@hitch42/applet 0.1.1-beta.20 → 0.1.1-beta.22

package/dist/git-migration-CIq-sN61.js

@@ -0,0 +1,629 @@
+import { n as generatedAgentContents, r as writeGeneratedAgents } from "./generated-agents-BUnJ0FQA.js";
+import { a as findWorkspaceRoot, n as findAppletRoot, o as isRootLayout, s as readWorkspaceConfig } from "./workspace-CtIKSgMD.js";
+import { r as orgUsesHitchGit, t as canCheckHitchGit } from "./auth-DuMRqSGe.js";
+import { n as loadAppletSourceDefinition } from "./load-config-Cffvj-aM.js";
+import { c as writeGitignore, r as loadPackageManifest } from "./project-DZGk765E.js";
+import { n as stagedSecretPaths, t as StagedSecretsError } from "./git-safety-Ck3X7jvA.js";
+import { o as gitLocal } from "./parent-Zx8Eg1Ki.js";
+import fs from "node:fs";
+import fs$1 from "node:fs/promises";
+import { basename, dirname, posix, resolve, sep } from "node:path";
+import { parseSync } from "vite";
+// src/git-migration.ts
+var MigrationError = class extends Error {};
+function migrationPath(path, code) {
+	const prefix = `applets/${code}/`;
+	const migrated = path.startsWith(prefix) ? path.slice(prefix.length) : path;
+	if (migrated === "hitch.config.ts" || migrated === ".github/workflows/hitch.yml" || path.startsWith("applets/") && !path.startsWith(prefix)) return void 0;
+	return migrated;
+}
+function migratedImport(path, specifier, code, tracked) {
+	if (!specifier.startsWith("./") && !specifier.startsWith("../")) return specifier;
+	const prefix = `applets/${code}/`;
+	const suffixStart = specifier.search(/[?#]/);
+	const request = suffixStart < 0 ? specifier : specifier.slice(0, suffixStart);
+	const suffix = suffixStart < 0 ? "" : specifier.slice(suffixStart);
+	const target = posix.normalize(posix.join(posix.dirname(path), request));
+	if (target.startsWith(prefix)) return specifier;
+	const found = [
+		target,
+		...[
+			".ts",
+			".tsx",
+			".js",
+			".mjs",
+			".json"
+		].map((extension) => `${target}${extension}`),
+		...[
+			".ts",
+			".tsx",
+			".js",
+			".mjs"
+		].map((extension) => `${target}/index${extension}`),
+		...target.endsWith(".js") ? [target.slice(0, -3) + ".ts", target.slice(0, -3) + ".tsx"] : []
+	].find((candidate) => tracked.includes(candidate));
+	if (found === void 0 || found.startsWith("applets/") || migrationPath(found, code) !== found || tracked.some((path) => path.startsWith(prefix) && (path.slice(prefix.length) === found || found.startsWith(`${path.slice(prefix.length)}/`) || path.slice(prefix.length).startsWith(`${found}/`)))) throw new MigrationError(`${path}: ${specifier}`);
+	const rewritten = posix.relative(posix.dirname(migrationPath(path, code)), target);
+	return `${rewritten.startsWith(".") ? rewritten : `./${rewritten}`}${suffix}`;
+}
+function rewriteAppletImports(source, path, code, tracked) {
+	const parsed = parseSync(path, source);
+	if (parsed.errors.length > 0) throw new MigrationError(`Cannot scan imports in ${path}: syntax errors.`);
+	const replacements = [];
+	const errors = [];
+	const visit = (value) => {
+		if (value === null || typeof value !== "object") return;
+		if (Array.isArray(value)) {
+			value.forEach(visit);
+			return;
+		}
+		const node = value;
+		let candidate = [
+			"ImportDeclaration",
+			"ExportNamedDeclaration",
+			"ExportAllDeclaration",
+			"ImportExpression",
+			"TSImportType",
+			"TSExternalModuleReference"
+		].includes(String(node.type)) ? node.source ?? node.argument ?? node.expression : node.type === "CallExpression" && typeof node.callee === "object" && node.callee !== null && "name" in node.callee && node.callee.name === "require" && Array.isArray(node.arguments) ? node.arguments[0] : void 0;
