@hitch42/applet 0.1.1-beta.4 → 0.1.1-beta.5

package/dist/applet.js

@@ -35,6 +35,7 @@ Deploy options:
   --changeset <id>    Deploy against a pending schema changeset. The build
                       generates against its schema and the release promotes
                       when the changeset applies. Manifest mismatches warn.
+Run applet deploy in the workspace root to deploy every applet.
 
 Logs options:
   --since <duration>  Show logs from this period. Default: 1h. Maximum: 7d.
@@ -51,7 +52,9 @@ Variables options:
   --secret            Store the value as a secret.
   -y, --yes           Skip the live applet confirmation.
 
-CI: set HITCH_API_KEY (and HITCH_API_URL for a non-default instance).`;
+CI: set HITCH_API_KEY (and HITCH_API_URL for a non-default instance).
+GitHub Actions: generate, build, and deploy use the job's OIDC token instead of
+a key. Grant the job id-token: write.`;
 async function main() {
 	const { positionals, values } = parseArgs({
 		allowPositionals: true,
@@ -82,23 +85,23 @@ async function main() {
 	const noLogFlags = values.run === void 0 && values.filter === void 0 && values.level === void 0 && values.limit === void 0 && values.live === void 0 && values.search === void 0 && values.since === void 0;
 	const noModeFlags = values["client-only"] === void 0 && values["server-only"] === void 0;
 	if (positionals.length === 1 && positionals[0] === "bootstrap" && values.changeset === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BN-p6XMP.js")).runBootstrap({ install: values["no-install"] !== true });
+		await (await import("./init-VzV28EFT.js")).runBootstrap({ install: values["no-install"] !== true });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "generate" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./generate-DnD-wLog.js")).runGenerate({ changesetId: values.changeset });
+		await (await import("./generate-D5rSXXa-.js")).runGenerate({ changesetId: values.changeset });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "build" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./build-DwUC2Gkd.js")).runBuild({ changesetId: values.changeset });
+		await (await import("./build-pvl3vj91.js")).runBuild({ changesetId: values.changeset });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "deploy" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./deploy-DWegAaXf.js")).runDeploy({ changesetId: values.changeset });
+		await (await import("./deploy-BDonkPqF.js")).runDeploy({ changesetId: values.changeset });
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "init" && values.changeset === void 0 && noModeFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BN-p6XMP.js")).runInit(positionals[1], {
+		await (await import("./init-VzV28EFT.js")).runInit(positionals[1], {
 			commit: values["no-commit"] !== true,
 			git: values["no-git"] !== true,
 			install: values["no-install"] !== true
@@ -106,7 +109,7 @@ async function main() {
 		return;
 	}
 	if (positionals.length === 2 && positionals[0] === "new" && values.changeset === void 0 && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-BN-p6XMP.js")).runNew({
+		await (await import("./init-VzV28EFT.js")).runNew({
 			code: positionals[1],
 			clientOnly: values["client-only"],
 			install: values["no-install"] !== true,

package/dist/{build-B5hbyJGZ.js → build-D1S5XCRV.js}

@@ -28,8 +28,7 @@ async function runPnpm(args, cwd) {
 		});
 	});
 }
-async function buildApplet(changesetId, outDir = ".hitch/dist") {
-	const appletRoot = process.cwd();
+async function buildApplet(appletRoot, changesetId, outDir = ".hitch/dist") {
 	const { workspaceRoot } = await prepareAppletProject(appletRoot);
 	await rm(resolve(appletRoot, ".hitch"), {
 		force: true,
@@ -68,7 +67,7 @@ async function buildApplet(changesetId, outDir = ".hitch/dist") {
 	});
 }
 async function runBuild(options = {}) {
-	await buildApplet(options.changesetId);
+	await buildApplet(process.cwd(), options.changesetId);
 }
 //#endregion
 export { runBuild as n, buildApplet as t };

package/dist/build-pvl3vj91.js

@@ -0,0 +1,2 @@
+import { n as runBuild } from "./build-D1S5XCRV.js";
+export { runBuild };

