@hitch42/applet 0.1.1-beta.20 → 0.1.1-beta.21

package/dist/{create-C2UrZYSK.d.ts → create-BJqLT8Uq.d.ts}

@@ -1,6 +1,5 @@
 import { AnyContractRouter } from "@orpc/contract";
 import { ClientPromiseResult } from "@orpc/client";
-//#region src/hitch/batch.d.ts
 type BatchVerb = "create" | "update" | "delete" | "updateWhere";
 type BatchTxRecords<Records> = { [Code in keyof Records]: { [Verb in keyof Records[Code] & BatchVerb]: Records[Code][Verb] extends ((...args: infer Args) => unknown) ? (input: Verb extends "create" ? Args[0] extends {
   body: infer Body;
@@ -31,8 +30,6 @@ type WithBatchRecorder<T> = T extends {
    */
   batch: BatchRecorderCall<T, Batch> & Batch;
 } : T;
-//#endregion
-//#region src/hitch/create.d.ts
 type Many<T> = Extract<T, readonly unknown[]>;
 type One<T> = Exclude<T, readonly unknown[]>;
 type SplitCreate<F> = F extends ((input: infer Input extends {
@@ -68,5 +65,4 @@ type WithRecordCreateCalls<Utils, Client> = Utils extends {
     call: SplitCreate<Clients[Code][Verb]>;
   } : Records[Code][Verb] : Records[Code][Verb] : Records[Code][Verb]; }; };
 } : Utils : Utils;
-//#endregion
 export { WithBatchRecorder as i, WithRecordCreates as n, WithSingleRecordCreates as r, WithRecordCreateCalls as t };

package/dist/{deploy-BbqyK5Ik.js → deploy-BM55ZoSp.js}

@@ -1,23 +1,28 @@
-import { n as readWorkspaceConfig } from "./workspace-8yqXsvce.js";
-import { t as fetchWithOrgAuth } from "./auth-D3CrCtZq.js";
-import { a as loadGitHubActionsSources, n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-BTFTCBgy.js";
-import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-D47vK5aa.js";
+import { a as findWorkspaceRoot, n as findAppletRoot, o as isRootLayout, r as findParentRoot, s as readWorkspaceConfig } from "./workspace-CtIKSgMD.js";
+import { n as fetchWithOrgAuth, r as orgUsesHitchGit, t as canCheckHitchGit } from "./auth-DuMRqSGe.js";
+import { n as loadAppletSourceDefinition } from "./load-config-Cffvj-aM.js";
+import { i as prepareAppletProject } from "./project-DZGk765E.js";
+import { a as loadGitHubActionsSources, n as githubActionsContext, t as fetchWithGitHubActions } from "./ci-oWlUJKm9.js";
+import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-FAQSHJgm.js";
+import { n as gitEnvironment, r as sourceHashes, t as SourceHashUnavailableError } from "./source-hash-BbvtRaus.js";
+import { a as prepareGitDeploy, o as pushStagedCommit, s as refreshHitchMain, t as deployErrorMessage } from "./git-deploy-C12nMNB6.js";
+import { n as childApplets, r as childHasChanges } from "./parent-Zx8Eg1Ki.js";
+import { n as migrateWorkspace } from "./git-migration-CIq-sN61.js";
 import { createRequire } from "node:module";
-import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
-import { lstat, readFile, readdir, readlink } from "node:fs/promises";
-import { dirname, relative, resolve, sep } from "node:path";
-import { execFile, spawn } from "node:child_process";
+import { readFile, readdir } from "node:fs/promises";
+import { basename, dirname, relative, resolve, sep } from "node:path";
+import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { createGzip } from "node:zlib";
-//#region \0rolldown/runtime.js
+// \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -33,13 +38,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
-//#endregion
-//#region ../../node_modules/.pnpm/events-universal@1.0.1/node_modules/events-universal/default.js
+// ../../node_modules/.pnpm/events-universal@1.0.1/node_modules/events-universal/default.js
 var require_default = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = __require("events");
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/fast-fifo@1.3.2/node_modules/fast-fifo/fixed-size.js
+// ../../node_modules/.pnpm/fast-fifo@1.3.2/node_modules/fast-fifo/fixed-size.js
 var require_fixed_size = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = class FixedFIFO {
 		constructor(hwm) {
@@ -76,8 +79,7 @@ var require_fixed_size = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/fast-fifo@1.3.2/node_modules/fast-fifo/index.js
