@hitch42/applet 0.1.1-beta.7 → 0.1.1-beta.8

package/dist/vite.js

@@ -1,15 +1,299 @@
-import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-Bd04cWhu.js";
-import { l as resolveInstanceUrl, s as organizationInstanceUrl, t as resolveWorkspaceOrg } from "./workspace-B6lenAS5.js";
-import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-BIifT6PK.js";
-import { existsSync } from "node:fs";
-import { appendFile, readFile, readdir, rm, writeFile } from "node:fs/promises";
-import { basename, relative, resolve } from "node:path";
+import { n as meSchema } from "./me-BW7Paary.js";
+import { i as APPLET_CODE_PATTERN, n as appletManifestSchema, r as appletSourceDefinitionSchema } from "./manifest-Bp87Uz0a.js";
+import { a as workflowOutcomeSchema, c as HITCH_SESSION_HEADER, l as HITCH_USER_HEADER, n as runWorkflowJournal } from "./workflow-engine-MogejNfF.js";
+import { c as organizationInstanceUrl, d as resolveInstanceUrl, l as rejectEnvironmentKey, s as bearerToken, t as resolveWorkspaceOrg, u as resolveAuthForOrg } from "./workspace-XVtM12ZC.js";
+import { c as writeClientEntry, i as writeRegisterDeclaration, l as writeManifestGen, r as syncContract, s as writeAppletRoot, u as writeServerEntry } from "./generate-BxYHdoAQ.js";
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { appendFile, readdir, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { basename, dirname, relative, resolve } from "node:path";
 import { cloudflare } from "@cloudflare/vite-plugin";
 import { tanstackRouter } from "@tanstack/router-plugin/vite";
 import react from "@vitejs/plugin-react";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+//#region src/dev-proxy.ts
+const REQUEST_DROP = /* @__PURE__ */ new Set([
+	"host",
+	"connection",
+	"content-length",
+	"cookie",
+	"authorization",
+	"origin",
+	"referer",
+	"accept-encoding"
+]);
+const RESPONSE_DROP = /* @__PURE__ */ new Set([
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"set-cookie"
+]);
+function refusesClient(headers, clientAddress) {
+	if (![
+		"127.0.0.1",
+		"::1",
+		"::ffff:127.0.0.1"
+	].includes(clientAddress ?? "")) return true;
+	const get = (name) => headers instanceof Headers ? headers.get(name) : headers[name]?.toString() ?? null;
+	const host = get("host") ?? get(":authority");
+	const origin = get("origin");
+	return origin !== null && (host === null || !URL.canParse(origin) || new URL(origin).host !== host) || get("sec-fetch-site") === "cross-site";
+}
+function createDevProxy(options) {
+	let warnedAboutUnauthorized = false;
+	return async (request, clientAddress) => {
+		if (refusesClient(request.headers, clientAddress)) return new Response(null, { status: 403 });
+		const intercepted = await options.intercept?.(request);
+		if (intercepted !== void 0) return intercepted;
+		const headers = new Headers(request.headers);
+		[...headers.keys()].filter((name) => REQUEST_DROP.has(name) || name.startsWith("x-hitch-")).forEach((name) => headers.delete(name));
+		headers.set("authorization", `Bearer ${options.token}`);
+		const url = new URL(request.url);
+		const upstream = await (options.fetch ?? globalThis.fetch)(`${options.orgUrl}${url.pathname}${url.search}`, {
+			method: request.method,
+			headers,
+			body: request.body,
+			signal: request.signal,
+			...request.body === null ? {} : { duplex: "half" }
+		});
+		if (upstream.status === 401 && !warnedAboutUnauthorized) {
+			warnedAboutUnauthorized = true;
+			options.warn(options.source === "environment" ? "HITCH_API_KEY was rejected." : "Your login expired. Run applet login, then restart the dev server.");
+		}
+		const responseHeaders = new Headers(upstream.headers);
+		[...responseHeaders.keys()].filter((name) => RESPONSE_DROP.has(name)).forEach((name) => responseHeaders.delete(name));
