@hitch42/cli 0.1.0-beta.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hitch42 Pty Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/hitch.js

@@ -0,0 +1,1148 @@
+#!/usr/bin/env node
+import { registerHooks } from "node:module";
+import { access, chmod, mkdir, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { os } from "@orpc/server";
+import { createCli } from "trpc-cli";
+import { createInterface } from "node:readline/promises";
+import { createORPCClient } from "@orpc/client";
+import { isContractProcedure } from "@orpc/contract";
+import { OpenAPILink } from "@orpc/openapi-client/fetch";
+import { z } from "zod";
+import { createClient } from "@hey-api/openapi-ts";
+import { readFileSync } from "node:fs";
+//#region ../shared/auth/src/store.mts
+const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
+var AuthenticationError = class extends Error {};
+function isErrno$2(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+async function readJson(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf8"));
+	} catch (error) {
+		if (isErrno$2(error, "ENOENT")) return void 0;
+		throw new Error(`Failed to read ${path}.`, { cause: error });
+	}
+}
+function isObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function emptyCredentialStore() {
+	return { instances: {} };
+}
+async function healCredentialStore(credentialsPath, source, store, unrecognizedCount) {
+	const backupPath = `${credentialsPath}.bak`;
+	try {
+		try {
+			await writeFile(backupPath, source, {
+				flag: "wx",
+				mode: 384
+			});
+		} catch (error) {
+			if (!isErrno$2(error, "EEXIST")) throw error;
+		}
+		await chmod(backupPath, 384);
+		await writeFile(credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+		await chmod(credentialsPath, 384);
+	} catch {
+		console.error(unrecognizedCount === void 0 ? `hitch: failed to heal credential store at ${credentialsPath}; using an empty in-memory store.` : `hitch: failed to heal credential store at ${credentialsPath}; using recognized credentials in memory only.`);
+		return store;
+	}
+	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
+	return store;
+}
+async function readRawCredentialStore(options = {}) {
+	const { credentialsPath } = storePaths(options);
+	let source;
+	try {
+		source = await readFile(credentialsPath, "utf8");
+	} catch (error) {
+		if (isErrno$2(error, "ENOENT")) return emptyCredentialStore();
+		throw new Error(`Failed to read ${credentialsPath}.`, { cause: error });
+	}
+	let value;
+	try {
+		value = JSON.parse(source);
+	} catch {
+		return healCredentialStore(credentialsPath, source, emptyCredentialStore());
+	}
+	if (!isObject$2(value) || !isObject$2(value.instances)) return healCredentialStore(credentialsPath, source, emptyCredentialStore());
+	const instances = Object.fromEntries(Object.entries(value.instances).flatMap(([instanceUrl, entry]) => {
+		if (isObject$2(entry) && typeof entry.organizationId === "string") {
+			const credentials = parseCredentials(entry);
+			return credentials === void 0 ? [] : [[instanceUrl, { [credentials.orgCode]: entry }]];
+		}
+		if (!isObject$2(entry)) return [];
+		return [[instanceUrl, Object.fromEntries(Object.entries(entry).filter(([orgCode, credentials]) => parseCredentials(credentials)?.orgCode === orgCode))]];
+	}));
+	const reshaped = Object.values(value.instances).some((entry) => !isObject$2(entry) || typeof entry.organizationId === "string");
+	const countLeaves = (store) => Object.values(store).reduce((total, entry) => total + (isObject$2(entry) && typeof entry.organizationId !== "string" ? Object.keys(entry).length : 1), 0);
+	const unrecognizedCount = countLeaves(value.instances) - countLeaves(instances);
+	if (!reshaped && unrecognizedCount === 0) return value;
+	return healCredentialStore(credentialsPath, source, { instances }, unrecognizedCount);
+}
+function parseCredentials(value) {
+	if (!isObject$2(value) || typeof value.organizationId !== "string" || typeof value.orgCode !== "string") return;
+	const organization = {
+		organizationId: value.organizationId,
+		orgCode: value.orgCode
+	};
+	if ((value.type === void 0 || value.type === "session") && typeof value.accessToken === "string" && (value.expiresAt === void 0 || typeof value.expiresAt === "number")) return {
+		type: "session",
+		accessToken: value.accessToken,
+		...value.expiresAt === void 0 ? {} : { expiresAt: value.expiresAt },
+		...organization
+	};
+	if (value.type === "apiKey" && typeof value.apiKey === "string") return {
+		type: "apiKey",
+		apiKey: value.apiKey,
+		...organization
+	};
+}
+function normalizeInstanceUrl(instanceUrl) {
+	let url;
+	try {
+		url = new URL(instanceUrl);
+	} catch (error) {
+		throw new Error(`Invalid Hitch instance URL: ${instanceUrl}`, { cause: error });
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Invalid Hitch instance URL protocol: ${url.protocol}`);
+	url.pathname = url.pathname.replace(/\/+$/, "");
+	url.search = "";
+	url.hash = "";
+	return url.toString().replace(/\/$/, "");
+}
+function organizationInstanceUrl(instanceUrl, orgCode) {
+	const url = new URL(normalizeInstanceUrl(instanceUrl));
+	const labels = url.hostname.split(".");
+	if (labels[0] !== "app" || labels.length < 2) return url.toString().replace(/\/$/, "");
+	url.hostname = [orgCode, ...labels.slice(1)].join(".");
+	return url.toString().replace(/\/$/, "");
+}
+function storePaths(options = {}) {
+	const env = options.env ?? process.env;
+	const home = options.homeDir ?? homedir();
+	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
+	return {
+		configDir,
+		cacheDir: join(env.XDG_CACHE_HOME || join(home, ".cache"), "hitch"),
+		configPath: join(configDir, "config.json"),
+		credentialsPath: join(configDir, "credentials.json")
+	};
+}
+async function resolveInstanceUrl(override, options = {}) {
+	if (override !== void 0) return normalizeInstanceUrl(override);
+	const envInstanceUrl = (options.env ?? process.env).HITCH_API_URL;
+	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
+	const { configPath } = storePaths(options);
+	const config = await readJson(configPath);
+	if (config === void 0) return DEFAULT_INSTANCE_URL;
+	if (!isObject$2(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
+	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
+}
+async function readCredentialStore(options = {}) {
+	const store = await readRawCredentialStore(options);
+	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
+		const credentials = parseCredentials(value);
+		return credentials === void 0 ? [] : [[orgCode, credentials]];
+	}))])) };
+}
+function environmentAuth(options) {
+	const apiKey = (options.env ?? process.env).HITCH_API_KEY;