+// ../../node_modules/.pnpm/fast-fifo@1.3.2/node_modules/fast-fifo/index.js
 var require_fast_fifo = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const FixedFIFO = require_fixed_size();
 	module.exports = class FastFIFO {
@@ -121,8 +123,7 @@ var require_fast_fifo = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/b4a@1.8.1/node_modules/b4a/index.js
+// ../../node_modules/.pnpm/b4a@1.8.1/node_modules/b4a/index.js
 var require_b4a = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function isBuffer(value) {
 		return Buffer.isBuffer(value) || value instanceof Uint8Array;
@@ -276,8 +277,7 @@ var require_b4a = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		writeUInt32LE
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/text-decoder@1.2.7/node_modules/text-decoder/lib/pass-through-decoder.js
+// ../../node_modules/.pnpm/text-decoder@1.2.7/node_modules/text-decoder/lib/pass-through-decoder.js
 var require_pass_through_decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const b4a = require_b4a();
 	module.exports = class PassThroughDecoder {
@@ -295,8 +295,7 @@ var require_pass_through_decoder = /* @__PURE__ */ __commonJSMin(((exports, modu
 		}
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/text-decoder@1.2.7/node_modules/text-decoder/lib/utf8-decoder.js
+// ../../node_modules/.pnpm/text-decoder@1.2.7/node_modules/text-decoder/lib/utf8-decoder.js
 var require_utf8_decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const b4a = require_b4a();
 	/**
@@ -443,8 +442,7 @@ var require_utf8_decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return 0;
 	}
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/text-decoder@1.2.7/node_modules/text-decoder/index.js
+// ../../node_modules/.pnpm/text-decoder@1.2.7/node_modules/text-decoder/index.js
 var require_text_decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const PassThroughDecoder = require_pass_through_decoder();
 	const UTF8Decoder = require_utf8_decoder();
@@ -495,8 +493,7 @@ var require_text_decoder = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 	}
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/streamx@2.28.1/node_modules/streamx/lib/errors.js
+// ../../node_modules/.pnpm/streamx@2.28.1/node_modules/streamx/lib/errors.js
 var require_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = class StreamError extends Error {
 		constructor(msg, code, fn = StreamError) {
@@ -533,8 +530,7 @@ var require_errors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/streamx@2.28.1/node_modules/streamx/index.js
+// ../../node_modules/.pnpm/streamx@2.28.1/node_modules/streamx/index.js
 var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { EventEmitter } = require_default();
 	const FIFO = require_fast_fifo();
@@ -1485,8 +1481,7 @@ var require_streamx = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		PassThrough
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/headers.js
+// ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/headers.js
 var require_headers = /* @__PURE__ */ __commonJSMin(((exports) => {
 	const b4a = require_b4a();
 	const ZEROS = "0000000000000000000";
@@ -1721,8 +1716,7 @@ var require_headers = /* @__PURE__ */ __commonJSMin(((exports) => {
 		return len + digits + str;
 	}
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/extract.js
+// ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/extract.js
 var require_extract = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { Writable, Readable, getStreamError } = require_streamx();
 	const FIFO = require_fast_fifo();
@@ -2070,8 +2064,7 @@ var require_extract = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return size && 512 - size;
 	}
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/constants.js
+// ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const constants = {
 		S_IFMT: 61440,
@@ -2087,8 +2080,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		module.exports = constants;
