@hitch42/applet 0.1.1-beta.20 → 0.1.1-beta.22

package/dist/source-hash-BbvtRaus.js

@@ -0,0 +1,107 @@
+import { a as findWorkspaceRoot } from "./workspace-CtIKSgMD.js";
+import { createHash } from "node:crypto";
+import { lstat, readlink } from "node:fs/promises";
+import { dirname, relative, resolve, sep } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+// src/source-hash.ts
+const execFileAsync = promisify(execFile);
+function gitEnvironment() {
+	return Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
+}
+var SourceHashUnavailableError = class extends Error {
+	constructor() {
+		super("Git is unavailable or the applet is outside a git repository.");
+	}
+};
+function isMissingPath(error) {
+	return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+async function hashFiles(topLevel, paths, env) {
+	if (paths.length === 0) return [];
+	return new Promise((resolveHashes, reject) => {
+		const child = spawn("git", ["hash-object", "--stdin-paths"], {
+			cwd: topLevel,
+			env
+		});
+		const stdout = [];
+		const stderr = [];
+		child.stdout.on("data", (chunk) => stdout.push(chunk));
+		child.stderr.on("data", (chunk) => stderr.push(chunk));
+		child.stdin.on("error", reject);
+		child.on("error", reject);
+		child.on("close", (code) => {
+			if (code !== 0) {
+				reject(/* @__PURE__ */ new Error(`git hash-object failed (${code}): ${Buffer.concat(stderr).toString("utf8").trim()}`));
+				return;
+			}
+			const hashes = Buffer.concat(stdout).toString("utf8").trimEnd().split("\n");
+			if (hashes.length !== paths.length || hashes.some((hash) => !/^[0-9a-f]{40,64}$/.test(hash))) {
+				reject(/* @__PURE__ */ new Error("git hash-object returned an unexpected number of hashes."));
+				return;
+			}
+			resolveHashes(hashes);
+		});
+		child.stdin.end(paths.map((path) => `"${path.split("").map((character) => character < " " || character === "" || character === "\"" || character === "\\" ? `\\${character.charCodeAt(0).toString(8).padStart(3, "0")}` : character).join("")}"\n`).join(""));
+	});
+}
+async function sourceHashes(appletRoots) {
+	if (appletRoots.length === 0) return /* @__PURE__ */ new Map();
+	const env = gitEnvironment();
+	const workspaceRoot = findWorkspaceRoot(appletRoots[0]) ?? dirname(dirname(appletRoots[0]));
+	let topLevel;
+	try {
+		const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
+			cwd: workspaceRoot,
+			env
+		});
+		topLevel = stdout.trim();
+	} catch (error) {
+		if (isMissingPath(error) || error instanceof Error && error.message.includes("not a git repository")) throw new SourceHashUnavailableError();
+		throw error;
+	}
+	const { stdout } = await execFileAsync("git", [
+		"ls-files",
+		"-z",
+		"--cached",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd: topLevel,
+		env,
+		maxBuffer: 67108864
+	});
+	const paths = [...new Set(stdout.split("\0").filter(Boolean))];
+	const present = (await Promise.all(paths.map(async (path) => {
+		const absolutePath = resolve(topLevel, path);
+		try {
+			const stat = await lstat(absolutePath);
+			if (stat.isFile()) return {
+				path,
+				kind: "file"
+			};
+			if (stat.isSymbolicLink()) return {
+				path,
+				kind: "link",
+				contentId: await readlink(absolutePath)
+			};
+			return;
+		} catch (error) {
+			if (isMissingPath(error)) return void 0;
+			throw error;
+		}
+	}))).filter((entry) => entry !== void 0);
+	const regularPaths = present.filter((entry) => entry.kind === "file").map((entry) => entry.path);
+	const hashes = await hashFiles(topLevel, regularPaths, env);
+	const contentIds = /* @__PURE__ */ new Map();
+	present.filter((entry) => entry.kind === "link").forEach((entry) => contentIds.set(entry.path, entry.contentId));
+	regularPaths.forEach((path, index) => contentIds.set(path, hashes[index]));
+	const appletsDirectory = relative(topLevel, resolve(workspaceRoot, "applets")).split(sep).join("/");
+	return new Map(appletRoots.map((appletRoot) => {
+		const appletDirectory = relative(topLevel, appletRoot).split(sep).join("/");
+		const digest = createHash("sha256");