+	return apiKey !== void 0 && apiKey.length > 0 ? {
+		accessToken: apiKey,
+		source: "environment"
+	} : void 0;
+}
+function resolvedStoredAuth(credentials) {
+	return credentials === void 0 ? void 0 : {
+		accessToken: credentials.type === "apiKey" ? credentials.apiKey : credentials.accessToken,
+		credentialType: credentials.type,
+		organizationId: credentials.organizationId,
+		orgCode: credentials.orgCode,
+		source: "store"
+	};
+}
+function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
+	const exact = resolvedStoredAuth(credentialsByOrg[orgCode]);
+	if (exact !== void 0) return exact;
+	const sessions = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "session").filter((credentials, index, all) => all.findIndex(({ accessToken }) => accessToken === credentials.accessToken) === index);
+	if (sessions.length === 1) return resolvedStoredAuth(sessions[0]);
+	if (sessions.length > 1) throw new AuthenticationError(`Multiple sessions are stored. Run hitch login for organization "${orgCode}".`);
+	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
+	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
+}
+async function resolveAuth(instanceUrl, options = {}, orgCode) {
+	const auth = environmentAuth(options);
+	if (auth !== void 0) return auth;
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = (await readCredentialStore(options)).instances[normalizedUrl] ?? {};
+	const selectedOrg = orgCode ?? (options.env ?? process.env).HITCH_DEFAULT_ORG;
+	if (selectedOrg !== void 0 && selectedOrg.length > 0) return resolveStoredAuthForOrg(credentialsByOrg, selectedOrg);
+	const orgCodes = Object.keys(credentialsByOrg).sort();
+	const soleOrg = orgCodes.at(0);
+	if (soleOrg === void 0) return void 0;
+	if (orgCodes.length === 1) return resolvedStoredAuth(credentialsByOrg[soleOrg]);
+	throw new AuthenticationError(`Multiple organizations are stored for ${normalizedUrl}: ${orgCodes.join(", ")}. Use --org, a workspace hitch.org, or HITCH_DEFAULT_ORG to choose one.`);
+}
+function rejectEnvironmentKey(response, auth) {
+	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
+}
+function bearerToken(credentials) {
+	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
+}
+async function setCredentials(instanceUrl, credentials, options = {}) {
+	const paths = storePaths(options);
+	const store = await readRawCredentialStore(options);
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	const credentialsByOrg = store.instances[normalizedUrl];
+	store.instances[normalizedUrl] = {
+		...isObject$2(credentialsByOrg) ? credentialsByOrg : {},
+		[credentials.orgCode]: credentials
+	};
+	await mkdir(paths.configDir, { recursive: true });
+	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+	await chmod(paths.credentialsPath, 384);
+}
+async function deleteCredentials(instanceUrl, orgCode, options = {}) {
+	const paths = storePaths(options);
+	const store = await readRawCredentialStore(options);
+	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
+	if (orgCode === void 0) delete store.instances[normalizedUrl];
+	else {
+		const credentialsByOrg = store.instances[normalizedUrl];
+		if (isObject$2(credentialsByOrg)) {
+			delete credentialsByOrg[orgCode];
+			if (Object.keys(credentialsByOrg).length === 0) delete store.instances[normalizedUrl];
+		}
+	}
+	if (Object.keys(store.instances).length === 0) {
+		await rm(paths.credentialsPath, { force: true });
+		return;
+	}
+	await mkdir(dirname(paths.credentialsPath), { recursive: true });
+	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+	await chmod(paths.credentialsPath, 384);
+}
+function instanceSlug(instanceUrl) {
+	const url = new URL(normalizeInstanceUrl(instanceUrl));
+	return `${url.protocol.slice(0, -1)}-${url.host}${url.pathname}`.replace(/[^a-zA-Z0-9.-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function instanceCacheDir(instanceUrl, options = {}) {
+	return join(storePaths(options).cacheDir, instanceSlug(instanceUrl));
+}
+function contractCacheDir(instanceUrl, organizationId, options = {}) {
+	return join(instanceCacheDir(instanceUrl, options), organizationId);
+}
+function adminContractCacheDir(instanceUrl, organizationId, options = {}) {
+	return join(contractCacheDir(instanceUrl, organizationId, options), "admin");
+}
+async function deleteInstanceCache(instanceUrl, options = {}) {
+	await rm(instanceCacheDir(instanceUrl, options), {
+		recursive: true,
+		force: true
+	});
+}
+//#endregion
+//#region ../shared/auth/src/device.mts
+const CLIENT_ID = "hitch-cli";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function defaultOpenUrl(url) {
+	try {
+		const child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+function requiredObject(value, message) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(message);
+	return value;
+}
+async function jsonResponse(response) {
+	try {
+		return requiredObject(await response.json(), "Expected a JSON object response.");
+	} catch (error) {
+		throw new Error(`Invalid JSON response from ${response.url || "Hitch"}.`, { cause: error });
+	}
+}
+async function postJson(fetcher, url, body) {
+	const response = await fetcher(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	return {
+		body: await jsonResponse(response),
+		response
+	};
+}
+function parseDeviceCode(value) {
+	if (typeof value.device_code !== "string" || typeof value.user_code !== "string" || typeof value.verification_uri !== "string" || typeof value.verification_uri_complete !== "string" || typeof value.expires_in !== "number" || value.interval !== void 0 && typeof value.interval !== "number") throw new AuthenticationError("Hitch returned an invalid device authorization response.");
+	return value;
+}
+function parseToken(value) {
+	return typeof value.access_token === "string" && typeof value.token_type === "string" ? value : void 0;
+}
+function parseDeviceOrganization(value) {
+	if (typeof value.organizationId !== "string" || typeof value.orgCode !== "string") throw new AuthenticationError("Hitch returned an invalid device organization response.");
+	return value;
+}
+function parseMe(value) {
+	const person = requiredObject(value.person, "Hitch returned an invalid identity response.");
+	if (typeof person.id !== "string" || typeof person.firstName !== "string" || typeof person.lastName !== "string" || typeof person.email !== "string" || !Array.isArray(value.memberships)) throw new Error("Hitch returned an invalid identity response.");
+	const organization = value.organization === void 0 || value.organization === null ? null : requiredObject(value.organization, "Hitch returned an invalid identity response.");
