zitejs 0.9.118 → 0.9.120

package/dist/cjs/auth/useAuth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cjs/auth/useAuth.test.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+/**
+ * The signed-out redirect on internal apps.
+ *
+ * A separate file from `index.test.ts` because it has to replace
+ * `better-auth/react` wholesale to drive `useSession`, and that would strip the
+ * real client the export tests next door assert against.
+ *
+ * The value here is entirely in WHICH signed-out renders it reacts to. An
+ * external app has a real logged-out state, and an app built before the
+ * platform sent an access mode tells us nothing — redirecting either turns a
+ * working public page into a forced sign-in.
+ */
+const { useSessionMock } = vitest_1.vi.hoisted(() => ({ useSessionMock: vitest_1.vi.fn() }));
+vitest_1.vi.mock('better-auth/react', () => ({
+    createAuthClient: () => ({
+        useSession: useSessionMock,
+        signIn: {},
+        signUp: {},
+        signOut: vitest_1.vi.fn(),
+        updateUser: vitest_1.vi.fn(),
+    }),
+}));
+vitest_1.vi.mock('better-auth/client/plugins', () => ({
+    magicLinkClient: () => ({}),
+    inferAdditionalFields: () => ({}),
+}));
+// `useAuth` takes only `useEffect` from React. Running it inline is the whole
+// of what a render would do here, and avoids pulling in a renderer.
+vitest_1.vi.mock('react', () => ({ useEffect: (fn) => fn() }));
+const index_js_1 = require("./index.js");
+const APP_URL = 'https://app.zite.so/dashboard';
+function stubLocation(href) {
+    const location = { pathname: new URL(href).pathname, href };
+    vitest_1.vi.stubGlobal('window', { location });
+    return location;
+}
+const signedOut = { data: null, isPending: false };
+(0, vitest_1.beforeEach)(() => {
+    delete process.env.ZITE_ACCESS_MODE;
+});
+(0, vitest_1.afterEach)(() => {
+    delete process.env.ZITE_ACCESS_MODE;
+    vitest_1.vi.unstubAllGlobals();
+    useSessionMock.mockReset();
+});
+const render = (session, { accessMode, href = APP_URL } = {}) => {
+    if (accessMode !== undefined)
+        process.env.ZITE_ACCESS_MODE = accessMode;
+    const location = stubLocation(href);
+    useSessionMock.mockReturnValue(session);
+    return { result: (0, index_js_1.useAuth)(), location };
+};
+(0, vitest_1.describe)('useAuth signed-out handling', () => {
+    (0, vitest_1.it)('sends a signed-out visitor on an internal app to sign-in', () => {
+        const { result, location } = render(signedOut, { accessMode: 'internal' });
+        (0, vitest_1.expect)(location.href.startsWith('/auth/login')).toBe(true);
+        // Reported as loading rather than signed out: the signed-out branch of an
+        // internal app is the empty screen this exists to prevent.
+        (0, vitest_1.expect)(result.isLoading).toBe(true);
+    });
+    (0, vitest_1.it)('leaves a signed-out visitor on an external app alone', () => {
+        const { result, location } = render(signedOut, { accessMode: 'external' });
+        (0, vitest_1.expect)(location.href).toBe(APP_URL);
+        (0, vitest_1.expect)(result.isLoading).toBe(false);
+        (0, vitest_1.expect)(result.user).toBe(null);
+    });
+    // Every app published before the platform started sending an access mode.
+    (0, vitest_1.it)('leaves an app that never declared an access mode alone', () => {
+        const { result, location } = render(signedOut);
+        (0, vitest_1.expect)(location.href).toBe(APP_URL);
+        (0, vitest_1.expect)(result.isLoading).toBe(false);
+    });
+    (0, vitest_1.it)('does not redirect while the session is still resolving', () => {
+        const { result, location } = render({ data: null, isPending: true }, { accessMode: 'internal' });
+        (0, vitest_1.expect)(location.href).toBe(APP_URL);
+        (0, vitest_1.expect)(result.isLoading).toBe(true);
+    });
+    (0, vitest_1.it)('does not redirect a signed-in visitor', () => {
+        const { result, location } = render({ data: { user: { id: 'u1', email: 'a@b.com' } }, isPending: false }, { accessMode: 'internal' });
+        (0, vitest_1.expect)(location.href).toBe(APP_URL);
+        (0, vitest_1.expect)(result.isLoading).toBe(false);
+        (0, vitest_1.expect)(result.user).toMatchObject({ id: 'u1' });
+    });
+    // `loginWithRedirect` refuses to navigate away from an auth page, so claiming
+    // a redirect here would hang the caller on `isLoading` forever.
+    (0, vitest_1.it)('does not claim to be loading on an auth page it cannot leave', () => {
+        const { result } = render(signedOut, {
+            accessMode: 'internal',
+            href: 'https://app.zite.so/auth/login',
+        });
+        (0, vitest_1.expect)(result.isLoading).toBe(false);
+    });
+});