 	}
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/pack.js
+// ../../node_modules/.pnpm/tar-stream@3.2.1/node_modules/tar-stream/pack.js
 var require_pack = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { Readable, Writable, getStreamError } = require_streamx();
 	const b4a = require_b4a();
@@ -2308,113 +2300,17 @@ var require_pack = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return b4a.isBuffer(buf) ? buf : b4a.from(buf);
 	}
 }));
-//#endregion
-//#region src/source-hash.ts
+// src/response-error.ts
 var import_tar_stream = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.extract = require_extract();
 	exports.pack = require_pack();
 })))(), 1);
-const execFileAsync$1 = promisify(execFile);
-function gitEnvironment() {
-	return Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
+async function hitchResponseError(response, summary) {
+	const body = await response.json().catch(() => null);
+	const details = body !== null && typeof body === "object" ? ["code" in body && typeof body.code === "string" ? body.code : void 0, "message" in body && typeof body.message === "string" ? body.message : void 0].filter((value) => value !== void 0).join(": ") : "";
+	return /* @__PURE__ */ new Error(`${summary} (${response.status})${details ? `: ${details}` : ""}.`);
 }
-var SourceHashUnavailableError = class extends Error {
-	constructor() {
-		super("Git is unavailable or the applet is outside a git repository.");
-	}
-};
-function isMissingPath(error) {
-	return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
-}
-async function hashFiles(topLevel, paths, env) {
-	if (paths.length === 0) return [];
-	return new Promise((resolveHashes, reject) => {
-		const child = spawn("git", ["hash-object", "--stdin-paths"], {
-			cwd: topLevel,
-			env
-		});
-		const stdout = [];
-		const stderr = [];
-		child.stdout.on("data", (chunk) => stdout.push(chunk));
-		child.stderr.on("data", (chunk) => stderr.push(chunk));
-		child.stdin.on("error", reject);
-		child.on("error", reject);
-		child.on("close", (code) => {
-			if (code !== 0) {
-				reject(/* @__PURE__ */ new Error(`git hash-object failed (${code}): ${Buffer.concat(stderr).toString("utf8").trim()}`));
-				return;
-			}
-			const hashes = Buffer.concat(stdout).toString("utf8").trimEnd().split("\n");
-			if (hashes.length !== paths.length || hashes.some((hash) => !/^[0-9a-f]{40,64}$/.test(hash))) {
-				reject(/* @__PURE__ */ new Error("git hash-object returned an unexpected number of hashes."));
-				return;
-			}
-			resolveHashes(hashes);
-		});
-		child.stdin.end(paths.map((path) => `"${path.split("").map((character) => character < " " || character === "" || character === "\"" || character === "\\" ? `\\${character.charCodeAt(0).toString(8).padStart(3, "0")}` : character).join("")}"\n`).join(""));
-	});
-}
-async function sourceHashes(appletRoots) {
-	if (appletRoots.length === 0) return /* @__PURE__ */ new Map();
-	const env = gitEnvironment();
-	const workspaceRoot = dirname(dirname(appletRoots[0]));
-	let topLevel;
-	try {
-		const { stdout } = await execFileAsync$1("git", ["rev-parse", "--show-toplevel"], {
-			cwd: workspaceRoot,
-			env
-		});
-		topLevel = stdout.trim();
-	} catch (error) {
-		if (isMissingPath(error) || error instanceof Error && error.message.includes("not a git repository")) throw new SourceHashUnavailableError();
-		throw error;
-	}
-	const { stdout } = await execFileAsync$1("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: topLevel,
-		env,
-		maxBuffer: 67108864
-	});
-	const paths = [...new Set(stdout.split("\0").filter(Boolean))];
-	const present = (await Promise.all(paths.map(async (path) => {
-		const absolutePath = resolve(topLevel, path);
-		try {
-			const stat = await lstat(absolutePath);
-			if (stat.isFile()) return {
-				path,
-				kind: "file"
-			};
-			if (stat.isSymbolicLink()) return {
-				path,
-				kind: "link",
-				contentId: await readlink(absolutePath)
-			};
-			return;
-		} catch (error) {
