@hitch42/cli 0.1.1-beta.1 → 0.1.1-beta.11

package/dist/hitch.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-import { registerHooks } from "node:module";
+import { createRequire, registerHooks } from "node:module";
 import { access, chmod, mkdir, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
+import { existsSync } from "node:fs";
 import { os } from "@orpc/server";
 import { createCli } from "trpc-cli";
 import { createInterface } from "node:readline/promises";
@@ -13,7 +14,6 @@ import { isContractProcedure } from "@orpc/contract";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
 import { z } from "zod";
 import { createClient } from "@hey-api/openapi-ts";
-import { readFileSync } from "node:fs";
 //#region ../shared/auth/src/store.mts
 const DEFAULT_INSTANCE_URL = "https://app.hitch42.com";
 var AuthenticationError = class extends Error {};
@@ -55,8 +55,8 @@ async function healCredentialStore(credentialsPath, source, store, unrecognizedC
 	console.error(unrecognizedCount === void 0 ? `hitch: reset unreadable credentials file (backup: ${backupPath}).` : unrecognizedCount === 0 ? `hitch: migrated credentials to per-organization storage (backup: ${backupPath}).` : `hitch: removed ${unrecognizedCount} unrecognized credential ${unrecognizedCount === 1 ? "entry" : "entries"} (backup: ${backupPath}).`);
 	return store;
 }
-async function readRawCredentialStore(options = {}) {
-	const { credentialsPath } = storePaths(options);
+async function readRawCredentialStore() {
+	const { credentialsPath } = storePaths();
 	let source;
 	try {
 		source = await readFile(credentialsPath, "utf8");
@@ -123,9 +123,9 @@ function organizationInstanceUrl(instanceUrl, orgCode) {
 	url.hostname = [orgCode, ...labels.slice(1)].join(".");
 	return url.toString().replace(/\/$/, "");
 }
-function storePaths(options = {}) {
-	const env = options.env ?? process.env;
-	const home = options.homeDir ?? homedir();
+function storePaths() {
+	const env = process.env;
+	const home = homedir();
 	const configDir = join(env.XDG_CONFIG_HOME || join(home, ".config"), "hitch");
 	return {
 		configDir,
@@ -134,25 +134,25 @@ function storePaths(options = {}) {
 		credentialsPath: join(configDir, "credentials.json")
 	};
 }
-async function resolveInstanceUrl(override, options = {}) {
+async function resolveInstanceUrl(override) {
 	if (override !== void 0) return normalizeInstanceUrl(override);
-	const envInstanceUrl = (options.env ?? process.env).HITCH_API_URL;
+	const envInstanceUrl = process.env.HITCH_API_URL;
 	if (envInstanceUrl !== void 0 && envInstanceUrl.length > 0) return normalizeInstanceUrl(envInstanceUrl);
-	const { configPath } = storePaths(options);
+	const { configPath } = storePaths();
 	const config = await readJson(configPath);
 	if (config === void 0) return DEFAULT_INSTANCE_URL;
 	if (!isObject$2(config) || config.instanceUrl !== void 0 && typeof config.instanceUrl !== "string") throw new Error(`${configPath}: expected { instanceUrl?: string }.`);
 	return normalizeInstanceUrl(config.instanceUrl ?? "https://app.hitch42.com");
 }
-async function readCredentialStore(options = {}) {
-	const store = await readRawCredentialStore(options);
+async function readCredentialStore() {
+	const store = await readRawCredentialStore();
 	return { instances: Object.fromEntries(Object.entries(store.instances).map(([instanceUrl, credentialsByOrg]) => [instanceUrl, Object.fromEntries(Object.entries(credentialsByOrg).flatMap(([orgCode, value]) => {
 		const credentials = parseCredentials(value);
 		return credentials === void 0 ? [] : [[orgCode, credentials]];
 	}))])) };
 }
-function environmentAuth(options) {
-	const apiKey = (options.env ?? process.env).HITCH_API_KEY;
+function environmentAuth() {
+	const apiKey = process.env.HITCH_API_KEY;
 	return apiKey !== void 0 && apiKey.length > 0 ? {
 		accessToken: apiKey,
 		source: "environment"
@@ -176,18 +176,18 @@ function resolveStoredAuthForOrg(credentialsByOrg, orgCode) {