package/dist/cjs/dev/index.js

@@ -33,24 +33,18 @@ function getFlowId(appDir) {
     catch { }
     return undefined;
 }
-/**
- * Find the connected email integration's key in an app's zite.config.json,
- * if any. The key is the integrationId used by the runtime SDK bridge.
- */
-function getEmailIntegrationId(appDir) {
+const readJsonFile = (path) => {
     try {
-        const configPath = (0, path_1.join)("apps", appDir, "zite.config.json");
-        if (!(0, fs_2.existsSync)(configPath))
-            return undefined;
-        const config = JSON.parse((0, fs_2.readFileSync)(configPath, "utf-8"));
-        const integrations = config.integrations ?? {};
-        for (const [id, int] of Object.entries(integrations)) {
-            if (int?.type === "email")
-                return id;
-        }
+        return (0, fs_2.existsSync)(path)
+            ? JSON.parse((0, fs_2.readFileSync)(path, "utf-8"))
+            : undefined;
     }
-    catch { }
-    return undefined;
+    catch {
+        return undefined;
+    }
+};
+function getEmailIntegrationId(appDir) {
+    return (0, lib_js_1.findEmailIntegrationId)(readJsonFile((0, path_1.join)("apps", appDir, "zite.config.json")), readJsonFile("zite.config.json"));
 }
 function getDeclaredEnvVarNames(appDir) {
     try {

package/dist/cjs/sync/lib.d.ts

@@ -82,6 +82,12 @@ export declare function normalizeAirtableLockNames(lock: AirtableLock): {
 };
 export declare function generateAirtableTs(inputLock: AirtableLock): string | null;
 export declare function generateBackendWrapperTs(envVarNames?: string[]): string;
+/**
+ * The key of the email integration an app sends through, which is the
+ * integrationId the runtime SDK bridge dispatches on. The app's own entry wins;
+ * otherwise it is the workspace email the app has `integrationSettings` for.
+ */
+export declare function findEmailIntegrationId(appConfig: unknown, workspaceConfig: unknown): string | undefined;
 /**
  * Generate `.zite/integrations/email.ts` — the `Email` client for an app with
  * an email integration connected. Mirrors the airtable SDK generation: a thin

package/dist/cjs/sync/lib.js

@@ -7,6 +7,7 @@ exports.generateApiTs = generateApiTs;
 exports.normalizeAirtableLockNames = normalizeAirtableLockNames;
 exports.generateAirtableTs = generateAirtableTs;
 exports.generateBackendWrapperTs = generateBackendWrapperTs;
+exports.findEmailIntegrationId = findEmailIntegrationId;
 exports.generateEmailSdk = generateEmailSdk;
 const parser_1 = require("@babel/parser");
 const sdkNames_js_1 = require("./sdkNames.js");
@@ -1346,6 +1347,18 @@ function generateBackendWrapperTs(envVarNames = []) {
         "",
     ].join("\n");
 }
+/**
+ * The key of the email integration an app sends through, which is the
+ * integrationId the runtime SDK bridge dispatches on. The app's own entry wins;
+ * otherwise it is the workspace email the app has `integrationSettings` for.
+ */
+function findEmailIntegrationId(appConfig, workspaceConfig) {
+    const app = (appConfig ?? {});
+    const workspace = (workspaceConfig ?? {});
+    const isEmail = (config, id) => config.integrations?.[id]?.type === "email";
+    return (Object.keys(app.integrations ?? {}).find((id) => isEmail(app, id)) ??
+        Object.keys(app.integrationSettings ?? {}).find((id) => isEmail(workspace, id)));
+}
 /**
  * Generate `.zite/integrations/email.ts` — the `Email` client for an app with
  * an email integration connected. Mirrors the airtable SDK generation: a thin

