@hitch42/applet 0.1.1-beta.20 → 0.1.1-beta.21

package/scaffold/.agents/skills/hitch-applets/references/performance.md

@@ -50,8 +50,8 @@ await hitch.batch(
   (tx) => {
     tx.companies.create({ body: { id: companyId, name: "Acme" } });
     tx.deals.create({ body: { name: "Acme renewal", company_id: companyId } });
-    tx.deals.update({ params: { id: dealId }, body: { stage: "won" } });
-    tx.deals.delete({ params: { id: staleDealId } });
+    tx.deals.update({ params: { record: dealId }, body: { stage: "won" } });
+    tx.deals.delete({ params: { record: staleDealId } });
     tx.deals.updateWhere({ body: { filter: { stage: "open" }, set: { stage: "lost" } } });
   },
   { idempotencyKey: `import-${runId}-${chunkIndex}` },

package/scaffold/.agents/skills/hitch-applets/references/records.md

@@ -15,15 +15,15 @@ Use the generated Hitch contract as the typed data plane.
 
 - `list` sends `GET /v1/<objectCode>` and lists records with query parameters.
 - `create` sends `POST /v1/<objectCode>` and creates one record or an array of records.
-- `get` sends `GET /v1/<objectCode>/{id}` and gets one record.
-- `history` sends `GET /v1/<objectCode>/{id}/history` and gets record changes.
-- `update` sends `PATCH /v1/<objectCode>/{id}` and updates one record.
-- `delete` sends `DELETE /v1/<objectCode>/{id}` and deletes one record.
+- `get` sends `GET /v1/<objectCode>/{record}` and gets one record.
+- `history` sends `GET /v1/<objectCode>/{record}/history` and gets record changes.
+- `update` sends `PATCH /v1/<objectCode>/{record}` and updates one record.
+- `delete` sends `DELETE /v1/<objectCode>/{record}` and deletes one record.
 - `query` sends `POST /v1/<objectCode>/query` and lists records with a structured body.
-- `updateWhere` sends `POST /v1/<objectCode>/update` and updates matching records.
+- `updateWhere` sends `POST /v1/<objectCode>/bulk-update` and updates matching records.
 - `aggregate` sends `POST /v1/<objectCode>/aggregate` and calculates aggregate values.
 
-- Pass a record ID in `params.id` for `get`, `history`, `update`, and `delete`.
+- Pass a record ID in `params.record` for `get`, `history`, `update`, and `delete`.
 - Pass record fields in `body` for `create` and `update`.
 - Pass structured query data in `body` for `query`.
 
@@ -67,7 +67,7 @@ const deals = await hitch.records.deals.query({
 });
 
 const deal = await hitch.records.deals.get({
-  params: { id: dealId },
+  params: { record: dealId },
 });
 ```
 
@@ -93,7 +93,7 @@ The first record has index 0. An empty array returns an empty array and requires
 
 ```ts
 const page = await hitch.records.deals.history({
-  params: { id },
+  params: { record: id },
   query: { limit: 25, cursor },
 });
 

package/scaffold/.agents/skills/hitch-cli/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: hitch-cli
-description: Use the `hitch` command line to sign in, select an organization, and read or write Hitch data and administration from the shell. Use when a task needs to inspect records, try a filter or aggregate, create test data, manage teams, grants, or capabilities, apply a changeset, or check applet access without writing applet code.
+description: Use the `hitch` command line to sign in, select an organization, and read or write Hitch data and settings from the shell. Use when a task needs to inspect records, try a filter or aggregate, create test data, manage teams, grants, or capabilities, apply a changeset, or check applet access without writing applet code.
 ---
 
 # Hitch CLI
 
-The `hitch` command talks to one organization on one Hitch instance. Its data and admin commands are generated from that organization's API, so the command set matches the organization's objects.
+The `hitch` command talks to one organization on one Hitch instance. Its commands are generated from that organization's API, so the command set matches the organization's objects.
 
 `hitch` is separate from `applet`. Use `applet` to create, generate, build, and deploy applets. Use `hitch` to work with the organization's data and settings. Read the `hitch-applets` skill for `applet`.
 