+		if (candidate !== null && typeof candidate === "object" && "type" in candidate && candidate.type === "TemplateLiteral" && "expressions" in candidate && Array.isArray(candidate.expressions) && candidate.expressions.length === 0 && "quasis" in candidate && Array.isArray(candidate.quasis)) {
+			const quasi = candidate.quasis[0];
+			if (quasi !== null && typeof quasi === "object" && "value" in quasi && quasi.value !== null && typeof quasi.value === "object" && "cooked" in quasi.value && typeof quasi.value.cooked === "string") candidate = {
+				...candidate,
+				value: quasi.value.cooked
+			};
+		}
+		if (candidate !== null && typeof candidate === "object" && "value" in candidate && typeof candidate.value === "string" && "start" in candidate && typeof candidate.start === "number" && "end" in candidate && typeof candidate.end === "number") try {
+			const text = migratedImport(path, candidate.value, code, tracked);
+			if (text !== candidate.value) {
+				const quote = source[candidate.start];
+				const escaped = JSON.stringify(text).slice(1, -1);
+				replacements.push({
+					start: candidate.start + 1,
+					end: candidate.end - 1,
+					text: quote === "'" ? escaped.replaceAll("\\\"", "\"").replaceAll("'", "\\'") : quote === "`" ? escaped.replaceAll("\\\"", "\"").replaceAll("`", "\\`").replaceAll("${", "\\${") : escaped
+				});
+			}
+		} catch (error) {
+			if (!(error instanceof MigrationError)) throw error;
+			errors.push(error.message);
+		}
+		Object.values(node).forEach(visit);
+	};
+	visit(parsed.program);
+	if (errors.length > 0) throw new MigrationError(errors.join("\n"));
+	return replacements.sort((a, b) => b.start - a.start).reduce((text, item) => text.slice(0, item.start) + item.text + text.slice(item.end), source);
+}
+function transformTree(entries, code) {
+	const files = /* @__PURE__ */ new Map();
+	const collisions = /* @__PURE__ */ new Set();
+	[...entries.filter((entry) => !entry.path.startsWith("applets/")), ...entries.filter((entry) => entry.path.startsWith(`applets/${code}/`))].forEach((entry) => {
+		const path = migrationPath(entry.path, code);
+		if (path === void 0) return;
+		[...files.keys()].forEach((existing) => {
+			if (path === existing || path.startsWith(`${existing}/`) || existing.startsWith(`${path}/`)) {
+				collisions.add(path);
+				files.delete(existing);
+			}
+		});
+		files.set(path, {
+			...entry,
+			path
+		});
+	});
+	return {
+		entries: [...files.values()],
+		collisions: [...collisions].sort()
+	};
+}
+function keepMigratedCommit(tree, parentTree, emptyTree) {
+	return tree !== (parentTree ?? emptyTree);
+}
+function migrationPlan(root, codes, paths) {
+	const parent = codes.length !== 1;
+	const entries = [...new Set(paths.map((path) => path.split("/")[0]))].filter((path) => path !== ".git" && path !== ".hitch-backup").sort();
+	return {
+		parent,
+		targets: codes.map((code) => ({
+			code,
+			root: parent ? resolve(root, code) : root
+		})),
+		backupFiles: entries.filter(backupPath),
+		removeFiles: entries
+	};
+}
+function backupPath(path) {
+	return !path.split("/").some((part) => [
+		"node_modules",
+		".hitch",
+		"dist",
+		".wrangler",
+		".tanstack",
+		"build",
+		"coverage",
+		".git",
+		".hitch-backup"
+	].includes(part));
+}
+function migratedManifest(source, org, sdk) {
+	const parsed = parseSync("applet.manifest.ts", source);
+	if (parsed.errors.length > 0) throw new MigrationError("The applet manifest has syntax errors.");
+	let name = "hitchMigratedManifest";
+	while (source.includes(name)) name += "_";
+	const exported = `export default { ...${name}, org: ${JSON.stringify(org)}, sdk: ${JSON.stringify(sdk)} };`;
+	const assignment = parsed.program.body.find((statement) => statement.type === "ExportDefaultDeclaration");
+	if (assignment !== void 0) {
+		let object = assignment.declaration;
+		while (object.type === "TSAsExpression" || object.type === "TSSatisfiesExpression" || object.type === "ParenthesizedExpression") object = object.expression;
