@hitch42/applet 0.1.1-beta.19 → 0.1.1-beta.21

package/dist/{use-phone-ug4B5gQp.js → use-phone-CB_idmrz.js}

@@ -1,5 +1,5 @@
 import { useEffect, useSyncExternalStore } from "react";
-//#region src/telephony/api.ts
+// src/telephony/api.ts
 var TelephonyApiError = class extends Error {
 	code;
 	status;
@@ -14,7 +14,7 @@ const createTelephonyApi = (baseUrl = location.origin) => {
 	const request = async (path, init) => {
 		const headers = new Headers(init?.headers);
 		if (init?.body) headers.set("content-type", "application/json");
-		const response = await fetch(`${baseUrl.replace(/\/$/, "")}/api/v1/telephony/${path}`, {
+		const response = await fetch(`${baseUrl.replace(/\/$/, "")}/api/${path}`, {
 			credentials: "include",
 			...init,
 			headers
@@ -28,29 +28,28 @@ const createTelephonyApi = (baseUrl = location.origin) => {
 		return response.json();
 	};
 	return {
-		token: (deviceKey, acceptsCalls) => request("voice/token", {
+		token: (deviceKey, acceptsCalls) => request("applet/v1/telephony/voice/token", {
 			method: "POST",
 			body: JSON.stringify({
 				deviceKey,
 				acceptsCalls
 			})
 		}),
-		startCall: (numberId, to) => request("calls", {
+		startCall: (numberId, to) => request("applet/v1/telephony/calls", {
 			method: "POST",
 			body: JSON.stringify({
 				numberId,
 				to
 			})
 		}),
-		getCall: (callId) => request(`calls/${encodeURIComponent(callId)}`),
-		uploadUrl: (callId) => request(`calls/${encodeURIComponent(callId)}/recording`, {
+		getCall: (callId) => request(`resource/v1/telephony/calls/${encodeURIComponent(callId)}`),
+		uploadUrl: (callId) => request(`applet/v1/telephony/calls/${encodeURIComponent(callId)}/recording`, {
 			method: "POST",
 			body: "{}"
 		})
 	};
 };
-//#endregion
-//#region src/telephony/recorder.ts
+// src/telephony/recorder.ts
 const DB_NAME = "hitch-telephony";
 const STORE = "recordings";
 const openDatabase = () => new Promise((resolve, reject) => {
@@ -162,8 +161,7 @@ const startRecording = async (callId, call, api, onError) => {
 		throw error;
 	}
 };
-//#endregion
-//#region src/telephony/phone.ts
+// src/telephony/phone.ts
 const DEVICE_KEY = "hitch:telephony:device";
 let singleton;
 var Phone = class {
@@ -708,8 +706,7 @@ var Phone = class {
 	}
 };
 const createPhone = (options = {}) => singleton ??= new Phone(options);
-//#endregion
-//#region src/telephony/use-phone.ts
+// src/telephony/use-phone.ts
 const usePhone = () => {
 	const phone = createPhone();
 	const state = useSyncExternalStore(phone.subscribe, phone.getSnapshot);
@@ -722,5 +719,4 @@ const usePhone = () => {
 		active: phone.active
 	};
 };
-//#endregion
 export { createPhone as n, usePhone as t };

package/dist/{use-phone-M7c_HsB7.d.ts → use-phone-DBAkasPq.d.ts}

@@ -1,4 +1,3 @@
-//#region src/telephony/phone.d.ts
 type PhoneState = {
   owner: boolean;
   status: "off" | "connecting" | "ready" | "error";
@@ -86,12 +85,9 @@ declare const createPhone: (options?: {
   baseUrl?: string;
   acceptsCalls?: boolean;
 }) => Phone;
-//#endregion
-//#region src/telephony/use-phone.d.ts
 declare const usePhone: () => {
   state: PhoneState;
   call: Phone["call"];
   active: Phone["active"];
 };
-//#endregion
 export { createPhone as i, Phone as n, PhoneState as r, usePhone as t };