@@ -31,84 +31,93 @@ There is no remembered active organization. When `--org` and the workspace disag
 
 ## Refresh the commands
 
-- `hitch login` syncs the commands. Run `hitch sync` after a schema change, and whenever `hitch --help` lacks an object. The command downloads the organization's API and caches the generated commands. It prints `Synced 3 objects.`
+- `hitch login` syncs the commands. Run `hitch sync` after a schema change, after a CLI upgrade, and whenever `hitch --help` lacks an object. The command downloads the organization's API and caches the generated commands. It prints `Synced 3 objects.`
 - If the CLI prints `the cached commands ... no longer load — run hitch sync`, run `hitch sync`. Until then only the built-in commands work.
-- The `admin` commands appear only when the signed-in identity holds an admin capability. A missing `admin` command means no capability, not a broken CLI.
 
 ## Read the command names
 
-Every generated command follows the API route.
+Every generated command comes from an API route. The words of the command are the words of the route path, and the verb is last.
 
-- Data commands: `hitch <object> <verb>`. The object is its code, for example `deals`. The verbs are `list`, `get`, `create`, `update`, `delete`, `query`, `update-where`, and `aggregate`. `hitch batch` sends a batch.
-- Admin commands: `hitch admin <route segments> <verb>`. The verb comes from the HTTP method: `list` or `get` for GET, `create` for POST, `update` for PATCH, `set` for PUT, `delete` for DELETE. For example `PUT /admin/v1/teams/{id}/members/{userId}` is `hitch admin teams members set`.
-- Every path, query, and body field becomes a flag in kebab case: `--id`, `--team-id`, `--can-read`. An object field takes JSON: `--filter '{"stage":"won"}'`. An array field takes one JSON value per item: `--aggregates '{"op":"sum","attribute":"amount","as":"total"}' '{"op":"count","as":"n"}'`.
+- Data commands: `hitch <object> <verb>`. The object is its code, for example `deals`. The verbs are `list`, `get`, `create`, `update`, `delete`, `query`, `aggregate`, and `bulk-update`. `hitch <object> history get` shows the changes to one record.
+- `hitch objects list`, `hitch objects get`, and `hitch objects schema get` read the objects and their attributes. `hitch batch run` sends a batch.
+- `hitch resource ...` works with platform features: files, email, SMS and calls, email trackers, and the directory of teams and members.
+- `hitch manage ...` changes the organization: objects and attributes, changesets, grants, teams, members, invitations, capabilities, API keys, applets, and the theme. Each command needs a capability.
+- `hitch me get` shows who you are. `hitch me teams list` and `hitch me applets list` show your teams and the applets that you can open.
+- The verb comes from the HTTP method: `list` or `get` for GET, `create` for POST, `update` for PATCH, `set` for PUT, `delete` for DELETE. A POST to an action uses the action as the verb: `hitch manage changesets apply`.
+- Every path, query, and body field becomes a flag in kebab case. A path field names its thing: `--object`, `--record`, `--team`, `--grant`, `--changeset`. An object field takes JSON: `--filter '{"stage":"won"}'`. An array field takes one JSON value per item: `--aggregates '{"op":"sum","attribute":"amount","as":"total"}' '{"op":"count","as":"n"}'`.
 - A required field is a required flag. The CLI does not prompt for a missing value. It prints the usage error.
-- Run `hitch <object> <verb> --help` to see the flags for that organization's schema.
+- Run `hitch <command> --help` to see its flags. The flags of a data command follow that organization's schema.
 - Every `delete` command asks for confirmation. Pass `--yes` to skip it. A script without a terminal must pass `--yes`.
-- A command prints its result as JSON. A list prints one JSON object with `data` and `next_cursor`. A command with no result prints nothing.
+- A command prints its result as JSON. A record list prints one JSON object with `data` and `next_cursor`. A command with no result prints nothing.
 - An error prints `hitch: <message>` and exits with code 1.
 
