zitejs 0.9.113 → 0.9.115

package/dist/cjs/runtime/index.test.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const index_js_1 = require("./index.js");
+/** Captures what the runtime would have dispatched to the workflow-runner. */
+function stubSdkCall(result = undefined) {
+    const calls = [];
+    vitest_1.vi.stubGlobal("__wrapSdkCall", async (_integrationId, _className, method, params) => {
+        calls.push({ method, params });
+        return result;
+    });
+    return calls;
+}
+(0, vitest_1.afterEach)(() => {
+    vitest_1.vi.unstubAllGlobals();
+});
+(0, vitest_1.describe)("the mechanism", () => {
+    (0, vitest_1.it)("drops an undefined filter value on serialization, leaving an unfiltered read", () => {
+        const token = undefined;
+        const wire = JSON.stringify({ filters: { tokenFraisAdmin: token } });
+        (0, vitest_1.expect)(wire).toBe('{"filters":{}}');
+        (0, vitest_1.expect)(JSON.parse(wire).filters).toEqual({});
+    });
+});
+(0, vitest_1.describe)("findOne", () => {
+    (0, vitest_1.it)("matches nothing when a filter value is undefined, without dispatching", async () => {
+        // The incident shape. `if (!row) return { status: 'invalid_token' }` is
+        // what callers already write, so answering "no match" makes that code
+        // correct on its own — where returning the first row made it lie.
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        const token = undefined;
+        const row = await clients.findOne({
+            filters: { tokenFraisAdmin: token },
+        });
+        (0, vitest_1.expect)(row).toBeUndefined();
+        (0, vitest_1.expect)(calls).toHaveLength(0);
+    });
+    (0, vitest_1.it)("warns so a missing value is still discoverable in the run log", async () => {
+        // A silent miss looks exactly like a legitimate no-match, which would hide
+        // the bug that produced it.
+        const warn = vitest_1.vi.spyOn(console, "warn").mockImplementation(() => { });
+        stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findOne({ filters: { tokenFraisAdmin: undefined } });
+        (0, vitest_1.expect)(warn).toHaveBeenCalledWith(vitest_1.expect.stringContaining('filter "tokenFraisAdmin" is undefined'));
+        warn.mockRestore();
+    });
+    (0, vitest_1.it)("matches nothing on an undefined operand inside a filter condition", async () => {
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        const row = await clients.findOne({
+            filters: { nom: { contains: undefined } },
+        });
+        (0, vitest_1.expect)(row).toBeUndefined();
+        (0, vitest_1.expect)(calls).toHaveLength(0);
+    });
+    (0, vitest_1.it)("matches nothing on an undefined id when nothing else narrows the query", async () => {
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        const id = undefined;
+        const row = await clients.findOne({ id });
+        (0, vitest_1.expect)(row).toBeUndefined();
+        (0, vitest_1.expect)(calls).toHaveLength(0);
+    });
+    (0, vitest_1.it)("still allows an undefined id when filters narrow the query", async () => {
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findOne({ id: undefined, filters: { nom: "Henry" } });
+        (0, vitest_1.expect)(calls).toHaveLength(1);
+    });
+    (0, vitest_1.it)("still allows a deliberate unfiltered lookup", async () => {
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findOne({ filters: {} });
+        await clients.findOne({});
+        (0, vitest_1.expect)(calls).toHaveLength(2);
+    });
+    (0, vitest_1.it)("passes real values through untouched", async () => {
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findOne({ filters: { tokenFraisAdmin: "b69779ae-eeea" } });
+        (0, vitest_1.expect)(calls[0]?.params).toMatchObject({
+            filters: { tokenFraisAdmin: "b69779ae-eeea" },
+        });
+    });
+    (0, vitest_1.it)("allows null, which means the field is empty", async () => {
+        const calls = stubSdkCall();
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findOne({ filters: { nom: { not: null } } });
+        (0, vitest_1.expect)(calls).toHaveLength(1);
+    });
+});
+(0, vitest_1.describe)("findAll", () => {
+    (0, vitest_1.it)("treats an undefined filter value as 'do not narrow on this'", async () => {
+        // Deliberately NOT guarded, unlike findOne. On a list query "no filter" is
+        // a coherent request, `filters: { x: maybeUndefined }` type-checks today,
+        // and this is what Prisma does with undefined in a `where`. The dangerous
+        // reading is findOne's, where an unnarrowed query returns an arbitrary row
+        // that the caller treats as a match.
+        const calls = stubSdkCall({ records: [], hasMore: false });
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findAll({ filters: { tokenFraisAdmin: undefined } });
+        (0, vitest_1.expect)(calls).toHaveLength(1);
+    });
+    (0, vitest_1.it)("still allows listing a whole table on purpose", async () => {
+        const calls = stubSdkCall({ records: [], hasMore: false });
+        const clients = (0, index_js_1.createTableClient)("Clients");
+        await clients.findAll();
+        await clients.findAll({ limit: 10 });
+        (0, vitest_1.expect)(calls).toHaveLength(2);
+    });
+});
+(0, vitest_1.describe)("other clients on the same path", () => {
+    (0, vitest_1.it)("guards the Airtable client", async () => {
+        const calls = stubSdkCall();
+        const table = (0, index_js_1.createAirtableClient)("airtable", "Clients", {
+            baseId: "app1",
+            tableId: "tbl1",
+        });
+        const row = await table.findOne({
+            filters: { tokenFraisAdmin: undefined },
+        });
+        (0, vitest_1.expect)(row).toBeUndefined();
+        (0, vitest_1.expect)(calls).toHaveLength(0);
+    });
+    (0, vitest_1.it)("leaves auth user lookups alone, as a findAll", async () => {
+        const calls = stubSdkCall({ records: [], total: 0, hasMore: false });
+        const auth = (0, index_js_1.createAuthClient)();
+        await auth.findAllUsers({ filters: { email: undefined } });
+        (0, vitest_1.expect)(calls).toHaveLength(1);
+    });
+});