 	const apiKeyOrgs = Object.values(credentialsByOrg).filter((credentials) => credentials.type === "apiKey").map(({ orgCode: storedOrg }) => storedOrg).sort();
 	if (apiKeyOrgs.length > 0) throw new AuthenticationError(`Stored API ${apiKeyOrgs.length === 1 ? "key is" : "keys are"} scoped to ${apiKeyOrgs.map((storedOrg) => `"${storedOrg}"`).join(", ")}, not "${orgCode}".`);
 }
-async function resolveAuth(instanceUrl, options = {}, orgCode) {
-	const auth = environmentAuth(options);
+async function resolveAuth(instanceUrl, orgCode) {
+	const auth = environmentAuth();
 	if (auth !== void 0) return auth;
 	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
-	const credentialsByOrg = (await readCredentialStore(options)).instances[normalizedUrl] ?? {};
-	const selectedOrg = orgCode ?? (options.env ?? process.env).HITCH_DEFAULT_ORG;
+	const credentialsByOrg = (await readCredentialStore()).instances[normalizedUrl] ?? {};
+	const selectedOrg = orgCode ?? process.env.HITCH_DEFAULT_ORG;
 	if (selectedOrg !== void 0 && selectedOrg.length > 0) return resolveStoredAuthForOrg(credentialsByOrg, selectedOrg);
 	const orgCodes = Object.keys(credentialsByOrg).sort();
 	const soleOrg = orgCodes.at(0);
 	if (soleOrg === void 0) return void 0;
 	if (orgCodes.length === 1) return resolvedStoredAuth(credentialsByOrg[soleOrg]);
-	throw new AuthenticationError(`Multiple organizations are stored for ${normalizedUrl}: ${orgCodes.join(", ")}. Use --org, a workspace hitch.org, or HITCH_DEFAULT_ORG to choose one.`);
+	throw new AuthenticationError(`Multiple organizations are stored for ${normalizedUrl}: ${orgCodes.join(", ")}. Use --org, the workspace hitch.config.ts, or HITCH_DEFAULT_ORG to choose one.`);
 }
 function rejectEnvironmentKey(response, auth) {
 	if (auth.source === "environment" && response.status === 401) throw new AuthenticationError("HITCH_API_KEY was rejected.");
@@ -195,9 +195,9 @@ function rejectEnvironmentKey(response, auth) {
 function bearerToken(credentials) {
 	return "apiKey" in credentials ? credentials.apiKey : credentials.accessToken;
 }
-async function setCredentials(instanceUrl, credentials, options = {}) {
-	const paths = storePaths(options);
-	const store = await readRawCredentialStore(options);
+async function setCredentials(instanceUrl, credentials) {
+	const paths = storePaths();
+	const store = await readRawCredentialStore();
 	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
 	const credentialsByOrg = store.instances[normalizedUrl];
 	store.instances[normalizedUrl] = {
@@ -208,9 +208,9 @@ async function setCredentials(instanceUrl, credentials, options = {}) {
 	await writeFile(paths.credentialsPath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
 	await chmod(paths.credentialsPath, 384);
 }
-async function deleteCredentials(instanceUrl, orgCode, options = {}) {
-	const paths = storePaths(options);
-	const store = await readRawCredentialStore(options);
+async function deleteCredentials(instanceUrl, orgCode) {
+	const paths = storePaths();
+	const store = await readRawCredentialStore();
 	const normalizedUrl = normalizeInstanceUrl(instanceUrl);
 	if (orgCode === void 0) delete store.instances[normalizedUrl];
 	else {
@@ -232,17 +232,17 @@ function instanceSlug(instanceUrl) {
 	const url = new URL(normalizeInstanceUrl(instanceUrl));
 	return `${url.protocol.slice(0, -1)}-${url.host}${url.pathname}`.replace(/[^a-zA-Z0-9.-]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function instanceCacheDir(instanceUrl, options = {}) {
-	return join(storePaths(options).cacheDir, instanceSlug(instanceUrl));
+function instanceCacheDir(instanceUrl) {
+	return join(storePaths().cacheDir, instanceSlug(instanceUrl));
 }
-function contractCacheDir(instanceUrl, organizationId, options = {}) {
-	return join(instanceCacheDir(instanceUrl, options), organizationId);
+function contractCacheDir(instanceUrl, organizationId) {
+	return join(instanceCacheDir(instanceUrl), organizationId);
