CODE_HEADER } from "./headers-CeRX-Xji.js";
 import { a as getRequestContext, i as getIdentityBearer, n as createWorkflow, s as tryGetRequestContext } from "./workflow-CTo2kZF1.js";
 import { s as publishNote, t as APP_CONTEXT_CHANNEL } from "./log-context-DWznGjfz.js";
-import { n as withBatchRecorder, t as createLazyClientProxy } from "./lazy-client-x0DCI98S.js";
+import { t as withBatchRecorder } from "./batch-_ZjAg-Kk.js";
+import { t as createLazyClientProxy } from "./lazy-client-CwIzYAoE.js";
 import { createORPCClient } from "@orpc/client";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
 //#region src/hitch/server.ts

package/dist/{telephony.d.ts → use-phone-M7c_HsB7.d.ts}

@@ -94,4 +94,4 @@ declare const usePhone: () => {
   active: Phone["active"];
 };
 //#endregion
-export { type Phone, type PhoneState, createPhone, usePhone };
+export { createPhone as i, Phone as n, PhoneState as r, usePhone as t };

package/dist/{telephony.js → use-phone-ug4B5gQp.js}

@@ -723,4 +723,4 @@ const usePhone = () => {
 	};
 };
 //#endregion
-export { createPhone, usePhone };
+export { createPhone as n, usePhone as t };

package/dist/{variables-BSFZnLxY.js → variables-DCbLJBr0.js}

@@ -1,5 +1,5 @@
 import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
-import { t as loadAppletConfig } from "./load-config-Dkr2VxZN.js";
+import { t as loadAppletConfig } from "./load-config-BYrBjPlr.js";
 import { t as question } from "./prompt-ChS-grYO.js";
 import { z } from "zod";
 //#region src/variables.ts

package/dist/vite.d.ts

@@ -1,4 +1,4 @@
-import { o as RegisteredAppletSourceDefinition } from "./manifest-BSUtHbu-.js";
+import { o as RegisteredAppletSourceDefinition } from "./manifest-BBHD_EY9.js";
 import { PluginOption } from "vite";
 //#region src/vite.d.ts
 declare function applet<const M extends RegisteredAppletSourceDefinition>(sourceDefinition: M): PluginOption[];