+		[...contentIds.entries()].filter(([path]) => path !== appletsDirectory && !path.startsWith(`${appletsDirectory}/`) || path.startsWith(`${appletDirectory}/`)).sort(([left], [right]) => Buffer.compare(Buffer.from(left), Buffer.from(right))).forEach(([path, contentId]) => digest.update(`${path}\0${contentId}\n`));
+		return [appletRoot, digest.digest("hex")];
+	}));
+}
+export { gitEnvironment as n, sourceHashes as r, SourceHashUnavailableError as t };

package/dist/store-E5NhITHl.js

@@ -0,0 +1,448 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+// ../shared/auth/src/lock.mts
+const LOCK_AGE = 3e4;
+function canTakeOverRefreshLock(age) {
+	return age > LOCK_AGE;
+}
+function ownsRefreshLock(contents, owner) {
+	return contents === owner;
+}
+async function withFileLock(path, action) {
+	await fs.mkdir(dirname(path), { recursive: true });
+	const deadline = Date.now() + LOCK_AGE;
+	while (Date.now() < deadline) {
+		const owner = randomUUID();
+		let lock;
+		try {
+			lock = await fs.open(path, "wx", 384);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+			try {
+				const contents = await fs.readFile(path, "utf8");
+				const info = await fs.stat(path);
+				if (canTakeOverRefreshLock(Date.now() - info.mtimeMs) && ownsRefreshLock(await fs.readFile(path, "utf8"), contents)) await fs.rm(path, { force: true });
+			} catch (error) {
+				if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 100));
+			continue;
+		}
+		try {
+			await lock.writeFile(owner);
+			return await action();
+		} finally {
+			await lock.close();
+			const contents = await fs.readFile(path, "utf8").catch((error) => {
+				if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+				throw error;
+			});
+			if (contents !== void 0 && ownsRefreshLock(contents, owner)) await fs.rm(path, { force: true });
+		}
+	}
+	throw new AuthenticationError("Timed out while waiting for the credential lock.");
+}
+// ../shared/auth/src/oauth.mts
+const CLIENT_ID = "hitch-cli-oauth";
+const REFRESH_GRANT = "refresh_token";
+async function saveOAuthCredentials(instanceUrl, credentials, refreshToken) {
+	const stored = {
+		...credentials,
+		refreshToken
+	};
+	await setCredentials(instanceUrl, stored);
+	return stored;
+}
+async function removeOAuthCredentials(instanceUrl, orgCode) {
+	await deleteCredentials(instanceUrl, orgCode);
+}
+async function withRefreshLock(instanceUrl, orgCode, action) {
+	const { configDir } = storePaths();
+	return withFileLock(join(configDir, `refresh-${encodeURIComponent(normalizeInstanceUrl(instanceUrl))}-${orgCode}.lock`), action);
+}
+async function refreshAccessToken(instanceUrl, orgCode) {
+	const current = await getCredentialsForOrg(instanceUrl, orgCode);
+	if (current?.type !== "oauth") throw new LoginRequiredError();
+	if (current.expiresAt - Date.now() > 6e4) return current;
+	return withRefreshLock(instanceUrl, orgCode, async () => {
+		const latest = await getCredentialsForOrg(instanceUrl, orgCode);
+		if (latest?.type !== "oauth") throw new LoginRequiredError();
+		if (latest.expiresAt - Date.now() > 6e4) return latest;
+		const refreshToken = latest.refreshToken;
+		const response = await globalThis.fetch(`${instanceUrl}/api/auth/oauth2/token`, {
+			method: "POST",
+			signal: AbortSignal.timeout(1e4),
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				grant_type: REFRESH_GRANT,
+				refresh_token: refreshToken,
+				client_id: CLIENT_ID,
+				resource: `${organizationInstanceUrl(instanceUrl, orgCode)}/mcp`
+			})
+		});
+		const body = await response.json();
+		if (body === null || typeof body !== "object") throw new AuthenticationError("Hitch returned an invalid token response.");
+		if ("error" in body && body.error === "invalid_grant") {
+			await removeOAuthCredentials(instanceUrl, orgCode);
+			throw new LoginRequiredError();
+		}
+		if (!response.ok || !("access_token" in body) || typeof body.access_token !== "string" || !("refresh_token" in body) || typeof body.refresh_token !== "string" || !("expires_in" in body) || typeof body.expires_in !== "number") throw new AuthenticationError(`Token refresh failed (${response.status}).`);