+		if (object.type === "ObjectExpression") {
+			const start = object.start + 1;
+			const body = source.slice(start, object.end - 1);
+			const newline = body.includes("\r\n") ? "\r\n" : "\n";
+			const indent = /^[ \t]*\r?\n([ \t]*)\S/.exec(body)?.[1];
+			const properties = `org: ${JSON.stringify(org)},${indent === void 0 ? " " : `${newline}${indent}`}sdk: ${JSON.stringify(sdk)},`;
+			const insertion = indent === void 0 ? ` ${properties}` : `${newline}${indent}${properties}`;
+			return `${source.slice(0, start)}${insertion}${/^\s/.test(body) ? "" : " "}${source.slice(start)}`;
+		}
+	}
+	if (assignment !== void 0) return `${source.slice(0, assignment.start)}const ${name} = ${source.slice(assignment.declaration.start, assignment.declaration.end)};\n${exported}${source.slice(assignment.end)}`;
+	const declaration = parsed.program.body.find((statement) => statement.type === "ExportNamedDeclaration" && statement.specifiers.some((element) => (element.exported.type === "Identifier" ? element.exported.name : element.exported.value) === "default"));
+	if (declaration === void 0 || declaration.type !== "ExportNamedDeclaration") throw new MigrationError("The manifest must have a default export before migration.");
+	const element = declaration.specifiers.find((item) => (item.exported.type === "Identifier" ? item.exported.name : item.exported.value) === "default");
+	const original = source.slice(element.local.start, element.local.end);
+	const from = declaration.source === null ? "" : ` from ${source.slice(declaration.source.start, declaration.end).replace(/;$/, "")}`;
+	const binding = declaration.source === null ? `const ${name} = ${original};` : `import { ${original} as ${name} }${from};`;
+	const remaining = declaration.specifiers.filter((item) => item !== element);
+	const retained = remaining.length === 0 ? "" : `export { ${remaining.map((item) => source.slice(item.start, item.end)).join(", ")} }${from};`;
+	return `${source.slice(0, declaration.start)}${retained}${source.slice(declaration.end)}\n${binding}\n${exported}\n`;
+}
+const MIGRATION_GIT_CONFIG = [
+	"-c",
+	"commit.gpgsign=false",
+	"-c",
+	"core.hooksPath=/dev/null"
+];
+async function migrationGit(root, args, input, env) {
+	return gitLocal(root, [...MIGRATION_GIT_CONFIG, ...args], input, {
+		...env,
+		GIT_OPTIONAL_LOCKS: "0"
+	});
+}
+async function refuseSymlink(path) {
+	try {
+		if ((await fs$1.lstat(path)).isSymbolicLink()) throw new MigrationError(`Migration cannot write through a symlink: ${path}`);
+	} catch (error) {
+		if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+	}
+}
+async function git(root, args, input, env) {
+	return (await migrationGit(root, args, input, env)).toString("utf8").trim();
+}
+function treeEntries(tree) {
+	return tree.toString("utf8").split("\0").filter(Boolean).map((line) => {
+		const tab = line.indexOf("	");
+		const [mode, type, oid] = line.slice(0, tab).split(" ");
+		if (!mode || !type || !oid || tab < 0) throw new Error("Invalid git tree entry.");
+		return {
+			mode,
+			type,
+			oid,
+			path: line.slice(tab + 1)
+		};
+	});
+}
+async function writeTree(root, entries, env) {
+	const groups = /* @__PURE__ */ new Map();
+	const files = [];
+	entries.forEach((entry) => {
+		const slash = entry.path.indexOf("/");
+		if (slash < 0) files.push(entry);
+		else {
+			const directory = entry.path.slice(0, slash);
+			const group = groups.get(directory) ?? [];
+			group.push({
+				...entry,
+				path: entry.path.slice(slash + 1)
+			});
+			groups.set(directory, group);
+		}
+	});
+	const directories = await Promise.all([...groups].map(async ([path, children]) => ({
+		mode: "040000",
+		type: "tree",
+		oid: await writeTree(root, children, env),
+		path
+	})));