package/dist/vite.js

@@ -1,10 +1,10 @@
-import { t as pruneContract } from "./contract-BbOj5EB7.js";
+import { t as pruneContract } from "./contract-BeKz1Qcs.js";
 import { a as openQueryCacheDatabase } from "./query-cache-CXmAyLv3.js";
-import { d as HITCH_USER_HEADER, u as HITCH_SESSION_HEADER } from "./headers-DkNr9MLJ.js";
+import { d as HITCH_SESSION_HEADER, f as HITCH_USER_HEADER } from "./headers-CeRX-Xji.js";
 import { a as workflowOutcomeSchema, n as runWorkflowJournal } from "./workflow-engine-BOTzURKM.js";
 import { a as organizationInstanceUrl, c as resolveInstanceUrl, o as rejectEnvironmentKey, r as bearerToken, s as resolveAuthForOrg } from "./store-B8N_8JIN.js";
-import { a as writeRegisterDeclaration, c as writeAppletRoot, d as writeServerEntry, i as syncContract, l as writeClientEntry, n as routesModuleSource, u as writeManifestGen } from "./generate-BV_emZgy.js";
-import { a as appletSourceDefinitionSchema, i as appletManifestSchema, o as APPLET_CODE_PATTERN, r as resolveWorkspaceOrg } from "./load-config-Dkr2VxZN.js";
+import { a as writeRegisterDeclaration, c as writeAppletRoot, d as writeServerEntry, i as syncContract, l as writeClientEntry, n as routesModuleSource, u as writeManifestGen } from "./generate-8yyxKRSz.js";
+import { a as appletSourceDefinitionSchema, i as appletManifestSchema, o as APPLET_CODE_PATTERN, r as resolveWorkspaceOrg } from "./load-config-BYrBjPlr.js";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -296,6 +296,18 @@ function createDevWorkflows(options) {
 	};
 }
 //#endregion
+//#region src/lazy-client-react.ts
+const CLIENT_REACT = "@hitch42/applet/client/react";
+const lazyClientReact = {
+	name: "hitch-lazy-client-react",
+	enforce: "pre",
+	apply: "build",
+	resolveId(source, importer, options) {
+		if (source !== CLIENT_REACT || options.kind !== "dynamic-import") return;
+		return this.resolve(`${CLIENT_REACT}?lazy`, importer, { skipSelf: true });
+	}
+};
+//#endregion
 //#region src/hitch/me-schemas.ts
 const personSchema = z.object({
 	id: z.uuid(),
@@ -560,6 +572,7 @@ function applet(sourceDefinition) {
 	}
 	const { dependencies: _dependencies, devDependencies: _devDependencies, ...definition } = parsedSourceDefinition.data;
 	const parsedDefinition = { data: definition };
+	const mountPath = definition.public ? `app/${definition.code}` : definition.code;
 	let appletConfig;
 	let buildRootOutDir;
 	let clearedOutDir = false;
@@ -577,7 +590,7 @@ function applet(sourceDefinition) {
 		children: [{
 			type: "physical",
 			directory: ".",
-			pathPrefix: parsedDefinition.data.code
+			pathPrefix: mountPath
 		}]
 	};
 	const resolveAppletConfig = (root) => {
@@ -661,7 +674,7 @@ function applet(sourceDefinition) {
 				}) : void 0,
 				hasClient && !hasAuthorRoot ? writeAppletRoot(root) : void 0,
 				hasServer ? writeServerEntry(root, hasHitchGen, manifest.code) : void 0,
-				hasHitchGen ? void 0 : writeRegisterDeclaration(resolve(root, ".hitch"))
+				hasHitchGen ? void 0 : writeRegisterDeclaration(resolve(root, ".hitch"), void 0, manifest.public === true)
 			]);
 			if (environment.command === "serve" && environment.mode !== "test" && environment.isPreview !== true) {
 				const instanceUrl = await resolveInstanceUrl();
@@ -726,7 +739,7 @@ function applet(sourceDefinition) {
 				if (colocated.length > 0) throw new Error(`Applet tests run only from the test folder. Move ${colocated.map((path) => `src/${path}`).join(", ")} to test/.`);
 			}
 			return {
-				base: `/${manifest.code}/`,
+				base: `/${mountPath}/`,
 				test: { include: ["test/**/*.test.{ts,tsx}"] },
 				resolve: { alias: {
 					"clsx/lite": "cn/lite",
@@ -764,7 +777,7 @@ function applet(sourceDefinition) {
 				invoke: async (workflow, body) => {
 					const address = server.httpServer?.address();
 					if (address === null || address === void 0 || typeof address === "string") throw new Error("The dev server has no port.");
-					const response = await fetch(`http://localhost:${address.port}/${manifest.code}/api/__hitch/workflows/${encodeURIComponent(workflow)}`, {
+					const response = await fetch(`http://localhost:${address.port}/${mountPath}/api/__hitch/workflows/${encodeURIComponent(workflow)}`, {
 						method: "POST",
 						headers: { "content-type": "application/json" },
 						body: JSON.stringify(body)
@@ -806,7 +819,7 @@ function applet(sourceDefinition) {
 				process.off("exit", removeDevServerFile);
 				removeDevServerFile();
 			});
-			const mount = `/${manifest.code}`;
+			const mount = `/${mountPath}`;
 			const apiPrefix = `${mount}/api`;
 			server.middlewares.use((request, response, next) => {
 				if (request.url === mount || request.url?.startsWith(`${mount}?`)) request.url = `${mount}/${request.url.slice(mount.length)}`;
@@ -923,6 +936,7 @@ function applet(sourceDefinition) {
 			...clsxFromCn,
 			enforce: "pre"
 		},
+		lazyClientReact,
 		...hasClientSource ? [
 			tanstackRouter({
 				generatedRouteTree: ".hitch/routeTree.gen.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hitch42/applet",
-  "version": "0.1.1-beta.17",
+  "version": "0.1.1-beta.19",
   "license": "MIT",
   "bin": {
     "applet": "./dist/applet.js"
@@ -8,7 +8,8 @@
   "files": [
     "dist",
     "fonts",
-    "scaffold"
+    "scaffold",
+    "types"
   ],
   "type": "module",
   "sideEffects": [
@@ -27,22 +28,6 @@
       "source": "./src/author/client.ts",
       "default": "./dist/client.js"
     },
-    "./react": {
-      "source": "./src/react/index.ts",
-      "default": "./dist/react.js"
-    },
-    "./react/markdown": {
-      "source": "./src/react/markdown.tsx",
-      "default": "./dist/react/markdown.js"
-    },
-    "./react/markdown-editor": {
-      "source": "./src/react/markdown-editor.tsx",
-      "default": "./dist/react/markdown-editor.js"
-    },
-    "./telephony": {
-      "source": "./src/telephony/index.ts",
-      "default": "./dist/telephony.js"
-    },
     "./vite": {
       "source": "./src/vite.ts",
       "default": "./dist/vite.js"
@@ -59,6 +44,14 @@
     "./_internal/log-context": {
       "source": "./src/server/log-context.ts",
       "default": "./dist/_internal/log-context.js"
+    },
+    "./client/hitch": {
+      "source": "./src/author/client-hitch.ts",
+      "default": "./dist/client/hitch.js"
+    },
+    "./client/react": {
+      "source": "./src/react/index.ts",
+      "default": "./dist/client/react.js"
     }
   },
   "dependencies": {