 ## Work with records
 
-Examples use an object called `deals` with attributes `amount`, `stage`, and `owner_id`. Ids are UUIDs.
+Examples use an object called `deals` with attributes `amount`, `stage`, and `owner_id`. Record ids are UUIDs.
 
 ```sh
 hitch deals list --limit 20 --include owner
-hitch deals get --id 0192f1a2-3b4c-7d5e-8f60-123456789abc --include owner
+hitch deals get --record 0192f1a2-3b4c-7d5e-8f60-123456789abc --include owner
 hitch deals create --name "Acme renewal" --amount 5000 --stage open
-hitch deals update --id 0192f1a2-3b4c-7d5e-8f60-123456789abc --stage won
-hitch deals delete --id 0192f1a2-3b4c-7d5e-8f60-123456789abc --yes
+hitch deals update --record 0192f1a2-3b4c-7d5e-8f60-123456789abc --stage won
+hitch deals delete --record 0192f1a2-3b4c-7d5e-8f60-123456789abc --yes
+hitch deals history get --record 0192f1a2-3b4c-7d5e-8f60-123456789abc
 hitch deals query --filter '{"stage":{"$in":["open","won"]}}' --sort '{"attribute":"createdAt","direction":"desc"}' --limit 50
-hitch deals update-where --filter '{"stage":"open"}' --set '{"stage":"lost"}' --expect 3
+hitch deals bulk-update --filter '{"stage":"open"}' --set '{"stage":"lost"}' --expect 3
 hitch deals aggregate --aggregates '{"op":"sum","attribute":"amount","as":"total"}' --group-by '[{"attribute":"stage"}]'
-hitch batch --requests '{"method":"POST","path":"/v1/deals","body":{"name":"A","stage":"open"}}'
+hitch batch run --requests '{"method":"POST","path":"/v1/deals","body":{"name":"A","stage":"open"}}'
+hitch objects schema get --object deals
 ```
 
 - The filter, sort, include, aggregate, and batch bodies use the same shapes as the SDK. Read the `hitch-data` skill for the rules and limits.
 - A list returns one page of at most 200 records and a cursor. Pass `--cursor <value>` for the next page.
 - Data commands act as the signed-in person with that person's grants. An API key acts as the member who made it.
 
-## Administer the organization
+## Manage the organization
 
-Admin commands need the matching capability. Examples use fake ids.
+`hitch manage` commands need the matching capability. Examples use the team `sales` and the member `james@acme.com`.
 
 ```sh
-hitch admin teams list
-hitch admin teams create --name Sales
-hitch admin teams members set --id <teamId> --user-id <userId>
-hitch admin capabilities list
-hitch admin capabilities grants set --capability objects:manage --team-id <teamId>
-hitch admin objects list
-hitch admin objects access list --object-id <objectId>
-hitch admin teams object-grants set --team-id <teamId> --object-id <objectId> --can-create --can-read --can-update --no-can-delete
-hitch admin teams object-grants conditions create --team-id <teamId> --object-id <objectId> --operator equals --operand current_user --path <attributeId>
-hitch admin objects default-grant set --object-id <objectId> --can-read --no-can-create --no-can-update --no-can-delete
-hitch admin applets access list --code sales_portal
-hitch admin applets grants set --code sales_portal --team-id <teamId>
+hitch resource teams list
+hitch manage teams create --name Sales
+hitch manage teams members set --team sales --member james@acme.com
+hitch manage invitations create --email bob@acme.com
+hitch manage capabilities list
+hitch manage capabilities grants set --capability objects:manage --grant sales
+hitch manage objects access get --object deals
+hitch manage objects grants set --object deals --grant sales --can-create --can-read --can-update --conditions '{"path":["owner"],"operator":"equals","operand":"current_user"}'
+hitch manage objects grants set --object deals --grant default --can-read
+hitch manage objects grants delete --object deals --grant sales --yes
+hitch manage applets access get --applet sales_portal
+hitch manage applets grants set --applet sales_portal --grant sales
 ```
 