package/dist/cjs/sync/lib.test.js

@@ -385,3 +385,31 @@ const duplicateIdentifierErrorsIn = (source) => {
         (0, vitest_1.expect)(output).toContain('ZiteError');
     });
 });
+(0, vitest_1.describe)('findEmailIntegrationId', () => {
+    const workspace = {
+        integrations: {
+            slack: { type: 'slack' },
+            'team-email': { type: 'email' },
+        },
+    };
+    (0, vitest_1.it)('finds the app\'s own email entry', () => {
+        (0, vitest_1.expect)((0, lib_js_1.findEmailIntegrationId)({ integrations: { mail: { type: 'email' } } }, workspace)).toBe('mail');
+    });
+    (0, vitest_1.it)('finds the workspace email the app has settings for', () => {
+        (0, vitest_1.expect)((0, lib_js_1.findEmailIntegrationId)({ integrationSettings: { slack: {}, 'team-email': { fromName: 'Ops' } } }, workspace)).toBe('team-email');
+    });
+    // An app that never opted in generates no client, so `zitejs/email` stays
+    // unresolved there instead of sending as a sender it never chose.
+    (0, vitest_1.it)('ignores a workspace email the app has no settings for', () => {
+        (0, vitest_1.expect)((0, lib_js_1.findEmailIntegrationId)({}, workspace)).toBeUndefined();
+    });
+    (0, vitest_1.it)('prefers the app\'s own entry over a workspace one', () => {
+        (0, vitest_1.expect)((0, lib_js_1.findEmailIntegrationId)({
+            integrations: { mail: { type: 'email' } },
+            integrationSettings: { 'team-email': {} },
+        }, workspace)).toBe('mail');
+    });
+    (0, vitest_1.it)('tolerates missing configs', () => {
+        (0, vitest_1.expect)((0, lib_js_1.findEmailIntegrationId)(undefined, undefined)).toBeUndefined();
+    });
+});

package/dist/cjs/upload/index.d.ts

@@ -2,6 +2,7 @@ export type UploadData = string | Blob | ArrayBuffer | File;
 export declare class FileUploadError extends Error {
     constructor(message: string);
 }
+export declare function toUploadBlob(data: UploadData): Blob;
 export declare function uploadFile({ data, filename, }: {
     data: UploadData;
     filename: string;

package/dist/cjs/upload/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FileUploadError = void 0;
+exports.toUploadBlob = toUploadBlob;
 exports.uploadFile = uploadFile;
 exports.useUpload = useUpload;
 const react_1 = require("react");
@@ -24,33 +25,35 @@ function getZiteAppMode(hostname) {
     }
     return 'live';
 }
-function readBlobAsDataUrl(blob) {
-    return new Promise((resolve, reject) => {
-        const reader = new FileReader();
-        reader.onload = () => resolve(reader.result);
-        reader.onerror = () => reject(reader.error ?? new Error('Failed to read file'));
-        reader.readAsDataURL(blob);
-    });
+function decodeDataUrl(dataUrl) {
+    const comma = dataUrl.indexOf(',');
+    if (comma === -1) {
+        throw new FileUploadError('Invalid data URL');
+    }
+    const header = dataUrl.slice(0, comma);
+    const payload = dataUrl.slice(comma + 1);
+    const mimeMatch = /^data:([^;,]*)/.exec(header);
+    const mimeType = mimeMatch?.[1] || 'application/octet-stream';
+    const bytes = Uint8Array.from(atob(payload), c => c.charCodeAt(0));
+    return new Blob([bytes], { type: mimeType });
 }
-async function toDataUrl(data) {
-    if (data instanceof Blob) {
-        return readBlobAsDataUrl(data);
+function toUploadBlob(data) {
+    if (typeof Blob !== 'undefined' && data instanceof Blob) {
+        return data;
     }
     if (data instanceof ArrayBuffer) {
-        const bytes = new Uint8Array(data);
-        let binary = '';
-        for (let i = 0; i < bytes.byteLength; i++) {
-            binary += String.fromCharCode(bytes[i]);
-        }
-        return 'data:application/octet-stream;base64,' + btoa(binary);
+        return new Blob([data], { type: 'application/octet-stream' });
     }
     if (typeof data === 'string') {
         if (data.startsWith('data:'))
-            return data;
-        if (/^[A-Za-z0-9+/]+=*$/.test(data)) {
-            return 'data:application/octet-stream;base64,' + data;
+            return decodeDataUrl(data);
+        // Only treat as raw base64 when the string is padded/aligned — otherwise
+        // short text like "hello" matches the alphabet and atob throws.
+        if (data.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(data)) {
+            const bytes = Uint8Array.from(atob(data), c => c.charCodeAt(0));
+            return new Blob([bytes], { type: 'application/octet-stream' });
         }
-        return 'data:text/plain;base64,' + btoa(unescape(encodeURIComponent(data)));
+        return new Blob([data], { type: 'text/plain' });
     }
     throw new FileUploadError('Invalid data format. Expected string, Blob, ArrayBuffer, or File.');
 }
@@ -62,36 +65,55 @@ function resolveFilename(data, filename) {
     }
     throw new FileUploadError('A filename is required unless the uploaded data is a File.');
 }
-async function performUpload(data, filename) {
-    const body = await toDataUrl(data);
-    const mode = getZiteAppMode(window.location.hostname);
-    const flowId = (0, config_js_1.getFlowId)();
+async function readErrorMessage(res, fallback) {
+    try {
+        const err = (await res.json());
+        if (err.message)
+            return err.message;
+    }
+    catch { }
+    return fallback;
+}
+function authHeaders() {
     const token = typeof localStorage !== 'undefined'
         ? localStorage.getItem('zite.auth.token')
         : null;
-    const res = await fetch((0, config_js_1.getApiUrl)() + '/v1/zite/public/' + flowId + '/upload?mode=' + mode, {
+    return token ? { Authorization: 'Bearer ' + token } : {};
+}
+async function performUpload(data, filename) {
+    const blob = toUploadBlob(data);
+    const mode = getZiteAppMode(window.location.hostname);
+    const flowId = (0, config_js_1.getFlowId)();
+    const sessionRes = await fetch((0, config_js_1.getApiUrl)() + '/v1/zite/public/' + flowId + '/upload-session?mode=' + mode, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            ...(token ? { Authorization: 'Bearer ' + token } : {}),
+            ...authHeaders(),
         },
-        body: JSON.stringify({ data: body, filename }),
+        body: JSON.stringify({
+            filename,
+            uploadLength: blob.size,
+            contentType: blob.type || 'application/octet-stream',
+        }),
     });
-    if (!res.ok) {
-        let message = 'Upload failed';
-        try {
-            const err = (await res.json());
-            if (err.message)
-                message = err.message;
-        }
-        catch { }
-        throw new FileUploadError(message);
+    if (!sessionRes.ok) {
+        throw new FileUploadError(await readErrorMessage(sessionRes, 'Upload failed'));
     }
-    const result = (await res.json());
-    if (!result.success || !result.fileUrl) {
-        throw new FileUploadError(result.message ?? 'Upload failed');
+    const session = (await sessionRes.json());
+    if (!session.success || !session.presignedUrl || !session.fileUrl) {
+        throw new FileUploadError(session.message ?? 'Upload failed');
+    }
+    const putRes = await fetch(session.presignedUrl, {
+        method: 'PUT',
+        headers: {
+            'Content-Type': session.contentType || blob.type || 'application/octet-stream',
+        },
+        body: blob,
+    });
+    if (!putRes.ok) {
+        throw new FileUploadError('Upload failed');
     }
-    return result.fileUrl;
+    return session.fileUrl;
 }
 async function uploadFile({ data, filename, }) {
     return { fileUrl: await performUpload(data, filename) };