package/dist/{variables-DCbLJBr0.js → variables-CgZstC7I.js}

@@ -1,8 +1,8 @@
-import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
-import { t as loadAppletConfig } from "./load-config-BYrBjPlr.js";
-import { t as question } from "./prompt-ChS-grYO.js";
+import { n as fetchWithOrgAuth } from "./auth-DuMRqSGe.js";
+import { t as loadAppletConfig } from "./load-config-Cffvj-aM.js";
+import { t as question } from "./prompt-CW98R-Un.js";
 import { z } from "zod";
-//#region src/variables.ts
+// src/variables.ts
 const variableRowSchema = z.object({
 	key: z.string(),
 	secret: z.boolean(),
@@ -57,7 +57,7 @@ async function runVariablesSet(options) {
 	const manifest = await loadAppletConfig(process.cwd());
 	await confirmLiveChange(manifest.code, options);
 	const fetcher = globalThis.fetch;
-	const response = await fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
+	const response = await fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/manage/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
 		method: "PUT",
 		headers: {
 			Authorization: `Bearer ${accessToken}`,
@@ -77,7 +77,7 @@ async function runVariablesSet(options) {
 }
 async function runVariablesList() {
 	const fetcher = globalThis.fetch;
-	const { code, response } = await requestForApplet((instanceUrl, accessToken, appletCode) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(appletCode)}/variables`, { headers: { Authorization: `Bearer ${accessToken}` } }));
+	const { code, response } = await requestForApplet((instanceUrl, accessToken, appletCode) => fetcher(`${instanceUrl}/api/manage/v1/applets/${encodeURIComponent(appletCode)}/variables`, { headers: { Authorization: `Bearer ${accessToken}` } }));
 	if (!response.ok) {
 		const { code: errorCode, message } = await readErrorDetails(response);
 		throw variablesError(response.status, errorCode, message);
@@ -93,7 +93,7 @@ async function runVariablesDelete(options) {
 	const manifest = await loadAppletConfig(process.cwd());
 	await confirmLiveChange(manifest.code, options);
 	const fetcher = globalThis.fetch;
-	const response = await fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
+	const response = await fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/manage/v1/applets/${encodeURIComponent(manifest.code)}/variables/${encodeURIComponent(options.key)}`, {
 		method: "DELETE",
 		headers: { Authorization: `Bearer ${accessToken}` }
 	}));
@@ -104,5 +104,4 @@ async function runVariablesDelete(options) {
 	}
 	console.log(`Deleted ${options.key} from applet "${manifest.code}".`);
 }
-//#endregion
 export { runVariablesDelete, runVariablesList, runVariablesSet };

package/dist/vite.d.ts

@@ -1,6 +1,4 @@
-import { o as RegisteredAppletSourceDefinition } from "./manifest-BBHD_EY9.js";
+import { o as RegisteredAppletSourceDefinition } from "./manifest-CpghlaJc.js";
 import { PluginOption } from "vite";
-//#region src/vite.d.ts
 declare function applet<const M extends RegisteredAppletSourceDefinition>(sourceDefinition: M): PluginOption[];
-//#endregion
 export { applet };