package/dist/cjs/sync/lib.js

@@ -541,6 +541,7 @@ function generateDbTs(inputSchema) {
     lines.push('//       `not: null` means "is set". An empty `in: []` matches nothing; an', "//       empty `notIn: []` applies no filter.");
     lines.push("//     sort is currently IGNORED here — it is stripped before the request.", "//       (it does work on zite.auth.findAllUsers). Order in SQL instead.");
     lines.push("//     limit defaults to 500, max 2000; offset is a row count (a number)");
+    lines.push('//     a filter value of `undefined` is REJECTED (it would query unfiltered', '//       and match an arbitrary record). Check the value first.');
     lines.push("//   .findOne({ id?, filters?, fields? }) → T | undefined");
     lines.push("//   .create({ record }) → T");
     lines.push("//   .update({ id, record }) → { id: string, fields: Partial<T> }");
@@ -1157,6 +1158,13 @@ function generateAirtableTs(inputLock) {
         "// Auto-generated by zitejs generate from zite.lock. Do not edit manually.",
         "// Airtable SDK — uses createAirtableClient from zitejs/runtime.",
         "//",
+        "// Usage in endpoint files (src/api/*.ts) — one client is exported per table:",
+        `//   import { ${lock.tables[0]?.sdkName ?? "TableName"} } from 'zitejs/integrations';`,
+        "//",
+        "// Always use 'zitejs/integrations' — never a relative path like",
+        "// '../../.zite/integrations/airtable'. The tsconfig aliases resolve zitejs/*",
+        "// imports to the correct .zite/ files.",
+        "//",
         "// Each exported table client has these methods (all take a single params object):",
         "//   findAll({ offset?, limit?, filters? }) => { records: T[], offset: string | undefined, hasMore: boolean }",
         "//   findOne({ id?, filters? }) => T | undefined",
@@ -1374,6 +1382,12 @@ function generateEmailSdk(integrationId) {
         "// Auto-generated by zitejs generate from zite.config.json. Do not edit manually.",
         "// Email SDK — sends through the Zite email gateway via the runtime bridge.",
         "//",
+        "// Usage in endpoint files (src/api/*.ts):",
+        "//   import { Email } from 'zitejs/email';",
+        "//",
+        "// Always use 'zitejs/email' — never a relative path like '../../.zite/integrations/email'.",
+        "// The tsconfig aliases resolve zitejs/* imports to the correct .zite/ files.",
+        "//",
         "//   await Email.send({ to, subject, body: [{ type: 'text', content: '...' }] })",
         "//     => { success: boolean; messageId: string }",
         "//",

