@hitch42/applet 0.1.1-beta.6 → 0.1.1-beta.7

package/dist/applet.js

@@ -2,18 +2,22 @@
 import { parseArgs } from "node:util";
 //#region bin/applet.ts
 const usage = `Usage:
+  applet login [--no-browser]
   applet init <org> [--no-commit | --no-git] [--no-install]
   applet bootstrap [--no-install]
   applet new <code> [--client-only | --server-only] [--no-install]
-  applet generate [--changeset <id>]
-  applet build [--changeset <id>]
-  applet deploy [--changeset <id>]
+  applet generate
+  applet build
+  applet deploy
   applet logs [code] [--since <duration>] [--limit <count>]
                      [--search <text>] [--level <level>] [--filter <json>] [--run <id>] [--live]
   applet variables set <KEY> [value] [--secret] [-y | --yes]
   applet variables list
   applet variables delete <KEY> [-y | --yes]
 
+Login options:
+  --no-browser      Print the sign-in URL without opening a browser.
+
 Init options:
   --no-commit        Do not create the initial commit
   --no-git           Do not create a git repository
@@ -27,15 +31,14 @@ New options:
 Bootstrap options:
   --no-install       Do not run pnpm install
 
-Generate options:
-  --changeset <id>    Generate against the schema this pending changeset
-                      would produce. The build honours HITCH_CHANGESET_ID.
+Schema changesets:
+  Set requiresChangeset in applet.manifest.ts to generate, build, and deploy
+  against a pending changeset. The release goes live when the changeset
+  applies in Hitch. After it applies, the field uses the live schema.
 
-Deploy options:
-  --changeset <id>    Deploy against a pending schema changeset. The build
-                      generates against its schema and the release promotes
-                      when the changeset applies. Manifest mismatches warn.
-Run applet deploy in the workspace root to deploy every applet.
+Run applet deploy in the workspace root to deploy every applet. In GitHub
+Actions it skips an applet when neither its folder nor any file outside
+applets/ changed since its current CI release.
 
 Logs options:
   --since <duration>  Show logs from this period. Default: 1h. Maximum: 7d.
@@ -52,6 +55,8 @@ Variables options:
   --secret            Store the value as a secret.
   -y, --yes           Skip the live applet confirmation.
 
+Login: applet login selects the organization from hitch.config.ts and shares
+credentials with hitch login.
 CI: set HITCH_API_KEY (and HITCH_API_URL for a non-default instance).
 GitHub Actions: generate, build, and deploy use the job's OIDC token instead of
 a key. Grant the job id-token: write.`;
@@ -59,13 +64,13 @@ async function main() {
 	const { positionals, values } = parseArgs({
 		allowPositionals: true,
 		options: {
-			changeset: { type: "string" },
 			"client-only": { type: "boolean" },
 			filter: { type: "string" },
 			run: { type: "string" },
 			level: { type: "string" },
 			limit: { type: "string" },
 			live: { type: "boolean" },
+			"no-browser": { type: "boolean" },
 			"no-commit": { type: "boolean" },
 			"no-git": { type: "boolean" },
 			"no-install": { type: "boolean" },
@@ -80,36 +85,41 @@ async function main() {
 		},
 		strict: true
 	});
+	if (positionals.length === 1 && positionals[0] === "login" && Object.keys(values).every((key) => key === "no-browser")) {
+		await (await import("./login-iT9MRuaw.js")).runLogin({ noBrowser: values["no-browser"] });
+		return;
+	}
+	if (values["no-browser"] !== void 0) throw new Error(usage);
 	const noGitFlags = values["no-commit"] === void 0 && values["no-git"] === void 0;
 	const noVariableFlags = values.secret === void 0 && values.yes === void 0;
 	const noLogFlags = values.run === void 0 && values.filter === void 0 && values.level === void 0 && values.limit === void 0 && values.live === void 0 && values.search === void 0 && values.since === void 0;
 	const noModeFlags = values["client-only"] === void 0 && values["server-only"] === void 0;
-	if (positionals.length === 1 && positionals[0] === "bootstrap" && values.changeset === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-tEMeys9M.js")).runBootstrap({ install: values["no-install"] !== true });
+	if (positionals.length === 1 && positionals[0] === "bootstrap" && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
+		await (await import("./init-Wu6XmyVc.js")).runBootstrap({ install: values["no-install"] !== true });
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "generate" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./generate-D5rSXXa-.js")).runGenerate({ changesetId: values.changeset });
+		await (await import("./generate-DSk8ihsC.js")).runGenerate({});
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "build" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./build-B70gkDi5.js")).runBuild({ changesetId: values.changeset });
+		await (await import("./build-DhNDp7ji.js")).runBuild();
 		return;
 	}
 	if (positionals.length === 1 && positionals[0] === "deploy" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./deploy-0dlUvCt3.js")).runDeploy({ changesetId: values.changeset });
+		await (await import("./deploy-CqrtNJ1x.js")).runDeploy({});
 		return;
 	}
-	if (positionals.length === 2 && positionals[0] === "init" && values.changeset === void 0 && noModeFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-tEMeys9M.js")).runInit(positionals[1], {
+	if (positionals.length === 2 && positionals[0] === "init" && noModeFlags && noVariableFlags && noLogFlags) {
+		await (await import("./init-Wu6XmyVc.js")).runInit(positionals[1], {
 			commit: values["no-commit"] !== true,
 			git: values["no-git"] !== true,
 			install: values["no-install"] !== true
 		});
 		return;
 	}
-	if (positionals.length === 2 && positionals[0] === "new" && values.changeset === void 0 && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./init-tEMeys9M.js")).runNew({
+	if (positionals.length === 2 && positionals[0] === "new" && noGitFlags && noVariableFlags && noLogFlags) {
+		await (await import("./init-Wu6XmyVc.js")).runNew({
 			code: positionals[1],
 			clientOnly: values["client-only"],
 			install: values["no-install"] !== true,
@@ -117,8 +127,8 @@ async function main() {
 		});
 		return;
 	}
-	if ((positionals.length === 1 || positionals.length === 2) && positionals[0] === "logs" && values.changeset === void 0 && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags) {
-		await (await import("./logs-m00pzr_O.js")).runLogs({
+	if ((positionals.length === 1 || positionals.length === 2) && positionals[0] === "logs" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags) {
+		await (await import("./logs-B-qZGXSK.js")).runLogs({
 			code: positionals[1],
 			filter: values.filter,
 			run: values.run,
@@ -130,8 +140,8 @@ async function main() {
 		});
 		return;
 	}
-	if ((positionals.length === 3 || positionals.length === 4) && positionals[0] === "variables" && values.changeset === void 0 && positionals[1] === "set" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags) {
-		await (await import("./variables-CP7Ce3Np.js")).runVariablesSet({
+	if ((positionals.length === 3 || positionals.length === 4) && positionals[0] === "variables" && positionals[1] === "set" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noLogFlags) {
+		await (await import("./variables-DcwMeIau.js")).runVariablesSet({
 			key: positionals[2],
 			secret: values.secret,
 			value: positionals[3],
@@ -139,12 +149,12 @@ async function main() {
 		});
 		return;
 	}
-	if (positionals.length === 2 && positionals[0] === "variables" && values.changeset === void 0 && positionals[1] === "list" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
-		await (await import("./variables-CP7Ce3Np.js")).runVariablesList({});
+	if (positionals.length === 2 && positionals[0] === "variables" && positionals[1] === "list" && values["no-install"] === void 0 && noModeFlags && noGitFlags && noVariableFlags && noLogFlags) {
+		await (await import("./variables-DcwMeIau.js")).runVariablesList({});
 		return;
 	}
-	if (positionals.length === 3 && positionals[0] === "variables" && values.changeset === void 0 && positionals[1] === "delete" && values["no-install"] === void 0 && noModeFlags && noGitFlags && values.secret === void 0 && noLogFlags) {
-		await (await import("./variables-CP7Ce3Np.js")).runVariablesDelete({
+	if (positionals.length === 3 && positionals[0] === "variables" && positionals[1] === "delete" && values["no-install"] === void 0 && noModeFlags && noGitFlags && values.secret === void 0 && noLogFlags) {
+		await (await import("./variables-DcwMeIau.js")).runVariablesDelete({
 			key: positionals[2],
 			yes: values.yes
 		});