+		const credentials = {
+			type: "oauth",
+			accessToken: body.access_token,
+			expiresAt: Date.now() + body.expires_in * 1e3,
+			organizationId: latest.organizationId,
+			orgCode
+		};
+		for (let attempt = 0; attempt < 3; attempt++) try {
+			return await saveOAuthCredentials(instanceUrl, credentials, body.refresh_token);
+		} catch (error) {
+			if (attempt === 2) throw new AuthenticationError("The login could not be saved. Run the command again within a minute.", { cause: error });
+			await new Promise((resolve) => setTimeout(resolve, 100 * (attempt + 1)));
+		}
+		throw new Error("Unreachable refresh write state.");
+	});
+}
+async function revokeOAuthCredentials(instanceUrl, credentials, warn = console.warn) {
+	try {
+		const response = await globalThis.fetch(`${normalizeInstanceUrl(instanceUrl)}/api/auth/oauth2/revoke`, {
+			method: "POST",
+			signal: AbortSignal.timeout(1e4),
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				token: credentials.refreshToken,
+				token_type_hint: "refresh_token",
+				client_id: CLIENT_ID
+			})
+		});
+		if (!response.ok) warn(`Warning: server sign-out failed (${response.status}).`);
+	} catch (error) {
+		warn(`Warning: server sign-out failed: ${error instanceof Error ? error.message : String(error)}`);
+	} finally {
+		await removeOAuthCredentials(instanceUrl, credentials.orgCode);
+	}
+}
+// ../shared/auth/src/store.mts
+const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
+var AuthenticationError = class extends Error {};
+var LoginRequiredError = class extends AuthenticationError {
+	constructor() {
+		super("Your Hitch login ended. Log in again with applet login or hitch login.");
+	}
+};
+let selectedStore;
+let keyringClass;
+let findKeyringCredentials;
+function configureKeyring(entryClass, findCredentials) {
+	keyringClass = entryClass;
+	findKeyringCredentials = findCredentials;
+	selectedStore = void 0;
+}
+function keyringEntry(account) {
+	if (keyringClass === void 0) throw new Error("Keyring is not configured.");
+	const options = process.platform === "linux" ? { linux: { store: "secret-service" } } : void 0;
+	return new keyringClass("hitch", account, options);
+}
+function credentialStorage() {
+	if (selectedStore !== void 0) return selectedStore;
+	if (keyringClass === void 0) throw new Error("Keyring is not configured.");
+	selectedStore = (process.platform === "linux" || process.platform === "darwin" || process.platform === "win32" ? ["secret"] : []).find((candidate) => {
+		const probe = `__probe__${randomUUID()}`;
+		try {
+			selectedStore = candidate;
+			const entry = keyringEntry(probe);
+			entry.setPassword(probe);
+			const verified = entry.getPassword() === probe;
+			const removed = entry.deletePassword();
+			return verified && removed;
+		} catch {
+			try {
+				keyringEntry(probe).deletePassword();
+			} catch {}
+			return false;
+		}
+	}) ?? "file";
+	return selectedStore;
+}
+function credentialStorageMessage(type = "oauth") {
+	return credentialStorage() === "file" ? `No keychain is available. Your login is saved in a plain file: ${type === "oauth" ? storePaths().oauthCredentialsPath : storePaths().credentialsPath}.` : void 0;
+}
+function account(instanceUrl, orgCode) {
+	return `${normalizeInstanceUrl(instanceUrl)} ${orgCode}`;
+}
+function listKeyringCredentials() {
+	if (findKeyringCredentials === void 0) throw new Error("Keyring listing is not configured.");
+	return findKeyringCredentials("hitch").filter(({ account }) => account !== "__index__");
+}
+function readKeychainCredential(instanceUrl, orgCode) {
+	const value = keyringEntry(account(instanceUrl, orgCode)).getPassword();
+	if (value === null) return void 0;
+	try {
+		const credentials = parseCredentials(JSON.parse(value));
+		if (credentials === void 0) throw new Error("Invalid credential shape.");
+		return credentials;
+	} catch (error) {
+		if (!value.startsWith("{")) return void 0;
+		throw new AuthenticationError(`Invalid keychain credential for ${orgCode}.`, { cause: error });
+	}
+}