+		return new Response(upstream.body, {
+			status: upstream.status,
+			statusText: upstream.statusText,
+			headers: responseHeaders
+		});
+	};
+}
+async function serveDevProxy(request, response, handler) {
+	const controller = new AbortController();
+	const onClose = () => {
+		if (!response.writableFinished) controller.abort();
+	};
+	response.on("close", onClose);
+	try {
+		const authority = request.headers[":authority"];
+		const host = request.headers.host ?? (Array.isArray(authority) ? authority[0] : authority);
+		const url = `http://${host ?? "localhost"}${request.url ?? "/"}`;
+		const result = await handler(new Request(url, {
+			method: request.method,
+			headers: {
+				...Object.fromEntries(Object.entries(request.headers).filter(([name]) => !name.startsWith(":"))),
+				host: host ?? "localhost"
+			},
+			signal: controller.signal,
+			...["GET", "HEAD"].includes(request.method ?? "GET") ? {} : {
+				body: Readable.toWeb(request),
+				duplex: "half"
+			}
+		}), request.socket.remoteAddress);
+		response.writeHead(result.status, result.statusText, Object.fromEntries(result.headers));
+		if (result.body === null) {
+			response.end();
+			return;
+		}
+		await pipeline(Readable.fromWeb(result.body), response);
+	} catch (error) {
+		if (!controller.signal.aborted || !(error instanceof Error) || error.name !== "AbortError" && error.code !== "ERR_STREAM_PREMATURE_CLOSE") throw error;
+	} finally {
+		response.off("close", onClose);
+	}
+}
+//#endregion
+//#region src/dev-workflows.ts
+const RUN_STATUSES = [
+	"in_progress",
+	"sleeping",
+	"success",
+	"error",
+	"terminated",
+	"open"
+];
+const badRequest = (message) => Response.json({
+	code: "BAD_REQUEST",
+	message
+}, { status: 400 });
+const workflowCodeError = (code) => code.length < 1 || code.length > 64 ? badRequest("The workflow code must have 1 to 64 characters.") : void 0;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function createDevWorkflows(options) {
+	const runs = /* @__PURE__ */ new Map();
+	const controller = new AbortController();
+	const stopped = () => controller.signal.aborted;
+	const wait = (milliseconds) => {
+		if (controller.signal.aborted) return Promise.reject(/* @__PURE__ */ new Error("The dev server stopped."));
+		return new Promise((resolve, reject) => {
+			const deadline = Date.now() + Math.max(0, milliseconds);
+			let timer;
+			const schedule = () => {
+				const remaining = deadline - Date.now();
+				if (remaining <= 0) {
+					controller.signal.removeEventListener("abort", onAbort);
+					resolve();
+					return;
+				}
+				timer = setTimeout(schedule, Math.min(remaining, 2147483647));
+			};
+			const onAbort = () => {
+				clearTimeout(timer);
+				controller.signal.removeEventListener("abort", onAbort);
+				reject(/* @__PURE__ */ new Error("The dev server stopped."));
+			};
+			controller.signal.addEventListener("abort", onAbort, { once: true });
+			schedule();
+		});
+	};
+	const record = (run, outcome) => {
+		switch (outcome.kind) {
+			case "step":
+			case "step_error":
+				run.status = "in_progress";
+				run.sleep_until = null;
+				break;
+			case "sleep":
+				run.status = "sleeping";
+				run.sleep_until = new Date(outcome.until).toISOString();
+				break;
+			case "done":
+				run.status = "success";
+				run.result = outcome.result ?? null;
+				run.sleep_until = null;
+				run.finished_at = (/* @__PURE__ */ new Date()).toISOString();
+				break;
+			case "error":
+				run.status = "error";
+				run.error = outcome.message.slice(0, 2048);
+				run.sleep_until = null;
+				run.finished_at = (/* @__PURE__ */ new Date()).toISOString();
+		}
+	};
+	const start = (workflow, payload) => {
+		const run = {
+			id: randomUUID(),
+			workflow,
+			status: "in_progress",
+			result: null,
+			error: null,
+			sleep_until: null,