package/dist/{build-DIsKQQT0.js → build-DauirTcY.js}

@@ -1,7 +1,8 @@
-import { r as prepareAppletProject } from "./project-mW0vsN8A.js";
+import { i as prepareAppletProjects, r as prepareAppletProject } from "./project-C_rtpjp8.js";
 import { rm } from "node:fs/promises";
 import { resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
 //#region src/build.ts
 function isMissingFile(error) {
 	return error instanceof Error && "code" in error && error.code === "ENOENT";
@@ -29,13 +30,19 @@ async function runPnpm(args, cwd) {
 		});
 	});
 }
-async function buildApplet(appletRoot, changesetId, outDir = ".hitch/dist") {
-	const { workspaceRoot } = await prepareAppletProject(appletRoot);
+async function buildApplet(appletRoot, outDir = ".hitch/dist") {
+	await runPnpm(["install"], await prepareAppletProject(appletRoot));
+	await buildPreparedApplet(appletRoot, outDir);
+}
+async function prepareWorkspaceBuild(workspaceRoot, appletRoots) {
+	await prepareAppletProjects(workspaceRoot, appletRoots);
+	await runPnpm(["install"], workspaceRoot);
+}
+async function buildPreparedApplet(appletRoot, outDir = ".hitch/dist", logPrefix = "") {
 	await rm(resolve(appletRoot, ".hitch"), {
 		force: true,
 		recursive: true
 	});
-	await runPnpm(["install"], workspaceRoot);
 	await new Promise((resolveBuild, rejectBuild) => {
 		let finished = false;
 		const child = spawn("pnpm", [
@@ -46,13 +53,21 @@ async function buildApplet(appletRoot, changesetId, outDir = ".hitch/dist") {
 			outDir
 		], {
 			cwd: appletRoot,
-			stdio: "inherit",
-			shell: process.platform === "win32",
-			env: {
-				...process.env,
-				...changesetId === void 0 ? {} : { HITCH_CHANGESET_ID: changesetId }
-			}
+			stdio: logPrefix === "" ? "inherit" : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			shell: process.platform === "win32"
 		});
+		if (child.stdout) createInterface({
+			input: child.stdout,
+			crlfDelay: Infinity
+		}).on("line", (line) => console.log(`${logPrefix}${line}`));
+		if (child.stderr) createInterface({
+			input: child.stderr,
+			crlfDelay: Infinity
+		}).on("line", (line) => console.error(`${logPrefix}${line}`));
 		child.once("error", (error) => {
 			finished = true;
 			rejectBuild(isMissingFile(error) ? /* @__PURE__ */ new Error("pnpm was not found. Install pnpm, then run applet build again.") : error);
@@ -68,8 +83,8 @@ async function buildApplet(appletRoot, changesetId, outDir = ".hitch/dist") {
 		});
 	});
 }
-async function runBuild(options = {}) {
-	await buildApplet(process.cwd(), options.changesetId);
+async function runBuild() {
+	await buildApplet(process.cwd());
 }
 //#endregion
-export { runBuild as n, buildApplet as t };
+export { runBuild as i, buildPreparedApplet as n, prepareWorkspaceBuild as r, buildApplet as t };

package/dist/build-DhNDp7ji.js

@@ -0,0 +1,2 @@
+import { i as runBuild } from "./build-DauirTcY.js";
+export { runBuild };

package/dist/{ci-D0nC_Ho7.js → ci-gPrwo6C0.js}

@@ -1,4 +1,4 @@
-import { i as resolveInstanceUrl } from "./auth-DaVK0k5R.js";
+import { l as resolveInstanceUrl } from "./workspace-B6lenAS5.js";
 //#region src/ci.ts
 function githubActionsContext(env = process.env) {
 	if (env.GITHUB_ACTIONS !== "true" || env.HITCH_API_KEY) return void 0;
@@ -34,9 +34,10 @@ async function fetchWithGitHubActions(context, options, request) {
 	const instanceUrl = await resolveInstanceUrl(void 0, options.store);
 	return request(instanceUrl, await githubActionsToken(context, instanceUrl, options.fetch ?? globalThis.fetch));
 }
-async function loadGitHubActionsBuildInputs(context, options) {
+async function loadGitHubActionsBuildInputs(context, options, requiresChangeset) {
 	const fetcher = options.fetch ?? globalThis.fetch;
-	const response = await fetchWithGitHubActions(context, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/ci/v1/build-inputs`, {
+	const query = requiresChangeset === void 0 ? "" : `?changeset_id=${encodeURIComponent(requiresChangeset)}`;
+	const response = await fetchWithGitHubActions(context, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/ci/v1/build-inputs${query}`, {
 		method: "POST",
 		headers: { Authorization: `Bearer ${accessToken}` }
 	}));
@@ -48,5 +49,20 @@ async function loadGitHubActionsBuildInputs(context, options) {
 		theme: body.theme
 	};
 }
+async function loadGitHubActionsSources(context, options) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const response = await fetchWithGitHubActions(context, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/ci/v1/applets`, { headers: { Authorization: `Bearer ${accessToken}` } }));
+	if (!response.ok) throw await hitchResponseError(response, "Failed to load the CI applets");
+	const body = await response.json();
+	if (body === null || typeof body !== "object" || !("data" in body) || !Array.isArray(body.data)) throw new Error("The CI applets response must contain a data array.");
+	return body.data.map((source) => {
+		if (source === null || typeof source !== "object" || !("code" in source) || typeof source.code !== "string" || !("source_directory" in source) || typeof source.source_directory !== "string" || !("git_sha" in source) || source.git_sha !== null && typeof source.git_sha !== "string") throw new Error("Each CI applet must contain code, source_directory, and git_sha fields.");
+		return {
+			code: source.code,
+			sourceDirectory: source.source_directory,
+			gitSha: source.git_sha
+		};
+	});
+}
 //#endregion
-export { loadGitHubActionsBuildInputs as i, githubActionsContext as n, hitchResponseError as r, fetchWithGitHubActions as t };
+export { loadGitHubActionsSources as a, loadGitHubActionsBuildInputs as i, githubActionsContext as n, hitchResponseError as r, fetchWithGitHubActions as t };