package/dist/vite.js

@@ -1,17 +1,20 @@
-import { t as pruneContract } from "./contract-BeKz1Qcs.js";
-import { a as openQueryCacheDatabase } from "./query-cache-CXmAyLv3.js";
-import { d as HITCH_SESSION_HEADER, f as HITCH_USER_HEADER } from "./headers-CeRX-Xji.js";
-import { a as workflowOutcomeSchema, n as runWorkflowJournal } from "./workflow-engine-BOTzURKM.js";
-import { a as organizationInstanceUrl, c as resolveInstanceUrl, o as rejectEnvironmentKey, r as bearerToken, s as resolveAuthForOrg } from "./store-B8N_8JIN.js";
-import { a as writeRegisterDeclaration, c as writeAppletRoot, d as writeServerEntry, i as syncContract, l as writeClientEntry, n as routesModuleSource, u as writeManifestGen } from "./generate-8yyxKRSz.js";
-import { a as appletSourceDefinitionSchema, i as appletManifestSchema, o as APPLET_CODE_PATTERN, r as resolveWorkspaceOrg } from "./load-config-BYrBjPlr.js";
+import { t as pruneContract } from "./contract-D9LCNGjD.js";
+import { a as openQueryCacheDatabase } from "./query-cache-DQJy45RT.js";
+import { d as HITCH_SESSION_HEADER, f as HITCH_USER_HEADER } from "./headers-BcEMIVCo.js";
+import { a as workflowOutcomeSchema, n as runWorkflowJournal } from "./workflow-engine-CyyaVENo.js";
+import { r as writeGeneratedAgents } from "./generated-agents-BUnJ0FQA.js";
+import { d as rejectEnvironmentKey, i as bearerToken, l as organizationInstanceUrl, m as resolveInstanceUrl, p as resolveAuthForOrg } from "./store-E5NhITHl.js";
+import { c as validateRootManifest, o as isRootLayout } from "./workspace-CtIKSgMD.js";
+import { a as appletSourceDefinitionSchema, i as appletReleaseManifest, o as resolveWorkspaceOrg, r as appletMountPath } from "./load-config-Cffvj-aM.js";
+import { a as writeRegisterDeclaration, c as writeAppletRoot, d as writeServerEntry, i as syncContract, l as writeClientEntry, n as routesModuleSource, u as writeManifestGen } from "./generate-48pqFh5M.js";
+import { t as APPLET_CODE_PATTERN } from "./manifest-patterns-BfxqImlp.js";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
+import { pathToFileURL } from "node:url";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { appendFile, readdir, rm, writeFile } from "node:fs/promises";
-import { createServer } from "node:http";
 import { basename, dirname, relative, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+import { createServer } from "node:http";
 import { cloudflare } from "@cloudflare/vite-plugin";
 import optimizeLocales from "@react-aria/optimize-locales-plugin";
 import { tanstackRouter } from "@tanstack/router-plugin/vite";
@@ -19,7 +22,7 @@ import react from "@vitejs/plugin-react";
 import { normalizePath } from "vite";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-//#region src/dev-proxy.ts
+// src/dev-proxy.ts
 const REQUEST_DROP = /* @__PURE__ */ new Set([
 	"host",
 	"connection",
@@ -56,7 +59,8 @@ function createDevProxy(options) {
 		if (intercepted !== void 0) return intercepted;
 		const headers = new Headers(request.headers);
 		[...headers.keys()].filter((name) => REQUEST_DROP.has(name) || name.startsWith("x-hitch-")).forEach((name) => headers.delete(name));
-		headers.set("authorization", `Bearer ${options.token}`);
+		const token = typeof options.token === "string" ? options.token : await options.token();
+		headers.set("authorization", `Bearer ${token}`);
 		const url = new URL(request.url);
 		const upstream = await globalThis.fetch(`${options.orgUrl}${url.pathname}${url.search}`, {
 			method: request.method,
@@ -112,8 +116,7 @@ async function serveDevProxy(request, response, handler) {
 		response.off("close", onClose);
 	}
 }
-//#endregion
-//#region src/dev-workflows.ts
+// src/dev-workflows.ts
 const RUN_STATUSES = [
 	"in_progress",
 	"sleeping",
@@ -228,10 +231,10 @@ function createDevWorkflows(options) {
 	};
 	const handle = (request) => {
 		const url = new URL(request.url);
-		const prefix = `/api/v1/applets/${encodeURIComponent(options.appletCode)}`;
-		if (!url.pathname.startsWith(`${prefix}/`)) return void 0;
-		const path = url.pathname.slice(prefix.length);