package/dist/cjs/upload/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cjs/upload/index.test.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const index_js_1 = require("./index.js");
+vitest_1.vi.mock('../auth/config.js', () => ({
+    getApiUrl: () => 'https://api.example.com',
+    getFlowId: () => 'app_123',
+}));
+const fetchMock = vitest_1.vi.fn();
+(0, vitest_1.beforeEach)(() => {
+    fetchMock.mockReset();
+    vitest_1.vi.stubGlobal('fetch', fetchMock);
+    vitest_1.vi.stubGlobal('window', { location: { hostname: 'portal.acme.com' } });
+    vitest_1.vi.stubGlobal('localStorage', { getItem: () => null });
+});
+(0, vitest_1.afterEach)(() => {
+    vitest_1.vi.unstubAllGlobals();
+});
+(0, vitest_1.describe)('toUploadBlob', () => {
+    (0, vitest_1.it)('wraps a string as text/plain and preserves File/Blob size', () => {
+        (0, vitest_1.expect)((0, index_js_1.toUploadBlob)('hello').size).toBe(5);
+        (0, vitest_1.expect)((0, index_js_1.toUploadBlob)('hello').type).toBe('text/plain');
+        const file = new File(['abc'], 'note.txt', { type: 'text/plain' });
+        (0, vitest_1.expect)((0, index_js_1.toUploadBlob)(file).size).toBe(3);
+    });
+});
+(0, vitest_1.describe)('uploadFile', () => {
+    (0, vitest_1.it)('requests a session then PUTs the bytes to the presigned URL', async () => {
+        const file = new File(['hello-world'], 'hello.txt', { type: 'text/plain' });
+        fetchMock
+            .mockResolvedValueOnce({
+            ok: true,
+            json: async () => ({
+                success: true,
+                presignedUrl: 'https://s3.example.com/put',
+                fileUrl: 'https://uploads.zite.com/orgid-1/zite-uploads/app_123/hello.txt',
+                contentType: 'text/plain',
+            }),
+        })
+            .mockResolvedValueOnce({ ok: true });
+        const result = await (0, index_js_1.uploadFile)({ data: file, filename: 'hello.txt' });
+        (0, vitest_1.expect)(result.fileUrl).toContain('hello.txt');
+        (0, vitest_1.expect)(fetchMock).toHaveBeenCalledTimes(2);
+        (0, vitest_1.expect)(fetchMock.mock.calls[0][0]).toBe('https://api.example.com/v1/zite/public/app_123/upload-session?mode=live');
+        const sessionInit = fetchMock.mock.calls[0][1];
+        (0, vitest_1.expect)(JSON.parse(sessionInit.body)).toEqual({
+            filename: 'hello.txt',
+            uploadLength: 11,
+            contentType: 'text/plain',
+        });
+        (0, vitest_1.expect)(fetchMock.mock.calls[1][0]).toBe('https://s3.example.com/put');
+        (0, vitest_1.expect)(fetchMock.mock.calls[1][1].method).toBe('PUT');
+    });
+    (0, vitest_1.it)('surfaces the plan-limit message from the session endpoint', async () => {
+        fetchMock.mockResolvedValueOnce({
+            ok: false,
+            json: async () => ({
+                message: 'File size exceeds maximum of 20 MB',
+            }),
+        });
+        const upload = (0, index_js_1.uploadFile)({
+            data: new File(['x'], 'big.bin'),
+            filename: 'big.bin',
+        });
+        await (0, vitest_1.expect)(upload).rejects.toBeInstanceOf(index_js_1.FileUploadError);
+        await (0, vitest_1.expect)(upload).rejects.toThrow('File size exceeds maximum of 20 MB');
+    });
+});