-- Object grants for a team live under `admin teams object-grants`. The default grant that every member holds lives under `admin objects default-grant`. Each has `conditions` and `attributes` subcommands.
-- Add `--delegate-attribute-id <attributeId>` to an object grant to delegate through a reference attribute.
-- `admin objects access list` shows which grantees cannot read an object. `admin applets access list` shows which grantees cannot use what an applet reads.
+- Paths name things by key, not by id. `--team` and `--grant` take a team code. `--member` and `--invitation` take an email. `--api-key` takes the key name, for example `CI_DEPLOY`. `--object` and `--attribute` take a code. `--mailbox` takes the mailbox address.
+- A team code is the team name folded to ASCII and lower case, with each run of other characters as one `_`. `Sales Team` has the code `sales_team`. A rename changes the code.
+- `manage objects grants set` sets the whole object grant of one grantee: a verb that you leave out is off, and the conditions and attribute rules that you pass replace the saved ones. `--grant` is a team code, or `default` for the grant that every member holds.
+- Pass each condition and each attribute rule as one JSON value, for example `--attributes '{"attribute":"owner","canUpdate":true}'`. Name attributes by code.
+- Add `--delegate '"company"'` to delegate through a reference attribute. The value is the attribute code as a JSON string.
+- `manage objects access get` shows each object grant in the shape that `manage objects grants set` takes. `manage applets access get` shows which grantees cannot use what an applet reads.
 
 ## Change the schema
 
-Schema changes go through a changeset. The CLI names the lifecycle as state, not as actions.
+Schema changes go through a changeset.
 
 ```sh
-hitch admin changesets create
-hitch admin objects create --name Deal --changeset-id <changesetId>
-hitch admin objects attributes create --code deals --name Amount --type currency --changeset-id <changesetId>
-hitch admin changesets blockers list --id <changesetId>
-hitch admin changesets update --id <changesetId> --status applied
-hitch admin changesets update --id <changesetId> --status abandoned
-hitch admin changesets update --id <changesetId> --adopt <otherChangesetId>
+hitch manage changesets create
+hitch manage objects create --name Deals --changeset-id <changesetId>
+hitch manage objects attributes create --object deals --name Amount --type currency --changeset-id <changesetId>
+hitch manage changesets check --changeset <changesetId>
+hitch manage changesets apply --changeset <changesetId>
+hitch manage changesets merge --changeset <changesetId> --from <otherChangesetId>
+hitch manage changesets abandon --changeset <changesetId>
 ```
 
 - A schema command without `--changeset-id` applies at once when it has no blockers. With a blocker, Hitch stages it in a new pending changeset and names it in the error.
 - Add `--dry-run` to evaluate a schema command without a change.
 - Add `--indexed` to an attribute that a query must sort or filter with ordered or text operators. Add `--is-multi` for a multi-value attribute. Pass `--type-config` as JSON. Pass `--options` as one JSON value per option.
-- Run `blockers list` before an apply. Any blocker stops the apply with HTTP 409.
+- Run `changesets check` before an apply. It shows what blocks the apply. Any blocker stops the apply with HTTP 409.
+- `changesets merge` moves the changes of `--from` into the changeset, after its own changes, and abandons `--from`.
 - Run `hitch sync` after an apply, so the new objects and attributes appear as commands.
 - Run `pnpm --dir applets/<code> run generate` after an apply, so applet types match.
 - To build applet code before the apply, set `requiresChangeset` in `applet.manifest.ts` to the changeset ID. Generate, build, and deploy then use the changeset schema, and the release goes live when the changeset applies.
@@ -126,4 +135,4 @@ hitch admin changesets update --id <changesetId> --adopt <otherChangesetId>
 | `Refusing to delete without --yes`                   | Add `--yes` in a script.                                                                             |
 | `hitch <object>` is an unknown command               | Run `hitch whoami`. If you are signed in, run `hitch sync`. The object is new or the cache is stale. |
 | `User's teams lack the `read` grant on this object.` | The identity has no grant on that object. Ask for a team grant, or use another identity.             |
-| `hitch admin` is missing                             | The identity holds no admin capability.                                                              |
+| `This endpoint requires the x capability.`           | The identity does not hold capability `x`. Ask for a capability grant to one of your teams.          |

package/scaffold/AGENTS.md

@@ -4,6 +4,12 @@ Before any command or file edit, read and follow `.agents/skills/hitch-applets/S
 
 Use `pnpm` for package commands.
 