-		const startMatch = /^\/workflows\/([^/]+)\/runs$/.exec(path);
+		const applet = `/applets/${encodeURIComponent(options.appletCode)}`;
+		const startPrefix = `/api/applet/v1${applet}/workflows/`;
+		const runsPath = `/api/applet/v1${applet}/workflow-runs`;
+		const startMatch = url.pathname.startsWith(startPrefix) ? /^([^/]+)\/runs$/.exec(url.pathname.slice(startPrefix.length)) : null;
 		if (request.method === "POST" && startMatch !== null) return (async () => {
 			let body;
 			try {
@@ -257,27 +260,23 @@ function createDevWorkflows(options) {
 				status: "in_progress"
 			} }, { status: 201 });
 		})();
-		const getMatch = /^\/workflows\/([^/]+)\/runs\/([^/]+)$/.exec(path);
+		const getMatch = url.pathname.startsWith(`${runsPath}/`) ? /^([^/]+)$/.exec(url.pathname.slice(runsPath.length + 1)) : null;
 		if (request.method === "GET" && getMatch !== null) {
-			let workflow;
 			let id;
 			try {
-				workflow = decodeURIComponent(getMatch[1]);
-				id = decodeURIComponent(getMatch[2]);
+				id = decodeURIComponent(getMatch[1]);
 			} catch (error) {
 				if (error instanceof URIError) return Promise.resolve(badRequest(error.message));
 				throw error;
 			}
-			const codeError = workflowCodeError(workflow);
-			if (codeError !== void 0) return Promise.resolve(codeError);
 			if (!UUID_PATTERN.test(id)) return Promise.resolve(badRequest("The run id must be a uuid."));
 			const run = runs.get(id);
-			return Promise.resolve(run?.workflow === workflow ? Response.json({ data: run }) : Response.json({
+			return Promise.resolve(run ? Response.json({ data: run }) : Response.json({
 				code: "workflow_run_not_found",
 				message: "The workflow run does not exist."
 			}, { status: 404 }));
 		}
-		if (request.method === "GET" && path === "/workflow-runs") {
+		if (request.method === "GET" && url.pathname === runsPath) {
 			const status = url.searchParams.get("status");
 			const limitValue = url.searchParams.get("limit");
 			const limit = limitValue === null ? 50 : Number(limitValue);
@@ -295,8 +294,7 @@ function createDevWorkflows(options) {
 		stop: () => controller.abort()
 	};
 }
-//#endregion
-//#region src/lazy-client-react.ts
+// src/lazy-client-react.ts
 const CLIENT_REACT = "@hitch42/applet/client/react";
 const lazyClientReact = {
 	name: "hitch-lazy-client-react",
@@ -307,8 +305,7 @@ const lazyClientReact = {
 		return this.resolve(`${CLIENT_REACT}?lazy`, importer, { skipSelf: true });
 	}
 };
-//#endregion
-//#region src/hitch/me-schemas.ts
+// src/hitch/me-schemas.ts
 const personSchema = z.object({
 	id: z.uuid(),
 	firstName: z.string(),
@@ -332,8 +329,7 @@ const meSchema = z.object({
 	}).nullable(),
 	multiOrg: z.boolean()
 });
-//#endregion
-//#region src/vite.ts
+// src/vite.ts
 const APPLET_COMPATIBILITY_DATE = "2026-07-14";
 const APPLET_COMPATIBILITY_FLAGS = ["nodejs_compat"];
 let activeDevListener;
@@ -565,14 +561,10 @@ function clientBootstrapScript(parentOrigin, appletCode, cacheQueries) {
 }
 function applet(sourceDefinition) {
 	const parsedSourceDefinition = appletSourceDefinitionSchema.safeParse(sourceDefinition);
-	if (!parsedSourceDefinition.success) {
-		const raw = sourceDefinition;
-		const orgMessage = typeof raw === "object" && raw !== null && "org" in raw ? " org now lives in hitch.config.ts, not in applet.manifest.ts." : "";
-		throw new Error(`applet(): ${parsedSourceDefinition.error.message}${orgMessage}`);
-	}
-	const { dependencies: _dependencies, devDependencies: _devDependencies, ...definition } = parsedSourceDefinition.data;
+	if (!parsedSourceDefinition.success) throw new Error(`applet(): ${parsedSourceDefinition.error.message}`);
+	const { dependencies: _dependencies, devDependencies: _devDependencies, sdk: _sdk, org: _org, ...definition } = parsedSourceDefinition.data;
 	const parsedDefinition = { data: definition };
-	const mountPath = definition.public ? `app/${definition.code}` : definition.code;
+	const mountPath = appletMountPath(definition);
 	let appletConfig;
 	let buildRootOutDir;
 	let clearedOutDir = false;
@@ -597,7 +589,8 @@ function applet(sourceDefinition) {