-			if (isMissingPath(error)) return void 0;
-			throw error;
-		}
-	}))).filter((entry) => entry !== void 0);
-	const regularPaths = present.filter((entry) => entry.kind === "file").map((entry) => entry.path);
-	const hashes = await hashFiles(topLevel, regularPaths, env);
-	const contentIds = /* @__PURE__ */ new Map();
-	present.filter((entry) => entry.kind === "link").forEach((entry) => contentIds.set(entry.path, entry.contentId));
-	regularPaths.forEach((path, index) => contentIds.set(path, hashes[index]));
-	const appletsDirectory = relative(topLevel, resolve(workspaceRoot, "applets")).split(sep).join("/");
-	return new Map(appletRoots.map((appletRoot) => {
-		const appletDirectory = relative(topLevel, appletRoot).split(sep).join("/");
-		const digest = createHash("sha256");
-		[...contentIds.entries()].filter(([path]) => path !== appletsDirectory && !path.startsWith(`${appletsDirectory}/`) || path.startsWith(`${appletDirectory}/`)).sort(([left], [right]) => Buffer.compare(Buffer.from(left), Buffer.from(right))).forEach(([path, contentId]) => digest.update(`${path}\0${contentId}\n`));
-		return [appletRoot, digest.digest("hex")];
-	}));
-}
-//#endregion
-//#region src/deploy.ts
+// src/deploy.ts
 const execFileAsync = promisify(execFile);
 var WorkspaceDeployError = class extends Error {
 	constructor(failedApplets) {
@@ -2499,15 +2395,18 @@ function releaseForm(manifest, bundle) {
 	body.set("bundle", new File([bundle], "bundle.tar.gz", { type: "application/gzip" }));
 	return body;
 }
-async function deployWithOrgAuth(appletRoot, distDir, manifest, sourceHash) {
+async function deployWithOrgAuth(appletRoot, distDir, manifest, sourceHash, gitSha) {
 	const fetcher = globalThis.fetch;
-	const [bundle, git] = await Promise.all([createBundle(distDir), readGitInfo(appletRoot)]);
+	const [bundle, git] = await Promise.all([createBundle(distDir), gitSha === void 0 ? readGitInfo(appletRoot) : Promise.resolve({
+		gitDirty: false,
+		gitSha
+	})]);
 	return fetchWithOrgAuth(manifest.org, (instanceUrl, accessToken) => {
 		const body = releaseForm(manifest, bundle);
 		body.set("gitDirty", String(git.gitDirty));
 		if (git.gitSha !== void 0) body.set("gitSha", git.gitSha);
 		if (sourceHash !== void 0) body.set("sourceHash", sourceHash);
-		return fetcher(`${instanceUrl}/api/v1/applets/${manifest.code}/releases`, {
+		return fetcher(`${instanceUrl}/api/applet/v1/applets/${manifest.code}/releases`, {
 			method: "POST",
 			headers: { Authorization: `Bearer ${accessToken}` },
 			body
@@ -2521,23 +2420,35 @@ async function deployWithGitHubActions(context, appletRoot, distDir, manifest, s
 		const body = releaseForm(manifest, bundle);
 		body.set("source_directory", sourceDirectory);
 		if (sourceHash !== void 0) body.set("source_hash", sourceHash);
-		return fetcher(`${instanceUrl}/api/ci/v1/applets/${manifest.code}/releases`, {
+		return fetcher(`${instanceUrl}/api/applet/v1/ci/applets/${manifest.code}/releases`, {
 			method: "POST",
 			headers: { Authorization: `Bearer ${accessToken}` },
 			body
 		});
 	});
 }
-async function deployApplet(appletRoot, options, logPrefix = "", sourceHash) {
-	const github = githubActionsContext();
-	sourceHash ??= (await computeSourceHash([appletRoot], github !== void 0)).get(appletRoot);
+async function buildRelease(appletRoot, options) {
 	if (options.dist === void 0) await buildApplet(appletRoot);
 	const distDir = resolve(appletRoot, options.dist ?? ".hitch/dist");
-	const manifest = await readManifest(distDir);
-	const response = github === void 0 ? await deployWithOrgAuth(appletRoot, distDir, manifest, sourceHash) : await deployWithGitHubActions(github, appletRoot, distDir, manifest, sourceHash);
-	if (!response.ok) throw await hitchResponseError(response, "Deploy failed");
+	return {
+		distDir,
+		manifest: await readManifest(distDir)
+	};
+}
+async function uploadRelease(appletRoot, distDir, manifest, stagedSha, logPrefix = "", sourceHash) {
+	const github = githubActionsContext();