+			started_at: (/* @__PURE__ */ new Date()).toISOString(),
+			finished_at: null
+		};
+		runs.set(run.id, run);
+		options.logger.info(`ℹ Workflow ${workflow} run ${run.id} started.`);
+		runWorkflowJournal({
+			invoke: async (_name, fn) => {
+				if (controller.signal.aborted) throw new Error("The dev server stopped.");
+				for (let attempt = 0;; attempt += 1) try {
+					const outcome = await fn();
+					if (stopped()) throw new Error("The dev server stopped.");
+					return outcome;
+				} catch (error) {
+					if (stopped() || attempt === 5) throw error;
+					const message = error instanceof Error ? error.message : String(error);
+					options.logger.error(`Workflow ${workflow} run ${run.id} invoke failed, retrying: ${message}`);
+					await wait(1e3 * 2 ** attempt);
+				}
+			},
+			sleep: (_name, milliseconds) => options.skipSleep ? Promise.resolve() : wait(milliseconds),
+			sleepUntil: (_name, until) => options.skipSleep ? Promise.resolve() : wait(until.getTime() - Date.now())
+		}, async (journal) => {
+			const outcome = await options.invoke(workflow, {
+				payload,
+				journal
+			});
+			record(run, outcome);
+			return outcome;
+		}).then(() => options.logger.info(`ℹ Workflow ${workflow} run ${run.id} succeeded.`), (error) => {
+			if (controller.signal.aborted) return;
+			const message = (error instanceof Error ? error.message : String(error)).slice(0, 2048);
+			run.status = "error";
+			run.error = message;
+			run.sleep_until = null;
+			run.finished_at = (/* @__PURE__ */ new Date()).toISOString();
+			options.logger.error(`Workflow ${workflow} run ${run.id} failed: ${message}`);
+		});
+		return run;
+	};
+	const handle = (request) => {
+		const url = new URL(request.url);
+		const prefix = `/api/v1/applets/${encodeURIComponent(options.appletCode)}`;
+		if (!url.pathname.startsWith(`${prefix}/`)) return void 0;
+		const path = url.pathname.slice(prefix.length);
+		const startMatch = /^\/workflows\/([^/]+)\/runs$/.exec(path);
+		if (request.method === "POST" && startMatch !== null) return (async () => {
+			let body;
+			try {
+				const text = await request.text();
+				body = text === "" ? {} : JSON.parse(text);
+			} catch {
+				return badRequest("The body must be a JSON object with a payload key.");
+			}
+			if (body === null || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key) => key !== "payload")) return badRequest("The body must be a JSON object with a payload key.");
+			let workflow;
+			try {
+				workflow = decodeURIComponent(startMatch[1]);
+			} catch (error) {
+				if (error instanceof URIError) return badRequest(error.message);
+				throw error;
+			}
+			const codeError = workflowCodeError(workflow);
+			if (codeError !== void 0) return codeError;
+			const run = start(workflow, "payload" in body ? body.payload : void 0);
+			return Response.json({ data: {
+				id: run.id,
+				workflow: run.workflow,
+				status: "in_progress"
+			} }, { status: 201 });
+		})();
+		const getMatch = /^\/workflows\/([^/]+)\/runs\/([^/]+)$/.exec(path);
+		if (request.method === "GET" && getMatch !== null) {
+			let workflow;
+			let id;
+			try {
+				workflow = decodeURIComponent(getMatch[1]);
+				id = decodeURIComponent(getMatch[2]);
+			} catch (error) {
+				if (error instanceof URIError) return Promise.resolve(badRequest(error.message));
+				throw error;
+			}
+			const codeError = workflowCodeError(workflow);
+			if (codeError !== void 0) return Promise.resolve(codeError);
+			if (!UUID_PATTERN.test(id)) return Promise.resolve(badRequest("The run id must be a uuid."));
+			const run = runs.get(id);
+			return Promise.resolve(run?.workflow === workflow ? Response.json({ data: run }) : Response.json({
+				code: "workflow_run_not_found",
+				message: "The workflow run does not exist."