package/dist/esm/auth/useAuth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/auth/useAuth.test.js

@@ -0,0 +1,94 @@
+import { describe, it, expect, afterEach, beforeEach, vi } from 'vitest';
+/**
+ * The signed-out redirect on internal apps.
+ *
+ * A separate file from `index.test.ts` because it has to replace
+ * `better-auth/react` wholesale to drive `useSession`, and that would strip the
+ * real client the export tests next door assert against.
+ *
+ * The value here is entirely in WHICH signed-out renders it reacts to. An
+ * external app has a real logged-out state, and an app built before the
+ * platform sent an access mode tells us nothing — redirecting either turns a
+ * working public page into a forced sign-in.
+ */
+const { useSessionMock } = vi.hoisted(() => ({ useSessionMock: vi.fn() }));
+vi.mock('better-auth/react', () => ({
+    createAuthClient: () => ({
+        useSession: useSessionMock,
+        signIn: {},
+        signUp: {},
+        signOut: vi.fn(),
+        updateUser: vi.fn(),
+    }),
+}));
+vi.mock('better-auth/client/plugins', () => ({
+    magicLinkClient: () => ({}),
+    inferAdditionalFields: () => ({}),
+}));
+// `useAuth` takes only `useEffect` from React. Running it inline is the whole
+// of what a render would do here, and avoids pulling in a renderer.
+vi.mock('react', () => ({ useEffect: (fn) => fn() }));
+import { useAuth } from './index.js';
+const APP_URL = 'https://app.zite.so/dashboard';
+function stubLocation(href) {
+    const location = { pathname: new URL(href).pathname, href };
+    vi.stubGlobal('window', { location });
+    return location;
+}
+const signedOut = { data: null, isPending: false };
+beforeEach(() => {
+    delete process.env.ZITE_ACCESS_MODE;
+});
+afterEach(() => {
+    delete process.env.ZITE_ACCESS_MODE;
+    vi.unstubAllGlobals();
+    useSessionMock.mockReset();
+});
+const render = (session, { accessMode, href = APP_URL } = {}) => {
+    if (accessMode !== undefined)
+        process.env.ZITE_ACCESS_MODE = accessMode;
+    const location = stubLocation(href);
+    useSessionMock.mockReturnValue(session);
+    return { result: useAuth(), location };
+};
+describe('useAuth signed-out handling', () => {
+    it('sends a signed-out visitor on an internal app to sign-in', () => {
+        const { result, location } = render(signedOut, { accessMode: 'internal' });
+        expect(location.href.startsWith('/auth/login')).toBe(true);
+        // Reported as loading rather than signed out: the signed-out branch of an
+        // internal app is the empty screen this exists to prevent.
+        expect(result.isLoading).toBe(true);
+    });
+    it('leaves a signed-out visitor on an external app alone', () => {
+        const { result, location } = render(signedOut, { accessMode: 'external' });
+        expect(location.href).toBe(APP_URL);
+        expect(result.isLoading).toBe(false);
+        expect(result.user).toBe(null);
+    });
+    // Every app published before the platform started sending an access mode.
+    it('leaves an app that never declared an access mode alone', () => {
+        const { result, location } = render(signedOut);
+        expect(location.href).toBe(APP_URL);
+        expect(result.isLoading).toBe(false);
+    });
+    it('does not redirect while the session is still resolving', () => {
+        const { result, location } = render({ data: null, isPending: true }, { accessMode: 'internal' });
+        expect(location.href).toBe(APP_URL);
+        expect(result.isLoading).toBe(true);
+    });
+    it('does not redirect a signed-in visitor', () => {
+        const { result, location } = render({ data: { user: { id: 'u1', email: 'a@b.com' } }, isPending: false }, { accessMode: 'internal' });
+        expect(location.href).toBe(APP_URL);
+        expect(result.isLoading).toBe(false);
+        expect(result.user).toMatchObject({ id: 'u1' });
+    });
+    // `loginWithRedirect` refuses to navigate away from an auth page, so claiming
+    // a redirect here would hang the caller on `isLoading` forever.
+    it('does not claim to be loading on an auth page it cannot leave', () => {
+        const { result } = render(signedOut, {
+            accessMode: 'internal',
+            href: 'https://app.zite.so/auth/login',
+        });
+        expect(result.isLoading).toBe(false);
+    });
+});