package/dist/client.d.ts

@@ -1,5 +1,5 @@
-import { f as RegisteredContract, m as RegisteredRouter, p as RegisteredManifest } from "./manifest-BQCAxATS.js";
-import { t as NarrowContract } from "./contract-DMrpbaLJ.js";
+import { f as RegisteredContract, m as RegisteredRouter, p as RegisteredManifest } from "./manifest-C489nYUy.js";
+import { t as NarrowContract } from "./contract-DB9QQhD9.js";
 import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
 import { o as WithFilesUpload } from "./upload-YbRKEqR6.js";
 import { RouterClient } from "@orpc/server";

package/dist/{contract-DMrpbaLJ.d.ts → contract-DB9QQhD9.d.ts}

@@ -1,4 +1,4 @@
-import { n as AppletManifest } from "./manifest-BQCAxATS.js";
+import { n as AppletManifest } from "./manifest-C489nYUy.js";
 import { AnyContractRouter } from "@orpc/contract";
 //#region src/hitch/contract.d.ts
 type ManifestObjectFor<Manifest, Code> = Manifest extends {

package/dist/{deploy-0dlUvCt3.js → deploy-CqrtNJ1x.js}

@@ -1,7 +1,6 @@
-import { t as fetchWithOrgAuth } from "./auth-DaVK0k5R.js";
-import { n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-D0nC_Ho7.js";
-import { r as readWorkspaceConfig } from "./load-config-BnxocLAQ.js";
-import { t as buildApplet } from "./build-DIsKQQT0.js";
+import { i as readWorkspaceConfig, n as fetchWithOrgAuth } from "./workspace-B6lenAS5.js";
+import { a as loadGitHubActionsSources, n as githubActionsContext, r as hitchResponseError, t as fetchWithGitHubActions } from "./ci-gPrwo6C0.js";
+import { n as buildPreparedApplet, r as prepareWorkspaceBuild, t as buildApplet } from "./build-DauirTcY.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { readFile, readdir } from "node:fs/promises";
@@ -2314,6 +2313,12 @@ var import_tar_stream = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin((
 	exports.pack = require_pack();
 })))(), 1);
 const execFileAsync = promisify(execFile);
+var WorkspaceDeployError = class extends Error {
+	constructor(failedApplets) {
+		super(`Failed to deploy: ${failedApplets.join(", ")}. See the applet logs above.`);
+		this.name = "WorkspaceDeployError";
+	}
+};
 function isErrno(error, code) {
 	return error instanceof Error && "code" in error && error.code === code;
 }
@@ -2401,7 +2406,6 @@ async function deployWithOrgAuth(appletRoot, distDir, manifest, options) {
 		const body = releaseForm(manifest, bundle);
 		body.set("gitDirty", String(git.gitDirty));
 		if (git.gitSha !== void 0) body.set("gitSha", git.gitSha);
-		if (options.changesetId !== void 0) body.set("changeset_id", options.changesetId);
 		return fetcher(`${instanceUrl}/api/v1/applets/${manifest.code}/releases`, {
 			method: "POST",
 			headers: { Authorization: `Bearer ${accessToken}` },
@@ -2422,21 +2426,21 @@ async function deployWithGitHubActions(context, appletRoot, distDir, manifest, o
 		});
 	});
 }
-async function deployApplet(appletRoot, options) {
+async function deployApplet(appletRoot, options, logPrefix = "") {
 	const github = githubActionsContext(options.store?.env ?? process.env);
-	if (github !== void 0 && options.changesetId !== void 0) throw new Error("A changeset deploy is not available in GitHub Actions.");
-	if (options.dist === void 0) await buildApplet(appletRoot, options.changesetId);
+	if (options.dist === void 0) await buildApplet(appletRoot);
 	const distDir = resolve(appletRoot, options.dist ?? ".hitch/dist");
 	const manifest = await readManifest(distDir);
 	const response = github === void 0 ? await deployWithOrgAuth(appletRoot, distDir, manifest, options) : await deployWithGitHubActions(github, appletRoot, distDir, manifest, options);
 	if (!response.ok) throw await hitchResponseError(response, "Deploy failed");
 	const result = await response.json();
-	console.log(`Deployed release ${result.data.id} (${result.promoted ? "promoted" : "not promoted"}).`);
+	console.log(`${logPrefix}Deployed release ${result.data.id} (${result.promoted ? "promoted" : "not promoted"}).`);
+	if (result.changeset_id !== void 0) console.log(`${logPrefix}The release goes live when changeset ${result.changeset_id} applies.`);
 	if (result.warnings?.length) {
-		for (const warning of result.warnings) console.warn(`Warning: ${warning.message}`);
-		console.warn(`Changeset ${result.changeset_id} cannot apply until the applet and the schema agree.`);
+		for (const warning of result.warnings) console.warn(`${logPrefix}Warning: ${warning.message}`);
+		console.warn(`${logPrefix}Changeset ${result.changeset_id} cannot apply until the applet and the schema agree.`);
 	}
-	if (result.unset_variables?.length) console.warn(`Warning: declared variables not set: ${result.unset_variables.join(", ")}. Set them with applet variables set.`);
+	if (result.unset_variables?.length) console.warn(`${logPrefix}Warning: declared variables not set: ${result.unset_variables.join(", ")}. Set them with applet variables set.`);
 	return result;
 }
 async function workspaceAppletRoots(workspaceRoot) {
@@ -2448,17 +2452,128 @@ async function workspaceAppletRoots(workspaceRoot) {
 	if (roots.length === 0) throw new Error(`No applets were found under ${appletsDir}.`);
 	return roots;
 }
+async function gitChanged(topLevel, base, pathspecs, env) {
+	try {
+		await execFileAsync("git", [
+			"diff",
+			"--quiet",
+			base,
+			"HEAD",
+			"--",
+			...pathspecs
+		], {
+			cwd: topLevel,
+			env
+		});
+		return false;
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === 1) return true;
+		throw error;
+	}
+}
+async function hasCommit(topLevel, sha, env) {
+	const git = (args) => execFileAsync("git", args, {
+		cwd: topLevel,
+		env
+	});
+	return git([
+		"cat-file",
+		"-e",
+		`${sha}^{commit}`
+	]).catch(() => git([
+		"fetch",
+		"--depth=1",
+		"origin",
+		sha
+	])).then(() => true, () => false);
+}
+async function ciDeployDecisions(github, workspaceRoot, appletRoots, options) {
+	const env = gitEnvironment();
+	const [sources, { stdout: topLevelOutput }, directories] = await Promise.all([
+		loadGitHubActionsSources(github, options),
+		execFileAsync("git", ["rev-parse", "--show-toplevel"], {
+			cwd: workspaceRoot,
+			env
+		}),
+		Promise.all(appletRoots.map((appletRoot) => repositoryDirectory(appletRoot)))
+	]);
+	const topLevel = topLevelOutput.trim();
+	const appletsDirectory = relative(topLevel, resolve(workspaceRoot, "applets")).split(sep).join("/");
+	const baseByDirectory = new Map(sources.map((source) => [source.sourceDirectory, source.gitSha]));
+	const bases = new Set(directories.flatMap((directory) => baseByDirectory.get(directory) ?? []));
+	const sharedChanges = /* @__PURE__ */ new Map();
+	for (const base of bases) sharedChanges.set(base, await hasCommit(topLevel, base, env) ? await gitChanged(topLevel, base, [`:(exclude)${appletsDirectory}`], env) : void 0);
+	const decisions = await Promise.all(appletRoots.map(async (appletRoot, index) => {
+		const directory = directories[index];
+		const base = baseByDirectory.get(directory) ?? null;
+		if (base === null) return [appletRoot, {
+			deploy: true,
+			reason: "no CI release to compare"
+		}];
+		const short = base.slice(0, 7);
+		const sharedChanged = sharedChanges.get(base);
+		if (sharedChanged === void 0) return [appletRoot, {
+			deploy: true,
+			reason: `commit ${short} is not in the repository`
+		}];
+		if (await gitChanged(topLevel, base, [directory], env)) return [appletRoot, {
+			deploy: true,
+			reason: `${directory} changed since ${short}`
+		}];
+		if (sharedChanged) return [appletRoot, {
+			deploy: true,
+			reason: `files outside ${appletsDirectory} changed since ${short}`
+		}];
+		return [appletRoot, {
+			deploy: false,
+			reason: `no changes since ${short}`
+		}];
+	}));
+	return new Map(decisions);
+}
 async function runDeploy(options) {
 	const root = process.cwd();
+	const github = githubActionsContext(options.store?.env ?? process.env);
 	if (existsSync(resolve(root, "applet.manifest.ts"))) {
 		await deployApplet(root, options);
 		return;
 	}
 	if (readWorkspaceConfig(root) === void 0) throw new Error("Run applet deploy in an applet folder or in the workspace root.");
-	for (const appletRoot of await workspaceAppletRoots(root)) {
-		console.log(`Deploying ${relative(root, appletRoot)}...`);
-		await deployApplet(appletRoot, options);
+	const appletRoots = await workspaceAppletRoots(root);
+	const decisions = github === void 0 ? void 0 : await ciDeployDecisions(github, root, appletRoots, options);
+	const selectedRoots = appletRoots.filter((appletRoot) => {
+		const name = relative(root, appletRoot);
+		const decision = decisions?.get(appletRoot);
+		if (decision === void 0) console.log(`Deploying ${name}...`);
+		else if (decision.deploy) console.log(`Deploying ${name}: ${decision.reason}.`);
+		else {
+			console.log(`Skipping ${name}: ${decision.reason}.`);
+			return false;
+		}
+		return true;
+	});
+	if (selectedRoots.length === 0) return;
+	if (options.dist === void 0) await prepareWorkspaceBuild(root, appletRoots);
+	const interactive = github === void 0 && (options.stdinIsTTY ?? process.stdin.isTTY === true);
+	const deploy = async (appletRoot) => {
+		const logPrefix = `[${relative(root, appletRoot)}] `;
+		if (options.dist === void 0) await buildPreparedApplet(appletRoot, ".hitch/dist", interactive ? "" : logPrefix);
+		await deployApplet(appletRoot, {
+			...options,
+			dist: options.dist ?? ".hitch/dist"
+		}, logPrefix);
+	};
+	if (interactive) {
+		for (const appletRoot of selectedRoots) await deploy(appletRoot);
+		return;
 	}
+	const failedApplets = (await Promise.allSettled(selectedRoots.map(deploy))).flatMap((result, index) => {
+		if (result.status === "fulfilled") return [];
+		const name = relative(root, selectedRoots[index]);
+		console.error(`[${name}] ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
+		return [name];
+	});
+	if (failedApplets.length > 0) throw new WorkspaceDeployError(failedApplets);
 }
 //#endregion
 export { runDeploy };