+			}, { status: 404 }));
+		}
+		if (request.method === "GET" && path === "/workflow-runs") {
+			const status = url.searchParams.get("status");
+			const limitValue = url.searchParams.get("limit");
+			const limit = limitValue === null ? 50 : Number(limitValue);
+			if (status !== null && !RUN_STATUSES.some((value) => value === status)) return Promise.resolve(badRequest("Invalid workflow run status."));
+			if (!Number.isInteger(limit) || limit < 1 || limit > 100) return Promise.resolve(badRequest("The limit must be an integer from 1 to 100."));
+			const workflow = url.searchParams.get("workflow");
+			const codeError = workflow === null ? void 0 : workflowCodeError(workflow);
+			if (codeError !== void 0) return Promise.resolve(codeError);
+			const data = [...runs.values()].filter((run) => (workflow === null || run.workflow === workflow) && (status === null || status === run.status || status === "open" && ["in_progress", "sleeping"].includes(run.status))).reverse().slice(0, limit).map(({ result: _result, ...summary }) => summary);
+			return Promise.resolve(Response.json({ data }));
+		}
+	};
+	return {
+		handle,
+		stop: () => controller.abort()
+	};
+}
+//#endregion
 //#region src/vite.ts
 const APPLET_COMPATIBILITY_DATE = "2026-07-14";
 const APPLET_COMPATIBILITY_FLAGS = ["nodejs_compat"];
+let activeDevListener;
 function clientBootstrapScript(parentOrigin, appletCode) {
 	return `(function () {
   var parentOrigin = ${parentOrigin === void 0 ? "null" : JSON.stringify(parentOrigin)};
@@ -151,6 +435,11 @@ function applet(sourceDefinition, options = {}) {
 	let clearedOutDir = false;
 	let contractSync;
 	let themeStylesheetUrl;
+	let devApiUrl;
+	let devListener;
+	let devLogger;
+	let devWorkflows;
+	let devContext;
 	const virtualRouteConfig = {
 		type: "root",
 		file: "__root.tsx",
@@ -169,6 +458,7 @@ function applet(sourceDefinition, options = {}) {
 		const routesDirectory = resolve(resolvedRoot, "src/client/routes");
 		const hasClient = existsSync(routesDirectory);
 		const hasServer = existsSync(resolve(resolvedRoot, "src/server/main.ts"));
+		if (!hasServer && parsedDefinition.data.telephony?.events.length) throw new Error("An applet with telephony events must have src/server/main.ts.");
 		if (!hasServer && (parsedDefinition.data.schedules?.length ?? 0) > 0) throw new Error("An applet with schedules must have src/server/main.ts.");
 		const legacyMain = resolve(resolvedRoot, "src/client/main.tsx");
 		const indexHtml = resolve(resolvedRoot, "index.html");
@@ -235,6 +525,66 @@ function applet(sourceDefinition, options = {}) {
 				hasServer ? writeServerEntry(root, hasHitchGen, manifest.code) : void 0,
 				hasHitchGen ? void 0 : writeRegisterDeclaration(resolve(root, ".hitch"))
 			]);
+			if (environment.command === "serve" && environment.mode !== "test" && environment.isPreview !== true) {
+				const instanceUrl = await resolveInstanceUrl(void 0, options.store);
+				const orgUrl = organizationInstanceUrl(instanceUrl, manifest.org);
+				const auth = await resolveAuthForOrg(instanceUrl, manifest.org, options.store);
+				if (auth === void 0) throw new Error("Not logged in. Run applet login.");
+				const token = bearerToken(auth);
+				const meResponse = await (options.fetch ?? globalThis.fetch)(`${orgUrl}/api/v1/me`, { headers: { authorization: `Bearer ${token}` } });
+				rejectEnvironmentKey(meResponse, auth);
+				if (meResponse.status === 401) throw new Error("Your login expired. Run applet login.");
+				if (!meResponse.ok) throw new Error(`Hitch returned ${meResponse.status} for /api/v1/me.`);