package/dist/esm/dev/index.js

@@ -2,7 +2,7 @@ import { watch } from "fs";
 import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync, } from "fs";
 import { join } from "path";
 import { runSync } from "../sync/index.js";
-import { generateDbTs, generateApiTs, generateBackendWrapperTs, generateAirtableTs, generateEmailSdk, } from "../sync/lib.js";
+import { generateDbTs, generateApiTs, generateBackendWrapperTs, generateAirtableTs, findEmailIntegrationId, generateEmailSdk, } from "../sync/lib.js";
 const debounceTimers = new Map();
 function debounce(key, fn, ms) {
     const existing = debounceTimers.get(key);
@@ -29,24 +29,18 @@ function getFlowId(appDir) {
     catch { }
     return undefined;
 }
-/**
- * Find the connected email integration's key in an app's zite.config.json,
- * if any. The key is the integrationId used by the runtime SDK bridge.
- */
-function getEmailIntegrationId(appDir) {
+const readJsonFile = (path) => {
     try {
-        const configPath = join("apps", appDir, "zite.config.json");
-        if (!existsSync(configPath))
-            return undefined;
-        const config = JSON.parse(readFileSync(configPath, "utf-8"));
-        const integrations = config.integrations ?? {};
-        for (const [id, int] of Object.entries(integrations)) {
-            if (int?.type === "email")
-                return id;
-        }
+        return existsSync(path)
+            ? JSON.parse(readFileSync(path, "utf-8"))
+            : undefined;
     }
-    catch { }
-    return undefined;
+    catch {
+        return undefined;
+    }
+};
+function getEmailIntegrationId(appDir) {
+    return findEmailIntegrationId(readJsonFile(join("apps", appDir, "zite.config.json")), readJsonFile("zite.config.json"));
 }
 function getDeclaredEnvVarNames(appDir) {
     try {

package/dist/esm/sync/lib.d.ts

@@ -82,6 +82,12 @@ export declare function normalizeAirtableLockNames(lock: AirtableLock): {
 };
 export declare function generateAirtableTs(inputLock: AirtableLock): string | null;
 export declare function generateBackendWrapperTs(envVarNames?: string[]): string;
+/**
+ * The key of the email integration an app sends through, which is the
+ * integrationId the runtime SDK bridge dispatches on. The app's own entry wins;
+ * otherwise it is the workspace email the app has `integrationSettings` for.
+ */
+export declare function findEmailIntegrationId(appConfig: unknown, workspaceConfig: unknown): string | undefined;
 /**
  * Generate `.zite/integrations/email.ts` — the `Email` client for an app with
  * an email integration connected. Mirrors the airtable SDK generation: a thin

package/dist/esm/sync/lib.js

@@ -1333,6 +1333,18 @@ export function generateBackendWrapperTs(envVarNames = []) {
         "",
     ].join("\n");
 }
+/**
+ * The key of the email integration an app sends through, which is the
+ * integrationId the runtime SDK bridge dispatches on. The app's own entry wins;
+ * otherwise it is the workspace email the app has `integrationSettings` for.
+ */
+export function findEmailIntegrationId(appConfig, workspaceConfig) {
+    const app = (appConfig ?? {});
+    const workspace = (workspaceConfig ?? {});
+    const isEmail = (config, id) => config.integrations?.[id]?.type === "email";
+    return (Object.keys(app.integrations ?? {}).find((id) => isEmail(app, id)) ??
+        Object.keys(app.integrationSettings ?? {}).find((id) => isEmail(workspace, id)));
+}
 /**
  * Generate `.zite/integrations/email.ts` — the `Email` client for an app with
  * an email integration connected. Mirrors the airtable SDK generation: a thin

