zitejs 0.9.13 → 0.9.15

package/dist/cjs/bundle/index.js

@@ -0,0 +1,476 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBundle = runBundle;
+/**
+ * `npx zitejs bundle` — Bundle endpoint files for cloudflare-lambda deployment.
+ *
+ * Replaces the legacy `scripts/bundle-endpoints.js` from zitejs-starter.
+ * Reads endpoints from src/api/*.ts, resolves SDK imports via .zite/backend.ts
+ * (monorepo) or src/__zite__/integrations.ts (legacy), and outputs bundled ESM
+ * code suitable for the cloudflare-lambda worker runtime.
+ *
+ * Usage:
+ *   npx zitejs bundle                     # bundle all endpoints
+ *   npx zitejs bundle --app admin-panel   # bundle endpoints for a specific app
+ *   npx zitejs bundle --script <path>     # bundle a one-off script
+ *
+ * Output: JSON to stdout
+ *   { bundledEndpoints: Record<string, string>, endpointErrors?: Record<string, string> }
+ *   or for --script: { bundledCode: string } or { error: string }
+ *
+ * Dependencies (add to zitejs package.json):
+ *   "esbuild": "^0.25.0"
+ *   "@babel/parser": "^7.26.0"
+ */
+const esbuild = __importStar(require("esbuild"));
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const parser_1 = require("@babel/parser");
+const _NODE_BUILTIN_NAMES = [
+    'http', 'https', 'http2', 'stream', 'buffer', 'util', 'events', 'crypto',
+    'path', 'fs', 'url', 'querystring', 'zlib', 'net', 'tls', 'os', 'assert',
+    'process', 'child_process', 'cluster', 'dgram', 'dns', 'inspector', 'module',
+    'perf_hooks', 'readline', 'repl', 'string_decoder', 'timers', 'tty', 'v8',
+    'vm', 'worker_threads', 'async_hooks', 'trace_events', 'punycode',
+];
+const NODE_BUILTINS = _NODE_BUILTIN_NAMES.flatMap(m => [m, `node:${m}`]);
+const PREBUNDLED_LIBS = {
+    '@zite/endpoints-runtime-sdk': '__zite-runtime__.js',
+    'zod': '__zod__.js',
+    'openai': '__openai__.js',
+    '@anthropic-ai/sdk': '__anthropic__.js',
+    'stripe': '__stripe__.js',
+    'airtable': '__airtable__.js',
+    '@notionhq/client': '__notion__.js',
+    '@slack/web-api': '__slack__.js',
+    'googleapis': '__googleapis__.js',
+    '@mailchimp/mailchimp_marketing': '__mailchimp__.js',
+    '@hubspot/api-client': '__hubspot__.js',
+    'jsforce': '__jsforce__.js',
+    '@linear/sdk': '__linear__.js',
+    '@microsoft/microsoft-graph-client': '__microsoft-graph__.js',
+    'twilio': '__twilio__.js',
+    'intercom-client': '__intercom__.js',
+    '@google/generative-ai': '__gemini__.js',
+};
+const BASE_BUILD_OPTIONS = {
+    bundle: true,
+    write: false,
+    format: 'esm',
+    platform: 'neutral',
+    target: 'es2022',
+    treeShaking: true,
+    external: NODE_BUILTINS,
+    mainFields: ['module', 'main'],
+    conditions: ['worker', 'browser', 'import', 'default'],
+};
+function getUsedSdkImports(endpointCode) {
+    try {
+        const ast = (0, parser_1.parse)(endpointCode, {
+            sourceType: 'module',
+            plugins: ['typescript'],
+        });
+        const usedImports = new Set();
+        const sdkSources = [
+            'zite-integrations-backend-sdk',
+            'zitejs/backend',
+            'zitejs/backend/base',
+        ];
+        for (const node of ast.program.body) {
+            if (node.type === 'ImportDeclaration' &&
+                sdkSources.includes(node.source.value)) {
+                if (node.importKind === 'type')
+                    continue;
+                for (const spec of node.specifiers) {
+                    if (spec.type === 'ImportSpecifier') {
+                        if (spec.importKind === 'type')
+                            continue;
+                        const importedName = spec.imported.type === 'Identifier'
+                            ? spec.imported.name
+                            : spec.imported.value;
+                        usedImports.add(importedName);
+                    }
+                    else if (spec.type === 'ImportNamespaceSpecifier') {
+                        return null;
+                    }
+                }
+            }
+        }
+        return Array.from(usedImports);
+    }
+    catch {
+        return null;
+    }
+}
+function getSdkExportKinds(sdkCode) {
+    try {
+        const ast = (0, parser_1.parse)(sdkCode, {
+            sourceType: 'module',
+            plugins: ['typescript'],
+        });
+        const typeExports = new Set();
+        const valueExports = new Set();
+        for (const node of ast.program.body) {
+            if (node.type === 'ExportNamedDeclaration') {
+                if (node.declaration?.type === 'TSTypeAliasDeclaration') {
+                    typeExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'TSInterfaceDeclaration') {
+                    typeExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'ClassDeclaration' && node.declaration.id) {
+                    valueExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'FunctionDeclaration' && node.declaration.id) {
+                    valueExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'VariableDeclaration') {
+                    for (const decl of node.declaration.declarations) {
+                        if (decl.id.type === 'Identifier') {
+                            valueExports.add(decl.id.name);
+                        }
+                    }
+                }
+                else if (node.specifiers && node.specifiers.length > 0) {
+                    for (const spec of node.specifiers) {
+                        if (spec.type === 'ExportSpecifier') {
+                            const name = spec.exported.type === 'Identifier'
+                                ? spec.exported.name
+                                : spec.exported.value;
+                            if (spec.exportKind === 'type') {
+                                typeExports.add(name);
+                            }
+                            else {
+                                valueExports.add(name);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        return { typeExports, valueExports };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the backend SDK file path. Tries monorepo layout first
+ * (.zite/backend.ts), falls back to legacy (__zite__/integrations.ts).