+	sourceHash ??= (await computeSourceHash([appletRoot], github !== void 0)).get(appletRoot);
+	const response = github === void 0 ? await deployWithOrgAuth(appletRoot, distDir, manifest, sourceHash, stagedSha) : await deployWithGitHubActions(github, appletRoot, distDir, manifest, sourceHash);
+	if (!response.ok) {
+		const body = await response.clone().json().catch(() => null);
+		const code = body !== null && typeof body === "object" && "code" in body && typeof body.code === "string" ? body.code : void 0;
+		const message = deployErrorMessage(code);
+		if (message !== void 0) throw new Error(message);
+		throw await hitchResponseError(response, "Deploy failed");
+	}
 	const result = await response.json();
 	console.log(`${logPrefix}Deployed release ${result.data.id} (${result.promoted ? "promoted" : "not promoted"}).`);
+	if (stagedSha !== void 0 && result.promoted) console.log(`${logPrefix}main is now ${stagedSha.slice(0, 7)}.`);
 	if (result.changeset_id !== void 0) console.log(`${logPrefix}The release goes live when changeset ${result.changeset_id} applies.`);
 	if (result.warnings?.length) {
 		for (const warning of result.warnings) console.warn(`${logPrefix}Warning: ${warning.message}`);
@@ -2546,6 +2457,15 @@ async function deployApplet(appletRoot, options, logPrefix = "", sourceHash) {
 	if (result.unset_variables?.length) console.warn(`${logPrefix}Warning: declared variables not set: ${result.unset_variables.join(", ")}. Set them with applet variables set.`);
 	return result;
 }
+async function deployApplet(appletRoot, options, logPrefix = "", sourceHash, stagedSha) {
+	const github = githubActionsContext();
+	sourceHash ??= (await computeSourceHash([appletRoot], github !== void 0)).get(appletRoot);
+	const { distDir, manifest } = await buildRelease(appletRoot, options);
+	if (stagedSha !== void 0 && manifest.code !== basename(appletRoot)) throw new Error(`The built applet code ${manifest.code} must match its folder ${basename(appletRoot)}.`);
+	if (stagedSha !== void 0 && manifest.org !== readWorkspaceConfig(findWorkspaceRoot(appletRoot) ?? dirname(dirname(appletRoot)))?.org) throw new Error("The built applet organization must match hitch.config.ts.");
+	if (stagedSha !== void 0) await pushStagedCommit(findWorkspaceRoot(appletRoot) ?? dirname(dirname(appletRoot)), manifest.org, stagedSha);
+	return uploadRelease(appletRoot, distDir, manifest, stagedSha, logPrefix, sourceHash);
+}
 function buildConcurrency() {
 	const value = process.env.APPLET_BUILD_CONCURRENCY;
 	if (value === void 0) return Infinity;
@@ -2568,15 +2488,20 @@ function semaphore(limit) {
 		}
 	};
 }
-async function workspaceAppletRoots(workspaceRoot) {
+async function workspaceAppletRoots(workspaceRoot, allowEmpty = false) {
 	const appletsDir = resolve(workspaceRoot, "applets");
 	const roots = (await readdir(appletsDir, { withFileTypes: true }).catch((error) => {
 		if (isErrno(error, "ENOENT")) return [];
 		throw error;
 	})).filter((entry) => entry.isDirectory()).map((entry) => resolve(appletsDir, entry.name)).filter((root) => existsSync(resolve(root, "applet.manifest.ts"))).sort();
-	if (roots.length === 0) throw new Error(`No applets were found under ${appletsDir}.`);
+	if (!allowEmpty && roots.length === 0) throw new Error(`No applets were found under ${appletsDir}.`);
 	return roots;
 }
+function validateSingleApplet(roots) {
+	if (roots.length === 1) return;
+	const names = roots.map((root) => basename(root)).join(", ");
+	throw new Error(`Hitch git keeps one applet per repo. This workspace has ${roots.length} applets: ${names}. Move each applet into its own workspace.`);
+}
 async function computeSourceHash(appletRoots, required) {
 	try {
 		return await sourceHashes(appletRoots);
@@ -2604,9 +2529,70 @@ async function ciDeployDecisions(github, appletRoots, hashes) {
 		}];
 	}));
 }
+async function deployRootApplet(root, options, flagChecked = false) {
+	const config = readWorkspaceConfig(root);
+	if (!flagChecked && !await orgUsesHitchGit(config.org)) throw new Error(`Hitch git is not switched on for ${config.org}.`);