+With Hitch git on, each applet repo has `applet.manifest.ts` and `src/` at its root.
+The manifest contains `org` and an exact `sdk` version, such as `"0.2.0"`.
+A `.hitchroot` parent holds child applet repos. Run commands in a child for that applet,
+or deploy and bootstrap in the parent for all children. Commit per child.
+Legacy workspaces use `hitch.config.ts` and `applets/<code>/`.
+
 The applet CLI refreshes its generated support files.
 The CLI adds missing MCP servers without changing existing entries.
 

package/dist/auth-D3CrCtZq.js

@@ -1,21 +0,0 @@
-import { a as organizationInstanceUrl, c as resolveInstanceUrl, i as getCredentialsForOrg, o as rejectEnvironmentKey, r as bearerToken, s as resolveAuthForOrg, t as AuthenticationError } from "./store-B8N_8JIN.js";
-import { t as loginWithDevice } from "./device-BgIfytaR.js";
-import "./workspace-8yqXsvce.js";
-//#region src/auth.ts
-async function fetchWithOrgAuth(orgCode, request) {
-	const instanceUrl = await resolveInstanceUrl();
-	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
-	const auth = await resolveAuthForOrg(instanceUrl, orgCode);
-	if (auth !== void 0) {
-		const response = await request(organizationUrl, bearerToken(auth));
-		rejectEnvironmentKey(response, auth);
-		if (response.status !== 401) return response;
-	}
-	if (process.stdin.isTTY !== true) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
-	await loginWithDevice(instanceUrl, { expectedOrg: orgCode });
-	const credentials = await getCredentialsForOrg(instanceUrl, orgCode);
-	if (credentials === void 0) throw new Error(`login did not provide credentials for organization "${orgCode}"`);
-	return request(organizationUrl, bearerToken(credentials));
-}
-//#endregion
-export { fetchWithOrgAuth as t };

package/dist/build-JtbY8q2p.js

@@ -1,2 +0,0 @@
-import { i as runBuild } from "./build-D47vK5aa.js";
-export { runBuild };

package/dist/generate-COCRy1Bs.js

@@ -1,2 +0,0 @@
-import { r as runGenerate } from "./generate-BLD0DoCk.js";
-export { runGenerate };

package/dist/login-CceGvlMi.js

@@ -1,14 +0,0 @@
-import { c as resolveInstanceUrl, t as AuthenticationError } from "./store-B8N_8JIN.js";
-import { t as loginWithDevice } from "./device-BgIfytaR.js";
-import { t as findWorkspaceConfig } from "./workspace-8yqXsvce.js";
-//#region src/login.ts
-async function runLogin(options) {
-	if (process.env.HITCH_API_KEY !== void 0) throw new AuthenticationError("HITCH_API_KEY is set — unset it to manage stored logins.");
-	const { me, membership } = await loginWithDevice(await resolveInstanceUrl(), {
-		expectedOrg: findWorkspaceConfig(process.cwd())?.org,
-		noBrowser: options.noBrowser
-	});
-	console.log(`Signed in as ${me.person.email} to ${membership.name}.`);
-}
-//#endregion
-export { runLogin };