 		const resolvedRoot = resolve(root);
 		if (appletConfig?.root === resolvedRoot) return appletConfig;
 		const directoryCode = basename(resolvedRoot);
-		if (directoryCode !== parsedDefinition.data.code) throw new Error(`Applet directory "${directoryCode}" does not match code "${parsedDefinition.data.code}". Rename the directory or change the code.`);
+		if (!isRootLayout(resolvedRoot) && directoryCode !== parsedDefinition.data.code) throw new Error(`Applet directory "${directoryCode}" does not match code "${parsedDefinition.data.code}". Rename the directory or change the code.`);
+		if (isRootLayout(resolvedRoot)) validateRootManifest(sourceDefinition);
 		const org = resolveWorkspaceOrg(resolvedRoot);
 		const routesDirectory = resolve(resolvedRoot, "src/client/routes");
 		const hasClient = existsSync(routesDirectory);
@@ -611,10 +604,7 @@ function applet(sourceDefinition) {
 		if (hasClient && !existsSync(indexHtml)) throw new Error(`Missing index.html at ${indexHtml}. Create it with <div id="root"></div> and <script type="module" src="/.hitch/entry.gen.tsx"><\/script>.`);
 		appletConfig = {
 			root: resolvedRoot,
-			manifest: appletManifestSchema.parse({
-				org,
-				...parsedDefinition.data
-			}),
+			manifest: appletReleaseManifest(parsedSourceDefinition.data, org),
 			routesDirectory,
 			hasClient,
 			hasAuthorRoot: hasClient && existsSync(resolve(routesDirectory, "__root.tsx")),
@@ -630,10 +620,7 @@ function applet(sourceDefinition) {
 	};
 	let apiManifest;
 	const callerRoot = resolve(".");
-	if (basename(callerRoot) === parsedDefinition.data.code && basename(resolve(callerRoot, "..")) === "applets") apiManifest = appletManifestSchema.parse({
-		org: resolveWorkspaceOrg(callerRoot),
-		...parsedDefinition.data
-	});
+	if (basename(callerRoot) === parsedDefinition.data.code && (basename(resolve(callerRoot, "..")) === "applets" || isRootLayout(callerRoot))) apiManifest = appletReleaseManifest(parsedSourceDefinition.data, resolveWorkspaceOrg(callerRoot));
 	const clsxFromCn = {
 		name: "hitch-clsx",
 		resolveId: (id) => id === "clsx" ? "\0hitch:clsx" : void 0,
@@ -650,6 +637,7 @@ function applet(sourceDefinition) {
 		async config(config, environment) {
 			buildRoutes = environment.command === "build" && environment.mode !== "test";
 			const { root, manifest, hasClient, hasAuthorRoot, hasServer, hasRouter } = resolveAppletConfig(config.root ?? resolve("."));
+			if (isRootLayout(root)) await writeGeneratedAgents(root);
 			apiManifest = manifest;
 			buildRootOutDir = resolve(root, config.build?.outDir ?? "dist");
 			if (environment.command === "build" && !clearedOutDir) {
@@ -682,14 +670,18 @@ function applet(sourceDefinition) {
 				const auth = await resolveAuthForOrg(instanceUrl, manifest.org);
 				if (auth === void 0) throw new Error("Not logged in. Run applet login.");
 				const token = bearerToken(auth);
-				const meResponse = await globalThis.fetch(`${orgUrl}/api/v1/me`, { headers: { authorization: `Bearer ${token}` } });
+				const meResponse = await globalThis.fetch(`${orgUrl}/api/me/v1`, { headers: { authorization: `Bearer ${token}` } });
 				rejectEnvironmentKey(meResponse, auth);
 				if (meResponse.status === 401) throw new Error("Your login expired. Run applet login.");
-				if (!meResponse.ok) throw new Error(`Hitch returned ${meResponse.status} for /api/v1/me.`);
+				if (!meResponse.ok) throw new Error(`Hitch returned ${meResponse.status} for /api/me/v1.`);
 				const { person } = meSchema.parse(await meResponse.json());
 				const proxy = createDevProxy({
 					orgUrl,
-					token,
+					token: async () => {
+						const current = await resolveAuthForOrg(instanceUrl, manifest.org);
+						if (current === void 0) throw new Error("Not logged in. Run applet login.");
+						return bearerToken(current);
+					},
 					source: auth.source,
 					warn: (message) => devLogger?.warn(message),
 					intercept: (request) => devWorkflows?.handle(request)
@@ -950,5 +942,4 @@ function applet(sourceDefinition) {
 		cloudflarePlugins
 	];
 }
-//#endregion
 export { applet };