+	return git(root, ["mktree", "-z"], Buffer.from([...files, ...directories].map((entry) => `${entry.mode} ${entry.type} ${entry.oid}\t${entry.path}\0`).join("")), env);
+}
+function commitIdentity(line) {
+	const match = /^(?:author|committer) (.*) <([^>]*)> (\d+ [+-]\d{4})$/.exec(line);
+	if (!match) throw new Error("Invalid git commit identity.");
+	return {
+		name: match[1],
+		email: match[2],
+		date: `@${match[3]}`
+	};
+}
+async function rewriteHistory(source, target, head, code) {
+	await fs$1.mkdir(target, { recursive: true });
+	await git(target, [
+		"init",
+		"-b",
+		"main"
+	]);
+	const alternates = resolve(target, ".git", "objects", "info", "alternates");
+	const common = resolve(source, await git(target, [
+		"--git-dir",
+		source,
+		"rev-parse",
+		"--git-common-dir"
+	]));
+	await fs$1.writeFile(alternates, `${resolve(common, "objects")}\n`);
+	const env = {};
+	const commits = (await git(target, [
+		"--git-dir",
+		source,
+		"rev-list",
+		"--reverse",
+		"--topo-order",
+		head
+	])).split("\n");
+	const rewritten = /* @__PURE__ */ new Map();
+	const emptyTree = await writeTree(target, [], env);
+	const reported = /* @__PURE__ */ new Set();
+	for (const sha of commits) {
+		const raw = await migrationGit(target, [
+			"--git-dir",
+			source,
+			"cat-file",
+			"commit",
+			sha
+		]);
+		const separator = raw.indexOf("\n\n");
+		const headers = raw.subarray(0, separator).toString("latin1").split("\n");
+		const parents = headers.filter((line) => line.startsWith("parent ")).map((line) => rewritten.get(line.slice(7)));
+		const transformed = transformTree(treeEntries(await migrationGit(target, [
+			"--git-dir",
+			source,
+			"ls-tree",
+			"-rz",
+			sha
+		])), code);
+		transformed.collisions.filter((path) => !reported.has(path)).forEach((path) => {
+			reported.add(path);
+			console.warn(`[${code}] ${path} exists both at the old root and in applets/${code}; kept the applet's copy.`);
+		});
+		const tree = await writeTree(target, transformed.entries, env);
+		if (!keepMigratedCommit(tree, parents[0]?.tree, emptyTree) && parents.every((parent) => parent.tree === tree)) {
+			rewritten.set(sha, {
+				sha: parents[0]?.sha,
+				tree
+			});
+			continue;
+		}
+		const parentShas = [...new Set(parents.flatMap((parent) => parent.sha ? [parent.sha] : []))];
+		const metadata = headers.filter((line) => /^(author|committer|encoding) /.test(line));
+		const commit = await git(target, [
+			"hash-object",
+			"-t",
+			"commit",
+			"-w",
+			"--stdin"
+		], Buffer.concat([
+			Buffer.from(`tree ${tree}\n${parentShas.map((parent) => `parent ${parent}\n`).join("")}`),
+			Buffer.from(`${metadata.join("\n")}\n\n`, "latin1"),
+			raw.subarray(separator + 2)
+		]), env);
+		rewritten.set(sha, {
+			sha: commit,
+			tree
+		});
+	}
+	const newHead = rewritten.get(head)?.sha;
+	if (newHead === void 0) throw new MigrationError(`No history remains for ${code}.`);
+	await git(target, [
+		"update-ref",
+		"refs/heads/main",
+		newHead
+	], void 0, env);
+	await git(target, [
+		"repack",
+		"-a",
+		"-d"
+	], void 0, env);
+	await fs$1.rm(alternates);
+	await git(target, [
+		"reset",
+		"--hard",
+		"HEAD"
+	]);
+}
+async function migrateWorkspace(root, message) {
+	if (process.stdin.isTTY !== true) throw new MigrationError("Migration needs a terminal. Run applet bootstrap in an interactive terminal, then run this command again.");
+	if (await git(root, ["rev-parse", "--is-shallow-repository"]) === "true") throw new MigrationError("A shallow repository cannot migrate. Fetch the full history first.");
+	let head;
+	try {
+		head = await git(root, [
+			"rev-parse",
+			"--verify",
+			"HEAD"
+		]);
+	} catch (cause) {
+		throw new MigrationError("The repository has no HEAD. Make a commit before migration.", { cause });
+	}