package/dist/{generate-C6eAL5eo.js → generate-BIifT6PK.js}

@@ -1,7 +1,7 @@
-import { i as resolveInstanceUrl, n as organizationInstanceUrl, t as fetchWithOrgAuth } from "./auth-DaVK0k5R.js";
-import { i as loadGitHubActionsBuildInputs, n as githubActionsContext } from "./ci-D0nC_Ho7.js";
-import { t as loadAppletConfig } from "./load-config-BnxocLAQ.js";
-import { r as prepareAppletProject } from "./project-mW0vsN8A.js";
+import { l as resolveInstanceUrl, n as fetchWithOrgAuth, s as organizationInstanceUrl } from "./workspace-B6lenAS5.js";
+import { i as loadGitHubActionsBuildInputs, n as githubActionsContext } from "./ci-gPrwo6C0.js";
+import { t as loadAppletConfig } from "./load-config-BknBkdRs.js";
+import { r as prepareAppletProject } from "./project-C_rtpjp8.js";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { access, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
@@ -352,11 +352,11 @@ async function responseJson(response) {
 		throw new Error("Failed to parse the organization's OpenAPI spec.", { cause: error });
 	}
 }
-async function loadAuthenticatedSpec(orgCode, options) {
+async function loadAuthenticatedSpec(manifest, options) {
 	const github = githubActionsContext(options.store?.env ?? process.env);
-	if (github !== void 0) return (await loadGitHubActionsBuildInputs(github, options)).openapi;
+	if (github !== void 0) return (await loadGitHubActionsBuildInputs(github, options, manifest.requiresChangeset)).openapi;
 	const fetcher = options.fetch ?? globalThis.fetch;
-	const response = await fetchWithOrgAuth(orgCode, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/openapi.json${options.changesetId === void 0 ? "" : `?changeset_id=${encodeURIComponent(options.changesetId)}`}`, { headers: { Authorization: `Bearer ${accessToken}` } }));
+	const response = await fetchWithOrgAuth(manifest.org, options, (instanceUrl, accessToken) => fetcher(`${instanceUrl}/api/v1/openapi.json${manifest.requiresChangeset === void 0 ? "" : `?changeset_id=${encodeURIComponent(manifest.requiresChangeset)}`}`, { headers: { Authorization: `Bearer ${accessToken}` } }));
 	if (!response.ok) throw new Error(`Failed to load the organization's OpenAPI spec (${response.status}).`);
 	return responseJson(response);
 }
@@ -367,18 +367,18 @@ async function loadThemeStylesheet(orgCode, options) {
 	if (!response.ok) throw new Error(`Failed to load the organization's theme (${response.status}).`);
 	return response.text();
 }
-async function loadBuildInputs(orgCode, options) {
+async function loadBuildInputs(manifest, options) {
 	const github = githubActionsContext(options.store?.env ?? process.env);
 	if (github !== void 0) {
-		const inputs = await loadGitHubActionsBuildInputs(github, options);
+		const inputs = await loadGitHubActionsBuildInputs(github, options, manifest.requiresChangeset);
 		return {
 			spec: inputs.openapi,
 			theme: inputs.theme
 		};
 	}
 	return {
-		spec: await loadAuthenticatedSpec(orgCode, options),
-		theme: await loadThemeStylesheet(orgCode, options)
+		spec: await loadAuthenticatedSpec(manifest, options),
+		theme: await loadThemeStylesheet(manifest.org, options)
 	};
 }
 async function generateContract(spec, outDir) {
@@ -442,14 +442,14 @@ export type * from "./zod.gen.ts";
 `);
 }
 async function syncContract(outDir, manifest, options = {}) {
-	await writeContractFiles(outDir, manifest, await loadAuthenticatedSpec(manifest.org, options));
+	await writeContractFiles(outDir, manifest, await loadAuthenticatedSpec(manifest, options));
 }
 async function runGenerate(options) {
 	await prepareAppletProject();
 	const root = process.cwd();
 	const outDir = resolve("./.hitch");
 	const manifest = await loadAppletConfig(process.cwd());
-	const { spec, theme: themeStylesheet } = await loadBuildInputs(manifest.org, options);
+	const { spec, theme: themeStylesheet } = await loadBuildInputs(manifest, options);
 	const stagedDir = await mkdtemp(resolve("./.hitch.tmp-"));
 	const backupDir = `${stagedDir}.backup`;
 	let staged = true;