package/dist/{workflow-DurM6Fwx.d.ts → workflow-BnBrJIzu.d.ts}

@@ -1,5 +1,4 @@
 import { z } from "zod";
-//#region src/server/workflow.d.ts
 type WorkflowDuration = {
   milliseconds?: number;
   seconds?: number;
@@ -24,5 +23,4 @@ type WorkflowDefinition<Payload, Result> = {
 };
 type AnyWorkflowDefinition = WorkflowDefinition<any, any>;
 declare function createWorkflow<Payload, Result>(run: (step: WorkflowStep, payload: Payload) => Promise<Result>): WorkflowDefinition<Payload, Result>;
-//#endregion
 export { createWorkflow as a, WorkflowStep as i, WorkflowDefinition as n, WorkflowDuration as r, AnyWorkflowDefinition as t };

package/dist/{workflow-engine-BOTzURKM.js → workflow-engine-CyyaVENo.js}

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region src/server/workflow-protocol.ts
+// src/server/workflow-protocol.ts
 const journalEntrySchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("step"),
@@ -67,8 +67,7 @@ const workflowOutcomeSchema = z.discriminatedUnion("kind", [
 		message: z.string()
 	})
 ]);
-//#endregion
-//#region src/server/workflow-engine.ts
+// src/server/workflow-engine.ts
 var WorkflowFailedError = class extends Error {};
 async function runWorkflowJournal(engine, invoke) {
 	const journal = [];
@@ -107,5 +106,4 @@ async function runWorkflowJournal(engine, invoke) {
 		}
 	}
 }
-//#endregion
 export { workflowOutcomeSchema as a, workflowInvocationRequestSchema as i, runWorkflowJournal as n, journalEntrySchema as r, WorkflowFailedError as t };

package/dist/{workflow-CTo2kZF1.js → workflow-l2SlVePB.js}

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/server/identity.ts
+// src/server/identity.ts
 const requestContext = new AsyncLocalStorage();
 function runWithRequestContext(context, fn) {
 	return requestContext.run(context, fn);
@@ -16,8 +16,7 @@ function getRequestContext() {
 function getIdentityBearer(identity) {
 	return identity.kind === "user" ? identity.sessionToken : identity.token;
 }
-//#endregion
-//#region src/server/workflow.ts
+// src/server/workflow.ts
 const DURATION_MULTIPLIERS = {
 	milliseconds: 1,
 	seconds: 1e3,
@@ -47,5 +46,4 @@ function toMilliseconds(duration) {
 function createWorkflow(run) {
 	return { run };
 }
-//#endregion
 export { getRequestContext as a, getIdentityBearer as i, createWorkflow as n, runWithRequestContext as o, toMilliseconds as r, tryGetRequestContext as s, MAX_DURATION_MS as t };