+	const startingDir = process.cwd();
+	const config = readWorkspaceConfig(root);
+	if (config === void 0 || isRootLayout(root)) throw new MigrationError("Expected an old Hitch workspace.");
+	const roots = (await fs$1.readdir(resolve(root, "applets"), { withFileTypes: true }).catch((error) => {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory() && fs.existsSync(resolve(root, "applets", entry.name, "applet.manifest.ts"))).map((entry) => resolve(root, "applets", entry.name)).sort();
+	if (roots.length === 0) throw new MigrationError("No applets were found in this workspace.");
+	if (resolve(await git(root, ["rev-parse", "--show-toplevel"])) !== resolve(root)) throw new MigrationError("The git repository must start at the workspace root.");
+	if ((await Promise.all([
+		"rebase-merge",
+		"rebase-apply",
+		"MERGE_HEAD"
+	].map((name) => git(root, [
+		"rev-parse",
+		"--git-path",
+		name
+	])))).some((path) => fs.existsSync(resolve(root, path)))) throw new MigrationError("Finish or abort the current rebase or merge before migration.");
+	const sourcePaths = [
+		"--",
+		".",
+		":(exclude).hitch-backup",
+		":(exclude).hitch-migration-*"
+	];
+	const dirty = Boolean(await git(root, [
+		"status",
+		"--porcelain",
+		...sourcePaths
+	]));
+	if (dirty && !message) throw new MigrationError("Commit your changes or pass -m, then run the command again.");
+	const author = commitIdentity(`author ${await git(root, ["var", "GIT_AUTHOR_IDENT"])}`);
+	const tracked = (await migrationGit(root, [
+		"ls-files",
+		"-z",
+		"--cached"
+	])).toString("utf8").split("\0").filter(Boolean);
+	const imports = /* @__PURE__ */ new Map();
+	const importErrors = [];
+	for (const applet of roots) {
+		const code = basename(applet);
+		for (const path of tracked.filter((path) => path.startsWith(`applets/${code}/`) && /\.(?:ts|tsx|js|mjs)$/.test(path))) try {
+			const source = await fs$1.readFile(resolve(root, path), "utf8");
+			const rewritten = rewriteAppletImports(source, path, code, tracked);
+			if (rewritten !== source) imports.set(path, rewritten);
+		} catch (error) {
+			if (!(error instanceof MigrationError)) throw error;
+			importErrors.push(error.message);
+		}
+	}
+	if (importErrors.length > 0) throw new MigrationError(`Imports leave the applet:\n${importErrors.join("\n")}`);
+	const cli = await loadPackageManifest();
+	const manifests = await Promise.all(roots.map(async (applet) => {
+		const definition = await loadAppletSourceDefinition(applet);
+		const code = basename(applet);
+		if (definition.code !== code) throw new MigrationError(`Applet code must match its folder: ${applet}.`);
+		return migratedManifest(await fs$1.readFile(resolve(applet, "applet.manifest.ts"), "utf8"), config.org, cli.version);
+	}));
+	const generatedAgents = await generatedAgentContents();
+	const ignored = (await git(root, [
+		"ls-files",
+		"--others",
+		"--ignored",
+		"--exclude-standard",
+		"-z"
+	])).split("\0").filter((path) => path && backupPath(path));
+	const branch = await git(root, [
+		"symbolic-ref",
+		"--short",
+		"-q",
+		"HEAD"
+	]).catch(() => "HEAD");
+	const branches = (await git(root, [
+		"for-each-ref",
+		"--format=%(refname:short)",
+		"refs/heads/"
+	])).split("\n").filter(Boolean);
+	const stashes = await git(root, ["stash", "list"]);
+	if (branches.some((name) => name !== branch) || stashes) console.warn(`Only ${branch} moved; other branches stay in the backup.`);
+	const plan = migrationPlan(root, roots.map((path) => basename(path)), [...tracked, ...(await fs$1.readdir(root, { withFileTypes: true })).map((entry) => entry.name)]);
+	if (plan.parent && plan.targets.some((target) => fs.existsSync(target.root))) throw new MigrationError("An applet destination already exists. Move it before migration.");