package/scaffold/.agents/skills/hitch-applets/SKILL.md

@@ -9,6 +9,12 @@ Build small applets against an organization's Hitch data. Keep each applet focus
 
 Treat each applet as an isolated microfrontend. Keep it separate from the data storage layer, and access Hitch data through the SDK.
 
+## Public applets
+
+Set `public: true` for an applet that anonymous visitors can use. It is served at `https://{org}.hitch42.app/app/{code}`. It runs as the applet identity. Its manifest grants cap its access.
+
+A public applet cannot use schedules, email, telephony, workflows, or `@hitch42/applet/client/hitch`. Client code calls its server procedures with `api` from `@hitch42/applet/client`.
+
 ## Go deeper
 
 This file holds the common rules. Read each matching reference before you edit an applet. Paths are relative to this file.
@@ -75,7 +81,7 @@ Use the client SDK unless the task needs a secret or an external service:
 
 ```ts
 import { useQuery } from "@tanstack/react-query";
-import { hitch } from "@hitch42/applet/client";
+import { hitch } from "@hitch42/applet/client/hitch";
 
 const deals = useQuery(
   hitch.records.deals.list.queryOptions({
@@ -122,7 +128,7 @@ Do not invent fields or silence type errors with casts. Ask the user when genera
 Upload a file with one call. The SDK creates the file record and sends the bytes directly to storage:
 
 ```ts
-import { hitch } from "@hitch42/applet/client";
+import { hitch } from "@hitch42/applet/client/hitch";
 
 const uploaded = await hitch.files.upload(file); // file is a web File
 ```

package/scaffold/.agents/skills/hitch-applets/references/files.md

@@ -11,7 +11,7 @@ Use the file API to upload bytes, read file metadata, and link files to records.
 - A failed upload throws an `Error` and leaves no usable id. Call `upload(file)` again to retry — the abandoned row is harmless.
 
 ```ts
-import { hitch } from "@hitch42/applet/client";
+import { hitch } from "@hitch42/applet/client/hitch";
 
 const uploaded = await hitch.files.upload(file);
 ```
@@ -34,7 +34,7 @@ Use a TanStack mutation in a React component:
 
 ```ts
 import { useMutation } from "@tanstack/react-query";
-import { hitch } from "@hitch42/applet/client";
+import { hitch } from "@hitch42/applet/client/hitch";
 
 const upload = useMutation({
   mutationFn: (file: File) => hitch.files.upload(file),

package/scaffold/.agents/skills/hitch-applets/references/markdown.md

@@ -9,8 +9,8 @@ Use the SDK components to edit and render markdown with Hitch file images.
 The editor supports GFM tables and task lists. A plain table serializes as GFM. A table with block content in a cell (for example a list) serializes as inline HTML, which the `Markdown` renderer also renders.
 
 ```tsx
-import { hitch } from "@hitch42/applet/client";
-import { MarkdownEditor } from "@hitch42/applet/react/markdown-editor";
+import { hitch } from "@hitch42/applet/client/hitch";
+import { MarkdownEditor } from "@hitch42/applet/client/react";
 
 <MarkdownEditor value={value} onChange={setValue} files={hitch.files} />;
 ```
@@ -31,7 +31,9 @@ The editor uses Tiptap and is large (about 166 KB gzip). Load it lazily when it
 import { lazy, Suspense } from "react";
 
 const MarkdownEditor = lazy(() =>
-  import("@hitch42/applet/react/markdown-editor").then((m) => ({ default: m.MarkdownEditor })),
+  import("@hitch42/applet/client/react").then((m) => ({
+    default: m.MarkdownEditor,
+  })),
 );
 