package/dist/ci-D0nC_Ho7.js

@@ -0,0 +1,52 @@
+import { i as resolveInstanceUrl } from "./auth-DaVK0k5R.js";
+//#region src/ci.ts
+function githubActionsContext(env = process.env) {
+	if (env.GITHUB_ACTIONS !== "true" || env.HITCH_API_KEY) return void 0;
+	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	if (!requestUrl || !requestToken) throw new Error("GitHub Actions did not provide an OIDC token. Grant the job the id-token: write permission, or set HITCH_API_KEY.");
+	return {
+		requestUrl,
+		requestToken
+	};
+}
+async function hitchResponseError(response, summary) {
+	let details = "";
+	try {
+		const body = await response.json();
+		if (body !== null && typeof body === "object") details = ["code" in body && typeof body.code === "string" ? body.code : void 0, "message" in body && typeof body.message === "string" ? body.message : void 0].filter((value) => value !== void 0).join(": ");
+	} catch {
+		details = "";
+	}
+	return /* @__PURE__ */ new Error(`${summary} (${response.status})${details ? `: ${details}` : ""}.`);
+}
+async function githubActionsToken(context, instanceUrl, fetcher) {
+	const url = new URL(context.requestUrl);
+	url.searchParams.set("audience", new URL(instanceUrl).origin);
+	const response = await fetcher(url, { headers: { Authorization: `bearer ${context.requestToken}` } });
+	if (!response.ok) throw new Error(`GitHub did not issue an OIDC token (${response.status}).`);
+	const body = await response.json();
+	if (body === null || typeof body !== "object" || !("value" in body)) throw new Error("GitHub returned an OIDC token response without a value.");
+	if (typeof body.value !== "string") throw new Error("GitHub returned an OIDC token response without a value.");
+	return body.value;
+}
+async function fetchWithGitHubActions(context, options, request) {
+	const instanceUrl = await resolveInstanceUrl(void 0, options.store);
+	return request(instanceUrl, await githubActionsToken(context, instanceUrl, options.fetch ?? globalThis.fetch));
+}
+async function loadGitHubActionsBuildInputs(context, options) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const response = await fetchWithGitHubActions(context, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/ci/v1/build-inputs`, {
+		method: "POST",
+		headers: { Authorization: `Bearer ${accessToken}` }
+	}));
+	if (!response.ok) throw await hitchResponseError(response, "Failed to load the CI build inputs");
+	const body = await response.json();
+	if (body === null || typeof body !== "object" || !("openapi" in body) || !("theme" in body) || typeof body.theme !== "string") throw new Error("The CI build inputs must contain an openapi document and a theme string.");
+	return {
+		openapi: body.openapi,
+		theme: body.theme
+	};
+}
+//#endregion
+export { loadGitHubActionsBuildInputs as i, githubActionsContext as n, hitchResponseError as r, fetchWithGitHubActions as t };