 }
-function adminContractCacheDir(instanceUrl, organizationId, options = {}) {
-	return join(contractCacheDir(instanceUrl, organizationId, options), "admin");
+function adminContractCacheDir(instanceUrl, organizationId) {
+	return join(contractCacheDir(instanceUrl, organizationId), "admin");
 }
-async function deleteInstanceCache(instanceUrl, options = {}) {
-	await rm(instanceCacheDir(instanceUrl, options), {
+async function deleteInstanceCache(instanceUrl) {
+	await rm(instanceCacheDir(instanceUrl), {
 		recursive: true,
 		force: true
 	});
@@ -365,17 +365,17 @@ async function authWithOrganization(fetcher, instanceUrl, auth, expectedOrg) {
 	};
 }
 async function loginWithDevice(instanceUrl, options = {}) {
-	const fetcher = options.fetch ?? globalThis.fetch;
-	const now = options.now ?? Date.now;
+	const fetcher = globalThis.fetch;
+	const now = Date.now;
 	const { body, response } = await postJson(fetcher, `${instanceUrl}/api/auth/device/code`, { client_id: CLIENT_ID });
 	if (!response.ok) throw new AuthenticationError(typeof body.error_description === "string" ? body.error_description : `Could not start sign-in (${response.status}).`);
 	const device = parseDeviceCode(body);
 	const verificationUrl = options.expectedOrg === void 0 ? device.verification_uri_complete : `${device.verification_uri_complete}&org=${encodeURIComponent(options.expectedOrg)}`;
-	(options.print ?? console.log)(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
+	console.log(`Open ${verificationUrl} and confirm code ${device.user_code}.`);
 	if (!options.noBrowser) try {
-		await (options.openUrl ?? defaultOpenUrl)(verificationUrl);
+		defaultOpenUrl(verificationUrl);
 	} catch {}
-	const token = await pollForToken(fetcher, instanceUrl, device, now, options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))));
+	const token = await pollForToken(fetcher, instanceUrl, device, now, (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
 	const { body: organizationBody, response: organizationResponse } = await postJson(fetcher, `${instanceUrl}/api/auth/device/organization`, { device_code: device.device_code });
 	if (!organizationResponse.ok) throw new AuthenticationError("The sign-in did not resolve an organization.");
 	const organization = parseDeviceOrganization(organizationBody);
@@ -393,7 +393,7 @@ async function loginWithDevice(instanceUrl, options = {}) {
 		organizationId: organization.organizationId,
 		orgCode: organization.orgCode
 	};
-	await setCredentials(instanceUrl, credentials, options.store);
+	await setCredentials(instanceUrl, credentials);
 	if (options.expectedOrg !== void 0 && organization.orgCode !== options.expectedOrg) throw new AuthenticationError(`logged in to "${organization.orgCode}" but this applet targets "${options.expectedOrg}" — confirm the right organization on the device page`);
 	return {
 		credentials,
@@ -402,6 +402,33 @@ async function loginWithDevice(instanceUrl, options = {}) {
 	};
 }
 //#endregion
+//#region ../shared/auth/src/workspace.mts
+const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const require = createRequire(import.meta.url);
+function readWorkspaceConfig(dir) {
+	const path = resolve(dir, "hitch.config.ts");
+	if (!existsSync(path)) return void 0;
+	let module;
+	try {
+		module = require(path);
+	} catch (error) {
+		throw new Error(`Failed to load ${path}.`, { cause: error });
+	}
+	const config = module !== null && typeof module === "object" && "default" in module ? module.default : module;
+	if (config === null || typeof config !== "object" || !("sdk" in config) || typeof config.sdk !== "string" || config.sdk.length === 0 || !("org" in config) || typeof config.org !== "string" || !ORG_CODE_PATTERN.test(config.org)) throw new Error(`Invalid Hitch config in ${path}: "sdk" must be a package spec and "org" an organization code.`);
+	const githubWorkflow = "githubWorkflow" in config ? config.githubWorkflow : void 0;