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "").replace(/\.\d+Z$/, "Z");
+	const backup = resolve(root, ".hitch-backup", stamp);
+	const staging = resolve(root, `.hitch-migration-${stamp}`);
+	const gitDir = await git(root, ["rev-parse", "--absolute-git-dir"]);
+	const commonDir = resolve(root, await git(root, ["rev-parse", "--git-common-dir"]));
+	await fs$1.mkdir(resolve(root, ".hitch-backup"), { recursive: true });
+	await fs$1.mkdir(backup);
+	console.log(`Hitch migration backup: ${backup}`);
+	try {
+		await Promise.all(plan.backupFiles.map(async (path) => {
+			await fs$1.mkdir(dirname(resolve(backup, path)), { recursive: true });
+			await fs$1.cp(resolve(root, path), resolve(backup, path), {
+				recursive: true,
+				dereference: false,
+				verbatimSymlinks: true,
+				filter: (source) => backupPath(source.slice(root.length + 1))
+			});
+		}));
+		const standardGit = (await fs$1.lstat(resolve(root, ".git"))).isDirectory();
+		let source = gitDir;
+		if (dirty) {
+			const snapshot = resolve(staging, ".source-repository");
+			await fs$1.mkdir(snapshot, { recursive: true });
+			await git(snapshot, [
+				"init",
+				"-b",
+				"main"
+			]);
+			await fs$1.writeFile(resolve(snapshot, ".git/objects/info/alternates"), `${resolve(commonDir, "objects")}\n`);
+			await git(snapshot, ["read-tree", head]);
+			await git(snapshot, [
+				"--work-tree",
+				root,
+				"add",
+				"-A",
+				...sourcePaths
+			]);
+			const secrets = stagedSecretPaths((await git(snapshot, [
+				"diff",
+				"--cached",
+				head,
+				"--name-only",
+				"-z",
+				"--diff-filter=ACMR"
+			])).split("\0").filter(Boolean));
+			if (secrets.length > 0) throw new StagedSecretsError(secrets);
+			head = await git(snapshot, [
+				"commit-tree",
+				await git(snapshot, ["write-tree"]),
+				"-p",
+				head,
+				"-m",
+				message
+			], void 0, {
+				GIT_AUTHOR_NAME: author.name,
+				GIT_AUTHOR_EMAIL: author.email,
+				GIT_COMMITTER_NAME: author.name,
+				GIT_COMMITTER_EMAIL: author.email
+			});
+			source = resolve(snapshot, ".git");
+		}
+		for (const [index, target] of plan.targets.entries()) {
+			const temporary = resolve(staging, target.code);
+			await rewriteHistory(source, temporary, head, target.code);
+			await Promise.all(["applet.manifest.ts", ".gitignore"].map((name) => refuseSymlink(resolve(temporary, name))));
+			if (fs.existsSync(resolve(temporary, ".hitch-backup"))) throw new MigrationError("The rewritten history contains .hitch-backup. The existing backup stays in place.");
+			for (const [path, text] of imports) if (path.startsWith(`applets/${target.code}/`)) {
+				const destination = resolve(temporary, migrationPath(path, target.code));
+				await refuseSymlink(destination);
+				await fs$1.writeFile(destination, text);
+			}
+			const manifestPath = `applets/${target.code}/applet.manifest.ts`;
+			await fs$1.writeFile(resolve(temporary, "applet.manifest.ts"), imports.has(manifestPath) ? migratedManifest(imports.get(manifestPath), config.org, cli.version) : manifests[index]);
+			const removableAgents = [];
+			for (const [name, expected] of generatedAgents) {
+				const path = resolve(temporary, name);
+				if (!fs.existsSync(path)) continue;
+				if ((await fs$1.readFile(path)).equals(expected)) removableAgents.push(name);
+				else console.warn(`${path} was edited; Hitch left it in place.`);
+			}
+			await writeGitignore(temporary, true);
+			await git(temporary, [
+				"rm",
+				"-f",
+				"-r",
+				"--ignore-unmatch",
+				"--",
+				...removableAgents,
+				"package.json",
+				"pnpm-lock.yaml",
+				"pnpm-workspace.yaml",
+				"vite.config.ts",
+				"tsconfig.json",
+				"index.html",
+				"tsr.config.json",
+				"components.json",
+				".node-version",
+				".oxlintrc.json",
+				".oxfmtrc.json"
+			]);
+			await git(temporary, ["add", "-A"]);