package/dist/{deploy-DWegAaXf.js → deploy-BDonkPqF.js}

@@ -1,6 +1,9 @@
 import { t as fetchWithOrgAuth } from "./auth-DaVK0k5R.js";
-import { t as buildApplet } from "./build-B5hbyJGZ.js";
+import { n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-D0nC_Ho7.js";
+import { r as readWorkspaceConfig } from "./load-config-BnxocLAQ.js";
+import { t as buildApplet } from "./build-D1S5XCRV.js";
 import { createRequire } from "node:module";
+import { existsSync } from "node:fs";
 import { readFile, readdir } from "node:fs/promises";
 import { relative, resolve, sep } from "node:path";
 import { execFile } from "node:child_process";
@@ -2355,14 +2358,17 @@ async function createBundle(distDir) {
 	body.set(bundle);
 	return body;
 }
-async function readGitInfo() {
-	const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
+function gitEnvironment() {
+	return Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_")));
+}
+async function readGitInfo(appletRoot) {
+	const env = gitEnvironment();
 	try {
 		const [{ stdout: status }, { stdout: sha }] = await Promise.all([execFileAsync("git", ["status", "--porcelain"], {
-			cwd: process.cwd(),
+			cwd: appletRoot,
 			env
 		}), execFileAsync("git", ["rev-parse", "HEAD"], {
-			cwd: process.cwd(),
+			cwd: appletRoot,
 			env
 		})]);
 		return {
@@ -2373,26 +2379,26 @@ async function readGitInfo() {
 		return { gitDirty: false };
 	}
 }
-async function deployError(response) {
-	let details = "";
-	try {
-		const body = await response.json();
-		if (body !== null && typeof body === "object") details = ["code" in body && typeof body.code === "string" ? body.code : void 0, "message" in body && typeof body.message === "string" ? body.message : void 0].filter((value) => value !== void 0).join(": ");
-	} catch {
-		details = "";
-	}
-	return /* @__PURE__ */ new Error(`Deploy failed (${response.status})${details ? `: ${details}` : ""}.`);
+async function repositoryDirectory(appletRoot) {
+	const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
+		cwd: appletRoot,
+		env: gitEnvironment()
+	});
+	const directory = relative(stdout.trim(), appletRoot).split(sep).join("/") || ".";
+	if (directory === ".." || directory.startsWith("../")) throw new Error(`${appletRoot} is outside its git repository ${stdout.trim()}.`);
+	return directory;
 }
-async function runDeploy(options) {
-	if (options.dist === void 0) await buildApplet(options.changesetId);
-	const distDir = resolve(options.dist ?? ".hitch/dist");
-	const manifest = await readManifest(distDir);
-	const [bundle, git] = await Promise.all([createBundle(distDir), readGitInfo()]);
+function releaseForm(manifest, bundle) {
+	const body = new FormData();
+	body.set("manifest", manifest.raw);
+	body.set("bundle", new File([bundle], "bundle.tar.gz", { type: "application/gzip" }));
+	return body;
+}
+async function deployWithOrgAuth(appletRoot, distDir, manifest, options) {
 	const fetcher = options.fetch ?? globalThis.fetch;
-	const response = await fetchWithOrgAuth(manifest.org, options, (instanceUrl, accessToken) => {
-		const body = new FormData();
-		body.set("manifest", manifest.raw);
-		body.set("bundle", new File([bundle], "bundle.tar.gz", { type: "application/gzip" }));
+	const [bundle, git] = await Promise.all([createBundle(distDir), readGitInfo(appletRoot)]);
+	return fetchWithOrgAuth(manifest.org, options, (instanceUrl, accessToken) => {
+		const body = releaseForm(manifest, bundle);
 		body.set("gitDirty", String(git.gitDirty));
 		if (git.gitSha !== void 0) body.set("gitSha", git.gitSha);
 		if (options.changesetId !== void 0) body.set("changeset_id", options.changesetId);
@@ -2402,7 +2408,28 @@ async function runDeploy(options) {
 			body
 		});
 	});
-	if (!response.ok) throw await deployError(response);
+}
+async function deployWithGitHubActions(context, appletRoot, distDir, manifest, options) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const [bundle, sourceDirectory] = await Promise.all([createBundle(distDir), repositoryDirectory(appletRoot)]);
+	return fetchWithGitHubActions(context, options, (instanceUrl, accessToken) => {
+		const body = releaseForm(manifest, bundle);
+		body.set("source_directory", sourceDirectory);
+		return fetcher(`${instanceUrl}/api/ci/v1/applets/${manifest.code}/releases`, {
+			method: "POST",
+			headers: { Authorization: `Bearer ${accessToken}` },
+			body
+		});
+	});
+}
+async function deployApplet(appletRoot, options) {
+	const github = githubActionsContext(options.store?.env ?? process.env);
+	if (github !== void 0 && options.changesetId !== void 0) throw new Error("A changeset deploy is not available in GitHub Actions.");
+	if (options.dist === void 0) await buildApplet(appletRoot, options.changesetId);
+	const distDir = resolve(appletRoot, options.dist ?? ".hitch/dist");
+	const manifest = await readManifest(distDir);
+	const response = github === void 0 ? await deployWithOrgAuth(appletRoot, distDir, manifest, options) : await deployWithGitHubActions(github, appletRoot, distDir, manifest, options);
+	if (!response.ok) throw await hitchResponseError(response, "Deploy failed");
 	const result = await response.json();
 	console.log(`Deployed release ${result.data.id} (${result.promoted ? "promoted" : "not promoted"}).`);
 	if (result.warnings?.length) {
@@ -2412,5 +2439,26 @@ async function runDeploy(options) {
 	if (result.unset_variables?.length) console.warn(`Warning: declared variables not set: ${result.unset_variables.join(", ")}. Set them with applet variables set.`);
 	return result;
 }
+async function workspaceAppletRoots(workspaceRoot) {
+	const appletsDir = resolve(workspaceRoot, "applets");
+	const roots = (await readdir(appletsDir, { withFileTypes: true }).catch((error) => {
+		if (isErrno(error, "ENOENT")) return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => resolve(appletsDir, entry.name)).filter((root) => existsSync(resolve(root, "applet.manifest.ts"))).sort();
+	if (roots.length === 0) throw new Error(`No applets were found under ${appletsDir}.`);
+	return roots;
+}
+async function runDeploy(options) {
+	const root = process.cwd();
+	if (existsSync(resolve(root, "applet.manifest.ts"))) {
+		await deployApplet(root, options);
+		return;
+	}
+	if (readWorkspaceConfig(root) === void 0) throw new Error("Run applet deploy in an applet folder or in the workspace root.");
+	for (const appletRoot of await workspaceAppletRoots(root)) {
+		console.log(`Deploying ${relative(root, appletRoot)}...`);
+		await deployApplet(appletRoot, options);
+	}
+}
 //#endregion
 export { runDeploy };