+	if (organization !== null && (typeof organization.id !== "string" || typeof organization.code !== "string")) throw new Error("Hitch returned an invalid identity response.");
+	return {
+		memberships: value.memberships.map((membership) => {
+			const item = requiredObject(membership, "Hitch returned an invalid membership.");
+			if (typeof item.orgId !== "string" || typeof item.code !== "string" || typeof item.name !== "string") throw new Error("Hitch returned an invalid membership.");
+			return item;
+		}),
+		organization,
+		person
+	};
+}
+async function fetchMe(fetcher, instanceUrl, auth) {
+	const response = await fetcher(`${instanceUrl}/api/v1/me`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
+	rejectEnvironmentKey(response, auth);
+	if (auth.credentialType === "apiKey" && response.status === 401) throw new AuthenticationError("API key rejected.");
+	const body = await jsonResponse(response);
+	if (!response.ok) throw new AuthenticationError(typeof body.message === "string" ? body.message : `Failed to load the signed-in identity (${response.status}).`);
+	return parseMe(body);
+}
+async function pollForToken(fetcher, instanceUrl, device, now, sleep) {
+	const deadline = now() + device.expires_in * 1e3;
+	let interval = (device.interval ?? 5) * 1e3;
+	while (now() < deadline) {
+		await sleep(Math.min(interval, deadline - now()));
+		if (now() >= deadline) break;
+		const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/token`, {
+			grant_type: DEVICE_GRANT,
+			device_code: device.device_code,
+			client_id: CLIENT_ID
+		});
+		const token = parseToken(body);
+		if (response.ok && token !== void 0) return token;
+		switch (body.error) {
+			case "authorization_pending": break;
+			case "slow_down":
+				interval += 5e3;
+				break;
+			case "expired_token": throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+			case "access_denied": throw new AuthenticationError("Sign-in was denied.");
+			default: throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Sign-in failed (${response.status}).`);
+		}
+	}
+	throw new AuthenticationError("The sign-in request expired. Run hitch login again.");
+}
+async function authWithOrganization(fetcher, instanceUrl, auth, expectedOrg) {
+	if (expectedOrg !== void 0 && auth.credentialType === "apiKey" && auth.orgCode !== void 0 && auth.orgCode !== expectedOrg) throw new AuthenticationError(`API key is scoped to organization "${auth.orgCode}", not "${expectedOrg}".`);
+	if (auth.organizationId !== void 0 && auth.orgCode !== void 0 && (expectedOrg === void 0 || auth.orgCode === expectedOrg)) return {
+		...auth,
+		organizationId: auth.organizationId,
+		orgCode: auth.orgCode
+	};
+	let me;
+	try {
+		me = await fetchMe(fetcher, expectedOrg === void 0 ? instanceUrl : organizationInstanceUrl(instanceUrl, expectedOrg), auth);
+	} catch (error) {
+		if (expectedOrg === void 0) throw error;
+		throw new AuthenticationError(`${auth.credentialType === "apiKey" || auth.source === "environment" ? "API key" : "Session"} cannot access organization "${expectedOrg}".`, { cause: error });
+	}
+	if (me.organization === null) throw new AuthenticationError("The current identity is not scoped to a Hitch organization.");
+	if (expectedOrg !== void 0 && me.organization.code !== expectedOrg) throw new AuthenticationError(`Hitch returned organization "${me.organization.code}".`);
+	return {
+		...auth,
+		organizationId: me.organization.id,
+		orgCode: me.organization.code
+	};
+}
+async function loginWithDevice(instanceUrl, options = {}) {
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const now = options.now ?? Date.now;
+	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
+	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
+	const device = parseDeviceCode(body);
+	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
+	(options.print ?? console.log)(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
+	if (!options.noBrowser) try {
+		await (options.openUrl ?? defaultOpenUrl)(verificationUrl);
+	} catch {}
+	const token = await pollForToken(fetcher, instanceUrl, device, now, options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))));
+	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
+	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
+	const organization = parseDeviceOrganization(organizationBody);
+	const me = await fetchMe(fetcher, instanceUrl, {
+		accessToken: token.access_token,
+		credentialType: "session",
+		source: "store"
+	});
+	const membership = me.memberships.find(({ orgId }) => orgId === organization.organizationId);
+	if (membership === void 0) throw new AuthenticationError("The device session is not scoped to a Hitch organization.");
+	const credentials = {
+		type: "session",
+		accessToken: token.access_token,
+		expiresAt: token.expires_in === void 0 ? void 0 : now() + token.expires_in * 1e3,
+		organizationId: organization.organizationId,
+		orgCode: organization.orgCode
+	};
+	await setCredentials(instanceUrl, credentials, options.store);
+	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
+	return {
+		credentials,
+		me,
+		membership
+	};
+}
+//#endregion
+//#region src/bridge.ts
+async function defaultPrompt$1(message) {
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return await readline.question(message);
+	} finally {
+		readline.close();
+	}
+}
+function cliInputSchema(schema) {
+	const jsonSchema = (io) => () => z.toJSONSchema(schema, {
+		io,
+		target: "draft-07",
+		override: ({ jsonSchema }) => {
+			if (jsonSchema.type !== "integer") return;
+			if (jsonSchema.minimum === Number.MIN_SAFE_INTEGER) delete jsonSchema.minimum;
+			if (jsonSchema.maximum === Number.MAX_SAFE_INTEGER) delete jsonSchema.maximum;
+		}
+	});
+	return { "~standard": {
+		...schema["~standard"],
+		vendor: "hitch",
+		jsonSchema: {
+			input: jsonSchema("input"),
+			output: jsonSchema("output")
+		}
+	} };
+}
+function unwrapOptional(schema) {
+	return schema instanceof z.ZodOptional ? {
+		required: false,
+		schema: schema.unwrap()
+	} : {
+		required: true,
+		schema
+	};
+}
+function flattenedInput(contract) {
+	const inputSchema = contract["~orpc"].inputSchema;
+	if (inputSchema === void 0) return {
+		schema: z.object({}),
+		sections: []
+	};
+	if (!(inputSchema instanceof z.ZodType)) throw new Error("Generated contract procedure is missing a Zod input schema.");
+	const root = unwrapOptional(inputSchema).schema;
+	if (!(root instanceof z.ZodObject)) throw new Error("Generated contract procedure input must be a detailed Zod object.");
+	const shape = {};
+	const sections = Object.entries(root.shape).map(([name, sectionSchema]) => {