+function isErrno(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+async function readJson(path) {
+	try {
+		return JSON.parse(await fs.readFile(path, "utf8"));
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return void 0;
+		throw new Error(`Failed to read ${path}.`, { cause: error });
+	}
+}
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseLegacyCredentials(instanceUrl, value) {
+	const parsed = parseCredentials(value);
+	if (parsed !== void 0 || !isObject(value) || value.type !== "oauth" || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return parsed;
+	const stored = credentialStorage() === "secret" ? keyringEntry(account(instanceUrl, value.orgCode)).getPassword() : null;
+	const refreshToken = typeof value.refreshToken === "string" ? value.refreshToken : stored;
+	return typeof refreshToken === "string" ? {
+		type: "oauth",
+		accessToken: typeof value.accessToken === "string" ? value.accessToken : "",
+		expiresAt: typeof value.expiresAt === "number" ? value.expiresAt : 0,
+		refreshToken,
+		organizationId: value.organizationId,
+		orgCode: value.orgCode
+	} : void 0;
+}
+async function setKeychainCredential(instanceUrl, credentials) {
+	keyringEntry(account(instanceUrl, credentials.orgCode)).setPassword(JSON.stringify(credentials));
+}
+function parseCredentials(value) {
+	if (!isObject(value) || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return;
+	const organization = {
+		organizationId: value.organizationId,
+		orgCode: value.orgCode
+	};
+	if ((value.type === void 0 || value.type === "session") && typeof value.accessToken === "string" && (value.expiresAt === void 0 || typeof value.expiresAt === "number")) return {
+		type: "session",
+		accessToken: value.accessToken,
+		...value.expiresAt === void 0 ? {} : { expiresAt: value.expiresAt },
+		...organization
+	};
+	if (value.type === "apiKey" && typeof value.apiKey === "string") return {
+		type: "apiKey",
+		apiKey: value.apiKey,
+		...organization
+	};
+	if (value.type === "oauth" && typeof value.accessToken === "string" && typeof value.expiresAt === "number" && typeof value.refreshToken === "string") return {
+		type: "oauth",
+		accessToken: value.accessToken,
+		expiresAt: value.expiresAt,
+		refreshToken: value.refreshToken,
+		...organization
+	};
+}
+function normalizeInstanceUrl(instanceUrl) {
+	let url;
+	try {
+		url = new URL(instanceUrl);
+	} catch (error) {
+		throw new Error(`Invalid Hitch instance URL: ${instanceUrl}`, { cause: error });
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Invalid Hitch instance URL protocol: ${url.protocol}`);
+	url.pathname = url.pathname.replace(/\/+$/, "");
+	url.search = "";
+	url.hash = "";
+	return url.toString().replace(/\/$/, "");
+}
+function organizationInstanceUrl(instanceUrl, orgCode) {
+	const url = new URL(normalizeInstanceUrl(instanceUrl));
+	const labels = url.hostname.split(".");
+	if (labels[0] !== "app" || labels.length < 2) return url.toString().replace(/\/$/, "");
+	url.hostname = [orgCode, ...labels.slice(1)].join(".");
+	return url.toString().replace(/\/$/, "");
+}
+function storePaths() {
+	const env = process.env;
+	const home = homedir();
+	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
+	return {
+		configDir,
+		cacheDir: join(env.XDG_CACHE_HOME || join(home, ".cache"), "hitch"),
+		configPath: join(configDir, "config.json"),
+		credentialsPath: join(configDir, "credentials.json"),
+		oauthCredentialsPath: join(configDir, "credentials-oauth.json")
+	};
+}
+async function resolveInstanceUrl(override) {
+	if (override !== void 0) return normalizeInstanceUrl(override);
+	const envInstanceUrl = process.env.HITCH_API_URL;
+	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
+	const { configPath } = storePaths();
+	const config = await readJson(configPath);
+	if (config === void 0) return DEFAULT_INSTANCE_URL;
+	if (!isObject(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
+	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
+}
+async function migrateOAuthFile(path) {
+	const source = await readFileCredentialStore(path);