package/dist/{generate-C6Sy7X7A.js → generate-C6eAL5eo.js}

@@ -1,4 +1,5 @@
 import { i as resolveInstanceUrl, n as organizationInstanceUrl, t as fetchWithOrgAuth } from "./auth-DaVK0k5R.js";
+import { i as loadGitHubActionsBuildInputs, n as githubActionsContext } from "./ci-D0nC_Ho7.js";
 import { t as loadAppletConfig } from "./load-config-BnxocLAQ.js";
 import { r as prepareAppletProject } from "./project-mW0vsN8A.js";
 import { createRequire } from "node:module";
@@ -352,30 +353,34 @@ async function responseJson(response) {
 	}
 }
 async function loadAuthenticatedSpec(orgCode, options) {
-	const ciPath = (options.store?.env ?? process.env).HITCH_CI_OPENAPI_PATH;
-	if (ciPath !== void 0) try {
-		return JSON.parse(await readFile(ciPath, "utf8"));
-	} catch (error) {
-		throw new Error(`Failed to read the CI OpenAPI input from ${ciPath}.`, { cause: error });
-	}
+	const github = githubActionsContext(options.store?.env ?? process.env);
+	if (github !== void 0) return (await loadGitHubActionsBuildInputs(github, options)).openapi;
 	const fetcher = options.fetch ?? globalThis.fetch;
 	const response = await fetchWithOrgAuth(orgCode, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/openapi.json${options.changesetId === void 0 ? "" : `?changeset_id=${encodeURIComponent(options.changesetId)}`}`, { headers: { Authorization: `Bearer ${accessToken}` } }));
 	if (!response.ok) throw new Error(`Failed to load the organization's OpenAPI spec (${response.status}).`);
 	return responseJson(response);
 }
 async function loadThemeStylesheet(orgCode, options) {
-	const ciPath = (options.store?.env ?? process.env).HITCH_CI_THEME_PATH;
-	if (ciPath !== void 0) try {
-		return await readFile(ciPath, "utf8");
-	} catch (error) {
-		throw new Error(`Failed to read the CI theme input from ${ciPath}.`, { cause: error });
-	}
 	const fetcher = options.fetch ?? globalThis.fetch;
 	const instanceUrl = await resolveInstanceUrl(void 0, options.store);
 	const response = await fetcher(`${organizationInstanceUrl(instanceUrl, orgCode)}/theme.css`);
 	if (!response.ok) throw new Error(`Failed to load the organization's theme (${response.status}).`);
 	return response.text();
 }
+async function loadBuildInputs(orgCode, options) {
+	const github = githubActionsContext(options.store?.env ?? process.env);
+	if (github !== void 0) {
+		const inputs = await loadGitHubActionsBuildInputs(github, options);
+		return {
+			spec: inputs.openapi,
+			theme: inputs.theme
+		};
+	}
+	return {
+		spec: await loadAuthenticatedSpec(orgCode, options),
+		theme: await loadThemeStylesheet(orgCode, options)
+	};
+}
 async function generateContract(spec, outDir) {
 	await mkdir(outDir, { recursive: true });
 	const paths = spec !== null && typeof spec === "object" && "paths" in spec ? spec.paths : void 0;
@@ -444,8 +449,7 @@ async function runGenerate(options) {
 	const root = process.cwd();
 	const outDir = resolve("./.hitch");
 	const manifest = await loadAppletConfig(process.cwd());
-	const spec = await loadAuthenticatedSpec(manifest.org, options);
-	const themeStylesheet = await loadThemeStylesheet(manifest.org, options);
+	const { spec, theme: themeStylesheet } = await loadBuildInputs(manifest.org, options);
 	const stagedDir = await mkdtemp(resolve("./.hitch.tmp-"));
 	const backupDir = `${stagedDir}.backup`;
 	let staged = true;