+		if (name !== "body" && name !== "headers" && name !== "params" && name !== "query") throw new Error(`Unsupported generated input section: ${name}`);
+		const section = unwrapOptional(sectionSchema);
+		if (!(section.schema instanceof z.ZodObject)) throw new Error(`Generated ${name} input must be a Zod object.`);
+		Object.entries(section.schema.shape).forEach(([key, value]) => {
+			if (Object.hasOwn(shape, key)) throw new Error(`Cannot flatten duplicate generated input field: ${key}`);
+			shape[key] = value;
+		});
+		return {
+			keys: Object.keys(section.schema.shape),
+			name,
+			required: section.required
+		};
+	});
+	return {
+		schema: z.object(shape),
+		sections
+	};
+}
+function procedureAt(client, path) {
+	const procedure = path.reduce((value, segment) => value[segment], client);
+	if (typeof procedure !== "function") throw new Error(`Generated client procedure is missing: ${path.join(".")}`);
+	return procedure;
+}
+function setAtPath(router, path, value) {
+	const parent = path.slice(0, -1).reduce((node, segment) => {
+		if (!Object.hasOwn(node, segment)) {
+			const created = {};
+			node[segment] = created;
+			return created;
+		}
+		return node[segment];
+	}, router);
+	const name = path.at(-1);
+	if (name !== void 0) parent[name] = value;
+}
+function createBridgeRouter(contract, options) {
+	const client = createORPCClient(new OpenAPILink(contract, {
+		url: `${options.instanceUrl}/api`,
+		headers: { Authorization: `Bearer ${bearerToken(options.auth)}` },
+		fetch: async (request, init) => {
+			const response = await (options.fetch ?? globalThis.fetch)(request, init);
+			if ("source" in options.auth) rejectEnvironmentKey(response, options.auth);
+			return response;
+		}
+	}));
+	const router = {};
+	const visit = (node, path) => {
+		if (isContractProcedure(node)) {
+			const { schema, sections } = flattenedInput(node);
+			const isDelete = node["~orpc"].route.method === "DELETE";
+			if (isDelete && Object.hasOwn(schema.shape, "yes")) throw new Error("Cannot add --yes: route input already has a \"yes\" field.");
+			const inputSchema = isDelete ? schema.extend({ yes: z.boolean().default(false).describe("Skip the confirmation prompt") }) : schema;
+			const description = node["~orpc"].route.summary ?? node["~orpc"].route.description;
+			const procedure = os.meta(description ? { description } : {}).input(cliInputSchema(inputSchema)).handler(async ({ input }) => {
+				if (isDelete && !input.yes) {
+					if (options.prompt === void 0 && process.stdin.isTTY !== true) throw new Error("Refusing to delete without --yes in non-interactive mode.");
+					const values = Object.entries(input).filter(([key, value]) => key !== "yes" && value !== void 0).map(([key, value]) => `${key}=${String(value)}`).join(" ");
+					const answer = await (options.prompt ?? defaultPrompt$1)(`Confirm ${path.join(" ")}${values.length === 0 ? "" : ` ${values}`}? [y/N] `);
+					if (!["y", "yes"].includes(answer.trim().toLowerCase())) throw new Error("Aborted.");
+				}
+				const detailed = Object.fromEntries(sections.flatMap((section) => {
+					const values = Object.fromEntries(section.keys.flatMap((key) => input[key] === void 0 ? [] : [[key, input[key]]]));
+					return section.required || Object.keys(values).length > 0 ? [[section.name, values]] : [];
+				}));
+				return procedureAt(client, path)(sections.length === 0 ? void 0 : detailed);
+			});
+			setAtPath(router, path, procedure);
+			return;
+		}
+		Object.entries(node).forEach(([name, child]) => visit(child, [...path, name]));
+	};
+	visit(contract, []);
+	return router;
+}
+//#endregion
+//#region src/generate.ts
+const RECORD_ROUTE = /^\/v1\/([^/]+)(?:\/(\{id\}|query|update|aggregate))?$/;
+const BATCH_PATH = "/v1/batch";
+const BATCH_ITEM_PATH = "paths./v1/batch.post.requestBody.content.application/json.schema.properties.requests.items";
+const BATCH_ID_PATH = /^\^\/v1\/([^/]+)\/\[0-9a-fA-F-\]\{36\}\$$/;
+const VERBS = {
+	"get:": "list",
+	"post:": "create",
+	"get:{id}": "get",
+	"patch:{id}": "update",
+	"delete:{id}": "delete",
+	"post:query": "query",
+	"post:update": "updateWhere",
+	"post:aggregate": "aggregate"
+};
+function isObject$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+const COMPONENT_REF = /^#\/components\/schemas\/([^/]+)$/;
+function resolveAllOfMember(member, schemas) {
+	if (!isObject$1(member)) return void 0;
+	if (!("$ref" in member)) return "allOf" in member ? void 0 : member;
+	if (typeof member.$ref !== "string" || Object.keys(member).length !== 1) return void 0;
+	const target = schemas[COMPONENT_REF.exec(member.$ref)?.[1] ?? ""];
+	return isObject$1(target) && !("$ref" in target) && !("allOf" in target) ? target : void 0;
+}
+function flattenTrivialAllOf(value, schemas) {
+	if (Array.isArray(value)) return value.map((item) => flattenTrivialAllOf(item, schemas));
+	if (!isObject$1(value)) return value;
+	const { allOf, ...siblings } = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, flattenTrivialAllOf(item, schemas)]));
+	if (!Array.isArray(allOf)) return allOf === void 0 ? siblings : {
+		allOf,
+		...siblings
+	};
+	const members = allOf.map((member) => resolveAllOfMember(member, schemas));
+	const entries = [...members, siblings].flatMap((member) => Object.entries(member ?? {}));
+	return members.every(isObject$1) && new Set(entries.map(([key]) => key)).size === entries.length ? Object.fromEntries(entries) : {
+		allOf,
+		...siblings
+	};
+}
+function isErrno$1(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+async function fileExists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch (error) {
+		if (isErrno$1(error, "ENOENT")) return false;
+		throw error;
+	}
+}
+async function addTypeScriptImportExtensions(outDir) {
+	await Promise.all((await readdir(outDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map(async ({ name }) => {
+		const path = resolve(outDir, name);
+		const source = await readFile(path, "utf8");
+		await writeFile(path, source.replace(/(["'])(\.\.?\/[^"']+)\1/g, (match, quote, specifier) => /\.(?:[cm]?[jt]sx?|json|node)$/i.test(specifier) ? match : `${quote}${specifier}.ts${quote}`));
+	}));
+}
+function recordOperation(path, method) {
+	const match = RECORD_ROUTE.exec(path);
+	if (!match || match[1] === "batch") return void 0;
+	const key = `${method.toLowerCase()}:${match.at(2) ?? ""}`;
+	if (!Object.hasOwn(VERBS, key)) return void 0;
+	return {
+		objectCode: match[1],
+		verb: VERBS[key]
+	};
+}
+function withRecordOperationId(path, method, operation) {
+	const record = recordOperation(path, method);
+	return record ? {
+		...operation,
+		operationId: `${record.objectCode}.${record.verb}`
+	} : void 0;
+}