+				const { person } = meSchema.parse(await meResponse.json());
+				const proxy = createDevProxy({
+					orgUrl,
+					token,
+					source: auth.source,
+					fetch: options.fetch,
+					warn: (message) => devLogger?.warn(message),
+					intercept: (request) => devWorkflows?.handle(request)
+				});
+				devContext = {
+					person,
+					proxy,
+					orgUrl,
+					cacheBuster: randomUUID()
+				};
+				if (hasServer && devListener === void 0) {
+					if (activeDevListener?.listening) activeDevListener.close();
+					const nonce = randomUUID();
+					devListener = createServer((request, response) => {
+						const url = request.url ?? "";
+						const prefix = `/${nonce}/api`;
+						const address = devListener?.address();
+						if (!(url === prefix || url.startsWith(`${prefix}/`) || url.startsWith(`${prefix}?`)) || address === null || address === void 0 || typeof address === "string" || request.headers.host !== `127.0.0.1:${address.port}`) {
+							response.writeHead(404).end();
+							return;
+						}
+						request.url = url.slice(nonce.length + 1);
+						serveDevProxy(request, response, proxy).catch((error) => {
+							const failure = error instanceof Error ? error : new Error(String(error));
+							devLogger?.error(`Local Hitch proxy failed: ${failure.message}`);
+							response.destroy(failure);
+						});
+					});
+					activeDevListener = devListener;
+					try {
+						await new Promise((resolvePromise, rejectPromise) => {
+							devListener?.once("error", rejectPromise);
+							devListener?.listen(0, "127.0.0.1", resolvePromise);
+						});
+						const address = devListener.address();
+						if (address === null || typeof address === "string") throw new Error("The local Hitch proxy has no port.");
+						devApiUrl = `http://127.0.0.1:${address.port}/${nonce}/api`;
+					} catch (error) {
+						if (devListener.listening) devListener.close();
+						if (activeDevListener === devListener) activeDevListener = void 0;
+						devListener = void 0;
+						throw error;
+					}
+				}
+			}
 			return {
 				base: `/${manifest.code}/`,
 				...hasServer && { environments: { worker: { build: { rollupOptions: { output: { codeSplitting: false } } } } } }
@@ -244,11 +594,84 @@ function applet(sourceDefinition, options = {}) {
 			apiManifest = resolveAppletConfig(config.root).manifest;
 		},
 		configureServer(server) {
-			const { manifest, root } = requireAppletConfig();
+			if (devContext === void 0) return;
+			const { manifest } = requireAppletConfig();
+			const { person, proxy, orgUrl, cacheBuster } = devContext;
+			const orgOrigin = new URL(orgUrl).origin;
+			devLogger = server.config.logger;
+			const skipSleep = process.env.HITCH_DEV_SKIP_SLEEP === "1";
+			devWorkflows = createDevWorkflows({
+				appletCode: manifest.code,
+				skipSleep,
+				logger: server.config.logger,
+				invoke: async (workflow, body) => {
+					const address = server.httpServer?.address();
+					if (address === null || address === void 0 || typeof address === "string") throw new Error("The dev server has no port.");
+					const response = await fetch(`http://localhost:${address.port}/${manifest.code}/api/__hitch/workflows/${encodeURIComponent(workflow)}`, {
+						method: "POST",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify(body)
+					});
+					if (!response.ok) throw new Error(`Workflow worker returned HTTP ${response.status}.`);
+					return workflowOutcomeSchema.parse(await response.json());
+				}
+			});
+			server.config.logger.info(`ℹ Running as ${person.email} in production org "${manifest.org}". Reads and writes use real data with your access.`);