package/dist/generate-DSk8ihsC.js

@@ -0,0 +1,2 @@
+import { n as runGenerate } from "./generate-BIifT6PK.js";
+export { runGenerate };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { _ as RegisteredWorkflows, a as AppletSourceDefinition, c as appletManifestSchema, d as RegisteredCatalog, f as RegisteredContract, g as RegisteredVariables, h as RegisteredVariableKeys, i as AppletPackages, l as appletSourceDefinitionSchema, m as RegisteredRouter, n as AppletManifest, o as RegisteredAppletSourceDefinition, p as RegisteredManifest, r as AppletManifestObject, s as appletDefinitionSchema, t as AppletDefinition, u as HitchRegister, v as registerHitchContract } from "./manifest-BQCAxATS.js";
-import { n as pruneContract, t as NarrowContract } from "./contract-DMrpbaLJ.js";
+import { _ as RegisteredWorkflows, a as AppletSourceDefinition, c as appletManifestSchema, d as RegisteredCatalog, f as RegisteredContract, g as RegisteredVariables, h as RegisteredVariableKeys, i as AppletPackages, l as appletSourceDefinitionSchema, m as RegisteredRouter, n as AppletManifest, o as RegisteredAppletSourceDefinition, p as RegisteredManifest, r as AppletManifestObject, s as appletDefinitionSchema, t as AppletDefinition, u as HitchRegister, v as registerHitchContract } from "./manifest-C489nYUy.js";
+import { n as pruneContract, t as NarrowContract } from "./contract-DB9QQhD9.js";
 import { a as UploadedHitchFile, c as createFileOutputSchema, d as getFileOutputSchema, i as UploadProgress, l as fileSchema, n as FilesUpload, r as UploadFileOptions, s as uploadFile, t as FilesClient, u as filesContract } from "./upload-YbRKEqR6.js";
 import { ContractProcedure, Meta } from "@orpc/contract";
 import { z } from "zod";
-//#region src/workspace.d.ts
+//#region ../shared/auth/src/workspace.d.mts
 interface HitchConfig {
   sdk: string;
   org: string;

package/dist/index.js

@@ -1,5 +1,5 @@
 import { i as registerHitchContract, t as uploadFile } from "./upload-DRbVhuDm.js";
-import { n as appletManifestSchema, r as appletSourceDefinitionSchema, t as appletDefinitionSchema } from "./manifest-DyoJ1MIL.js";
+import { n as appletManifestSchema, r as appletSourceDefinitionSchema, t as appletDefinitionSchema } from "./manifest-Bd04cWhu.js";
 import { oc } from "@orpc/contract";
 import { z } from "zod";
 //#region src/hitch/contract.ts

package/dist/{init-tEMeys9M.js → init-Wu6XmyVc.js}

@@ -1,8 +1,8 @@
-import { a as ORG_CODE_PATTERN, i as APPLET_CODE_PATTERN } from "./manifest-DyoJ1MIL.js";
-import { i as resolveInstanceUrl, r as resolveAuthForOrg } from "./auth-DaVK0k5R.js";
-import { n as runGenerate } from "./generate-C6eAL5eo.js";
-import { n as loadAppletSourceDefinition, r as readWorkspaceConfig } from "./load-config-BnxocLAQ.js";
-import { a as writeWorkspaceSupport, i as writeAppletSupport, n as loadCliManifest, t as assertWorkspaceCli } from "./project-mW0vsN8A.js";
+import { a as ORG_CODE_PATTERN, i as APPLET_CODE_PATTERN } from "./manifest-Bd04cWhu.js";
+import { c as resolveAuthForOrg, i as readWorkspaceConfig, l as resolveInstanceUrl } from "./workspace-B6lenAS5.js";
+import { n as runGenerate } from "./generate-BIifT6PK.js";
+import { n as loadAppletSourceDefinition } from "./load-config-BknBkdRs.js";
+import { a as writeAppletSupport, n as loadCliManifest, o as writeWorkspaceSupport, t as assertWorkspaceCli } from "./project-C_rtpjp8.js";
 import { access, cp, mkdir, readdir, writeFile } from "node:fs/promises";
 import { relative, resolve } from "node:path";
 import { spawn } from "node:child_process";

package/dist/load-config-BknBkdRs.js

@@ -0,0 +1,27 @@
+import { r as appletSourceDefinitionSchema } from "./manifest-Bd04cWhu.js";
+import { t as resolveWorkspaceOrg } from "./workspace-B6lenAS5.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { loadConfigFromFile } from "vite";
+//#region src/typegen/load-config.ts
+async function loadAppletSourceDefinition(root) {
+	const path = resolve(root, "applet.manifest.ts");
+	if (!existsSync(path)) throw new Error(`No applet manifest found at ${path}.`);
+	const loaded = await loadConfigFromFile({
+		command: "build",
+		mode: "production"
+	}, path, root);
+	if (loaded === null) throw new Error(`No applet manifest found at ${path}.`);
+	const parsed = appletSourceDefinitionSchema.safeParse(loaded.config);
+	if (!parsed.success) throw new Error(`Invalid applet manifest at ${loaded.path}: ${parsed.error.message}`);
+	return parsed.data;
+}
+async function loadAppletConfig(root) {
+	const { dependencies: _dependencies, devDependencies: _devDependencies, ...definition } = await loadAppletSourceDefinition(root);
+	return {
+		org: resolveWorkspaceOrg(root),
+		...definition
+	};
+}
+//#endregion
+export { loadAppletSourceDefinition as n, loadAppletConfig as t };

package/dist/login-iT9MRuaw.js

@@ -0,0 +1,12 @@
+import { a as loginWithDevice, l as resolveInstanceUrl, o as AuthenticationError, r as findWorkspaceConfig } from "./workspace-B6lenAS5.js";
+//#region src/login.ts
+async function runLogin(options) {
+	if (process.env.HITCH_API_KEY !== void 0) throw new AuthenticationError("HITCH_API_KEY is set — unset it to manage stored logins.");
+	const { me, membership } = await loginWithDevice(await resolveInstanceUrl(), {
+		expectedOrg: findWorkspaceConfig(process.cwd())?.org,
+		noBrowser: options.noBrowser
+	});
+	console.log(`Signed in as ${me.person.email} to ${membership.name}.`);
+}
+//#endregion
+export { runLogin };

package/dist/{logs-m00pzr_O.js → logs-B-qZGXSK.js}

@@ -1,6 +1,6 @@
-import { i as APPLET_CODE_PATTERN } from "./manifest-DyoJ1MIL.js";
-import { t as fetchWithOrgAuth } from "./auth-DaVK0k5R.js";
-import { i as resolveWorkspaceOrg, r as readWorkspaceConfig, t as loadAppletConfig } from "./load-config-BnxocLAQ.js";
+import { i as APPLET_CODE_PATTERN } from "./manifest-Bd04cWhu.js";
+import { i as readWorkspaceConfig, n as fetchWithOrgAuth, t as resolveWorkspaceOrg } from "./workspace-B6lenAS5.js";
+import { t as loadAppletConfig } from "./load-config-BknBkdRs.js";
 import { z } from "zod";
 //#region src/logs.ts
 const LOG_LEVELS = [