+	if (!Object.values(source.instances).some((entries) => Object.values(entries).some((entry) => entry.type === "oauth"))) return;
+	await updateFileCredentialStore(path, async (store) => {
+		for (const [instance, entries] of Object.entries(store.instances)) {
+			for (const [org, credential] of Object.entries(entries)) {
+				if (credential.type !== "oauth") continue;
+				if (credentialStorage() === "secret") {
+					if (readKeychainCredential(instance, org) === void 0) {
+						await setKeychainCredential(instance, credential);
+						if (JSON.stringify(readKeychainCredential(instance, org)) !== JSON.stringify(credential)) throw new AuthenticationError(`Cannot verify migrated login for ${org}.`);
+					}
+				} else await updateFileCredentialStore(storePaths().oauthCredentialsPath, (destination) => {
+					destination.instances[instance] ??= {};
+					destination.instances[instance][org] ??= credential;
+				});
+				delete entries[org];
+			}
+			if (Object.keys(entries).length === 0) delete store.instances[instance];
+		}
+	});
+}
+async function readCredentialStore() {
+	const paths = storePaths();
+	await migrateOAuthFile(paths.credentialsPath);
+	await migrateOAuthFile(`${paths.credentialsPath}.bak`);
+	if (credentialStorage() === "secret") await migrateOAuthFile(paths.oauthCredentialsPath);
+	const legacy = await readFileCredentialStore(storePaths().credentialsPath);
+	const oauth = credentialStorage() === "file" ? await readFileCredentialStore(storePaths().oauthCredentialsPath) : { instances: {} };
+	const instances = legacy.instances;
+	Object.entries(oauth.instances).forEach(([instance, credentials]) => {
+		instances[instance] = {
+			...instances[instance],
+			...credentials
+		};
+	});
+	if (credentialStorage() === "secret") listKeyringCredentials().forEach(({ account: key }) => {
+		const split = key.lastIndexOf(" ");
+		if (split < 0) return;
+		const instanceUrl = key.slice(0, split);
+		const orgCode = key.slice(split + 1);
+		const credentials = readKeychainCredential(instanceUrl, orgCode);
+		if (credentials !== void 0) {
+			instances[instanceUrl] ??= {};
+			instances[instanceUrl][orgCode] = credentials;
+		}
+	});
+	return { instances };
+}
+async function getCredentialsForOrg(instanceUrl, orgCode) {
+	return (await readCredentialStore()).instances[normalizeInstanceUrl(instanceUrl)]?.[orgCode];
+}
+function environmentAuth() {
+	const apiKey = process.env.HITCH_API_KEY;
+	return apiKey !== void 0 && apiKey.length > 0 ? {
+		accessToken: apiKey,
+		source: "environment"
+	} : void 0;
+}
+function resolvedStoredAuth(credentials) {
+	return credentials === void 0 ? void 0 : {
+		accessToken: credentials.type === "apiKey" ? credentials.apiKey : credentials.accessToken,
+		credentialType: credentials.type,
+		organizationId: credentials.organizationId,
+		orgCode: credentials.orgCode,
+		source: "store"
+	};
+}
+function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
+	const exact = resolvedStoredAuth(credentialsByOrg[orgCode]);
+	if (exact !== void 0) return exact;
+	const sessions = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "session").filter((credentials, index, all) => all.findIndex(({ accessToken }) => accessToken === credentials.accessToken) === index);
+	if (sessions.length === 1) return resolvedStoredAuth(sessions[0]);
+	if (sessions.length > 1) throw new AuthenticationError(`Multiple sessions are stored. Run hitch login for organization "${orgCode}".`);
+	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
+	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
+}
+async function resolveAuth(instanceUrl, orgCode) {
+	const auth = environmentAuth();
+	if (auth !== void 0) return auth;
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = (await readCredentialStore()).instances[normalizedUrl] ?? {};
+	const selectedOrg = orgCode ?? process.env.HITCH_DEFAULT_ORG;
+	if (selectedOrg !== void 0 && selectedOrg.length > 0) return refreshResolvedAuth(normalizedUrl, resolveStoredAuthForOrg(credentialsByOrg, selectedOrg));
+	const orgCodes = Object.keys(credentialsByOrg).sort();