package/dist/esm/sync/lib.test.js

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import ts from 'typescript';
-import { generateAirtableTs, generateApiTs, generateBackendWrapperTs, generateDbTs, generateEmailSdk, } from './lib.js';
+import { findEmailIntegrationId, generateAirtableTs, generateApiTs, generateBackendWrapperTs, generateDbTs, generateEmailSdk, } from './lib.js';
 /**
  * Syntax errors in the emitted source. `.zite/db.ts` sits at the repo root and
  * every app imports it, so anything unparseable here fails typecheck for the
@@ -380,3 +380,31 @@ describe('generateBackendWrapperTs', () => {
         expect(output).toContain('ZiteError');
     });
 });
+describe('findEmailIntegrationId', () => {
+    const workspace = {
+        integrations: {
+            slack: { type: 'slack' },
+            'team-email': { type: 'email' },
+        },
+    };
+    it('finds the app\'s own email entry', () => {
+        expect(findEmailIntegrationId({ integrations: { mail: { type: 'email' } } }, workspace)).toBe('mail');
+    });
+    it('finds the workspace email the app has settings for', () => {
+        expect(findEmailIntegrationId({ integrationSettings: { slack: {}, 'team-email': { fromName: 'Ops' } } }, workspace)).toBe('team-email');
+    });
+    // An app that never opted in generates no client, so `zitejs/email` stays
+    // unresolved there instead of sending as a sender it never chose.
+    it('ignores a workspace email the app has no settings for', () => {
+        expect(findEmailIntegrationId({}, workspace)).toBeUndefined();
+    });
+    it('prefers the app\'s own entry over a workspace one', () => {
+        expect(findEmailIntegrationId({
+            integrations: { mail: { type: 'email' } },
+            integrationSettings: { 'team-email': {} },
+        }, workspace)).toBe('mail');
+    });
+    it('tolerates missing configs', () => {
+        expect(findEmailIntegrationId(undefined, undefined)).toBeUndefined();
+    });
+});

package/dist/esm/upload/index.d.ts

@@ -2,6 +2,7 @@ export type UploadData = string | Blob | ArrayBuffer | File;
 export declare class FileUploadError extends Error {
     constructor(message: string);
 }
+export declare function toUploadBlob(data: UploadData): Blob;
 export declare function uploadFile({ data, filename, }: {
     data: UploadData;
     filename: string;

package/dist/esm/upload/index.js

@@ -18,33 +18,35 @@ function getZiteAppMode(hostname) {
     }
     return 'live';
 }
-function readBlobAsDataUrl(blob) {
-    return new Promise((resolve, reject) => {
-        const reader = new FileReader();
-        reader.onload = () => resolve(reader.result);
-        reader.onerror = () => reject(reader.error ?? new Error('Failed to read file'));
-        reader.readAsDataURL(blob);
-    });
+function decodeDataUrl(dataUrl) {
+    const comma = dataUrl.indexOf(',');
+    if (comma === -1) {
+        throw new FileUploadError('Invalid data URL');
+    }
+    const header = dataUrl.slice(0, comma);
+    const payload = dataUrl.slice(comma + 1);
+    const mimeMatch = /^data:([^;,]*)/.exec(header);
+    const mimeType = mimeMatch?.[1] || 'application/octet-stream';
+    const bytes = Uint8Array.from(atob(payload), c => c.charCodeAt(0));
+    return new Blob([bytes], { type: mimeType });
 }
-async function toDataUrl(data) {
-    if (data instanceof Blob) {
-        return readBlobAsDataUrl(data);
+export function toUploadBlob(data) {
+    if (typeof Blob !== 'undefined' && data instanceof Blob) {
+        return data;
     }
     if (data instanceof ArrayBuffer) {
-        const bytes = new Uint8Array(data);
-        let binary = '';
-        for (let i = 0; i < bytes.byteLength; i++) {
-            binary += String.fromCharCode(bytes[i]);
-        }
-        return 'data:application/octet-stream;base64,' + btoa(binary);
+        return new Blob([data], { type: 'application/octet-stream' });
     }
     if (typeof data === 'string') {
         if (data.startsWith('data:'))
-            return data;
-        if (/^[A-Za-z0-9+/]+=*$/.test(data)) {
-            return 'data:application/octet-stream;base64,' + data;
+            return decodeDataUrl(data);
+        // Only treat as raw base64 when the string is padded/aligned — otherwise
+        // short text like "hello" matches the alphabet and atob throws.
+        if (data.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(data)) {
+            const bytes = Uint8Array.from(atob(data), c => c.charCodeAt(0));
+            return new Blob([bytes], { type: 'application/octet-stream' });
         }
-        return 'data:text/plain;base64,' + btoa(unescape(encodeURIComponent(data)));
+        return new Blob([data], { type: 'text/plain' });
     }
     throw new FileUploadError('Invalid data format. Expected string, Blob, ArrayBuffer, or File.');
 }
@@ -56,36 +58,55 @@ function resolveFilename(data, filename) {
     }
     throw new FileUploadError('A filename is required unless the uploaded data is a File.');
 }
-async function performUpload(data, filename) {
-    const body = await toDataUrl(data);
-    const mode = getZiteAppMode(window.location.hostname);
-    const flowId = getFlowId();
+async function readErrorMessage(res, fallback) {
+    try {
+        const err = (await res.json());
+        if (err.message)
+            return err.message;
+    }
+    catch { }
+    return fallback;
+}
+function authHeaders() {
     const token = typeof localStorage !== 'undefined'
         ? localStorage.getItem('zite.auth.token')
         : null;
-    const res = await fetch(getApiUrl() + '/v1/zite/public/' + flowId + '/upload?mode=' + mode, {
+    return token ? { Authorization: 'Bearer ' + token } : {};
+}
+async function performUpload(data, filename) {
+    const blob = toUploadBlob(data);
+    const mode = getZiteAppMode(window.location.hostname);
+    const flowId = getFlowId();
+    const sessionRes = await fetch(getApiUrl() + '/v1/zite/public/' + flowId + '/upload-session?mode=' + mode, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            ...(token ? { Authorization: 'Bearer ' + token } : {}),
+            ...authHeaders(),
         },
-        body: JSON.stringify({ data: body, filename }),
+        body: JSON.stringify({
+            filename,
+            uploadLength: blob.size,
+            contentType: blob.type || 'application/octet-stream',
+        }),
     });
-    if (!res.ok) {
-        let message = 'Upload failed';
-        try {
-            const err = (await res.json());
-            if (err.message)
-                message = err.message;
-        }
-        catch { }
-        throw new FileUploadError(message);
+    if (!sessionRes.ok) {
+        throw new FileUploadError(await readErrorMessage(sessionRes, 'Upload failed'));
     }
-    const result = (await res.json());
-    if (!result.success || !result.fileUrl) {
-        throw new FileUploadError(result.message ?? 'Upload failed');
+    const session = (await sessionRes.json());
+    if (!session.success || !session.presignedUrl || !session.fileUrl) {
+        throw new FileUploadError(session.message ?? 'Upload failed');
+    }
+    const putRes = await fetch(session.presignedUrl, {
+        method: 'PUT',
+        headers: {
+            'Content-Type': session.contentType || blob.type || 'application/octet-stream',
+        },
+        body: blob,
+    });
+    if (!putRes.ok) {
+        throw new FileUploadError('Upload failed');
     }
-    return result.fileUrl;
+    return session.fileUrl;
 }
 export async function uploadFile({ data, filename, }) {
     return { fileUrl: await performUpload(data, filename) };