package/dist/cjs/sync/sdkNames.d.ts

@@ -25,7 +25,8 @@ export declare function toPascalCase(name: string): string;
 export declare function toCamelCase(name: string): string;
 /**
  * camelCase for a FRESH sdkName, reading acronym runs as words: "VIP" ->
- * "vip", "APIKey" -> "apiKey" (plain toCamelCase yields "vIP" / "aPIKey").
+ * "vip", "APIKey" -> "apiKey" (plain toCamelCase yields "vIP" / "aPIKey"), and
+ * folding a diacritic into its base letter: "Filières" -> "filieres".
  *
  * Deliberately not folded into toCamelCase: that also derives endpoint
  * identifiers from existing filenames on every generate, where normalizing

package/dist/cjs/sync/sdkNames.js

@@ -50,7 +50,8 @@ function toCamelCase(name) {
 }
 /**
  * camelCase for a FRESH sdkName, reading acronym runs as words: "VIP" ->
- * "vip", "APIKey" -> "apiKey" (plain toCamelCase yields "vIP" / "aPIKey").
+ * "vip", "APIKey" -> "apiKey" (plain toCamelCase yields "vIP" / "aPIKey"), and
+ * folding a diacritic into its base letter: "Filières" -> "filieres".
  *
  * Deliberately not folded into toCamelCase: that also derives endpoint
  * identifiers from existing filenames on every generate, where normalizing
@@ -58,7 +59,22 @@ function toCamelCase(name) {
  * chosen for the first time — generateSchema preserves existing sdkNames.
  */
 function toSdkName(name) {
+    // Decompose, then drop the combining marks, so an accented letter keeps its
+    // base rather than being read as punctuation. `toPascalCase` treats anything
+    // outside [a-zA-Z0-9] as a word separator and uppercases what follows it, so
+    // without this a table called "Fiches Filières" allocates `fichesFiliRes`.
+    //
+    // The bar is not "looks nicer" — it is Zite 1.0, which sanitised names this
+    // exact way (`getIntegrationNameMapping`) and therefore allocated
+    // `fichesFilieres`. Every app carried over from 1.0 compiles against that
+    // name, so a generator that disagrees hands a non-English base an accessor
+    // nobody would write and nothing resolves to.
+    //
+    // Only Latin diacritics fold. A name with no ASCII letters at all (Cyrillic,
+    // CJK, emoji) still collapses to `_` here, exactly as it did in 1.0.
     const deAcronymed = name
+        .normalize("NFD")
+        .replace(/[\u0300-\u036f]/g, "")
         .replace(/([A-Z]+)([A-Z][a-z])/g, (_, run, next) => run.charAt(0) + run.slice(1).toLowerCase() + next)
         .replace(/([A-Z])([A-Z]+)/g, (_, first, rest) => first + rest.toLowerCase());
     return toCamelCase(deAcronymed);