+function validateBatchEntry(entry, index) {
+	const properties = isObject$1(entry) && isObject$1(entry.properties) ? entry.properties : void 0;
+	const method = isObject$1(properties?.method) ? properties.method.enum : void 0;
+	const path = isObject$1(properties?.path) ? properties.path : void 0;
+	const methodValue = Array.isArray(method) && method.length === 1 ? method[0] : void 0;
+	const enumPath = Array.isArray(path?.enum) && path.enum.length === 1 ? path.enum[0] : void 0;
+	if (Array.isArray(method) && method.length !== 1 || Array.isArray(path?.enum) && path.enum.length !== 1) throw new Error(`${BATCH_ITEM_PATH}.oneOf[${index}] expected a create, update, delete, or updateWhere batch entry, found ${describeValue(entry)}`);
+	const isCreate = methodValue === "POST" && typeof enumPath === "string" && /^\/v1\/([^/]+)$/.test(enumPath) && enumPath !== BATCH_PATH;
+	const isUpdateWhere = methodValue === "POST" && typeof enumPath === "string" && /^\/v1\/([^/]+)\/update$/.test(enumPath);
+	const isIdMutation = (methodValue === "PATCH" || methodValue === "DELETE") && typeof path?.pattern === "string" && BATCH_ID_PATH.test(path.pattern);
+	if (isCreate || isUpdateWhere || isIdMutation) return;
+	throw new Error(`${BATCH_ITEM_PATH}.oneOf[${index}] expected a create, update, delete, or updateWhere batch entry, found ${describeValue(entry)}`);
+}
+function prepareBatchOperation(operation) {
+	if (!isObject$1(operation)) throw new Error(`paths.${BATCH_PATH}.post expected an object, found ${describeValue(operation)}`);
+	const requestBody = isObject$1(operation.requestBody) ? operation.requestBody : void 0;
+	const content = isObject$1(requestBody?.content) ? requestBody.content : void 0;
+	const mediaType = isObject$1(content?.["application/json"]) ? content["application/json"] : void 0;
+	const schema = isObject$1(mediaType?.schema) ? mediaType.schema : void 0;
+	const properties = isObject$1(schema?.properties) ? schema.properties : void 0;
+	const requests = isObject$1(properties?.requests) ? properties.requests : void 0;
+	const items = isObject$1(requests?.items) ? requests.items : void 0;
+	if (items === void 0) throw new Error(`${BATCH_ITEM_PATH} expected an object, found ${describeValue(items)}`);
+	if (items.oneOf === void 0) {
+		if (items.type === "object" && Object.keys(items).length === 1) return void 0;
+		throw new Error(`${BATCH_ITEM_PATH}.oneOf expected a non-empty array, found ${describeValue(items.oneOf)}`);
+	}
+	if (!Array.isArray(items.oneOf)) throw new Error(`${BATCH_ITEM_PATH}.oneOf expected an array, found ${describeValue(items.oneOf)}`);
+	items.oneOf.forEach(validateBatchEntry);
+	if (items.oneOf.length === 0) throw new Error(`${BATCH_ITEM_PATH}.oneOf expected a non-empty array, found an empty array`);
+	return {
+		...operation,
+		operationId: "batch"
+	};
+}
+function prepareRecordSpec(spec) {
+	if (!isObject$1(spec) || !isObject$1(spec.paths)) throw new Error("spec: expected an OpenAPI document with paths");
+	const cloned = structuredClone(spec);
+	const prepared = flattenTrivialAllOf(cloned, isObject$1(cloned.components) && isObject$1(cloned.components.schemas) ? cloned.components.schemas : {});
+	prepared.paths = Object.fromEntries(Object.entries(prepared.paths).flatMap(([path, pathItem]) => {
+		if (path === BATCH_PATH) {
+			if (!isObject$1(pathItem) || pathItem.post === void 0) return [];
+			const operation = prepareBatchOperation(pathItem.post);
+			return operation === void 0 ? [] : [[path, { post: operation }]];
+		}
+		const operations = Object.entries(pathItem).flatMap(([method, operation]) => {
+			const prepared = withRecordOperationId(path, method, operation);
+			return prepared ? [[method, prepared]] : [];
+		});
+		return operations.length > 0 ? [[path, Object.fromEntries(operations)]] : [];
+	}));
+	return prepared;
+}
+function describeValue(value) {
+	if (value === void 0) return "undefined";
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "object") return "an object";
+	return `${typeof value} ${JSON.stringify(value)}`;
+}
+async function generateContract(spec, outDir) {
+	await mkdir(outDir, { recursive: true });
+	const paths = spec !== null && typeof spec === "object" && "paths" in spec ? spec.paths : void 0;
+	if (!(paths !== null && typeof paths === "object" && !Array.isArray(paths) && Object.keys(paths).length === 0)) {
+		await createClient({
+			input: spec,
+			output: outDir,
+			plugins: ["zod", {
+				name: "orpc",
+				contracts: {
+					strategy: "single",
+					nesting: "operationId"
+				}
+			}]
+		});
+		await addTypeScriptImportExtensions(outDir);
+	}
+	const orpcPath = resolve(outDir, "orpc.gen.ts");
+	if (!await fileExists(orpcPath)) await Promise.all([writeFile(orpcPath, "// Generated by applet generate — no operations in spec.\nexport const contract = {} as const;\n"), fileExists(resolve(outDir, "zod.gen.ts")).then((exists) => exists ? void 0 : writeFile(resolve(outDir, "zod.gen.ts"), "// Generated by applet generate — no schemas in spec.\nexport {};\n"))]);
+}
+//#endregion
+//#region src/cache.ts
+const HTTP_METHODS = /* @__PURE__ */ new Set([
+	"delete",
+	"get",
+	"head",
+	"options",
+	"patch",
+	"post",
+	"put",
+	"trace"
+]);
+const WRITE_VERBS = {
+	POST: "create",
+	PATCH: "update",
+	PUT: "set",
+	DELETE: "delete"
+};
+const camelSegment = (segment) => segment.replace(/-(\w)/g, (_, letter) => letter.toUpperCase());
+function adminOperationId(method, path) {
+	const segments = path.replace(/^\/admin\/v1\//, "").split("/");
+	const statics = segments.filter((segment) => !segment.startsWith("{"));
+	if (statics.length === 0) throw new Error(`Admin route ${method} ${path} has no resource segment.`);
+	const collection = !(segments.at(-1)?.startsWith("{") === true) && statics.at(-1)?.endsWith("s") === true;
+	const verb = method === "GET" ? collection ? "list" : "get" : WRITE_VERBS[method] ?? method.toLowerCase();
+	return [...statics.map(camelSegment), verb].join(".");
+}
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isUnknownJsonSchema(value) {
+	if (!isObject(value) || !Array.isArray(value.anyOf) || value.anyOf.length !== 2) return false;
+	const [anything, impossible] = value.anyOf;
+	return isObject(anything) && Object.keys(anything).length === 0 && isObject(impossible) && isObject(impossible.not) && Object.keys(impossible.not).length === 0;
+}
+function normalizeUnknownResponseSchemas(operation) {
+	if (!isObject(operation.responses)) return operation;
+	return {
+		...operation,
+		responses: Object.fromEntries(Object.entries(operation.responses).map(([status, response]) => {
+			if (!isObject(response) || !isObject(response.content)) return [status, response];