package/dist/generate-D5rSXXa-.js

@@ -0,0 +1,2 @@
+import { n as runGenerate } from "./generate-C6eAL5eo.js";
+export { runGenerate };

package/dist/{init-BN-p6XMP.js → init-VzV28EFT.js}

@@ -1,6 +1,6 @@
 import { a as ORG_CODE_PATTERN, i as APPLET_CODE_PATTERN } from "./manifest-DyoJ1MIL.js";
 import { i as resolveInstanceUrl, r as resolveAuthForOrg } from "./auth-DaVK0k5R.js";
-import { n as runGenerate } from "./generate-C6Sy7X7A.js";
+import { n as runGenerate } from "./generate-C6eAL5eo.js";
 import { n as loadAppletSourceDefinition, r as readWorkspaceConfig } from "./load-config-BnxocLAQ.js";
 import { a as writeWorkspaceSupport, i as writeAppletSupport, n as loadCliManifest, t as assertWorkspaceCli } from "./project-mW0vsN8A.js";
 import { access, cp, mkdir, readdir, writeFile } from "node:fs/promises";

package/dist/vite.js

@@ -1,6 +1,6 @@
 import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-DyoJ1MIL.js";
 import { i as resolveInstanceUrl, n as organizationInstanceUrl } from "./auth-DaVK0k5R.js";
-import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-C6Sy7X7A.js";
+import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-C6eAL5eo.js";
 import { i as resolveWorkspaceOrg } from "./load-config-BnxocLAQ.js";
 import { existsSync } from "node:fs";
 import { appendFile, readFile, readdir, rm, writeFile } from "node:fs/promises";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hitch42/applet",
-  "version": "0.1.1-beta.4",
+  "version": "0.1.1-beta.5",
   "license": "MIT",
   "bin": {
     "applet": "./dist/applet.js"

package/scaffold/.github/workflows/hitch.yml

@@ -18,4 +18,4 @@ jobs:
       contents: read
       id-token: write
     # Hitch verifies the called workflow's commit SHA from the OIDC token.
-    uses: hitch-42/actions/.github/workflows/deploy.yml@ea655986e6ad6d41b9859dacd3183b7feca8e23e
+    uses: hitch-42/actions/.github/workflows/deploy.yml@b03cda4a4369decfc376d87425c21bcb61bddc57

package/dist/build-DwUC2Gkd.js

@@ -1,2 +0,0 @@
-import { n as runBuild } from "./build-B5hbyJGZ.js";
-export { runBuild };

package/dist/generate-DnD-wLog.js

@@ -1,2 +0,0 @@
-import { n as runGenerate } from "./generate-C6Sy7X7A.js";
-export { runGenerate };