+			await git(temporary, [
+				"commit",
+				"-m",
+				"Move to Hitch git"
+			], void 0, {
+				GIT_AUTHOR_NAME: author.name,
+				GIT_AUTHOR_EMAIL: author.email,
+				GIT_COMMITTER_NAME: author.name,
+				GIT_COMMITTER_EMAIL: author.email
+			});
+		}
+		for (const target of plan.targets) {
+			const temporary = resolve(staging, target.code);
+			const localFiles = /* @__PURE__ */ new Map();
+			[...ignored.filter((path) => !path.startsWith("applets/")), ...ignored.filter((path) => path.startsWith(`applets/${target.code}/`))].forEach((path) => {
+				const destination = migrationPath(path, target.code);
+				if (destination !== void 0) localFiles.set(destination, path);
+			});
+			for (const [destination, path] of localFiles) {
+				const expected = generatedAgents.get(destination);
+				const source = resolve(backup, path);
+				if (expected !== void 0 && (await fs$1.readFile(source)).equals(expected)) continue;
+				const output = resolve(temporary, destination);
+				if (fs.existsSync(output)) continue;
+				await fs$1.mkdir(dirname(output), { recursive: true });
+				await fs$1.cp(source, output, {
+					dereference: false,
+					verbatimSymlinks: true
+				});
+			}
+		}
+		if (!standardGit) {
+			await fs$1.cp(commonDir, resolve(backup, "repository"), {
+				recursive: true,
+				verbatimSymlinks: true
+			});
+			await fs$1.cp(resolve(gitDir, "HEAD"), resolve(backup, "repository/HEAD"));
+		}
+		await fs$1.rename(resolve(root, ".git"), resolve(backup, ".git"));
+		for (const path of plan.removeFiles) await fs$1.rm(resolve(root, path), {
+			force: true,
+			recursive: true
+		});
+		if (plan.parent) {
+			await fs$1.writeFile(resolve(root, ".hitchroot"), "");
+			for (const target of plan.targets) await fs$1.rename(resolve(staging, target.code), target.root);
+		} else {
+			const temporary = resolve(staging, plan.targets[0].code);
+			for (const { name: entry } of await fs$1.readdir(temporary, { withFileTypes: true })) {
+				if (entry === ".hitch-backup") throw new MigrationError("The rewritten history contains .hitch-backup. The existing backup stays in place.");
+				await fs$1.rm(resolve(root, entry), {
+					force: true,
+					recursive: true
+				});
+				await fs$1.rename(resolve(temporary, entry), resolve(root, entry));
+			}
+		}
+		await fs$1.rm(staging, {
+			recursive: true,
+			force: true
+		});
+		const invokedApplet = roots.find((path) => startingDir === path || startingDir.startsWith(`${path}${sep}`));
+		if (invokedApplet !== void 0) process.chdir(plan.targets.find((target) => target.code === basename(invokedApplet)).root);
+		if (plan.parent) await writeGeneratedAgents(root);
+		for (const target of plan.targets) await writeGeneratedAgents(target.root);
+		if (plan.parent) console.log(`Work in parent ${root}`);
+		plan.targets.forEach((target) => console.log(`Work in ${target.root}`));
+		console.log("Other copies of the old repo must use applet clone from now on");
+		console.log("Remove .github/workflows/hitch.yml from the old GitHub repo.");
+		return plan.targets.map((target) => target.root);
+	} catch (cause) {
+		await fs$1.rm(staging, {
+			recursive: true,
+			force: true
+		});
+		const restore = fs.existsSync(resolve(backup, ".git")) ? `Remove the new repos and .hitchroot, then restore the backup files and .git into ${root}.` : `The original .git stays in ${root}. The workspace stays in place.`;
+		throw new MigrationError(`Migration stopped: ${cause instanceof Error ? cause.message : String(cause)}. Backup: ${backup}. ${restore} Keep .hitch-backup untouched.`, { cause });
+	}
+}
+async function migrateIfEnabled(cwd, message) {
+	const root = findWorkspaceRoot(cwd);
+	if (root === void 0 || isRootLayout(root)) return void 0;
+	const config = readWorkspaceConfig(root);