package/dist/store-B8N_8JIN.js

@@ -1,196 +0,0 @@
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { homedir } from "node:os";
-//#region ../shared/auth/src/store.mts
-const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
-var AuthenticationError = class extends Error {};
-function isErrno(error, code) {
-	return error instanceof Error && "code" in error && error.code === code;
-}
-async function readJson(path) {
-	try {
-		return JSON.parse(await readFile(path, "utf8"));
-	} catch (error) {
-		if (isErrno(error, "ENOENT")) return void 0;
-		throw new Error(`Failed to read ${path}.`, { cause: error });
-	}
-}
-function isObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function emptyCredentialStore() {
-	return { instances: {} };
-}
-async function healCredentialStore(credentialsPath, source, store, unrecognizedCount) {
-	const backupPath = `${credentialsPath}.bak`;
-	try {
-		try {
-			await writeFile(backupPath, source, {
-				flag: "wx",
-				mode: 384
-			});
-		} catch (error) {
-			if (!isErrno(error, "EEXIST")) throw error;
-		}
-		await chmod(backupPath, 384);
-		await writeFile(credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
-		await chmod(credentialsPath, 384);
-	} catch {
-		console.error(unrecognizedCount === void 0 ? `hitch: failed to heal credential store at ${credentialsPath}; using an empty in-memory store.` : `hitch: failed to heal credential store at ${credentialsPath}; using recognized credentials in memory only.`);
-		return store;
-	}
-	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
-	return store;
-}
-async function readRawCredentialStore() {
-	const { credentialsPath } = storePaths();
-	let source;
-	try {
-		source = await readFile(credentialsPath, "utf8");
-	} catch (error) {
-		if (isErrno(error, "ENOENT")) return emptyCredentialStore();
-		throw new Error(`Failed to read ${credentialsPath}.`, { cause: error });
-	}
-	let value;
-	try {
-		value = JSON.parse(source);
-	} catch {
-		return healCredentialStore(credentialsPath, source, emptyCredentialStore());
-	}
-	if (!isObject(value) || !isObject(value.instances)) return healCredentialStore(credentialsPath, source, emptyCredentialStore());
-	const instances = Object.fromEntries(Object.entries(value.instances).flatMap(([instanceUrl, entry]) => {
-		if (isObject(entry) && typeof entry.organizationId === "string") {
-			const credentials = parseCredentials(entry);
-			return credentials === void 0 ? [] : [[instanceUrl, { [credentials.orgCode]: entry }]];
-		}
-		if (!isObject(entry)) return [];
-		return [[instanceUrl, Object.fromEntries(Object.entries(entry).filter(([orgCode, credentials]) => parseCredentials(credentials)?.orgCode === orgCode))]];
-	}));
-	const reshaped = Object.values(value.instances).some((entry) => !isObject(entry) || typeof entry.organizationId === "string");
-	const countLeaves = (store) => Object.values(store).reduce((total, entry) => total + (isObject(entry) && typeof entry.organizationId !== "string" ? Object.keys(entry).length : 1), 0);
-	const unrecognizedCount = countLeaves(value.instances) - countLeaves(instances);
-	if (!reshaped && unrecognizedCount === 0) return value;
-	return healCredentialStore(credentialsPath, source, { instances }, unrecognizedCount);
-}
-function parseCredentials(value) {
-	if (!isObject(value) || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return;
-	const organization = {
-		organizationId: value.organizationId,
-		orgCode: value.orgCode
-	};
-	if ((value.type === void 0 || value.type === "session") && typeof value.accessToken === "string" && (value.expiresAt === void 0 || typeof value.expiresAt === "number")) return {
-		type: "session",
-		accessToken: value.accessToken,
-		...value.expiresAt === void 0 ? {} : { expiresAt: value.expiresAt },
-		...organization
-	};
-	if (value.type === "apiKey" && typeof value.apiKey === "string") return {
-		type: "apiKey",
-		apiKey: value.apiKey,
-		...organization
-	};
-}
-function normalizeInstanceUrl(instanceUrl) {
-	let url;
-	try {
-		url = new URL(instanceUrl);
-	} catch (error) {
-		throw new Error(`Invalid Hitch instance URL: ${instanceUrl}`, { cause: error });
-	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Invalid Hitch instance URL protocol: ${url.protocol}`);
-	url.pathname = url.pathname.replace(/\/+$/, "");
-	url.search = "";
-	url.hash = "";
-	return url.toString().replace(/\/$/, "");
-}
-function organizationInstanceUrl(instanceUrl, orgCode) {
-	const url = new URL(normalizeInstanceUrl(instanceUrl));
-	const labels = url.hostname.split(".");
-	if (labels[0] !== "app" || labels.length < 2) return url.toString().replace(/\/$/, "");
-	url.hostname = [orgCode, ...labels.slice(1)].join(".");
-	return url.toString().replace(/\/$/, "");
-}
-function storePaths() {
-	const env = process.env;
-	const home = homedir();
-	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
-	return {
-		configDir,
-		cacheDir: join(env.XDG_CACHE_HOME || join(home, ".cache"), "hitch"),
-		configPath: join(configDir, "config.json"),
-		credentialsPath: join(configDir, "credentials.json")
-	};
-}
-async function resolveInstanceUrl(override) {
-	if (override !== void 0) return normalizeInstanceUrl(override);
-	const envInstanceUrl = process.env.HITCH_API_URL;
-	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
-	const { configPath } = storePaths();
-	const config = await readJson(configPath);
-	if (config === void 0) return DEFAULT_INSTANCE_URL;
-	if (!isObject(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
-	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
-}
-async function readCredentialStore() {
-	const store = await readRawCredentialStore();
-	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
-		const credentials = parseCredentials(value);
-		return credentials === void 0 ? [] : [[orgCode, credentials]];
-	}))])) };
-}
-async function getCredentialsForOrg(instanceUrl, orgCode) {
-	return (await readCredentialStore()).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
-}
-function environmentAuth() {
-	const apiKey = process.env.HITCH_API_KEY;
-	return apiKey !== void 0 && apiKey.length > 0 ? {
-		accessToken: apiKey,
-		source: "environment"
-	} : void 0;
-}
-function resolvedStoredAuth(credentials) {
-	return credentials === void 0 ? void 0 : {
-		accessToken: credentials.type === "apiKey" ? credentials.apiKey : credentials.accessToken,
-		credentialType: credentials.type,
-		organizationId: credentials.organizationId,
-		orgCode: credentials.orgCode,
-		source: "store"
-	};
-}
-function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
-	const exact = resolvedStoredAuth(credentialsByOrg[orgCode]);
-	if (exact !== void 0) return exact;
-	const sessions = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "session").filter((credentials, index, all) => all.findIndex(({ accessToken }) => accessToken === credentials.accessToken) === index);
-	if (sessions.length === 1) return resolvedStoredAuth(sessions[0]);
-	if (sessions.length > 1) throw new AuthenticationError(`Multiple sessions are stored. Run hitch login for organization "${orgCode}".`);
-	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
-	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
-}
-async function resolveAuthForOrg(instanceUrl, orgCode) {
-	const auth = environmentAuth();
-	if (auth !== void 0) return auth;
-	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
-	const credentialsByOrg = Object.entries((await readCredentialStore()).instances).find(([instance]) => instance === normalizedUrl)?.[1];
-	return resolveStoredAuthForOrg(credentialsByOrg ?? {}, orgCode);
-}
-function rejectEnvironmentKey(response, auth) {
-	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
-}
-function bearerToken(credentials) {
-	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
-}
-async function setCredentials(instanceUrl, credentials) {
-	const paths = storePaths();
-	const store = await readRawCredentialStore();
-	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
-	const credentialsByOrg = store.instances[normalizedUrl];
-	store.instances[normalizedUrl] = {
-		...isObject(credentialsByOrg) ? credentialsByOrg : {},
-		[credentials.orgCode]: credentials
-	};
-	await mkdir(paths.configDir, { recursive: true });
-	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
-	await chmod(paths.credentialsPath, 384);
-}
-//#endregion
-export { organizationInstanceUrl as a, resolveInstanceUrl as c, getCredentialsForOrg as i, setCredentials as l, DEFAULT_INSTANCE_URL as n, rejectEnvironmentKey as o, bearerToken as r, resolveAuthForOrg as s, AuthenticationError as t };