+ */
+function findSdkPath(baseDir) {
+    const monorepoPath = path.resolve(baseDir, '.zite/backend.ts');
+    if (fs.existsSync(monorepoPath))
+        return monorepoPath;
+    const legacyPath = path.resolve(baseDir, 'src/__zite__/integrations.ts');
+    if (fs.existsSync(legacyPath))
+        return legacyPath;
+    return null;
+}
+/**
+ * Determine which import source the endpoint uses for the SDK.
+ * Returns the source string so we can generate the correct wrapper.
+ */
+function getSdkImportSource(baseDir) {
+    if (fs.existsSync(path.resolve(baseDir, '.zite/backend.ts'))) {
+        return 'zitejs/backend';
+    }
+    return 'zite-integrations-backend-sdk';
+}
+function createAliasPlugin(opts) {
+    return {
+        name: 'zite-alias',
+        setup(build) {
+            const sdkSources = [
+                /^zite-integrations-backend-sdk$/,
+                /^zitejs\/backend$/,
+                /^zitejs\/backend\/base$/,
+            ];
+            for (const filter of sdkSources) {
+                build.onResolve({ filter }, () => {
+                    if (opts.sdkPath)
+                        return { path: path.resolve(opts.sdkPath) };
+                    if (opts.baseDir) {
+                        const sdkPath = findSdkPath(opts.baseDir);
+                        if (sdkPath)
+                            return { path: sdkPath };
+                    }
+                    return { path: 'zitejs/backend', external: true };
+                });
+            }
+            // Resolve zitejs/db to .zite/db.ts
+            build.onResolve({ filter: /^zitejs\/db$/ }, () => {
+                if (opts.baseDir) {
+                    const dbPath = path.resolve(opts.baseDir, '.zite/db.ts');
+                    if (fs.existsSync(dbPath))
+                        return { path: dbPath };
+                }
+                return { path: 'zitejs/db', external: true };
+            });
+            // Resolve zitejs/runtime
+            build.onResolve({ filter: /^zitejs\/runtime$/ }, () => {
+                return { path: 'zitejs/runtime', external: true };
+            });
+            for (const [pkgName, modulePath] of Object.entries(PREBUNDLED_LIBS)) {
+                const escapedName = pkgName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                const filter = new RegExp(`^${escapedName}$`);
+                build.onResolve({ filter }, () => ({
+                    path: `./${modulePath}`,
+                    external: true,
+                }));
+            }
+        },
+    };
+}
+function generateEndpointWrapper(endpointName, usedImports, sdkExportKinds, sdkSource) {
+    if (usedImports === null) {
+        return `
+import * as sdk from '${sdkSource}';
+Object.assign(globalThis, sdk);
+import endpoint from './api/${endpointName}';
+globalThis.__endpoint = endpoint;
+`;
+    }
+    if (usedImports.length === 0) {
+        return `
+import endpoint from './api/${endpointName}';
+globalThis.__endpoint = endpoint;
+`;
+    }
+    const typeImports = [];
+    const valueImports = [];
+    for (const name of usedImports) {
+        if (sdkExportKinds?.typeExports.has(name)) {
+            typeImports.push(name);
+        }
+        else {
+            valueImports.push(name);
+        }
+    }
+    const importStatements = [];
+    if (typeImports.length > 0) {
+        importStatements.push(`import type { ${typeImports.join(', ')} } from '${sdkSource}';`);
+    }
+    if (valueImports.length > 0) {
+        importStatements.push(`import { ${valueImports.join(', ')} } from '${sdkSource}';`);
+    }
+    const globalAssign = valueImports.length > 0
+        ? `Object.assign(globalThis, { ${valueImports.join(', ')} });`
+        : '';
+    return `
+${importStatements.join('\n')}
+${globalAssign}
+import endpoint from './api/${endpointName}';
+globalThis.__endpoint = endpoint;
+`;
+}
+async function bundleEndpointsImpl(baseDir, endpointNames) {
+    const bundledEndpoints = {};
+    const endpointErrors = {};
+    const aliasPlugin = createAliasPlugin({ baseDir });
+    const sdkSource = getSdkImportSource(baseDir);
+    let sdkExportKinds = null;
+    try {
+        const sdkPath = findSdkPath(baseDir);
+        if (sdkPath) {
+            const sdkCode = fs.readFileSync(sdkPath, 'utf-8');
+            sdkExportKinds = getSdkExportKinds(sdkCode);
+        }
+    }
+    catch { }
+    for (const name of endpointNames) {
+        let usedImports = null;