+	if (!await canCheckHitchGit() || !await orgUsesHitchGit(config.org)) return void 0;
+	if (process.stdin.isTTY !== true) throw new MigrationError("Migration needs a terminal. Run applet bootstrap in an interactive terminal, then run this command again.");
+	const selected = findAppletRoot(cwd);
+	const code = selected === void 0 ? void 0 : basename(selected);
+	const roots = await migrateWorkspace(root, message);
+	return {
+		root,
+		roots,
+		selected: code === void 0 ? void 0 : roots.find((path) => roots.length === 1 || basename(path) === code)
+	};
+}
+export { migrateWorkspace as n, migrateIfEnabled as t };

package/dist/git-safety-Ck3X7jvA.js

@@ -0,0 +1,13 @@
+// src/git-safety.ts
+function stagedSecretPaths(paths) {
+	return paths.filter((path) => {
+		const name = path.split("/").at(-1);
+		return name !== ".env.example" && (name === ".env" || name.startsWith(".env.") || name === ".dev.vars" || name.startsWith(".dev.vars."));
+	});
+}
+var StagedSecretsError = class extends Error {
+	constructor(paths) {
+		super(`Remove these secret files from the index before deployment:\n${paths.join("\n")}`);
+	}
+};
+export { stagedSecretPaths as n, StagedSecretsError as t };

package/dist/{headers-CeRX-Xji.js → headers-BcEMIVCo.js}

@@ -1,4 +1,4 @@
-//#region src/headers.ts
+// src/headers.ts
 const HITCH_USER_HEADER = "x-hitch-user";
 const HITCH_SESSION_HEADER = "x-hitch-session";
 const HITCH_APPLET_HEADER = "x-hitch-applet";
@@ -14,5 +14,4 @@ const HITCH_REQUEST_HOST_HEADER = "x-hitch-request-host";
 const HITCH_WORKFLOW_RUN_HEADER = "x-hitch-workflow-run";
 const HITCH_WORKFLOW_HEADER = "x-hitch-workflow";
 const HITCH_WORKFLOW_INVOCATION_HEADER = "x-hitch-workflow-invocation";
-//#endregion
 export { HITCH_ORG_CODE_HEADER as a, HITCH_REQUEST_HOST_HEADER as c, HITCH_SESSION_HEADER as d, HITCH_USER_HEADER as f, HITCH_WORKFLOW_RUN_HEADER as h, HITCH_ORGANIZATION_HEADER as i, HITCH_SCHEDULE_HEADER as l, HITCH_WORKFLOW_INVOCATION_HEADER as m, HITCH_APPLET_HEADER as n, HITCH_PUBLIC_HEADER as o, HITCH_WORKFLOW_HEADER as p, HITCH_APPLET_TOKEN_HEADER as r, HITCH_RELEASE_HEADER as s, HITCH_APPLET_CODE_HEADER as t, HITCH_SCHEDULE_RUN_HEADER as u };

package/dist/{hitch-client-Cw-WZ_8v.js → hitch-client-CNN-dU6d.js}

@@ -1,18 +1,17 @@
-import { n as withFilesUpload, r as getRegisteredHitchContract } from "./upload-DRbVhuDm.js";
-import { t as withBatchRecorder } from "./batch-_ZjAg-Kk.js";
-import { t as createLazyClientProxy } from "./lazy-client-CwIzYAoE.js";
+import { n as withFilesUpload, r as getRegisteredHitchContract } from "./upload-D1mzpsSk.js";
+import { t as withBatchRecorder } from "./batch-DwyWmiaE.js";
+import { t as createLazyClientProxy } from "./lazy-client--QCL0wiu.js";
 import { createORPCClient } from "@orpc/client";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
 import { createTanstackQueryUtils } from "@orpc/tanstack-query";
-//#region src/hitch/browser.ts
+// src/hitch/browser.ts
 function createHitchClient(contract) {
 	return createLazyClientProxy(() => createORPCClient(new OpenAPILink(contract, {
 		url: `${location.origin}/api`,
 		fetch: (request, init) => globalThis.fetch(request, init)
 	})));
 }
-//#endregion
-//#region src/author/hitch-client.ts
+// src/author/hitch-client.ts
 function buildClientHitch() {
 	const contract = getRegisteredHitchContract();
 	if (contract === void 0) throw new Error("`hitch` is unavailable: run `applet generate` first. The framework imports your .hitch automatically at build; in plain node import your .hitch once before calling hitch.");
@@ -20,5 +19,4 @@ function buildClientHitch() {
 }
 const hitchClient = createLazyClientProxy(buildClientHitch);
 const hitch = withFilesUpload(createTanstackQueryUtils(hitchClient), () => hitchClient.files);
-//#endregion
 export { hitch as t };