package/dist/workspace-CtIKSgMD.js

@@ -0,0 +1,76 @@
+import { createRequire, registerHooks } from "node:module";
+import { pathToFileURL } from "node:url";
+import fs from "node:fs";
+import { basename, dirname, resolve } from "node:path";
+// ../shared/auth/src/workspace.mts
+const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const require = createRequire(import.meta.url);
+var WorkspaceValidationError = class extends Error {};
+const SDK_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
+function validateRootManifest(value) {
+	if (value === null || typeof value !== "object" || !("org" in value) || typeof value.org !== "string" || !ORG_CODE_PATTERN.test(value.org)) throw new WorkspaceValidationError("Invalid applet manifest: \"org\" must be an organization code.");
+	if (!("sdk" in value) || typeof value.sdk !== "string" || !SDK_VERSION_PATTERN.test(value.sdk)) throw new WorkspaceValidationError("Invalid applet manifest: \"sdk\" must be an exact version, for example \"0.2.0\".");
+	return {
+		org: value.org,
+		sdk: `@hitch42/applet@${value.sdk}`,
+		githubWorkflow: false
+	};
+}
+function isRootLayout(dir) {
+	return fs.existsSync(resolve(dir, "applet.manifest.ts")) && !fs.existsSync(resolve(dir, "hitch.config.ts")) && !(basename(dirname(dir)) === "applets" && fs.existsSync(resolve(dir, "../../hitch.config.ts")));
+}
+function readWorkspaceConfig(dir) {
+	const rootLayout = isRootLayout(dir);
+	const path = resolve(dir, rootLayout ? "applet.manifest.ts" : "hitch.config.ts");
+	if (!fs.existsSync(path)) return void 0;
+	let module;
+	const configUrl = pathToFileURL(fs.realpathSync(path)).href;
+	const hooks = registerHooks({ load(url, context, nextLoad) {
+		return nextLoad(url, url === configUrl ? {
+			...context,
+			format: "module-typescript"
+		} : context);
+	} });
+	try {
+		delete require.cache[require.resolve(path)];
+		module = require(path);
+	} catch (error) {
+		throw new Error(`Failed to load ${path}.`, { cause: error });
+	} finally {
+		hooks.deregister();
+	}
+	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
+	if (rootLayout) return validateRootManifest(config);
+	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new WorkspaceValidationError(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
+	const githubWorkflow = "githubWorkflow" in config ? config.githubWorkflow : void 0;
+	if (githubWorkflow !== void 0 && typeof githubWorkflow !== "boolean") throw new WorkspaceValidationError(`Invalid Hitch config in ${path}: "githubWorkflow" must be a boolean.`);
+	return {
+		sdk: config.sdk,
+		org: config.org,
+		githubWorkflow
+	};
+}
+function findWorkspaceRoot(cwd) {
+	const dir = resolve(cwd);
+	if (fs.existsSync(resolve(dir, ".hitchroot"))) return void 0;
+	if (fs.existsSync(resolve(dir, "hitch.config.ts"))) return dir;
+	if (fs.existsSync(resolve(dir, "applet.manifest.ts"))) return basename(dirname(dir)) === "applets" && fs.existsSync(resolve(dir, "../../hitch.config.ts")) ? resolve(dir, "../..") : dir;
+	return dirname(dir) === dir ? void 0 : findWorkspaceRoot(dirname(dir));
+}
+function findAppletRoot(cwd) {
+	const dir = resolve(cwd);
+	if (fs.existsSync(resolve(dir, ".hitchroot"))) return void 0;
+	if (fs.existsSync(resolve(dir, "applet.manifest.ts"))) return dir;
+	if (fs.existsSync(resolve(dir, "hitch.config.ts")) || dirname(dir) === dir) return void 0;
+	return findAppletRoot(dirname(dir));
+}
+function findParentRoot(cwd) {
+	const dir = resolve(cwd);
+	if (fs.existsSync(resolve(dir, ".hitchroot"))) return dir;
+	return dirname(dir) === dir ? void 0 : findParentRoot(dirname(dir));
+}
+function findWorkspaceConfig(cwd) {
+	const root = findWorkspaceRoot(cwd);
+	return root === void 0 ? void 0 : readWorkspaceConfig(root);
+}
+export { findWorkspaceRoot as a, validateRootManifest as c, findWorkspaceConfig as i, findAppletRoot as n, isRootLayout as o, findParentRoot as r, readWorkspaceConfig as s, SDK_VERSION_PATTERN as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hitch42/applet",
-  "version": "0.1.1-beta.19",
+  "version": "0.1.1-beta.21",
   "license": "MIT",
   "bin": {
     "applet": "./dist/applet.js"
@@ -59,6 +59,7 @@
     "@fontsource-variable/geist-mono": "^5.3.0",
     "@fontsource-variable/inter": "^5.3.0",
     "@hey-api/openapi-ts": "0.0.0-next-20260824173136",
+    "@napi-rs/keyring": "2.1.2",
     "@orpc/client": "^1.15.0",
     "@orpc/contract": "^1.15.0",
     "@orpc/openapi-client": "^1.15.0",
@@ -88,14 +89,14 @@
     "oxlint": "^1.87.0",
     "oxlint-tsgolint": "^7.0.2003",
     "react-aria-components": "^1.20.0",
-    "shadcn": "^4.16.1",
+    "shadcn": "^4.23.0",
     "smol-toml": "^1.9.0",
     "streamdown": "^2.6.0",
     "tailwindcss": "^4.3.0",
     "tw-animate-css": "^1.4.0",
-    "vite": "8.3.0",
-    "vitest": "4.1.11",
-    "zod": "^4.4.3"
+    "vite": "8.3.3",
+    "vitest": "4.1.12",
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "@orpc/server": "^1.15.0",

package/scaffold/.agents/skills/hitch-applets/SKILL.md

@@ -11,7 +11,7 @@ Treat each applet as an isolated microfrontend. Keep it separate from the data s
 
 ## Public applets
 
-Set `public: true` for an applet that anonymous visitors can use. It is served at `https://{org}.hitch42.app/app/{code}`. It runs as the applet identity. Its manifest grants cap its access.
+Set `public: true` for an applet that anonymous visitors can use. It is served at `https://{org}.hitch42.app/pages/{code}`. It runs as the applet identity. Its manifest grants cap its access.
 
 A public applet cannot use schedules, email, telephony, workflows, or `@hitch42/applet/client/hitch`. Client code calls its server procedures with `api` from `@hitch42/applet/client`.
 