+			if (manifest.requiresChangeset !== void 0) server.config.logger.info(`ℹ This applet requires changeset ${manifest.requiresChangeset}. Local dev uses the live schema, so a pending changeset's schema is not available until it applies.`);
+			if (skipSleep) server.config.logger.info("ℹ HITCH_DEV_SKIP_SLEEP is set. Workflow sleeps and retry delays run at once.");
+			const devServerFile = resolve(requireAppletConfig().root, ".hitch/dev-server.json");
+			let devServerUrl;
+			const removeDevServerFile = () => {
+				if (devServerUrl === void 0) return;
+				try {
+					const file = JSON.parse(readFileSync(devServerFile, "utf8"));
+					if (file !== null && typeof file === "object" && "pid" in file && file.pid === process.pid && "url" in file && file.url === devServerUrl) rmSync(devServerFile, { force: true });
+				} catch (error) {
+					if (!(error instanceof SyntaxError) && !(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+				}
+			};
+			server.httpServer?.once("listening", () => {
+				const address = server.httpServer?.address();
+				if (address === null || address === void 0 || typeof address === "string") return;
+				mkdirSync(dirname(devServerFile), { recursive: true });
+				devServerUrl = `http://localhost:${address.port}`;
+				writeFileSync(devServerFile, JSON.stringify({
+					url: devServerUrl,
+					pid: process.pid
+				}));
+				server.config.logger.info(`ℹ Preview in Hitch: ${orgUrl}/applets/${manifest.code}?_hitch_dev=${address.port}`);
+				process.once("exit", removeDevServerFile);
+			});
+			server.httpServer?.once("close", () => {
+				devWorkflows?.stop();
+				devListener?.close();
+				if (activeDevListener === devListener) activeDevListener = void 0;
+				process.off("exit", removeDevServerFile);
+				removeDevServerFile();
+			});
 			const mount = `/${manifest.code}`;
 			const apiPrefix = `${mount}/api`;
 			server.middlewares.use((request, response, next) => {
+				if (request.url === mount || request.url?.startsWith(`${mount}?`)) request.url = `${mount}/${request.url.slice(mount.length)}`;
 				const url = request.url ?? "";
+				const pathname = url.split("?", 1)[0] ?? "";
+				if (pathname.startsWith("/__applet/context/")) {
+					if (pathname !== `/__applet/context/${manifest.code}` || request.method !== "GET") {
+						response.writeHead(404).end();
+						return;
+					}
+					if (refusesClient(request.headers, request.socket.remoteAddress)) {
+						response.writeHead(403).end();
+						return;
+					}
+					response.setHeader("Cache-Control", "no-store");
+					response.setHeader("Content-Type", "application/json; charset=utf-8");
+					response.end(JSON.stringify({
+						cacheBuster,
+						cacheScope: person.id
+					}));
+					return;
+				}
 				if (url === "/_hitch/client.js" || url.startsWith("/_hitch/client.js?")) {
 					response.statusCode = 200;
 					response.setHeader("Cache-Control", "no-store");
@@ -256,29 +679,37 @@ function applet(sourceDefinition, options = {}) {
 					response.end("// PostHog is disabled in standalone applet development.\n");
 					return;
 				}
-				if (url === "/theme.css" || url.startsWith("/theme.css?")) {
-					readFile(resolve(root, ".hitch/theme.css")).then((theme) => {
-						response.statusCode = 200;
-						response.setHeader("Cache-Control", "no-cache");
-						response.setHeader("Content-Type", "text/css; charset=utf-8");
-						response.end(theme);
-					}, (error) => {
-						if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-							next();
-							return;
-						}