+			return [status, {
+				...response,
+				content: Object.fromEntries(Object.entries(response.content).map(([mediaType, media]) => isObject(media) && isUnknownJsonSchema(media.schema) ? [mediaType, {
+					...media,
+					schema: { type: [
+						"array",
+						"boolean",
+						"integer",
+						"null",
+						"number",
+						"object",
+						"string"
+					] }
+				}] : [mediaType, media]))
+			}];
+		}))
+	};
+}
+function prepareAdminSpec(spec) {
+	if (!isObject(spec) || !isObject(spec.paths)) throw new Error("spec: expected an OpenAPI document with paths");
+	const prepared = structuredClone(spec);
+	const derivedOperationIds = /* @__PURE__ */ new Set();
+	prepared.paths = Object.fromEntries(Object.entries(prepared.paths).flatMap(([path, value]) => {
+		if (path === "/admin/v1/openapi.json") return [];
+		if (!isObject(value)) throw new Error(`spec: expected an OpenAPI path item at ${path}`);
+		const pathItem = Object.fromEntries(Object.entries(value).map(([method, operation]) => {
+			if (!HTTP_METHODS.has(method.toLowerCase()) || !isObject(operation)) return [method, operation];
+			const operationId = adminOperationId(method.toUpperCase(), path);
+			if (derivedOperationIds.has(operationId)) throw new Error(`Admin route naming produced duplicate command "${operationId}".`);
+			derivedOperationIds.add(operationId);
+			return [method, normalizeUnknownResponseSchemas({
+				...operation,
+				operationId
+			})];
+		}));
+		return Object.keys(pathItem).some((method) => HTTP_METHODS.has(method.toLowerCase())) ? [[path, pathItem]] : [];
+	}));
+	return prepared;
+}
+function objectCount(spec) {
+	if (spec === null || typeof spec !== "object" || !("paths" in spec)) return 0;
+	const paths = spec.paths;
+	if (paths === null || typeof paths !== "object") return 0;
+	return new Set(Object.entries(paths).flatMap(([path, item]) => item !== null && typeof item === "object" ? Object.keys(item).flatMap((method) => {
+		const operation = recordOperation(path, method);
+		return operation ? [operation.objectCode] : [];
+	}) : [])).size;
+}
+async function syncContractCache(instanceUrl, credentials, options = {}) {
+	if (credentials.organizationId === void 0) throw new Error("Stored credentials do not include an organization. Run hitch login again.");
+	const response = await (options.fetch ?? globalThis.fetch)(`${instanceUrl}/api/v1/openapi.json`, { headers: { Authorization: `Bearer ${bearerToken(credentials)}` } });
+	if ("source" in credentials) rejectEnvironmentKey(response, credentials);
+	if (!response.ok) throw new Error(`Failed to fetch the organization contract (${response.status} ${response.statusText}).`);
+	const prepared = prepareRecordSpec(await response.json());
+	const count = objectCount(prepared);
+	const outDir = contractCacheDir(instanceUrl, credentials.organizationId, options.store);
+	await mkdir(outDir, { recursive: true });
+	await Promise.all((await readdir(outDir)).flatMap((name) => name === "admin" ? [] : [rm(resolve(outDir, name), {
+		recursive: true,
+		force: true
+	})]));
+	await generateContract(prepared, outDir);
+	await writeFile(resolve(outDir, "cli-meta.json"), `${JSON.stringify({
+		organizationId: credentials.organizationId,
+		objectCount: count
+	}, null, 2)}\n`);
+	return count;
+}
+async function syncAdminContractCache(instanceUrl, credentials, options = {}) {
+	if (credentials.organizationId === void 0) throw new Error("Stored credentials do not include an organization. Run hitch login again.");
+	const outDir = adminContractCacheDir(instanceUrl, credentials.organizationId, options.store);
+	let response;
+	try {
+		response = await (options.fetch ?? globalThis.fetch)(`${instanceUrl}/api/admin/v1/openapi.json`, { headers: { Authorization: `Bearer ${bearerToken(credentials)}` } });
+		if ("source" in credentials) rejectEnvironmentKey(response, credentials);
+	} catch (error) {
+		if (error instanceof AuthenticationError) throw error;
+		(options.warn ?? console.error)(`Warning: failed to probe admin commands: ${error instanceof Error ? error.message : String(error)}`);
+		return false;
+	}
+	if (response.status === 401 || response.status === 403) {
+		await rm(outDir, {
+			recursive: true,
+			force: true
+		});
+		return false;
+	}
+	if (!response.ok) {
+		(options.warn ?? console.error)(`Warning: failed to probe admin commands (${response.status} ${response.statusText}).`);
+		return false;
+	}
+	const prepared = prepareAdminSpec(await response.json());
+	await rm(outDir, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(outDir, { recursive: true });
+	await generateContract(prepared, outDir);
+	return true;
+}
+//#endregion
+//#region src/commands.ts
+var NotLoggedInError = class extends Error {};
+async function defaultPrompt(message) {
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return await readline.question(message);
+	} finally {
+		readline.close();
+	}
+}
+function rejectEnvironmentCredentialManagement(options = {}) {
+	if ((options.env ?? process.env).HITCH_API_KEY !== void 0) throw new AuthenticationError("HITCH_API_KEY is set — unset it to manage stored logins.");
+}
+function requireAuth(auth) {
+	if (auth === void 0) throw new NotLoggedInError("Not logged in. Run hitch login.");
+	return auth;
+}
+function createStaticRouter(activeInstanceUrl, dependencies = {}, selectedOrg) {
+	const fetcher = dependencies.fetch ?? globalThis.fetch;
+	const now = dependencies.now ?? Date.now;
+	const print = dependencies.print ?? console.log;
+	const warn = dependencies.warn ?? console.error;
+	return os.router({
+		login: os.meta({ description: "Sign in to a Hitch organization." }).input(z.object({
+			apiKey: z.union([z.string(), z.boolean()]).default(false).describe("Store an API key, prompting when no value is given"),
+			noBrowser: z.boolean().default(false).describe("Do not open a browser"),
+			instance: z.string().optional().describe("Hitch instance URL")
+		})).handler(async ({ input }) => {
+			rejectEnvironmentCredentialManagement(dependencies.store);
+			if (input.apiKey !== false && input.noBrowser) throw new AuthenticationError("--api-key and --no-browser cannot be used together.");
+			const instanceUrl = input.instance === void 0 ? activeInstanceUrl : await resolveInstanceUrl(input.instance, dependencies.store);
+			let me;
+			let membership;
+			let storedCredentials;
+			if (input.apiKey !== false) {
+				const apiKey = typeof input.apiKey === "string" ? input.apiKey : await (dependencies.prompt ?? defaultPrompt)("Paste your API key: ");
+				if (apiKey.length === 0) throw new AuthenticationError("API key cannot be empty.");