+	if (githubWorkflow !== void 0 && typeof githubWorkflow !== "boolean") throw new Error(`Invalid Hitch config in ${path}: "githubWorkflow" must be a boolean.`);
+	return {
+		sdk: config.sdk,
+		org: config.org,
+		githubWorkflow
+	};
+}
+function findWorkspaceConfig(cwd) {
+	const appletsDir = dirname(cwd);
+	return readWorkspaceConfig(cwd) ?? (basename(appletsDir) === "applets" ? readWorkspaceConfig(dirname(appletsDir)) : void 0);
+}
+//#endregion
 //#region src/bridge.ts
 async function defaultPrompt$1(message) {
 	const readline = createInterface({
@@ -493,7 +520,7 @@ function createBridgeRouter(contract, options) {
 		url: `${options.instanceUrl}/api`,
 		headers: { Authorization: `Bearer ${bearerToken(options.auth)}` },
 		fetch: async (request, init) => {
-			const response = await (options.fetch ?? globalThis.fetch)(request, init);
+			const response = await globalThis.fetch(request, init);
 			if ("source" in options.auth) rejectEnvironmentKey(response, options.auth);
 			return response;
 		}
@@ -508,9 +535,9 @@ function createBridgeRouter(contract, options) {
 			const description = node["~orpc"].route.summary ?? node["~orpc"].route.description;
 			const procedure = os.meta(description ? { description } : {}).input(cliInputSchema(inputSchema)).handler(async ({ input }) => {
 				if (isDelete && !input.yes) {
-					if (options.prompt === void 0 && process.stdin.isTTY !== true) throw new Error("Refusing to delete without --yes in non-interactive mode.");
+					if (process.stdin.isTTY !== true) throw new Error("Refusing to delete without --yes in non-interactive mode.");
 					const values = Object.entries(input).filter(([key, value]) => key !== "yes" && value !== void 0).map(([key, value]) => `${key}=${String(value)}`).join(" ");
-					const answer = await (options.prompt ?? defaultPrompt$1)(`Confirm ${path.join(" ")}${values.length === 0 ? "" : ` ${values}`}? [y/N] `);
+					const answer = await defaultPrompt$1(`Confirm ${path.join(" ")}${values.length === 0 ? "" : ` ${values}`}? [y/N] `);
 					if (!["y", "yes"].includes(answer.trim().toLowerCase())) throw new Error("Aborted.");
 				}
 				const detailed = Object.fromEntries(sections.flatMap((section) => {
@@ -529,7 +556,7 @@ function createBridgeRouter(contract, options) {
 }
 //#endregion
 //#region src/generate.ts
-const RECORD_ROUTE = /^\/v1\/([^/]+)(?:\/(\{id\}|query|update|aggregate))?$/;
+const RECORD_ROUTE = /^\/v1\/([^/]+)(?:\/(\{id\}(?:\/history)?|query|update|aggregate))?$/;
 const BATCH_PATH = "/v1/batch";
 const BATCH_ITEM_PATH = "paths./v1/batch.post.requestBody.content.application/json.schema.properties.requests.items";
 const BATCH_ID_PATH = /^\^\/v1\/([^/]+)\/\[0-9a-fA-F-\]\{36\}\$$/;
@@ -537,6 +564,7 @@ const VERBS = {
 	"get:": "list",
 	"post:": "create",
 	"get:{id}": "get",
+	"get:{id}/history": "history",
 	"patch:{id}": "update",
 	"delete:{id}": "delete",
 	"post:query": "query",
@@ -646,7 +674,7 @@ function prepareRecordSpec(spec) {
 	const prepared = flattenTrivialAllOf(cloned, isObject$1(cloned.components) && isObject$1(cloned.components.schemas) ? cloned.components.schemas : {});
 	prepared.paths = Object.fromEntries(Object.entries(prepared.paths).flatMap(([path, pathItem]) => {
 		if (path === BATCH_PATH) {
-			if (!isObject$1(pathItem) || pathItem.post === void 0) return [];
+			if (!isObject$1(pathItem)) return [];
 			const operation = prepareBatchOperation(pathItem.post);
 			return operation === void 0 ? [] : [[path, { post: operation }]];
 		}
@@ -774,14 +802,14 @@ function objectCount(spec) {
 		return operation ? [operation.objectCode] : [];
 	}) : [])).size;
 }
-async function syncContractCache(instanceUrl, credentials, options = {}) {
+async function syncContractCache(instanceUrl, credentials) {
 	if (credentials.organizationId === void 0) throw new Error("Stored credentials do not include an organization. Run hitch login again.");