package/dist/{manifest-DyoJ1MIL.js → manifest-Bd04cWhu.js}

@@ -63,6 +63,7 @@ const appletManifestShape = {
 	org: z.string().regex(ORG_CODE_PATTERN, "must start with a lowercase letter, end with a letter or number, and contain only lowercase letters, numbers, and non-consecutive hyphens"),
 	name: nameSchema,
 	code: codeSchema,
+	requiresChangeset: z.uuid().optional(),
 	schedules: appletManifestSchedulesSchema.optional(),
 	variables: appletManifestVariablesSchema.optional(),
 	objects: appletManifestObjectsSchema
@@ -94,6 +95,7 @@ const appletManifestSchema = z.strictObject(appletManifestShape).superRefine(che
 const appletDefinitionSchema = z.strictObject({
 	name: appletManifestShape.name,
 	code: appletManifestShape.code,
+	requiresChangeset: appletManifestShape.requiresChangeset,
 	schedules: appletManifestShape.schedules,
 	variables: appletManifestShape.variables,
 	objects: appletManifestShape.objects
@@ -161,6 +163,7 @@ const checkSourcePackages = (manifest, context) => {
 const appletSourceDefinitionSchema = z.strictObject({
 	name: appletManifestShape.name,
 	code: appletManifestShape.code,
+	requiresChangeset: appletManifestShape.requiresChangeset,
 	schedules: appletManifestShape.schedules,
 	variables: appletManifestShape.variables,
 	objects: appletManifestShape.objects,

package/dist/{manifest-BQCAxATS.d.ts → manifest-C489nYUy.d.ts}

@@ -32,6 +32,8 @@ interface AppletManifest {
   org: string;
   name: string;
   code: string;
+  /** This code needs the schema as of this changeset. */
+  requiresChangeset?: string;
   schedules?: readonly {
     code: string;
     name: string;

package/dist/{project-mW0vsN8A.js → project-C_rtpjp8.js}

@@ -1,4 +1,5 @@
-import { n as loadAppletSourceDefinition, r as readWorkspaceConfig } from "./load-config-BnxocLAQ.js";
+import { i as readWorkspaceConfig } from "./workspace-B6lenAS5.js";
+import { n as loadAppletSourceDefinition } from "./load-config-BknBkdRs.js";
 import { z } from "zod";
 import { existsSync } from "node:fs";
 import { cp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
@@ -340,17 +341,17 @@ export default defineConfig({
 		hasClient ? writeFile(resolve(root, "components.json"), await readFile(new URL("../scaffold/applet/components.json", import.meta.url), "utf8")) : void 0
 	]);
 }
-async function prepareAppletProject(appletRoot = process.cwd()) {
-	const definition = await loadAppletSourceDefinition(appletRoot);
-	const workspaceRoot = dirname(dirname(resolve(appletRoot)));
+async function prepareAppletProjects(workspaceRoot, appletRoots) {
+	const definitions = await Promise.all(appletRoots.map((root) => loadAppletSourceDefinition(root)));
 	const workspace = readWorkspaceConfig(workspaceRoot);
-	if (workspace === void 0) throw new Error(`No Hitch workspace found for ${appletRoot}.`);
+	if (workspace === void 0) throw new Error(`No Hitch workspace found at ${workspaceRoot}.`);
 	const cli = await loadCliManifest({ allowDevelopment: true });
-	await Promise.all([cli === void 0 ? void 0 : writeWorkspaceSupport(workspaceRoot, workspace, cli), writeAppletSupport(appletRoot, definition)]);
-	return {
-		definition,
-		workspaceRoot
-	};
+	await Promise.all([cli === void 0 ? void 0 : writeWorkspaceSupport(workspaceRoot, workspace, cli), ...appletRoots.map((root, index) => writeAppletSupport(root, definitions[index]))]);
+}
+async function prepareAppletProject(appletRoot = process.cwd()) {
+	const workspaceRoot = dirname(dirname(resolve(appletRoot)));
+	await prepareAppletProjects(workspaceRoot, [appletRoot]);
+	return workspaceRoot;
 }
 //#endregion
-export { writeWorkspaceSupport as a, writeAppletSupport as i, loadCliManifest as n, prepareAppletProject as r, assertWorkspaceCli as t };
+export { writeAppletSupport as a, prepareAppletProjects as i, loadCliManifest as n, writeWorkspaceSupport as o, prepareAppletProject as r, assertWorkspaceCli as t };

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 import { a as createWorkflow, i as WorkflowStep, n as WorkflowDefinition, r as WorkflowDuration } from "./workflow-DurM6Fwx.js";
-import { _ as RegisteredWorkflows, f as RegisteredContract, g as RegisteredVariables, p as RegisteredManifest } from "./manifest-BQCAxATS.js";
-import { t as NarrowContract } from "./contract-DMrpbaLJ.js";
+import { _ as RegisteredWorkflows, f as RegisteredContract, g as RegisteredVariables, p as RegisteredManifest } from "./manifest-C489nYUy.js";
+import { t as NarrowContract } from "./contract-DB9QQhD9.js";
 import { t as WithBatchRecorder } from "./batch-Qa4B4-Yp.js";
 import { o as WithFilesUpload } from "./upload-YbRKEqR6.js";
 import { ContractRouterClient } from "@orpc/contract";

package/dist/{variables-CP7Ce3Np.js → variables-DcwMeIau.js}

@@ -1,8 +1,8 @@
-import { t as fetchWithOrgAuth } from "./auth-DaVK0k5R.js";
-import { t as loadAppletConfig } from "./load-config-BnxocLAQ.js";
+import { n as fetchWithOrgAuth } from "./workspace-B6lenAS5.js";
+import { t as loadAppletConfig } from "./load-config-BknBkdRs.js";
 import { z } from "zod";
-import { Writable } from "node:stream";
 import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
 //#region src/variables.ts
 const variableRowSchema = z.object({
 	key: z.string(),

package/dist/vite.d.ts

@@ -1,4 +1,4 @@
-import { o as RegisteredAppletSourceDefinition } from "./manifest-BQCAxATS.js";
+import { o as RegisteredAppletSourceDefinition } from "./manifest-C489nYUy.js";
 import { PluginOption } from "vite";
 //#region ../shared/auth/src/store.d.mts
 interface SessionCredentials {

package/dist/vite.js

@@ -1,7 +1,6 @@
-import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-DyoJ1MIL.js";
-import { i as resolveInstanceUrl, n as organizationInstanceUrl } from "./auth-DaVK0k5R.js";
-import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-C6eAL5eo.js";
-import { i as resolveWorkspaceOrg } from "./load-config-BnxocLAQ.js";
+import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-Bd04cWhu.js";
+import { l as resolveInstanceUrl, s as organizationInstanceUrl, t as resolveWorkspaceOrg } from "./workspace-B6lenAS5.js";
+import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-BIifT6PK.js";
 import { existsSync } from "node:fs";
 import { appendFile, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { basename, relative, resolve } from "node:path";
@@ -221,10 +220,7 @@ function applet(sourceDefinition, options = {}) {
 			}
 			if (environment.command === "build") themeStylesheetUrl = `${organizationInstanceUrl(await resolveInstanceUrl(void 0, options.store), manifest.org)}/theme.css`;
 			if (environment.command === "build" && manifest.objects.length > 0) {
-				contractSync ??= syncContract(resolve(root, ".hitch"), manifest, {
-					...options,
-					changesetId: (options.store?.env ?? process.env).HITCH_CHANGESET_ID
-				});
+				contractSync ??= syncContract(resolve(root, ".hitch"), manifest, options);
 				await contractSync;
 			}
 			const hasHitchGen = existsSync(resolve(root, ".hitch/index.ts"));