package/dist/cjs/sync/sdkNames.test.js

@@ -235,3 +235,51 @@ const recordTypeKeys = (source, typeName) => {
         (0, vitest_1.expect)(schema.tables[0].name).toBe("Deals");
     });
 });
+/**
+ * `toPascalCase` reads anything outside [a-zA-Z0-9] as a word separator and
+ * uppercases what follows, so an accent used to split the word it sat inside:
+ * "Filières" -> `filiRes`. Zite 1.0 stripped the combining mark instead, and
+ * every app carried over from it compiles against THAT name — so this is a
+ * disagreement with the apps in the wild, not a cosmetic preference.
+ */
+(0, vitest_1.describe)("diacritics in a fresh sdkName", () => {
+    const nameFor = (tableName) => (0, lib_js_1.generateSchema)(database([{ id: "tbl_1", name: tableName, fields: [] }]))
+        .tables[0].sdkName;
+    vitest_1.it.each([
+        ["Fiches Filières", "fichesFilieres"],
+        ["Recherches Métiers", "recherchesMetiers"],
+        ["Profil Compétences", "profilCompetences"],
+        ["Café Menu", "cafeMenu"],
+        ["Señor Clients", "senorClients"],
+        // Real, from a migrated base: an all-caps name where the accent sits inside
+        // an acronym run, so the de-acronym pass has to see the folded letter.
+        ["XICOH TRÁMITES", "xicohTramites"],
+    ])("folds %s into %s", (display, sdkName) => {
+        (0, vitest_1.expect)(nameFor(display)).toBe(sdkName);
+    });
+    (0, vitest_1.it)("folds a field name the same way", () => {
+        const schema = (0, lib_js_1.generateSchema)(database([
+            {
+                id: "tbl_1",
+                name: "Trámites",
+                fields: [field("fld_1", "Horario de Atención")],
+            },
+        ]));
+        (0, vitest_1.expect)(schema.tables[0].fields[0].sdkName).toBe("horarioDeAtencion");
+    });
+    (0, vitest_1.it)("leaves a name with no ASCII letters degenerate, as 1.0 did", () => {
+        // NFD only folds Latin diacritics. Nothing here to fold onto, so this
+        // collapses exactly as before — called out so the narrower scope is a
+        // decision on the record rather than an oversight.
+        (0, vitest_1.expect)(nameFor("Посещения")).toBe("_");
+    });
+    (0, vitest_1.it)("does not rename a table already locked to the old spelling", () => {
+        // The whole point of the lock: an app compiling against `fichesFiliRes`
+        // keeps it. Only names allocated from here on change.
+        const existingSchema = {
+            tables: [{ id: "tbl_1", sdkName: "fichesFiliRes", fields: [] }],
+        };
+        const schema = (0, lib_js_1.generateSchema)(database([{ id: "tbl_1", name: "Fiches Filières", fields: [] }]), existingSchema);
+        (0, vitest_1.expect)(schema.tables[0].sdkName).toBe("fichesFiliRes");
+    });
+});

package/dist/esm/api/index.d.ts

@@ -0,0 +1,2 @@
+export { createCaller } from '../caller/index.js';
+export type { EndpointConfig } from '../caller/index.js';

package/dist/esm/api/index.js

@@ -0,0 +1 @@
+export { createCaller } from '../caller/index.js';