-	const response = await (options.fetch ?? globalThis.fetch)(`${instanceUrl}/api/v1/openapi.json`, { headers: { Authorization: `Bearer ${bearerToken(credentials)}` } });
+	const response = await globalThis.fetch(`${instanceUrl}/api/v1/openapi.json`, { headers: { Authorization: `Bearer ${bearerToken(credentials)}` } });
 	if ("source" in credentials) rejectEnvironmentKey(response, credentials);
 	if (!response.ok) throw new Error(`Failed to fetch the organization contract (${response.status} ${response.statusText}).`);
 	const prepared = prepareRecordSpec(await response.json());
 	const count = objectCount(prepared);
-	const outDir = contractCacheDir(instanceUrl, credentials.organizationId, options.store);
+	const outDir = contractCacheDir(instanceUrl, credentials.organizationId);
 	await mkdir(outDir, { recursive: true });
 	await Promise.all((await readdir(outDir)).flatMap((name) => name === "admin" ? [] : [rm(resolve(outDir, name), {
 		recursive: true,
@@ -794,16 +822,16 @@ async function syncContractCache(instanceUrl, credentials, options = {}) {
 	}, null, 2)}\n`);
 	return count;
 }
-async function syncAdminContractCache(instanceUrl, credentials, options = {}) {
+async function syncAdminContractCache(instanceUrl, credentials) {
 	if (credentials.organizationId === void 0) throw new Error("Stored credentials do not include an organization. Run hitch login again.");
-	const outDir = adminContractCacheDir(instanceUrl, credentials.organizationId, options.store);
+	const outDir = adminContractCacheDir(instanceUrl, credentials.organizationId);
 	let response;
 	try {
-		response = await (options.fetch ?? globalThis.fetch)(`${instanceUrl}/api/admin/v1/openapi.json`, { headers: { Authorization: `Bearer ${bearerToken(credentials)}` } });
+		response = await globalThis.fetch(`${instanceUrl}/api/admin/v1/openapi.json`, { headers: { Authorization: `Bearer ${bearerToken(credentials)}` } });
 		if ("source" in credentials) rejectEnvironmentKey(response, credentials);
 	} catch (error) {
 		if (error instanceof AuthenticationError) throw error;
-		(options.warn ?? console.error)(`Warning: failed to probe admin commands: ${error instanceof Error ? error.message : String(error)}`);
+		console.error(`Warning: failed to probe admin commands: ${error instanceof Error ? error.message : String(error)}`);
 		return false;
 	}
 	if (response.status === 401 || response.status === 403) {
@@ -814,7 +842,7 @@ async function syncAdminContractCache(instanceUrl, credentials, options = {}) {
 		return false;
 	}
 	if (!response.ok) {
-		(options.warn ?? console.error)(`Warning: failed to probe admin commands (${response.status} ${response.statusText}).`);
+		console.error(`Warning: failed to probe admin commands (${response.status} ${response.statusText}).`);
 		return false;
 	}
 	const prepared = prepareAdminSpec(await response.json());
@@ -840,32 +868,31 @@ async function defaultPrompt(message) {
 		readline.close();
 	}
 }
-function rejectEnvironmentCredentialManagement(options = {}) {
-	if ((options.env ?? process.env).HITCH_API_KEY !== void 0) throw new AuthenticationError("HITCH_API_KEY is set — unset it to manage stored logins.");
+function rejectEnvironmentCredentialManagement() {
+	if (process.env.HITCH_API_KEY !== void 0) throw new AuthenticationError("HITCH_API_KEY is set — unset it to manage stored logins.");
 }
 function requireAuth(auth) {
 	if (auth === void 0) throw new NotLoggedInError("Not logged in. Run hitch login.");
 	return auth;
 }
-function createStaticRouter(activeInstanceUrl, dependencies = {}, selectedOrg) {
-	const fetcher = dependencies.fetch ?? globalThis.fetch;
-	const now = dependencies.now ?? Date.now;
-	const print = dependencies.print ?? console.log;
-	const warn = dependencies.warn ?? console.error;
+function createStaticRouter(activeInstanceUrl, selectedOrg) {
+	const fetcher = globalThis.fetch;
+	const print = console.log;
+	const warn = console.error;
 	return os.router({