package/dist/workspace-8yqXsvce.js

@@ -1,31 +0,0 @@
-import { createRequire } from "node:module";
-import { existsSync } from "node:fs";
-import { basename, dirname, resolve } from "node:path";
-//#region ../shared/auth/src/workspace.mts
-const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-const require = createRequire(import.meta.url);
-function readWorkspaceConfig(dir) {
-	const path = resolve(dir, "hitch.config.ts");
-	if (!existsSync(path)) return void 0;
-	let module;
-	try {
-		module = require(path);
-	} catch (error) {
-		throw new Error(`Failed to load ${path}.`, { cause: error });
-	}
-	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
-	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new Error(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
-	const githubWorkflow = "githubWorkflow" in config ? config.githubWorkflow : void 0;
-	if (githubWorkflow !== void 0 && typeof githubWorkflow !== "boolean") throw new Error(`Invalid Hitch config in ${path}: "githubWorkflow" must be a boolean.`);
-	return {
-		sdk: config.sdk,
-		org: config.org,
-		githubWorkflow
-	};
-}
-function findWorkspaceConfig(cwd) {
-	const appletsDir = dirname(cwd);
-	return readWorkspaceConfig(cwd) ?? (basename(appletsDir) === "applets" ? readWorkspaceConfig(dirname(appletsDir)) : void 0);
-}
-//#endregion
-export { readWorkspaceConfig as n, findWorkspaceConfig as t };