+				me = await fetchMe(fetcher, instanceUrl, {
+					accessToken: apiKey,
+					credentialType: "apiKey",
+					source: "store"
+				});
+				const organization = me.organization;
+				if (organization === null) throw new AuthenticationError("The API key is not scoped to a Hitch organization.");
+				const apiKeyMembership = me.memberships.find(({ orgId }) => orgId === organization.id);
+				if (apiKeyMembership === void 0) throw new AuthenticationError("The API key is not scoped to a Hitch organization.");
+				if (selectedOrg !== void 0 && organization.code !== selectedOrg) throw new AuthenticationError(`API key is scoped to organization "${organization.code}", not "${selectedOrg}".`);
+				membership = apiKeyMembership;
+				storedCredentials = {
+					type: "apiKey",
+					apiKey,
+					organizationId: organization.id,
+					orgCode: organization.code
+				};
+				await setCredentials(instanceUrl, storedCredentials, dependencies.store);
+			} else {
+				const login = await loginWithDevice(instanceUrl, {
+					expectedOrg: selectedOrg,
+					fetch: fetcher,
+					noBrowser: input.noBrowser,
+					now,
+					openUrl: dependencies.openUrl,
+					print,
+					sleep: dependencies.sleep,
+					store: dependencies.store
+				});
+				me = login.me;
+				membership = login.membership;
+				storedCredentials = login.credentials;
+			}
+			const organizationUrl = organizationInstanceUrl(instanceUrl, storedCredentials.orgCode);
+			await syncContractCache(organizationUrl, storedCredentials, {
+				fetch: fetcher,
+				store: dependencies.store
+			});
+			await syncAdminContractCache(organizationUrl, storedCredentials, {
+				fetch: fetcher,
+				store: dependencies.store,
+				warn
+			});
+			print(`Signed in as ${me.person.email} to ${membership.name}${storedCredentials.type === "apiKey" ? " (API key)" : ""}.`);
+		}),
+		logout: os.meta({ description: "Sign out and remove locally stored credentials." }).input(z.object({})).handler(async () => {
+			rejectEnvironmentCredentialManagement(dependencies.store);
+			const credentials = Object.values((await readCredentialStore(dependencies.store)).instances[normalizeInstanceUrl(activeInstanceUrl)] ?? {});
+			await Promise.all(credentials.filter((credential) => credential.type === "session").map(async (credential) => {
+				try {
+					const response = await fetcher(`${activeInstanceUrl}/api/auth/sign-out`, {
+						method: "POST",
+						headers: { Authorization: `Bearer ${bearerToken(credential)}` }
+					});
+					if (!response.ok) warn(`Warning: server sign-out failed (${response.status}).`);
+				} catch (error) {
+					warn(`Warning: server sign-out failed: ${error instanceof Error ? error.message : String(error)}`);
+				}
+			}));
+			const cacheUrls = [activeInstanceUrl, ...credentials.map((credential) => organizationInstanceUrl(activeInstanceUrl, credential.orgCode))];
+			await Promise.all([deleteCredentials(activeInstanceUrl, void 0, dependencies.store), ...[...new Set(cacheUrls)].map((url) => deleteInstanceCache(url, dependencies.store))]);
+			print(`Logged out of ${activeInstanceUrl}.`);
+		}),
+		openapi: os.meta({ description: "Print the organization's OpenAPI spec as JSON (used by applet generate)" }).input(z.object({})).handler(async () => {
+			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, dependencies.store, selectedOrg)), selectedOrg);
+			const response = await fetcher(`${organizationInstanceUrl(activeInstanceUrl, auth.orgCode)}/api/v1/openapi.json`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
+			rejectEnvironmentKey(response, auth);
+			if (!response.ok) throw new AuthenticationError(`Failed to load the organization's OpenAPI spec (${response.status}).`);
+			process.stdout.write(`${JSON.stringify(await response.json(), null, 2)}\n`);
+		}),
+		whoami: os.meta({ description: "Show the current Hitch identity and organization." }).input(z.object({})).handler(async () => {
+			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, dependencies.store, selectedOrg)), selectedOrg);
+			const me = await fetchMe(fetcher, organizationInstanceUrl(activeInstanceUrl, auth.orgCode), auth);
+			const membership = me.memberships.find(({ orgId }) => orgId === auth.organizationId);
+			if (membership === void 0) throw new AuthenticationError(`The current identity is not a member of organization "${auth.orgCode}".`);
+			return {
+				id: me.person.id,
+				email: me.person.email,
+				name: `${me.person.firstName} ${me.person.lastName}`.trim(),
+				org: membership.name,
+				orgId: auth.organizationId
+			};
+		}),
+		sync: os.meta({ description: "Refresh the cached commands for the current organization." }).input(z.object({})).handler(async () => {
+			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, dependencies.store, selectedOrg)), selectedOrg);
+			const organizationUrl = organizationInstanceUrl(activeInstanceUrl, auth.orgCode);
+			const count = await syncContractCache(organizationUrl, auth, {
+				fetch: fetcher,
+				store: dependencies.store
+			});
+			await syncAdminContractCache(organizationUrl, auth, {
+				fetch: fetcher,
+				store: dependencies.store,
+				warn
+			});
+			print(`Synced ${count} object${count === 1 ? "" : "s"}.`);
+		})
+	});
+}
+//#endregion
+//#region src/organization.ts
+const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function readOrg(dir) {
+	const path = resolve(dir, "package.json");
+	let source;
+	try {
+		source = readFileSync(path, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+		throw error;
+	}
+	let packageJson;
+	try {
+		packageJson = JSON.parse(source);
+	} catch (error) {
+		throw new Error(`Invalid JSON in ${path}.`, { cause: error });
+	}
+	if (packageJson === null || typeof packageJson !== "object" || !("hitch" in packageJson)) return;
+	const hitch = packageJson.hitch;
+	if (hitch === null || typeof hitch !== "object" || !("org" in hitch) || typeof hitch.org !== "string" || !ORG_CODE_PATTERN.test(hitch.org)) throw new Error(`Invalid "hitch.org" in ${path}.`);
+	return hitch.org;
+}
+function readWorkspaceOrg(cwd) {
+	const localOrg = readOrg(cwd);
+	if (localOrg !== void 0) return localOrg;
+	const appletsDir = dirname(cwd);
+	return basename(appletsDir) === "applets" ? readOrg(dirname(appletsDir)) : void 0;
+}
+function validateOrg(orgCode, source) {
+	if (!ORG_CODE_PATTERN.test(orgCode)) throw new Error(`Invalid organization in ${source}.`);
+	return orgCode;
+}
+function resolveOrganization(explicitOrg, cwd, env) {
+	const cliOrg = explicitOrg === void 0 ? void 0 : validateOrg(explicitOrg, "--org");
+	const workspaceOrg = readWorkspaceOrg(cwd);