 		login: os.meta({ description: "Sign in to a Hitch organization." }).input(z.object({
 			apiKey: z.union([z.string(), z.boolean()]).default(false).describe("Store an API key, prompting when no value is given"),
 			noBrowser: z.boolean().default(false).describe("Do not open a browser"),
 			instance: z.string().optional().describe("Hitch instance URL")
 		})).handler(async ({ input }) => {
-			rejectEnvironmentCredentialManagement(dependencies.store);
+			rejectEnvironmentCredentialManagement();
 			if (input.apiKey !== false && input.noBrowser) throw new AuthenticationError("--api-key and --no-browser cannot be used together.");
-			const instanceUrl = input.instance === void 0 ? activeInstanceUrl : await resolveInstanceUrl(input.instance, dependencies.store);
+			const instanceUrl = input.instance === void 0 ? activeInstanceUrl : await resolveInstanceUrl(input.instance);
 			let me;
 			let membership;
 			let storedCredentials;
 			if (input.apiKey !== false) {
-				const apiKey = typeof input.apiKey === "string" ? input.apiKey : await (dependencies.prompt ?? defaultPrompt)("Paste your API key: ");
+				const apiKey = typeof input.apiKey === "string" ? input.apiKey : await defaultPrompt("Paste your API key: ");
 				if (apiKey.length === 0) throw new AuthenticationError("API key cannot be empty.");
 				me = await fetchMe(fetcher, instanceUrl, {
 					accessToken: apiKey,
@@ -884,37 +911,24 @@ function createStaticRouter(activeInstanceUrl, dependencies = {}, selectedOrg) {
 					organizationId: organization.id,
 					orgCode: organization.code
 				};
-				await setCredentials(instanceUrl, storedCredentials, dependencies.store);
+				await setCredentials(instanceUrl, storedCredentials);
 			} else {
 				const login = await loginWithDevice(instanceUrl, {
 					expectedOrg: selectedOrg,
-					fetch: fetcher,
-					noBrowser: input.noBrowser,
-					now,
-					openUrl: dependencies.openUrl,
-					print,
-					sleep: dependencies.sleep,
-					store: dependencies.store
+					noBrowser: input.noBrowser
 				});
 				me = login.me;
 				membership = login.membership;
 				storedCredentials = login.credentials;
 			}
 			const organizationUrl = organizationInstanceUrl(instanceUrl, storedCredentials.orgCode);
-			await syncContractCache(organizationUrl, storedCredentials, {
-				fetch: fetcher,
-				store: dependencies.store
-			});
-			await syncAdminContractCache(organizationUrl, storedCredentials, {
-				fetch: fetcher,
-				store: dependencies.store,
-				warn
-			});
+			await syncContractCache(organizationUrl, storedCredentials);
+			await syncAdminContractCache(organizationUrl, storedCredentials);
 			print(`Signed in as ${me.person.email} to ${membership.name}${storedCredentials.type === "apiKey" ? " (API key)" : ""}.`);
 		}),
 		logout: os.meta({ description: "Sign out and remove locally stored credentials." }).input(z.object({})).handler(async () => {
-			rejectEnvironmentCredentialManagement(dependencies.store);
-			const credentials = Object.values((await readCredentialStore(dependencies.store)).instances[normalizeInstanceUrl(activeInstanceUrl)] ?? {});
+			rejectEnvironmentCredentialManagement();
+			const credentials = Object.values((await readCredentialStore()).instances[normalizeInstanceUrl(activeInstanceUrl)] ?? {});
 			await Promise.all(credentials.filter((credential) => credential.type === "session").map(async (credential) => {
 				try {
 					const response = await fetcher(`${activeInstanceUrl}/api/auth/sign-out`, {
@@ -927,18 +941,18 @@ function createStaticRouter(activeInstanceUrl, dependencies = {}, selectedOrg) {
 				}
 			}));
 			const cacheUrls = [activeInstanceUrl, ...credentials.map((credential) => organizationInstanceUrl(activeInstanceUrl, credential.orgCode))];
-			await Promise.all([deleteCredentials(activeInstanceUrl, void 0, dependencies.store), ...[...new Set(cacheUrls)].map((url) => deleteInstanceCache(url, dependencies.store))]);