+	await prepareAppletProject(root);
+	const definition = await loadAppletSourceDefinition(root);
+	const sha = await prepareGitDeploy(root, definition.code, config.org, options.message, options.dist !== void 0);
+	const { distDir, manifest } = await buildRelease(root, options);
+	if (manifest.code !== definition.code || manifest.org !== config.org) throw new Error("The built applet identity must match applet.manifest.ts.");
+	await pushStagedCommit(root, manifest.org, sha);
+	await uploadRelease(root, distDir, manifest, sha);
+}
 async function runDeploy(options) {
 	const root = process.cwd();
 	const github = githubActionsContext();
+	if (process.env.GITHUB_ACTIONS !== "true") {
+		const workspaceRoot = findWorkspaceRoot(root);
+		const parent = workspaceRoot === void 0 ? findParentRoot(root) : void 0;
+		if (parent !== void 0) {
+			const failed = [];
+			for (const child of await childApplets(parent)) try {
+				const config = readWorkspaceConfig(child);
+				if (!await orgUsesHitchGit(config.org)) throw new Error(`Hitch git is not switched on for ${config.org}.`);
+				await refreshHitchMain(child, config.org, (await loadAppletSourceDefinition(child)).code);
+				if (!await childHasChanges(child)) {
+					console.log(`[${basename(child)}] Skipped: no changes.`);
+					continue;
+				}
+				await deployRootApplet(child, options, true);
+				console.log(`[${basename(child)}] Deployed.`);
+			} catch (error) {
+				failed.push(basename(child));
+				console.error(`[${basename(child)}] ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if (failed.length > 0) throw new WorkspaceDeployError(failed);
+			return;
+		}
+		if (workspaceRoot === void 0) throw new Error("Run applet deploy in an applet, workspace or parent folder.");
+		const config = readWorkspaceConfig(workspaceRoot);
+		const enabled = isRootLayout(workspaceRoot) ? await orgUsesHitchGit(config.org) : await canCheckHitchGit() && await orgUsesHitchGit(config.org);
+		if (isRootLayout(workspaceRoot)) {
+			if (!enabled) throw new Error(`Hitch git is not switched on for ${config.org}.`);
+			await deployRootApplet(workspaceRoot, options, true);
+			return;
+		}
+		if (enabled) {
+			const selected = findAppletRoot(root);
+			const migrated = await migrateWorkspace(workspaceRoot, options.message);
+			const roots = selected === void 0 ? migrated : migrated.filter((path) => migrated.length === 1 || basename(path) === basename(selected));
+			const failed = [];
+			for (const appletRoot of roots) try {
+				await deployRootApplet(appletRoot, options, true);
+			} catch (error) {
+				failed.push(appletRoot);
+				console.error(`[${basename(appletRoot)}] ${error instanceof Error ? error.message : String(error)}`);
+			}
+			if (failed.length > 0) throw new WorkspaceDeployError(failed);
+			return;
+		}
+		if (root !== workspaceRoot && !existsSync(resolve(root, "applet.manifest.ts"))) throw new Error("Run applet deploy in an applet folder or in the workspace root.");
+		if (root !== workspaceRoot) {
+			await deployApplet(findAppletRoot(root), options);
+			return;
+		}
+	}
 	if (existsSync(resolve(root, "applet.manifest.ts"))) {
 		await deployApplet(root, options);
 		return;
@@ -2650,5 +2636,27 @@ async function runDeploy(options) {
 	});
 	if (failedApplets.length > 0) throw new WorkspaceDeployError(failedApplets);
 }
-//#endregion
-export { runDeploy };
+async function runRollback(releaseId) {
+	const cwd = process.cwd();
+	const workspaceRoot = findWorkspaceRoot(cwd);
+	const config = workspaceRoot === void 0 ? void 0 : readWorkspaceConfig(workspaceRoot);
+	if (config === void 0 || workspaceRoot === void 0) throw new Error("Run applet rollback in an applet folder or in the workspace root.");
+	const roots = isRootLayout(workspaceRoot) ? [workspaceRoot] : await workspaceAppletRoots(workspaceRoot, true);
+	validateSingleApplet(roots);
+	const code = (await loadAppletSourceDefinition(roots[0])).code;