-						next(error);
+				if (url === "/api" || url.startsWith("/api/") || url.startsWith("/api?") || url === "/theme.css" || url.startsWith("/theme.css?")) {
+					serveDevProxy(request, response, proxy).catch((error) => {
+						if (response.headersSent) response.destroy(error instanceof Error ? error : new Error(String(error)));
+						else next(error);
 					});
 					return;
 				}
-				if (url === apiPrefix || url.startsWith(`${apiPrefix}/`) || url.startsWith(`${apiPrefix}?`)) request.url = url.slice(mount.length);
+				if (url === apiPrefix || url.startsWith(`${apiPrefix}/`) || url.startsWith(`${apiPrefix}?`)) {
+					if (refusesClient(request.headers, request.socket.remoteAddress)) {
+						response.writeHead(403).end();
+						return;
+					}
+					request.url = url.slice(mount.length);
+					if (request.url.startsWith("/api/__hitch/") && request.headers.origin !== void 0) {
+						response.writeHead(404).end();
+						return;
+					}
+					request.originalUrl = request.url;
+					request.headers[HITCH_USER_HEADER] = person.id;
+					request.headers[HITCH_SESSION_HEADER] = "local-dev";
+					request.rawHeaders = request.rawHeaders.flatMap((name, index, headers) => index % 2 === 0 && name.toLowerCase() !== "x-hitch-user" && name.toLowerCase() !== "x-hitch-session" ? [name, headers[index + 1] ?? ""] : []);
+					request.rawHeaders.push(HITCH_USER_HEADER, person.id, HITCH_SESSION_HEADER, "local-dev");
+				}
+				response.setHeader("Content-Security-Policy", `frame-ancestors ${orgOrigin}`);
 				next();
 			});
 		},
 		transformIndexHtml: {
 			order: "post",
 			handler(html) {
-				const parentOrigin = themeStylesheetUrl === void 0 ? void 0 : new URL(themeStylesheetUrl).origin;
+				const parentOrigin = devContext?.orgUrl === void 0 ? themeStylesheetUrl === void 0 ? void 0 : new URL(themeStylesheetUrl).origin : new URL(devContext.orgUrl).origin;
 				return {
 					html: themeStylesheetUrl === void 0 ? html : html.replace("href=\"/theme.css\"", `href="${themeStylesheetUrl}"`),
 					tags: [{
@@ -332,7 +763,11 @@ function applet(sourceDefinition, options = {}) {
 					not_found_handling: "single-page-application",
 					run_worker_first: ["/api/*"]
 				} } : {},
-				...hasServer ? { main: resolve(root, ".hitch/entry.server.gen.ts") } : {}
+				...hasServer ? { main: resolve(root, ".hitch/entry.server.gen.ts") } : {},
+				...devApiUrl === void 0 ? {} : { vars: {
+					...workerConfig.vars,
+					HITCH_API_URL: devApiUrl
+				} }
 			};
 		},
 		get viteEnvironment() {

package/dist/workflow-engine-MogejNfF.js

@@ -0,0 +1,117 @@
+import { z } from "zod";
+//#region src/headers.ts
+const HITCH_USER_HEADER = "x-hitch-user";
+const HITCH_SESSION_HEADER = "x-hitch-session";
+const HITCH_APPLET_HEADER = "x-hitch-applet";
+const HITCH_APPLET_TOKEN_HEADER = "x-hitch-applet-token";
+//#endregion
+//#region src/server/workflow-protocol.ts
+const journalEntrySchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("step"),
+		id: z.string(),
+		name: z.string(),
+		result: z.unknown()
+	}),
+	z.object({
+		kind: z.literal("sleep"),
+		id: z.string(),
+		name: z.string(),
+		until: z.number()
+	}),
+	z.object({
+		kind: z.literal("attempt"),
+		id: z.string(),
+		name: z.string(),
+		error: z.string()
+	}),
+	z.object({
+		kind: z.literal("failed"),
+		id: z.string(),
+		name: z.string(),
+		error: z.string()
+	})
+]);
+const workflowInvocationRequestSchema = z.object({
+	payload: z.unknown(),
+	journal: z.array(journalEntrySchema)
+});
+const workflowOutcomeSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("step"),
+		id: z.string(),