package/dist/esm/backend/index.d.ts

@@ -82,6 +82,12 @@ export interface EndpointConfig<TInput = unknown, TOutput = unknown, TStream ext
      * `{ user: null }` for a webhook fire exactly as it does for a cron one.
      */
     webhook?: TWebhook;
+    /**
+     * Set by {@link createEndpoint}, not by hand. The worker validates
+     * `inputSchema` for bundles built before this did, and skips ones that
+     * declare it — parsing twice would apply a schema's transforms twice.
+     */
+    validatesInput?: boolean;
     execute: (params: {
         input: TInput;
         context: TSchedule extends ZiteSchedule ? ZiteRequestContext | ZiteScheduledContext : TWebhook extends ZiteWebhook ? ZiteRequestContext | ZiteScheduledContext : ZiteRequestContext;
@@ -89,4 +95,11 @@ export interface EndpointConfig<TInput = unknown, TOutput = unknown, TStream ext
         stream: ZiteStreamInterface;
     } : {})) => Promise<TOutput> | TOutput;
 }
+/**
+ * Create an endpoint definition, parsing `input` against `inputSchema` before
+ * `execute` runs. Nothing downstream parses it — the worker calls `execute` on
+ * whatever this returns — so while this was a bare `return config` a required
+ * field could be missing and the endpoint ran anyway. Parsing here is also what
+ * makes `TRawInput` -> `TInput` (defaults, transforms) true at runtime.
+ */
 export declare function createEndpoint<TInput = unknown, TOutput = unknown, TStream extends boolean = false, TSchedule extends ZiteSchedule | undefined = undefined, TWebhook extends ZiteWebhook | undefined = undefined, TRawInput = TInput>(config: EndpointConfig<TInput, TOutput, TStream, TSchedule, TWebhook, TRawInput>): EndpointConfig<TInput, TOutput, TStream, TSchedule, TWebhook, TRawInput>;

package/dist/esm/backend/index.js

@@ -26,6 +26,68 @@ export class ZiteError extends Error {
         this.name = "ZiteError";
     }
 }
+/** Injected by the runner on a platform-fired run — see `isPlatformTriggeredInput`. */
+const PLATFORM_TRIGGER_KEYS = ["__cron", "__webhook"];
+function isPlatformTriggeredInput(input) {
+    if (typeof input !== "object" || input === null)
+        return false;
+    return PLATFORM_TRIGGER_KEYS.some((key) => Object.prototype.hasOwnProperty.call(input, key));
+}
+function isIssueBearingError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        Array.isArray(error.issues));
+}
+function describeIssues(error) {
+    return error.issues
+        .map((issue) => {
+        const path = issue.path.map((part) => String(part)).join(".");
+        return path ? `${path}: ${issue.message}` : issue.message;
+    })
+        .join("; ");
+}
+/**
+ * Create an endpoint definition, parsing `input` against `inputSchema` before
+ * `execute` runs. Nothing downstream parses it — the worker calls `execute` on
+ * whatever this returns — so while this was a bare `return config` a required
+ * field could be missing and the endpoint ran anyway. Parsing here is also what
+ * makes `TRawInput` -> `TInput` (defaults, transforms) true at runtime.
+ */
 export function createEndpoint(config) {
-    return config;
+    const { inputSchema, execute } = config;
+    const firesWithoutARequest = Boolean(config.schedule || config.webhook);
+    // An `inputSchema` that isn't a validator stays inert, as it was.
+    if (!inputSchema || typeof inputSchema.parse !== "function")
+        return config;
+    return {
+        ...config,
+        validatesInput: true,
+        // `async` so a schema failure rejects: `execute` may be declared sync, and
+        // a sync throw would escape the caller's `.catch()`.
+        execute: async (params) => {
+            // Cron and webhook fires carry no request body, so a schema written for
+            // request callers doesn't describe them.
+            if (isPlatformTriggeredInput(params.input))
+                return execute(params);
+            // Same, for a fire with no input object to hold the sentinel: the runner
+            // only merges `__cron` into a plain object.
+            if (firesWithoutARequest && params.input === undefined) {
+                return execute(params);
+            }
+            let parsed;
+            try {
+                parsed = inputSchema.parse(params.input);
+            }
+            catch (error) {
+                throw new ZiteError({
+                    code: "BAD_REQUEST",
+                    message: isIssueBearingError(error)
+                        ? `Invalid input: ${describeIssues(error)}`
+                        : `Invalid input: ${String(error?.message ?? error)}`,
+                    userFacingMessage: "Some of the information sent with this request was missing or invalid.",
+                });
+            }
+            return execute({ ...params, input: parsed });
+        },
+    };
 }

package/dist/esm/backend/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/backend/index.test.js