package/dist/esm/upload/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/upload/index.test.js

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { FileUploadError, toUploadBlob, uploadFile } from './index.js';
+vi.mock('../auth/config.js', () => ({
+    getApiUrl: () => 'https://api.example.com',
+    getFlowId: () => 'app_123',
+}));
+const fetchMock = vi.fn();
+beforeEach(() => {
+    fetchMock.mockReset();
+    vi.stubGlobal('fetch', fetchMock);
+    vi.stubGlobal('window', { location: { hostname: 'portal.acme.com' } });
+    vi.stubGlobal('localStorage', { getItem: () => null });
+});
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe('toUploadBlob', () => {
+    it('wraps a string as text/plain and preserves File/Blob size', () => {
+        expect(toUploadBlob('hello').size).toBe(5);
+        expect(toUploadBlob('hello').type).toBe('text/plain');
+        const file = new File(['abc'], 'note.txt', { type: 'text/plain' });
+        expect(toUploadBlob(file).size).toBe(3);
+    });
+});
+describe('uploadFile', () => {
+    it('requests a session then PUTs the bytes to the presigned URL', async () => {
+        const file = new File(['hello-world'], 'hello.txt', { type: 'text/plain' });
+        fetchMock
+            .mockResolvedValueOnce({
+            ok: true,
+            json: async () => ({
+                success: true,
+                presignedUrl: 'https://s3.example.com/put',
+                fileUrl: 'https://uploads.zite.com/orgid-1/zite-uploads/app_123/hello.txt',
+                contentType: 'text/plain',
+            }),
+        })
+            .mockResolvedValueOnce({ ok: true });
+        const result = await uploadFile({ data: file, filename: 'hello.txt' });
+        expect(result.fileUrl).toContain('hello.txt');
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        expect(fetchMock.mock.calls[0][0]).toBe('https://api.example.com/v1/zite/public/app_123/upload-session?mode=live');
+        const sessionInit = fetchMock.mock.calls[0][1];
+        expect(JSON.parse(sessionInit.body)).toEqual({
+            filename: 'hello.txt',
+            uploadLength: 11,
+            contentType: 'text/plain',
+        });
+        expect(fetchMock.mock.calls[1][0]).toBe('https://s3.example.com/put');
+        expect(fetchMock.mock.calls[1][1].method).toBe('PUT');
+    });
+    it('surfaces the plan-limit message from the session endpoint', async () => {
+        fetchMock.mockResolvedValueOnce({
+            ok: false,
+            json: async () => ({
+                message: 'File size exceeds maximum of 20 MB',
+            }),
+        });
+        const upload = uploadFile({
+            data: new File(['x'], 'big.bin'),
+            filename: 'big.bin',
+        });
+        await expect(upload).rejects.toBeInstanceOf(FileUploadError);
+        await expect(upload).rejects.toThrow('File size exceeds maximum of 20 MB');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.118",
+  "version": "0.9.120",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",