package/dist/{auth-DaVK0k5R.js → workspace-B6lenAS5.js}

@@ -1,5 +1,7 @@
+import { createRequire } from "node:module";
+import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 //#region ../shared/auth/src/store.mts
@@ -326,6 +328,30 @@ async function loginWithDevice(instanceUrl, options = {}) {
 	};
 }
 //#endregion
+//#region ../shared/auth/src/workspace.mts
+const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const require = createRequire(import.meta.url);
+function readWorkspaceConfig(dir) {
+	const path = resolve(dir, "hitch.config.ts");
+	if (!existsSync(path)) return void 0;
+	let module;
+	try {
+		module = require(path);
+	} catch (error) {
+		throw new Error(`Failed to load ${path}.`, { cause: error });
+	}
+	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
+	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new Error(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
+	return {
+		sdk: config.sdk,
+		org: config.org
+	};
+}
+function findWorkspaceConfig(cwd) {
+	const appletsDir = dirname(cwd);
+	return readWorkspaceConfig(cwd) ?? (basename(appletsDir) === "applets" ? readWorkspaceConfig(dirname(appletsDir)) : void 0);
+}
+//#endregion
 //#region src/auth.ts
 async function fetchWithOrgAuth(orgCode, options, request) {
 	const fetcher = options.fetch ?? globalThis.fetch;
@@ -334,9 +360,10 @@ async function fetchWithOrgAuth(orgCode, options, request) {
 	const auth = await resolveAuthForOrg(instanceUrl, orgCode, options.store);
 	if (auth !== void 0) {
 		const response = await request(organizationUrl, bearerToken(auth));
-		if (response.status !== 401 && response.status !== 403) return response;
+		rejectEnvironmentKey(response, auth);
+		if (response.status !== 401) return response;
 	}
-	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new Error("not logged in — set HITCH_API_KEY or run in a terminal to log in");
+	if (!(options.stdinIsTTY ?? process.stdin.isTTY === true)) throw new AuthenticationError("Not logged in. Run applet login, or set HITCH_API_KEY.");
 	await (options.login ?? loginWithDevice)(instanceUrl, {
 		expectedOrg: orgCode,
 		fetch: fetcher,
@@ -347,4 +374,14 @@ async function fetchWithOrgAuth(orgCode, options, request) {
 	return request(organizationUrl, bearerToken(credentials));
 }
 //#endregion
-export { resolveInstanceUrl as i, organizationInstanceUrl as n, resolveAuthForOrg as r, fetchWithOrgAuth as t };
+//#region src/workspace.ts
+function resolveWorkspaceOrg(appletRoot) {
+	const appletsDir = dirname(appletRoot);
+	if (basename(appletsDir) === "applets") {
+		const config = readWorkspaceConfig(dirname(appletsDir));
+		if (config !== void 0) return config.org;
+	}
+	throw new Error(`No Hitch workspace found for ${appletRoot}. An applet must live at <workspace>/applets/<code> with hitch.config.ts in the workspace root.`);
+}
+//#endregion
+export { loginWithDevice as a, resolveAuthForOrg as c, readWorkspaceConfig as i, resolveInstanceUrl as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, organizationInstanceUrl as s, resolveWorkspaceOrg as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hitch42/applet",
-  "version": "0.1.1-beta.6",
+  "version": "0.1.1-beta.7",
   "license": "MIT",
   "bin": {
     "applet": "./dist/applet.js"

package/scaffold/.agents/skills/hitch-applets/SKILL.md

@@ -30,6 +30,8 @@ For attribute types, filters, and API limits, read `../hitch-data/SKILL.md`. To
 ## Work with the workspace
 
 - Run package commands with `pnpm`.
+- Run `pnpm exec applet login` from the workspace root or an applet directory to sign in. It uses the organization in `hitch.config.ts` and shares credentials with `hitch login`. Add `--no-browser` to print the sign-in URL without opening a browser.
+- A server permission error is not a login request. After an applet has a CI release, the server rejects local deployments; deploy subsequent releases through CI.
 - If `package.json` is absent, read `sdk` from `hitch.config.ts`. Run `pnpm dlx <sdk> bootstrap` from the workspace root.
 - Run `pnpm exec applet new <code>` from the workspace root to create a full applet.
 - Add `--client-only` or `--server-only` when the applet needs only one part.
@@ -138,3 +140,11 @@ pnpm --dir applets/<code> run build
 If missing packages block a check, stop package checks. Do not retry the check through another binary.
 
 If a command fails, report the exact blocker. Do not deploy as a verification step.
+
+## Deploy from GitHub
+
+- A push to the production branch runs `applet deploy` in the workspace root through GitHub Actions.
+- An applet deploys when its own folder changed since its current CI release. Every applet deploys when a file outside `applets/` changed. An applet without a CI release always deploys.
+- The deploy skips other applets and logs the reason. A skip is expected, not a failure.
+- A schema change in Hitch alone does not trigger CI.
+- Do not import from a sibling applet folder. The change check does not follow such imports.

package/scaffold/.agents/skills/hitch-applets/references/manifest.md

@@ -11,6 +11,7 @@ The applet tool reads `org` from `hitch.config.ts` in the workspace root.
 - `name` gives the applet a display name.
 - `code` gives the applet its stable code and URL prefix.
 - `objects` declares record objects and attribute access.
+- `requiresChangeset` optionally names the schema changeset that the code needs.
 - `variables` optionally declares runtime variables.
 - `schedules` optionally declares scheduled server calls.
 - `dependencies` optionally declares applet runtime packages.
@@ -42,6 +43,22 @@ The manifest and applet definition reject unknown fields.
 - Expect the Vite base path to be `/<code>/`.
 - Include the code in each client route path.
 
+## Set `requiresChangeset`
+
+Set `requiresChangeset` when the code needs a schema change that is not live yet.
+
+```ts
+requiresChangeset: "0192a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b",
+```
+
+- Use the ID of a changeset in the same organization.
+- Generate, build, and deploy all use this field. The CLI has no changeset flag.
+- While the changeset is pending, types and the build use the schema that the changeset will produce.
+- While the changeset is pending, a deploy binds the release to the changeset. The release goes live when a person applies the changeset in Hitch.
+- After the changeset applies, the field uses the live schema. A deploy then promotes as usual. Remove the field when it is convenient.
+- A deploy fails when the changeset was abandoned. Remove the field or name a pending changeset.
+- A git push uses the same rules. The push never applies the changeset.
+
 ## Declare objects
 
 Add one entry for each object that the applet needs.

package/scaffold/.agents/skills/hitch-cli/SKILL.md

@@ -12,8 +12,9 @@ The `hitch` command talks to one organization on one Hitch instance. Its data an
 ## Sign in
 
 - Run `hitch login` to sign in with the device flow. The command prints a URL and a code. Open the URL and confirm the code. Add `--no-browser` when the shell cannot open a browser.
+- `applet login` uses this same device flow and credential store. Both commands preselect the organization from `hitch.config.ts` at the workspace root or in an applet directory. Use `hitch login --org <code>` to select it explicitly.
 - Run `hitch login --api-key` to store an API key instead. The command prompts for the key. Pass `--api-key <key>` to skip the prompt.
-- Set `HITCH_API_KEY` to use a key for one shell session. It overrides every stored login. While it is set, `hitch login` and `hitch logout` refuse to run.
+- Set `HITCH_API_KEY` to use a key for one shell session. It overrides every stored login. While it is set, `hitch login`, `applet login`, and `hitch logout` refuse to run.
 - Run `hitch whoami` to print the current person, email, organization name, and organization id as JSON.
 - Run `hitch logout` to remove every stored login and cached command set.
 - Set `HITCH_API_URL` or pass `--instance <url>` to `hitch login` for an instance other than the default.
@@ -23,7 +24,7 @@ The `hitch` command talks to one organization on one Hitch instance. Its data an
 The CLI resolves the organization in this order. The first match wins.
 