@@ -0,0 +1,201 @@
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { z } from "zod";
+import { createEndpoint, ZiteError } from "./index.js";
+import { createTableClient } from "../runtime/index.js";
+const requestContext = { user: { id: "u1", email: "a@b.c" } };
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe("createEndpoint input validation", () => {
+    it("rejects input that does not satisfy inputSchema, without running execute", async () => {
+        const execute = vi.fn();
+        const endpoint = createEndpoint({
+            inputSchema: z.object({ token: z.string().min(10) }),
+            execute,
+        });
+        await expect(endpoint.execute({ input: {}, context: requestContext })).rejects.toBeInstanceOf(ZiteError);
+        expect(execute).not.toHaveBeenCalled();
+    });
+    it("surfaces the failure as BAD_REQUEST and names the offending field", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.object({ token: z.string().min(10) }),
+            execute: async () => "unreachable",
+        });
+        await expect(endpoint.execute({ input: {}, context: requestContext })).rejects.toMatchObject({
+            code: "BAD_REQUEST",
+            message: expect.stringContaining("token"),
+        });
+    });
+    it("rejects a call with no input at all", async () => {
+        const execute = vi.fn();
+        const endpoint = createEndpoint({
+            inputSchema: z.object({ token: z.string().min(10) }),
+            execute,
+        });
+        await expect(endpoint.execute({
+            input: undefined,
+            context: requestContext,
+        })).rejects.toMatchObject({ code: "BAD_REQUEST" });
+        expect(execute).not.toHaveBeenCalled();
+    });
+    it("hands execute the parsed value, so schema defaults finally apply", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.object({
+                token: z.string(),
+                limit: z.number().default(10),
+            }),
+            execute: async ({ input }) => input,
+        });
+        await expect(endpoint.execute({
+            input: { token: "abc" },
+            context: requestContext,
+        })).resolves.toEqual({ token: "abc", limit: 10 });
+    });
+    it("passes valid input through untouched", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.object({
+                token: z.string().min(10),
+                action: z.enum(["load", "accept"]),
+            }),
+            execute: async ({ input }) => input.action,
+        });
+        await expect(endpoint.execute({
+            input: { token: "b69779ae-eeea", action: "load" },
+            context: requestContext,
+        })).resolves.toBe("load");
+    });
+    it("declares that it validates, so the worker does not parse a second time", () => {
+        const withSchema = createEndpoint({
+            inputSchema: z.object({ token: z.string() }),
+            execute: async () => null,
+        });
+        const withoutSchema = createEndpoint({ execute: async () => null });
+        expect(withSchema.validatesInput).toBe(true);
+        expect(withoutSchema.validatesInput).toBeUndefined();
+    });
+    it("leaves an endpoint without an inputSchema exactly as it was", async () => {
+        const endpoint = createEndpoint({
+            execute: async ({ input }) => input,
+        });
+        await expect(endpoint.execute({
+            input: { anything: true },
+            context: requestContext,
+        })).resolves.toEqual({ anything: true });
+    });
+    it("preserves the stream handle for streaming endpoints", async () => {
+        const stream = { write: async () => { }, forward: async () => "" };
+        const endpoint = createEndpoint({
+            stream: true,
+            inputSchema: z.object({ prompt: z.string() }),
+            execute: async (params) => params.stream === stream,
+        });
+        await expect(endpoint.execute({
+            input: { prompt: "hi" },
+            context: requestContext,
+            stream,
+        })).resolves.toBe(true);
+    });
+});
+describe("platform-triggered runs", () => {
+    it("does not validate a cron fire, and leaves __cron readable", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.object({ token: z.string().min(10) }),
+            schedule: {