@@ -40,11 +40,26 @@ Follow the Hitch applet rules for SDK-owned configuration, providers, and genera
 
 ## Work with the workspace
 
+With Hitch git on, the applet is the repo root. Its manifest includes `org`
+and an exact `sdk` version, such as `"0.2.0"`. There is no `hitch.config.ts`.
+Run package scripts inside that root. In the legacy command examples below,
+`applets/<code>` means the applet directory: `.` for a root applet or `<code>`
+from a `.hitchroot` parent. The legacy layout stays for orgs with Hitch git off
+and GitHub Actions.
+
+A `.hitchroot` parent is local and has no git repo. Each child is one applet
+repo. Parent deploy processes changed children in order. Parent bootstrap
+prepares all children. Commit per child. Generated agent files live once in
+the parent; children use gitignored links. Keep edited files when the CLI
+reports them.
+
 - Run package commands with `pnpm`.
-- Run `pnpm exec applet login` from the workspace root or an applet directory to sign in. It uses the organization in `hitch.config.ts` and shares credentials with `hitch login`. Add `--no-browser` to print the sign-in URL without opening a browser.
+- Run `pnpm exec applet login` from the workspace root or an applet directory to sign in. It uses the organization in `applet.manifest.ts` or legacy `hitch.config.ts` and shares credentials with `hitch login`. Add `--no-browser` to print the sign-in URL without opening a browser.
 - A server permission error is not a login request.
-- After a workspace is linked to a repository, deploy in two ways. Run `pnpm exec applet deploy` to release a change immediately. Push to the production branch to deploy through CI and keep releases in sync with the repository.
-- Run `pnpm exec applet new <code>` from the workspace root to create a full applet.
+- Keep one applet in each repository. Run `pnpm exec applet deploy -m "<message>"` to commit changes and deploy through Hitch git.
+- Run `pnpm exec applet clone <org>/<code> [dir]` to get an applet and its git history from Hitch.
+- Run `pnpm exec applet rollback <release-id>` to make an earlier release live again.
+- Run `pnpm exec applet new <code>` from a parent or workspace to create a full applet.
 - Add `--client-only` or `--server-only` when the applet needs only one part.
 - Use `--client-only` for a user interface that uses the current user's Hitch access and needs no server.
 - Use `--server-only` for an API or schedule that needs no user interface.
@@ -179,10 +194,13 @@ If missing packages block a check, stop package checks. Do not retry the check t
 
 If a command fails, report the exact blocker. Do not deploy as a verification step.
 
-## Deploy from GitHub
+## Deploy through Hitch git
+
+- Keep one applet per repository, with its manifest and source at the root.
+- Let the SDK migrate old workspaces after its backup. Keep `.hitch-backup/`.
+- Use `applet clone` for other copies after migration. Remove the old GitHub deploy workflow.
+- Run `pnpm exec applet deploy -m "<message>"` from the workspace root or applet folder. The CLI commits changes, pushes the commit to Hitch, and moves `main` when the release goes live.
+- Run `pnpm exec applet clone <org>/<code> [dir]` to work from the current Hitch history.
+- Run `pnpm exec applet rollback <release-id>` to make an earlier release live again. Revert or reset local commits before the next deploy.
 
-- A push to the production branch runs `applet deploy` in the workspace root through GitHub Actions.
-- An applet deploys when its folder or a file outside `applets/` differs from its current release, including a local `applet deploy`. Uncommitted and untracked files count. Gitignored files do not count. An applet whose current release has no source hash always deploys.
-- The deploy skips other applets and logs the reason. A skip is expected, not a failure.
-- A schema change in Hitch alone does not trigger CI.
-- Do not import from a sibling applet folder. The change check does not follow such imports.
+GitHub-linked applets still deploy through GitHub Actions CI until their organization moves to Hitch git.

package/scaffold/.agents/skills/hitch-applets/references/files.md

@@ -77,7 +77,7 @@ Use the `get` query utilities when React needs file metadata as query state.
 ```ts
 const fileQuery = useQuery(
   hitch.files.get.queryOptions({
-    input: { params: { id } },
+    input: { params: { file: id } },
   }),
 );
 
@@ -100,7 +100,7 @@ Store `uploaded.id` as the value of an attachment attribute. A multi-value attac
 const uploaded = await hitch.files.upload(file);
 
 await hitch.records.claims.update.call({
-  params: { id: claimId },
+  params: { record: claimId },
   body: { receipt_id: uploaded.id }, // multi-value: [uploaded.id]
 });
 ```