 1. `--org <code>` on any command.
-2. The workspace organization: the `hitch.org` field in the nearest `package.json`, or in the workspace root when the current directory is an applet under `applets/`.
+2. The workspace organization: the `org` field in `hitch.config.ts` in the current directory, or in the workspace root when the current directory is an applet under `applets/`.
 3. `HITCH_DEFAULT_ORG`.
 
 There is no remembered active organization. When `--org` and the workspace disagree, the command fails with `--org "x" does not match workspace organization "y"`. When several organizations are stored and none is selected, the command fails and names the three ways to choose.
@@ -110,6 +111,7 @@ hitch admin changesets update --id <changesetId> --adopt <otherChangesetId>
 - Run `blockers list` before an apply. Any blocker stops the apply with HTTP 409.
 - Run `hitch sync` after an apply, so the new objects and attributes appear as commands.
 - Run `pnpm --dir applets/<code> run generate` after an apply, so applet types match.
+- To build applet code before the apply, set `requiresChangeset` in `applet.manifest.ts` to the changeset ID. Generate, build, and deploy then use the changeset schema, and the release goes live when the changeset applies.
 
 ## Fix common errors
 
@@ -119,7 +121,7 @@ hitch admin changesets update --id <changesetId> --adopt <otherChangesetId>
 | `HITCH_API_KEY was rejected.`                        | The key in the environment is invalid or revoked. Unset it or replace it.                |
 | `API key is scoped to organization "x", not "y".`    | The key belongs to another organization. Select `x` or use another key.                  |
 | `--org "x" does not match workspace organization`    | Run the command outside the workspace, or drop `--org`.                                  |
-| `Multiple organizations are stored ...`              | Pass `--org`, set `hitch.org`, or set `HITCH_DEFAULT_ORG`.                               |
+| `Multiple organizations are stored ...`              | Pass `--org`, use the workspace `hitch.config.ts`, or set `HITCH_DEFAULT_ORG`.           |
 | `the cached commands ... no longer load`             | Run `hitch sync`.                                                                        |
 | `Refusing to delete without --yes`                   | Add `--yes` in a script.                                                                 |
 | `hitch <object>` is an unknown command               | Run `hitch sync`. The object is new or the cache is stale.                               |

package/scaffold/.agents/skills/hitch-data/SKILL.md

@@ -48,4 +48,4 @@ An organization's data lives in Hitch objects. Each object has attributes. Each
 
 - Every object or attribute change goes through a changeset. Hitch evaluates the change against existing records and dependent applets.
 - A change that would break existing data, such as a unique constraint with duplicates, is blocked until the data is fixed.
-- An applet release can bind to a pending changeset. The changeset apply switches the schema and promotes the release together.
+- An applet release can bind to a pending changeset. Set `requiresChangeset` in `applet.manifest.ts` to bind it. The changeset apply switches the schema and promotes the release together.

package/scaffold/.github/workflows/hitch.yml

@@ -2,12 +2,6 @@ name: Deploy Hitch applets
 
 on:
   push:
-    paths:
-      - "applets/**"
-      - ".github/workflows/hitch.yml"
-      - "hitch.config.ts"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
 
 permissions: {}
 

package/dist/build-B70gkDi5.js

@@ -1,2 +0,0 @@
-import { n as runBuild } from "./build-DIsKQQT0.js";
-export { runBuild };

package/dist/generate-D5rSXXa-.js

@@ -1,2 +0,0 @@
-import { n as runGenerate } from "./generate-C6eAL5eo.js";
-export { runGenerate };

package/dist/load-config-BnxocLAQ.js

@@ -1,56 +0,0 @@
-import { a as ORG_CODE_PATTERN, r as appletSourceDefinitionSchema } from "./manifest-DyoJ1MIL.js";
-import { createRequire } from "node:module";
-import { z } from "zod";
-import { existsSync } from "node:fs";
-import { basename, dirname, resolve } from "node:path";
-import { loadConfigFromFile } from "vite";
-//#region src/workspace.ts
-const hitchConfigSchema = z.object({
-	sdk: z.string().min(1),
-	org: z.string().regex(ORG_CODE_PATTERN)
-});
-const require = createRequire(import.meta.url);
-function readWorkspaceConfig(dir) {
-	const path = resolve(dir, "hitch.config.ts");
-	if (!existsSync(path)) return void 0;
-	let module;
-	try {
-		module = require(path);
-	} catch (error) {
-		throw new Error(`Failed to load ${path}.`, { cause: error });
-	}
-	const config = hitchConfigSchema.safeParse(module !== null && typeof module === "object" && "default" in module ? module.default : module);
-	if (!config.success) throw new Error(`Invalid Hitch config in ${path}: ${config.error.message}`);
-	return config.data;
-}
-function resolveWorkspaceOrg(appletRoot) {
-	const appletsDir = dirname(appletRoot);
-	if (basename(appletsDir) === "applets") {
-		const config = readWorkspaceConfig(dirname(appletsDir));
-		if (config !== void 0) return config.org;
-	}
-	throw new Error(`No Hitch workspace found for ${appletRoot}. An applet must live at <workspace>/applets/<code> with hitch.config.ts in the workspace root.`);
-}
-//#endregion
-//#region src/typegen/load-config.ts
-async function loadAppletSourceDefinition(root) {
-	const path = resolve(root, "applet.manifest.ts");
-	if (!existsSync(path)) throw new Error(`No applet manifest found at ${path}.`);
-	const loaded = await loadConfigFromFile({
-		command: "build",
-		mode: "production"
-	}, path, root);
-	if (loaded === null) throw new Error(`No applet manifest found at ${path}.`);
-	const parsed = appletSourceDefinitionSchema.safeParse(loaded.config);
-	if (!parsed.success) throw new Error(`Invalid applet manifest at ${loaded.path}: ${parsed.error.message}`);
-	return parsed.data;
-}
-async function loadAppletConfig(root) {
-	const { dependencies: _dependencies, devDependencies: _devDependencies, ...definition } = await loadAppletSourceDefinition(root);
-	return {
-		org: resolveWorkspaceOrg(root),
-		...definition
-	};
-}
-//#endregion
-export { resolveWorkspaceOrg as i, loadAppletSourceDefinition as n, readWorkspaceConfig as r, loadAppletConfig as t };