+                scheduleType: "recurring",
+                schedule: { frequency: "hourly", interval: 6 },
+                timezone: "UTC",
+            },
+            execute: async ({ input }) => input,
+        });
+        await expect(endpoint.execute({
+            input: { __cron: { scheduleId: "s1" } },
+            context: { user: null },
+        })).resolves.toEqual({ __cron: { scheduleId: "s1" } });
+    });
+    it("does not validate a scheduled fire that carries no input object", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.string(),
+            schedule: {
+                scheduleType: "recurring",
+                schedule: { frequency: "hourly", interval: 6 },
+                timezone: "UTC",
+            },
+            execute: async ({ input }) => input ?? "(no input)",
+        });
+        await expect(endpoint.execute({ input: undefined, context: { user: null } })).resolves.toBe("(no input)");
+    });
+    it("still validates an ordinary endpoint called with no input", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.string(),
+            execute: async ({ input }) => input,
+        });
+        await expect(endpoint.execute({ input: undefined, context: requestContext })).rejects.toMatchObject({ code: "BAD_REQUEST" });
+    });
+    it("does not validate a webhook fire", async () => {
+        const endpoint = createEndpoint({
+            inputSchema: z.object({ token: z.string().min(10) }),
+            webhook: {},
+            execute: async ({ input }) => input,
+        });
+        await expect(endpoint.execute({
+            input: { __webhook: { headers: {} }, id: 7 },
+            context: { user: null },
+        })).resolves.toEqual({ __webhook: { headers: {} }, id: 7 });
+    });
+});
+/**
+ * The failure this was written for: an endpoint that looks a customer up by a
+ * token, called with no token. The undefined was dropped on the way to the
+ * database and the unfiltered lookup returned the first row of the table.
+ * Either guard alone stops it; they fail at different layers, so both are here.
+ */
+describe("regression: token lookup on an endpoint called without a token", () => {
+    function buildEndpoint(onMatch) {
+        const clients = createTableClient("Clients");
+        return createEndpoint({
+            inputSchema: z.object({
+                token: z.string().min(10),
+                action: z.enum(["load", "accept"]),
+            }),
+            execute: async ({ input }) => {
+                const row = await clients.findOne({ filters: { token: input.token } });
+                if (!row)
+                    return "invalid_token";
+                onMatch(row.nom);
+                return "ok";
+            },
+        });
+    }
+    it("stops at the schema, so the database is never reached", async () => {
+        const dispatched = [];
+        vi.stubGlobal("__wrapSdkCall", async (_i, _c, m) => {
+            dispatched.push(m);
+            return { id: "1", token: "", nom: "an unrelated customer" };
+        });
+        const matched = [];
+        await expect(buildEndpoint((nom) => matched.push(nom)).execute({
+            input: {},
+            context: requestContext,
+        })).rejects.toMatchObject({ code: "BAD_REQUEST" });
+        expect(dispatched).toEqual([]);
+        expect(matched).toEqual([]);
+    });
+    it("stops at the query too, if an undefined token reaches it another way", async () => {
+        const dispatched = [];
+        vi.stubGlobal("__wrapSdkCall", async (_i, _c, m) => {
+            dispatched.push(m);
+            return { id: "1", token: "", nom: "an unrelated customer" };
+        });
+        const warn = vi.spyOn(console, "warn").mockImplementation(() => { });
+        const clients = createTableClient("Clients");
+        const token = undefined;
+        // Answers "no match" rather than throwing: `if (!row) return
+        // { status: 'invalid_token' }` is what the endpoint already does, so this
+        // makes the incident path correct without the app changing anything.
+        const row = await clients.findOne({ filters: { token } });
+        expect(row).toBeUndefined();
+        expect(dispatched).toEqual([]);
+        expect(warn).toHaveBeenCalled();
+        warn.mockRestore();
+    });
+});