+	const soleOrg = orgCodes.at(0);
+	if (soleOrg === void 0) return void 0;
+	if (orgCodes.length === 1) return refreshResolvedAuth(normalizedUrl, resolvedStoredAuth(credentialsByOrg[soleOrg]));
+	throw new AuthenticationError(`Multiple organizations are stored for ${normalizedUrl}: ${orgCodes.join(", ")}. Use --org, the workspace hitch.config.ts, or HITCH_DEFAULT_ORG to choose one.`);
+}
+async function resolveAuthForOrg(instanceUrl, orgCode) {
+	const auth = environmentAuth();
+	if (auth !== void 0) return auth;
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = Object.entries((await readCredentialStore()).instances).find(([instance]) => instance === normalizedUrl)?.[1];
+	return refreshResolvedAuth(normalizedUrl, resolveStoredAuthForOrg(credentialsByOrg ?? {}, orgCode));
+}
+async function refreshResolvedAuth(instanceUrl, auth) {
+	if (auth?.credentialType !== "oauth" || auth.orgCode === void 0) return auth;
+	return resolvedStoredAuth(await refreshAccessToken(instanceUrl, auth.orgCode));
+}
+function rejectEnvironmentKey(response, auth) {
+	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
+}
+function bearerToken(credentials) {
+	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
+}
+async function setCredentials(instanceUrl, credentials) {
+	if (credentials.type === "oauth" && credentialStorage() === "secret") {
+		await setKeychainCredential(instanceUrl, credentials);
+		return;
+	}
+	const paths = storePaths();
+	await updateFileCredentialStore(credentials.type === "oauth" ? paths.oauthCredentialsPath : paths.credentialsPath, (store) => {
+		const key = normalizeInstanceUrl(instanceUrl);
+		store.instances[key] ??= {};
+		store.instances[key][credentials.orgCode] = credentials;
+	});
+}
+async function deleteCredentials(instanceUrl, orgCode) {
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const paths = storePaths();
+	await Promise.all([paths.credentialsPath, paths.oauthCredentialsPath].map((path) => updateFileCredentialStore(path, (store) => {
+		if (orgCode === void 0) delete store.instances[normalizedUrl];
+		else if (Object.hasOwn(store.instances, normalizedUrl)) {
+			const credentials = store.instances[normalizedUrl];
+			delete credentials[orgCode];
+			if (Object.keys(credentials).length === 0) delete store.instances[normalizedUrl];
+		}
+	})));
+	if (credentialStorage() === "secret") listKeyringCredentials().map(({ account }) => account).filter((key) => key.startsWith(`${normalizedUrl} `) && (orgCode === void 0 || key === account(normalizedUrl, orgCode))).forEach((key) => keyringEntry(key).deletePassword());
+}
+async function readFileCredentialStore(credentialsPath) {
+	const value = await readJson(credentialsPath);
+	if (value === void 0) return { instances: {} };
+	if (!isObject(value) || !isObject(value.instances)) throw new AuthenticationError(`Invalid credential store at ${credentialsPath}.`);
+	return { instances: Object.fromEntries(Object.entries(value.instances).flatMap(([instanceUrl, entry]) => {
+		if (!isObject(entry)) return [];
+		const direct = parseLegacyCredentials(instanceUrl, entry);
+		const credentials = direct === void 0 ? Object.values(entry).flatMap((item) => {
+			const parsed = parseLegacyCredentials(instanceUrl, item);
+			return parsed === void 0 ? [] : [[parsed.orgCode, parsed]];
+		}) : [[direct.orgCode, direct]];
+		return [[instanceUrl, Object.fromEntries(credentials)]];
+	})) };
+}
+async function updateFileCredentialStore(path, update) {
+	await withFileLock(`${path}.lock`, async () => {
+		const store = await readFileCredentialStore(path);
+		await update(store);
+		const temporary = `${path}.${randomUUID()}.tmp`;
+		try {
+			await fs.writeFile(temporary, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+			await fs.rename(temporary, path);
+		} finally {
+			await fs.rm(temporary, { force: true });
+		}
+	});
+}
+export { configureKeyring as a, normalizeInstanceUrl as c, rejectEnvironmentKey as d, resolveAuth as f, saveOAuthCredentials as g, revokeOAuthCredentials as h, bearerToken as i, organizationInstanceUrl as l, resolveInstanceUrl as m, DEFAULT_INSTANCE_URL as n, credentialStorageMessage as o, resolveAuthForOrg as p, LoginRequiredError as r, deleteCredentials as s, AuthenticationError as t, readCredentialStore as u };