 <Suspense fallback={<div className="min-h-32" />}>
@@ -39,15 +41,15 @@ const MarkdownEditor = lazy(() =>
 </Suspense>;
 ```
 
-Use the `/react/markdown-editor` path for the lazy import. A lazy import from `@hitch42/applet/react` does not split the editor out when the applet also imports `Markdown`.
+The lazy import splits the editor out even when the page also imports `Markdown` statically: the `applet()` Vite plugin gives the dynamic import its own module.
 
 ## Render markdown
 
 Pass the same files surface to `Markdown`:
 
 ```tsx
-import { hitch } from "@hitch42/applet/client";
-import { Markdown } from "@hitch42/applet/react/markdown";
+import { hitch } from "@hitch42/applet/client/hitch";
+import { Markdown } from "@hitch42/applet/client/react";
 
 <Markdown files={hitch.files}>{value}</Markdown>;
 ```

package/scaffold/.agents/skills/hitch-applets/references/records.md

@@ -2,7 +2,7 @@
 
 Use the generated Hitch contract as the typed data plane.
 
-- Import `hitch` from `@hitch42/applet/client` in client code.
+- Import `hitch` from `@hitch42/applet/client/hitch` in client code. A public applet has no client `hitch`: it calls its own server procedures with `api` from `@hitch42/applet/client`.
 - Import `hitch` from `@hitch42/applet/server` in server code.
 - Read object codes, attribute codes, inputs, and outputs from the generated types.
 - Use only the target applet's `.hitch` types as schema evidence.
@@ -33,7 +33,7 @@ Use TanStack Query options from each generated procedure.
 
 ```ts
 import { useQuery } from "@tanstack/react-query";
-import { hitch } from "@hitch42/applet/client";
+import { hitch } from "@hitch42/applet/client/hitch";
 
 const deals = useQuery(
   hitch.records.deals.query.queryOptions({
@@ -46,7 +46,7 @@ const deals = useQuery(
 
 ```ts
 import { useMutation } from "@tanstack/react-query";
-import { hitch } from "@hitch42/applet/client";
+import { hitch } from "@hitch42/applet/client/hitch";
 
 const createDeal = useMutation(hitch.records.deals.create.mutationOptions());
 

package/scaffold/.github/workflows/hitch.yml

@@ -12,4 +12,4 @@ jobs:
       contents: read
       id-token: write
     # Hitch verifies the called workflow's commit SHA from the OIDC token.
-    uses: hitch-42/actions/.github/workflows/deploy.yml@4097528b45f7e2962eee9b67ff20a09a6c032d60
+    uses: hitch-42/actions/.github/workflows/deploy.yml@01e0cfa0a58c6186d678d425e96d8da330226e55

package/types/public-applet-client-hitch.d.ts

@@ -0,0 +1,2 @@
+// Public applets have no Hitch client SDK. Call your server procedures with api from @hitch42/applet/client.
+export {};

package/dist/build-ueR7XjZT.js

@@ -1,2 +0,0 @@
-import { i as runBuild } from "./build-XHoa_sJL.js";
-export { runBuild };

package/dist/generate-C9bWqdaB.js

@@ -1,2 +0,0 @@
-import { r as runGenerate } from "./generate-BV_emZgy.js";
-export { runGenerate };

package/dist/react/markdown-editor.js

@@ -1,2 +0,0 @@
-import { t as MarkdownEditor } from "../markdown-editor-C5mLHGqu.js";
-export { MarkdownEditor };

package/dist/react/markdown.d.ts

@@ -1,2 +0,0 @@
-import { n as MarkdownFiles, r as MarkdownProps, t as Markdown } from "../markdown-DSHOQIOb.js";
-export { Markdown, MarkdownFiles, MarkdownProps };

package/dist/react/markdown.js

@@ -1,2 +0,0 @@
-import { t as Markdown } from "../markdown-CwlqzBtP.js";
-export { Markdown };

package/dist/react.js

@@ -1,3 +0,0 @@
-import { t as Markdown } from "./markdown-CwlqzBtP.js";
-import { t as MarkdownEditor } from "./markdown-editor-C5mLHGqu.js";
-export { Markdown, MarkdownEditor };