package/dist/esm/bundle/index.d.ts

@@ -1 +1,25 @@
+/**
+ * `npx zitejs bundle` — Bundle endpoint files for cloudflare-lambda deployment.
+ *
+ * Replaces the legacy `scripts/bundle-endpoints.js` from zitejs-starter.
+ * Reads endpoints from src/api/*.ts, resolves SDK imports via .zite/backend.ts
+ * (monorepo) or src/__zite__/integrations.ts (legacy), and outputs bundled ESM
+ * code suitable for the cloudflare-lambda worker runtime.
+ *
+ * Usage:
+ *   npx zitejs bundle                     # bundle all endpoints
+ *   npx zitejs bundle --app admin-panel   # bundle endpoints for a specific app
+ *   npx zitejs bundle --script <path>     # bundle a one-off script
+ *
+ * Output: JSON to stdout
+ *   { bundledEndpoints: Record<string, string>, endpointErrors?: Record<string, string> }
+ *   or for --script: { bundledCode: string } or { error: string }
+ *
+ * Dependencies (add to zitejs package.json):
+ *   "esbuild": "^0.25.0"
+ *   "@babel/parser": "^7.26.0"
+ */
+import * as esbuild from 'esbuild';
+export declare const UNSUPPORTED_IN_WORKERD: Set<string>;
+export declare const BASE_BUILD_OPTIONS: esbuild.BuildOptions;
 export declare function runBundle(): Promise<void>;

package/dist/esm/bundle/index.js

@@ -23,14 +23,21 @@ import * as esbuild from 'esbuild';
 import * as path from 'path';
 import * as fs from 'fs';
 import { parse } from '@babel/parser';
-const _NODE_BUILTIN_NAMES = [
-    'http', 'https', 'http2', 'stream', 'buffer', 'util', 'events', 'crypto',
-    'path', 'fs', 'url', 'querystring', 'zlib', 'net', 'tls', 'os', 'assert',
-    'process', 'child_process', 'cluster', 'dgram', 'dns', 'inspector', 'module',
-    'perf_hooks', 'readline', 'repl', 'string_decoder', 'timers', 'tty', 'v8',
-    'vm', 'worker_threads', 'async_hooks', 'trace_events', 'punycode',
-];
-const NODE_BUILTINS = _NODE_BUILTIN_NAMES.flatMap(m => [m, `node:${m}`]);
+import { builtinModules } from 'node:module';
+// workerd's `nodejs_compat` does not provide these. Left external they bundle
+// fine and then kill the worker at load time with `No such module`; excluded,
+// esbuild fails the one endpoint with a resolvable error instead. Pinned by
+// apps/cloudflare-lambda tests/sdk-compat/node-builtin-support.test.ts.
+export const UNSUPPORTED_IN_WORKERD = new Set([
+    'child_process', 'dgram', 'inspector', 'inspector/promises', 'perf_hooks',
+    'readline', 'readline/promises', 'repl', 'tty', 'v8', 'worker_threads',
+]);
+// External, not bundled: the worker supplies them. Sourced from Node because
+// the hand-written list covered 36 of 68, so a dependency reaching for a name
+// we forgot (`constants`, `fs/promises`) failed the whole endpoint.
+const NODE_BUILTINS = builtinModules
+    .filter(m => !m.startsWith('_') && !UNSUPPORTED_IN_WORKERD.has(m))
+    .flatMap(m => [m, `node:${m}`]);
 const PREBUNDLED_LIBS = {
     '@zite/endpoints-runtime-sdk': '__zite-runtime__.js',
     'zod': '__zod__.js',
@@ -51,7 +58,7 @@ const PREBUNDLED_LIBS = {
     '@google/generative-ai': '__gemini__.js',
     '@elevenlabs/elevenlabs-js': '__elevenlabs__.js',
 };
-const BASE_BUILD_OPTIONS = {
+export const BASE_BUILD_OPTIONS = {
     bundle: true,
     write: false,
     format: 'esm',

package/dist/esm/db/index.d.ts

@@ -0,0 +1,2 @@
+export { createTableClient } from '../runtime/index.js';
+export type { TableClient } from '../runtime/index.js';

package/dist/esm/db/index.js

@@ -0,0 +1 @@
+export { createTableClient } from '../runtime/index.js';