+	const response = await fetchWithOrgAuth(config.org, (organizationUrl, accessToken) => globalThis.fetch(`${organizationUrl}/api/manage/v1/applets/${code}/releases/${encodeURIComponent(releaseId)}/promote`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ rollback: true })
+	}));
+	if (!response.ok) throw await hitchResponseError(response, "Rollback failed");
+	const result = await response.json();
+	const release = result !== null && typeof result === "object" && "data" in result ? result.data : void 0;
+	const sha = release !== null && typeof release === "object" && "git_sha" in release && typeof release.git_sha === "string" ? release.git_sha : void 0;
+	if (sha === void 0) throw new Error("The rollback response has no commit id.");
+	console.log(`Rolled back ${code} to release ${releaseId} (commit ${sha.slice(0, 7)}). main moved back. Your local branch still has the newer commits: revert or reset them before the next deploy.`);
+}
+export { runDeploy, runRollback };

package/dist/{device-BgIfytaR.js → device-CZWWckCq.js}

@@ -1,7 +1,8 @@
-import { l as setCredentials, o as rejectEnvironmentKey, t as AuthenticationError } from "./store-B8N_8JIN.js";
+import { c as normalizeInstanceUrl, d as rejectEnvironmentKey, g as saveOAuthCredentials, l as organizationInstanceUrl, o as credentialStorageMessage, t as AuthenticationError, u as readCredentialStore } from "./store-E5NhITHl.js";
 import { spawn } from "node:child_process";
-//#region ../shared/auth/src/device.mts
-const CLIENT_ID = "hitch-cli";
+import readline from "node:readline/promises";
+// ../shared/auth/src/device.mts
+const CLIENT_ID = "hitch-cli-oauth";
 const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function defaultOpenUrl(url) {
 	try {
@@ -40,13 +41,10 @@ function parseDeviceCode(value) {
 	return value;
 }
 function parseToken(value) {
-	return typeof value.access_token === "string" && typeof value.token_type === "string" ? value : void 0;
+	return typeof value.access_token === "string" && typeof value.refresh_token === "string" && typeof value.expires_in === "number" && typeof value.token_type === "string" ? value : void 0;
 }
-function parseDeviceOrganization(value) {
-	if (typeof value.organizationId !== "string" || typeof value.orgCode !== "string") throw new AuthenticationError("Hitch returned an invalid device organization response.");
-	return value;
-}
-function parseMe(value) {
+function parseMe(input) {
+	const value = requiredObject(input, "Hitch returned an invalid identity response.");
 	const person = requiredObject(value.person, "Hitch returned an invalid identity response.");
 	if (typeof person.id !== "string" || typeof person.firstName !== "string" || typeof person.lastName !== "string" || typeof person.email !== "string" || !Array.isArray(value.memberships)) throw new Error("Hitch returned an invalid identity response.");
 	const organization = value.organization === void 0 || value.organization === null ? null : requiredObject(value.organization, "Hitch returned an invalid identity response.");
@@ -62,24 +60,30 @@ function parseMe(value) {
 	};
 }
 async function fetchMe(fetcher, instanceUrl, auth) {
-	const response = await fetcher(`${instanceUrl}/api/v1/me`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
+	const response = await fetcher(`${instanceUrl}/api/me/v1`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
 	rejectEnvironmentKey(response, auth);
 	if (auth.credentialType === "apiKey" && response.status === 401) throw new AuthenticationError("API key rejected.");
 	const body = await jsonResponse(response);
 	if (!response.ok) throw new AuthenticationError(typeof body.message === "string" ? body.message : `Failed to load the signed-in identity (${response.status}).`);
 	return parseMe(body);
 }
-async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
+async function pollForToken(fetcher, instanceUrl, resource, device, now, sleep) {
 	const deadline = now() + device.expires_in * 1e3;
 	let interval = (device.interval ?? 5) * 1e3;
 	while (now() < deadline) {