+			await Promise.all([deleteCredentials(activeInstanceUrl), ...[...new Set(cacheUrls)].map((url) => deleteInstanceCache(url))]);
 			print(`Logged out of ${activeInstanceUrl}.`);
 		}),
 		openapi: os.meta({ description: "Print the organization's OpenAPI spec as JSON (used by applet generate)" }).input(z.object({})).handler(async () => {
-			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, dependencies.store, selectedOrg)), selectedOrg);
+			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, selectedOrg)), selectedOrg);
 			const response = await fetcher(`${organizationInstanceUrl(activeInstanceUrl, auth.orgCode)}/api/v1/openapi.json`, { headers: { Authorization: `Bearer ${auth.accessToken}` } });
 			rejectEnvironmentKey(response, auth);
 			if (!response.ok) throw new AuthenticationError(`Failed to load the organization's OpenAPI spec (${response.status}).`);
 			process.stdout.write(`${JSON.stringify(await response.json(), null, 2)}\n`);
 		}),
 		whoami: os.meta({ description: "Show the current Hitch identity and organization." }).input(z.object({})).handler(async () => {
-			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, dependencies.store, selectedOrg)), selectedOrg);
+			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, selectedOrg)), selectedOrg);
 			const me = await fetchMe(fetcher, organizationInstanceUrl(activeInstanceUrl, auth.orgCode), auth);
 			const membership = me.memberships.find(({ orgId }) => orgId === auth.organizationId);
 			if (membership === void 0) throw new AuthenticationError(`The current identity is not a member of organization "${auth.orgCode}".`);
@@ -951,57 +965,23 @@ function createStaticRouter(activeInstanceUrl, dependencies = {}, selectedOrg) {
 			};
 		}),
 		sync: os.meta({ description: "Refresh the cached commands for the current organization." }).input(z.object({})).handler(async () => {
-			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, dependencies.store, selectedOrg)), selectedOrg);
+			const auth = await authWithOrganization(fetcher, activeInstanceUrl, requireAuth(await resolveAuth(activeInstanceUrl, selectedOrg)), selectedOrg);
 			const organizationUrl = organizationInstanceUrl(activeInstanceUrl, auth.orgCode);
-			const count = await syncContractCache(organizationUrl, auth, {
-				fetch: fetcher,
-				store: dependencies.store
-			});
-			await syncAdminContractCache(organizationUrl, auth, {
-				fetch: fetcher,
-				store: dependencies.store,
-				warn
-			});
+			const count = await syncContractCache(organizationUrl, auth);
+			await syncAdminContractCache(organizationUrl, auth);
 			print(`Synced ${count} object${count === 1 ? "" : "s"}.`);
 		})
 	});
 }
 //#endregion
 //#region src/organization.ts
-const ORG_CODE_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-function readOrg(dir) {
-	const path = resolve(dir, "package.json");
-	let source;
-	try {
-		source = readFileSync(path, "utf8");
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
-		throw error;
-	}
-	let packageJson;
-	try {
-		packageJson = JSON.parse(source);
-	} catch (error) {
-		throw new Error(`Invalid JSON in ${path}.`, { cause: error });
-	}
-	if (packageJson === null || typeof packageJson !== "object" || !("hitch" in packageJson)) return;
-	const hitch = packageJson.hitch;
-	if (hitch === null || typeof hitch !== "object" || !("org" in hitch) || typeof hitch.org !== "string" || !ORG_CODE_PATTERN.test(hitch.org)) throw new Error(`Invalid "hitch.org" in ${path}.`);
-	return hitch.org;
-}
-function readWorkspaceOrg(cwd) {
-	const localOrg = readOrg(cwd);
-	if (localOrg !== void 0) return localOrg;
-	const appletsDir = dirname(cwd);
-	return basename(appletsDir) === "applets" ? readOrg(dirname(appletsDir)) : void 0;
-}
 function validateOrg(orgCode, source) {
 	if (!ORG_CODE_PATTERN.test(orgCode)) throw new Error(`Invalid organization in ${source}.`);
 	return orgCode;
 }
 function resolveOrganization(explicitOrg, cwd, env) {