+	if (cliOrg !== void 0 && workspaceOrg !== void 0 && cliOrg !== workspaceOrg) throw new Error(`--org "${cliOrg}" does not match workspace organization "${workspaceOrg}".`);
+	if (cliOrg !== void 0 || workspaceOrg !== void 0) return cliOrg ?? workspaceOrg;
+	const defaultOrg = env.HITCH_DEFAULT_ORG;
+	return defaultOrg === void 0 || defaultOrg.length === 0 ? void 0 : validateOrg(defaultOrg, "HITCH_DEFAULT_ORG");
+}
+function extractOrganizationArg(argv) {
+	let orgCode;
+	const remaining = [];
+	let acceptsOptions = true;
+	for (let index = 0; index < argv.length; index += 1) {
+		const value = argv[index];
+		if (value === "--") acceptsOptions = false;
+		if (!acceptsOptions || value !== "--org" && !value.startsWith("--org=")) {
+			remaining.push(value);
+			continue;
+		}
+		if (orgCode !== void 0) throw new Error("Use --org only once.");
+		const nextValue = value === "--org" ? argv.at(index + 1) : value.slice(6);
+		if (nextValue === void 0 || nextValue.length === 0 || nextValue.startsWith("-")) throw new Error("--org requires an organization code.");
+		orgCode = nextValue;
+		if (value === "--org") index += 1;
+	}
+	return {
+		argv: remaining,
+		...orgCode === void 0 ? {} : { orgCode }
+	};
+}
+//#endregion
+//#region src/cli.ts
+function isErrno(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+const cacheDirectoryUrls = /* @__PURE__ */ new Set();
+let cacheResolveHookRegistered = false;
+async function resolveCacheImportsAgainstCli(contractPath) {
+	cacheDirectoryUrls.add(`${pathToFileURL(await realpath(dirname(contractPath))).href}/`);
+	if (cacheResolveHookRegistered) return;
+	cacheResolveHookRegistered = true;
+	registerHooks({ resolve(specifier, context, nextResolve) {
+		const importer = context.parentURL;
+		const isBare = !specifier.startsWith(".") && !URL.canParse(specifier);
+		if (importer !== void 0 && isBare && [...cacheDirectoryUrls].some((directory) => importer.startsWith(directory))) return {
+			url: import.meta.resolve(specifier),
+			shortCircuit: true
+		};
+		return nextResolve(specifier, context);
+	} });
+}
+async function loadContract(path, warn) {
+	let modified;
+	try {
+		modified = (await stat(path)).mtimeMs;
+	} catch (error) {
+		if (isErrno(error, "ENOENT")) return void 0;
+		throw error;
+	}
+	await resolveCacheImportsAgainstCli(path);
+	let module;
+	try {
+		module = await import(`${pathToFileURL(path).href}?mtime=${modified}`);
+	} catch (error) {
+		if (!isErrno(error, "ERR_MODULE_NOT_FOUND")) throw error;
+		warn(`hitch: the cached commands at ${path} no longer load — run hitch sync to refresh them.`);
+		return;
+	}
+	if (module.contract === null || typeof module.contract !== "object") throw new Error(`${path}: generated contract export is missing.`);
+	return module.contract;
+}
+async function buildRouter(dependencies = {}, options = {}) {
+	const instanceUrl = await resolveInstanceUrl(void 0, dependencies.store);
+	const selectedOrg = resolveOrganization(options.orgCode, process.cwd(), dependencies.store?.env ?? process.env);
+	const staticRouter = createStaticRouter(instanceUrl, dependencies, selectedOrg);
+	if (options.staticOnly) return staticRouter;
+	let resolved;
+	try {
+		resolved = await resolveAuth(instanceUrl, dependencies.store, selectedOrg);
+	} catch (error) {
+		(dependencies.warn ?? console.error)(`hitch: ${error instanceof Error ? error.message : String(error)}`);
+		return staticRouter;
+	}
+	if (resolved === void 0) return staticRouter;
+	const auth = await authWithOrganization(dependencies.fetch ?? globalThis.fetch, instanceUrl, resolved, selectedOrg);
+	const warn = dependencies.warn ?? console.error;
+	const organizationUrl = organizationInstanceUrl(instanceUrl, auth.orgCode);
+	const [contract, adminContract] = await Promise.all([loadContract(resolve(contractCacheDir(organizationUrl, auth.organizationId, dependencies.store), "orpc.gen.ts"), warn), loadContract(resolve(adminContractCacheDir(organizationUrl, auth.organizationId, dependencies.store), "orpc.gen.ts"), warn)]);
+	const bridgeOptions = {
+		instanceUrl: organizationUrl,
+		auth,
+		fetch: dependencies.fetch,
+		prompt: dependencies.prompt
+	};
+	const dynamicRouter = contract === void 0 ? {} : createBridgeRouter(contract, bridgeOptions);
+	const staticNamespaces = /* @__PURE__ */ new Set([...Object.keys(staticRouter), "admin"]);
+	const availableDynamic = Object.fromEntries(Object.entries(dynamicRouter).filter(([namespace]) => {
+		if (!staticNamespaces.has(namespace)) return true;
+		warn(`Warning: generated namespace "${namespace}" is shadowed by a built-in command.`);
+		return false;
+	}));
+	if (adminContract === void 0) return os.router({
+		...availableDynamic,
+		...staticRouter
+	});
+	return os.router({
+		...availableDynamic,
+		admin: createBridgeRouter(adminContract, bridgeOptions),
+		...staticRouter
+	});
+}
+async function runCli(dependencies = {}, argv) {
+	const selected = extractOrganizationArg(argv ?? process.argv.slice(2));
+	const command = selected.argv.at(0);
+	const router = await buildRouter(dependencies, {
+		orgCode: selected.orgCode,
+		staticOnly: [
+			"login",
+			"logout",
+			"openapi",
+			"whoami",
+			"sync"
+		].includes(command ?? "")
+	});
+	const cli = createCli({
+		router,
+		name: "hitch"
+	});
+	const options = {
+		argv: selected.argv,
+		formatError: (error) => `hitch: ${error instanceof Error ? error.message : String(error)}`
+	};
+	const program = cli.buildProgram(options);
+	const rootProgram = program;
+	rootProgram.option("--org <code>", "Select a Hitch organization");
+	const openapiCommand = program.commands?.find((command) => command.name() === "openapi");
+	if (openapiCommand !== void 0) {
+		openapiCommand._hidden = true;
+		rootProgram.description(rootProgram.description().replace(/Available subcommands: [^\n]*/, `Available subcommands: ${program.commands?.filter((command) => command !== openapiCommand).map((command) => command.name()).join(", ")}`));
+	}
+	await cli.run(options, program);
+}
+//#endregion
+//#region bin/hitch.ts
+await runCli();
+//#endregion
+export {};

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@hitch42/cli",
+  "version": "0.1.0-beta.2",
+  "license": "MIT",
+  "bin": {
+    "hitch": "./dist/hitch.js"
+  },
+  "files": [
+    "dist/*.js"
+  ],
+  "type": "module",
+  "dependencies": {
+    "@hey-api/openapi-ts": "0.0.0-next-20260824173136",
+    "@orpc/client": "^1.15.0",
+    "@orpc/contract": "^1.15.0",
+    "@orpc/openapi-client": "^1.15.0",
+    "@orpc/server": "^1.15.0",
+    "trpc-cli": "^0.15.1",
+    "zod": "^4.4.3"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hitch-42/hitch.git",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org",
+    "tag": "beta"
+  }
+}