 		await sleep(Math.min(interval, deadline - now()));
 		if (now() >= deadline) break;
-		const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/token`, {
-			grant_type: DEVICE_GRANT,
-			device_code: device.device_code,
-			client_id: CLIENT_ID
+		const response = await fetcher(`${instanceUrl}/api/auth/oauth2/token`, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: DEVICE_GRANT,
+				device_code: device.device_code,
+				client_id: CLIENT_ID,
+				resource
+			})
 		});
+		const body = await jsonResponse(response);
 		const token = parseToken(body);
 		if (response.ok && token !== void 0) return token;
 		switch (body.error) {
@@ -97,39 +101,55 @@ async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
 async function loginWithDevice(instanceUrl, options = {}) {
 	const fetcher = globalThis.fetch;
 	const now = Date.now;
-	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
+	const storedOrgs = Object.keys((await readCredentialStore()).instances[normalizeInstanceUrl(instanceUrl)] ?? {});
+	let orgCode = options.expectedOrg ?? process.env.HITCH_DEFAULT_ORG ?? (storedOrgs.length === 1 ? storedOrgs[0] : void 0);
+	if (orgCode === void 0 && process.stdin.isTTY === true) {
+		const terminal = readline.createInterface({
+			input: process.stdin,
+			output: process.stdout
+		});
+		try {
+			orgCode = (await terminal.question("Organization code: ")).trim();
+		} finally {
+			terminal.close();
+		}
+	}
+	if (!orgCode) throw new AuthenticationError("Select an organization with --org or HITCH_DEFAULT_ORG.");
+	const organizationUrl = organizationInstanceUrl(instanceUrl, orgCode);
+	const resource = `${organizationUrl}/mcp`;
+	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, {
+		client_id: CLIENT_ID,
+		scope: "openid offline_access",
+		resource
+	});
 	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
 	const device = parseDeviceCode(body);
-	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
+	const verificationUrl = device.verification_uri_complete;
 	console.log(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
 	if (!options.noBrowser) try {
 		defaultOpenUrl(verificationUrl);
 	} catch {}
-	const token = await pollForToken(fetcher, instanceUrl, device, now, (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
-	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
-	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
-	const organization = parseDeviceOrganization(organizationBody);
-	const me = await fetchMe(fetcher, instanceUrl, {
+	const token = await pollForToken(fetcher, instanceUrl, resource, device, now, (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+	const me = await fetchMe(fetcher, organizationUrl, {
 		accessToken: token.access_token,
 		credentialType: "session",
 		source: "store"
 	});
-	const membership = me.memberships.find(({ orgId }) => orgId === organization.organizationId);
-	if (membership === void 0) throw new AuthenticationError("The device session is not scoped to a Hitch organization.");
-	const credentials = {
-		type: "session",
+	const membership = me.memberships.find(({ code }) => code === orgCode);
+	if (membership === void 0) throw new AuthenticationError(`You are not a member of the Hitch organization "${orgCode}".`);
+	const credentials = await saveOAuthCredentials(instanceUrl, {
+		type: "oauth",
 		accessToken: token.access_token,
-		expiresAt: token.expires_in === void 0 ? void 0 : now() + token.expires_in * 1e3,
-		organizationId: organization.organizationId,
-		orgCode: organization.orgCode
-	};
-	await setCredentials(instanceUrl, credentials);
-	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
+		expiresAt: now() + token.expires_in * 1e3,
+		organizationId: membership.orgId,
+		orgCode
+	}, token.refresh_token);
+	const storageMessage = credentialStorageMessage();
+	if (storageMessage !== void 0) console.log(storageMessage);
 	return {
 		credentials,
 		me,
 		membership
 	};
 }
-//#endregion
-export { loginWithDevice as t };
+export { parseMe as n, loginWithDevice as t };