 	const cliOrg = explicitOrg === void 0 ? void 0 : validateOrg(explicitOrg, "--org");
-	const workspaceOrg = readWorkspaceOrg(cwd);
+	const workspaceOrg = findWorkspaceConfig(cwd)?.org;
 	if (cliOrg !== void 0 && workspaceOrg !== void 0 && cliOrg !== workspaceOrg) throw new Error(`--org "${cliOrg}" does not match workspace organization "${workspaceOrg}".`);
 	if (cliOrg !== void 0 || workspaceOrg !== void 0) return cliOrg ?? workspaceOrg;
 	const defaultOrg = env.HITCH_DEFAULT_ORG;
@@ -1070,28 +1050,26 @@ async function loadContract(path, warn) {
 	if (module.contract === null || typeof module.contract !== "object") throw new Error(`${path}: generated contract export is missing.`);
 	return module.contract;
 }
-async function buildRouter(dependencies = {}, options = {}) {
-	const instanceUrl = await resolveInstanceUrl(void 0, dependencies.store);
-	const selectedOrg = resolveOrganization(options.orgCode, process.cwd(), dependencies.store?.env ?? process.env);
-	const staticRouter = createStaticRouter(instanceUrl, dependencies, selectedOrg);
+async function buildRouter(options = {}) {
+	const instanceUrl = await resolveInstanceUrl();
+	const selectedOrg = resolveOrganization(options.orgCode, process.cwd(), process.env);
+	const staticRouter = createStaticRouter(instanceUrl, selectedOrg);
 	if (options.staticOnly) return staticRouter;
 	let resolved;
 	try {
-		resolved = await resolveAuth(instanceUrl, dependencies.store, selectedOrg);
+		resolved = await resolveAuth(instanceUrl, selectedOrg);
 	} catch (error) {
-		(dependencies.warn ?? console.error)(`hitch: ${error instanceof Error ? error.message : String(error)}`);
+		console.error(`hitch: ${error instanceof Error ? error.message : String(error)}`);
 		return staticRouter;
 	}
 	if (resolved === void 0) return staticRouter;
-	const auth = await authWithOrganization(dependencies.fetch ?? globalThis.fetch, instanceUrl, resolved, selectedOrg);
-	const warn = dependencies.warn ?? console.error;
+	const auth = await authWithOrganization(globalThis.fetch, instanceUrl, resolved, selectedOrg);
+	const warn = console.error;
 	const organizationUrl = organizationInstanceUrl(instanceUrl, auth.orgCode);
-	const [contract, adminContract] = await Promise.all([loadContract(resolve(contractCacheDir(organizationUrl, auth.organizationId, dependencies.store), "orpc.gen.ts"), warn), loadContract(resolve(adminContractCacheDir(organizationUrl, auth.organizationId, dependencies.store), "orpc.gen.ts"), warn)]);
+	const [contract, adminContract] = await Promise.all([loadContract(resolve(contractCacheDir(organizationUrl, auth.organizationId), "orpc.gen.ts"), warn), loadContract(resolve(adminContractCacheDir(organizationUrl, auth.organizationId), "orpc.gen.ts"), warn)]);
 	const bridgeOptions = {
 		instanceUrl: organizationUrl,
-		auth,
-		fetch: dependencies.fetch,
-		prompt: dependencies.prompt
+		auth
 	};
 	const dynamicRouter = contract === void 0 ? {} : createBridgeRouter(contract, bridgeOptions);
 	const staticNamespaces = /* @__PURE__ */ new Set([...Object.keys(staticRouter), "admin"]);
@@ -1110,10 +1088,10 @@ async function buildRouter(dependencies = {}, options = {}) {
 		...staticRouter
 	});
 }
-async function runCli(dependencies = {}, argv) {
+async function runCli(argv) {
 	const selected = extractOrganizationArg(argv ?? process.argv.slice(2));
 	const command = selected.argv.at(0);
-	const router = await buildRouter(dependencies, {
+	const router = await buildRouter({
 		orgCode: selected.orgCode,
 		staticOnly: [
 			"login",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hitch42/cli",
-  "version": "0.1.1-beta.1",
+  "version": "0.1.1-beta.11",
   "license": "MIT",
   "bin": {
     "hitch": "./dist/hitch.js"
@@ -19,7 +19,7 @@
     "zod": "^4.4.3"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.18"
   },
   "repository": {
     "type": "git",
@@ -29,6 +29,6 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org",
-    "tag": "beta"
+    "tag": "latest"
   }
 }