package/dist/{upload-DRbVhuDm.js → upload-D1mzpsSk.js}

@@ -1,5 +1,5 @@
 import "@orpc/server";
-//#region src/hitch/registry.ts
+// src/hitch/registry.ts
 let registeredContract;
 function registerHitchContract(contract) {
 	registeredContract = contract;
@@ -7,8 +7,7 @@ function registerHitchContract(contract) {
 function getRegisteredHitchContract() {
 	return registeredContract;
 }
-//#endregion
-//#region src/hitch/upload.ts
+// src/hitch/upload.ts
 function abortError(signal) {
 	return signal?.reason ?? new DOMException("The upload was aborted.", "AbortError");
 }
@@ -80,7 +79,7 @@ async function uploadFile(files, file, options = {}) {
 	} }, { signal: options.signal });
 	const status = await putFile(file, created.uploadUrl, created.data.contentType, options);
 	if (status < 200 || status >= 300) throw new Error(`Upload of "${file.name}" failed with status ${status}.`);
-	const confirmed = await files.confirm({ params: { id: created.data.id } }, { signal: options.signal });
+	const confirmed = await files.confirm({ params: { fileId: created.data.id } }, { signal: options.signal });
 	return {
 		...confirmed.data,
 		downloadUrl: confirmed.downloadUrl
@@ -95,7 +94,7 @@ function withFilesUpload(target, files) {
 		const proxy = new Proxy(value, { get: (filesInner, filesProperty, filesReceiver) => {
 			if (filesProperty === "upload") return (file, options) => uploadFile(files(), file, options);
 			if (filesProperty === "download") return async (id, options) => {
-				const result = await files().get({ params: { id } }, options);
+				const result = await files().get({ params: { fileId: id } }, options);
 				return {
 					...result.data,
 					downloadUrl: result.downloadUrl
@@ -110,5 +109,4 @@ function withFilesUpload(target, files) {
 		return proxy;
 	} });
 }
-//#endregion
 export { registerHitchContract as i, withFilesUpload as n, getRegisteredHitchContract as r, uploadFile as t };

package/dist/{upload-D_kkmne_.d.ts → upload-wp-Ilsv6.d.ts}

@@ -1,5 +1,4 @@
 import { ContractProcedure, Meta, Schema } from "@orpc/contract";
-//#region src/hitch/files.d.ts
 type HitchFile = {
   id: string;
   organizationId: string;
@@ -26,9 +25,9 @@ type CreateFileOutput = {
   data: PendingHitchFile;
   uploadUrl: string;
 };
-type FileIdInput = {
+type FileInput = {
   params: {
-    id: string;
+    fileId: string;
   };
 };
 type FileOutput = {
@@ -37,12 +36,10 @@ type FileOutput = {
 };
 type FilesContract = {
   create: ContractProcedure<Schema<CreateFileInput, CreateFileInput>, Schema<CreateFileOutput, CreateFileOutput>, Record<never, never>, Meta>;
-  confirm: ContractProcedure<Schema<FileIdInput, FileIdInput>, Schema<FileOutput, FileOutput>, Record<never, never>, Meta>;
-  get: ContractProcedure<Schema<FileIdInput, FileIdInput>, Schema<FileOutput, FileOutput>, Record<never, never>, Meta>;
+  confirm: ContractProcedure<Schema<FileInput, FileInput>, Schema<FileOutput, FileOutput>, Record<never, never>, Meta>;
+  get: ContractProcedure<Schema<FileInput, FileInput>, Schema<FileOutput, FileOutput>, Record<never, never>, Meta>;
 };
 declare const filesContract: FilesContract;
-//#endregion
-//#region src/hitch/upload.d.ts
 type FilesClient = {
   create(input: {
     body: {
@@ -60,7 +57,7 @@ type FilesClient = {
   }>;
   confirm(input: {
     params: {
-      id: string;
+      fileId: string;
     };
   }, options?: {
     signal?: AbortSignal;
@@ -70,7 +67,7 @@ type FilesClient = {
   }>;
   get(input: {
     params: {
-      id: string;
+      fileId: string;
     };
   }, options?: {
     signal?: AbortSignal;
@@ -104,5 +101,4 @@ type WithFilesUpload<T> = T extends {
 } : T & {
   files: FilesUpload;
 };
-//#endregion
 export { UploadedHitchFile as a, filesContract as c, UploadProgress as i, FilesUpload as n, WithFilesUpload as o, UploadFileOptions as r, uploadFile as s, FilesClient as t };