+		name: z.string(),
+		result: z.unknown()
+	}),
+	z.object({
+		kind: z.literal("sleep"),
+		id: z.string(),
+		name: z.string(),
+		until: z.number()
+	}),
+	z.object({
+		kind: z.literal("step_error"),
+		id: z.string(),
+		name: z.string(),
+		message: z.string(),
+		retries: z.object({
+			limit: z.number(),
+			delayMs: z.number(),
+			backoff: z.enum([
+				"constant",
+				"linear",
+				"exponential"
+			])
+		})
+	}),
+	z.object({
+		kind: z.literal("done"),
+		result: z.unknown()
+	}),
+	z.object({
+		kind: z.literal("error"),
+		message: z.string()
+	})
+]);
+//#endregion
+//#region src/server/workflow-engine.ts
+var WorkflowFailedError = class extends Error {};
+async function runWorkflowJournal(engine, invoke) {
+	const journal = [];
+	for (let index = 1;; index += 1) {
+		const outcome = await engine.invoke(`invoke ${index}`, () => invoke(journal));
+		switch (outcome.kind) {
+			case "step":
+				journal.push(outcome);
+				break;
+			case "sleep":
+				journal.push(outcome);
+				await engine.sleepUntil(`sleep ${index}`, new Date(outcome.until));
+				break;
+			case "step_error": {
+				const attempts = 1 + journal.filter((entry) => entry.kind === "attempt" && entry.id === outcome.id).length;
+				journal.push({
+					kind: "attempt",
+					id: outcome.id,
+					name: outcome.name,
+					error: outcome.message
+				});
+				if (attempts > outcome.retries.limit) {
+					journal.push({
+						kind: "failed",
+						id: outcome.id,
+						name: outcome.name,
+						error: outcome.message
+					});
+					break;
+				}
+				await engine.sleep(`retry ${index}`, outcome.retries.delayMs * (outcome.retries.backoff === "exponential" ? 2 ** (attempts - 1) : outcome.retries.backoff === "linear" ? attempts : 1));
+				break;
+			}
+			case "done": return outcome.result;
+			case "error": throw new WorkflowFailedError(outcome.message);
+		}
+	}
+}
+//#endregion
+export { workflowOutcomeSchema as a, HITCH_SESSION_HEADER as c, workflowInvocationRequestSchema as i, HITCH_USER_HEADER as l, runWorkflowJournal as n, HITCH_APPLET_HEADER as o, journalEntrySchema as r, HITCH_APPLET_TOKEN_HEADER as s, WorkflowFailedError as t };

package/dist/{workspace-B6lenAS5.js → workspace-XVtM12ZC.js}

@@ -342,9 +342,12 @@ function readWorkspaceConfig(dir) {
 	}
 	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
 	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new Error(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
+	const githubWorkflow = "githubWorkflow" in config ? config.githubWorkflow : void 0;
+	if (githubWorkflow !== void 0 && typeof githubWorkflow !== "boolean") throw new Error(`Invalid Hitch config in ${path}: "githubWorkflow" must be a boolean.`);
 	return {
 		sdk: config.sdk,
-		org: config.org
+		org: config.org,
+		githubWorkflow
 	};
 }
 function findWorkspaceConfig(cwd) {
@@ -384,4 +387,4 @@ function resolveWorkspaceOrg(appletRoot) {
 	throw new Error(`No Hitch workspace found for ${appletRoot}. An applet must live at <workspace>/applets/<code> with hitch.config.ts in the workspace root.`);
 }
 //#endregion
-export { loginWithDevice as a, resolveAuthForOrg as c, readWorkspaceConfig as i, resolveInstanceUrl as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, organizationInstanceUrl as s, resolveWorkspaceOrg as t };
+export { loginWithDevice as a, organizationInstanceUrl as c, resolveInstanceUrl as d, readWorkspaceConfig as i, rejectEnvironmentKey as l, fetchWithOrgAuth as n, AuthenticationError as o, findWorkspaceConfig as r, bearerToken as s, resolveWorkspaceOrg as t, resolveAuthForOrg as u };