+        try {
+            const endpointPath = path.join(baseDir, 'src', 'api', `${name}.ts`);
+            const endpointCode = fs.readFileSync(endpointPath, 'utf-8');
+            usedImports = getUsedSdkImports(endpointCode);
+        }
+        catch { }
+        const wrapperCode = generateEndpointWrapper(name, usedImports, sdkExportKinds, sdkSource);
+        try {
+            const result = await esbuild.build({
+                ...BASE_BUILD_OPTIONS,
+                stdin: {
+                    contents: wrapperCode,
+                    resolveDir: `${baseDir}/src`,
+                    loader: 'ts',
+                },
+                logLevel: 'warning',
+                plugins: [aliasPlugin],
+            });
+            if (result.warnings && result.warnings.length > 0) {
+                const msgs = result.warnings.map(w => `${w.location?.file || 'unknown'}:${w.location?.line || '?'} - ${w.text}`);
+                endpointErrors[name] = `Warnings: ${msgs.join('; ')}`;
+            }
+            if (result.outputFiles && result.outputFiles.length > 0) {
+                bundledEndpoints[name] = result.outputFiles[0].text;
+            }
+            else {
+                endpointErrors[name] = 'No output generated';
+            }
+        }
+        catch (err) {
+            const e = err;
+            if (e.errors && Array.isArray(e.errors)) {
+                const msgs = e.errors.map(er => {
+                    const loc = er.location
+                        ? `${er.location.file || 'unknown'}:${er.location.line || '?'}:${er.location.column || '?'}`
+                        : 'unknown';
+                    return `${loc} - ${er.text}`;
+                });
+                endpointErrors[name] = msgs.join('\n');
+            }
+            else {
+                endpointErrors[name] = e.message || String(err);
+            }
+        }
+    }
+    console.log(JSON.stringify({
+        bundledEndpoints,
+        endpointErrors: Object.keys(endpointErrors).length > 0 ? endpointErrors : undefined,
+    }));
+}
+async function bundleOneOffScriptImpl(scriptPath, sdkPath) {
+    const rawScript = fs.readFileSync(scriptPath, 'utf-8');
+    const plugin = createAliasPlugin({ sdkPath });
+    let importSection = '';
+    let bodySection = rawScript;
+    try {
+        const ast = (0, parser_1.parse)(rawScript, {
+            sourceType: 'module',
+            plugins: ['typescript'],
+            allowReturnOutsideFunction: true,
+        });
+        let lastImportEnd = 0;
+        for (const node of ast.program.body) {
+            if (node.type === 'ImportDeclaration' && node.end) {
+                lastImportEnd = node.end;
+            }
+        }
+        if (lastImportEnd > 0) {
+            importSection = rawScript.slice(0, lastImportEnd);
+            bodySection = rawScript.slice(lastImportEnd);
+        }
+    }
+    catch { }
+    const wrappedScript = `${importSection}
+export async function execute() {
+${bodySection}
+}`;
+    try {
+        const result = await esbuild.build({
+            ...BASE_BUILD_OPTIONS,
+            stdin: {
+                contents: wrappedScript,
+                loader: 'ts',
+                resolveDir: process.cwd(),
+            },
+            minify: false,
+            logLevel: 'silent',
+            plugins: [plugin],
+        });
+        if (result.errors.length > 0) {
+            console.log(JSON.stringify({ error: result.errors.map(e => e.text).join('\n') }));
+            process.exit(1);
+        }
+        if (!result.outputFiles || result.outputFiles.length === 0) {
+            console.log(JSON.stringify({ error: 'esbuild produced no output' }));
+            process.exit(1);
+        }
+        const esbuildOutput = result.outputFiles[0].text;
+        console.log(JSON.stringify({
+            bundledCode: `${esbuildOutput}\nglobalThis.__endpoint = { execute };\n`,
+        }));
+    }
+    catch (err) {
+        const e = err;
+        if (e.errors && Array.isArray(e.errors)) {
+            const msgs = e.errors.map(er => {
+                const loc = er.location
+                    ? `${er.location.file || 'unknown'}:${er.location.line || '?'}`
+                    : 'unknown';
+                return `${loc} - ${er.text}`;
+            });
+            console.log(JSON.stringify({ error: msgs.join('\n') }));
+        }
+        else {
+            console.log(JSON.stringify({ error: e.message || String(err) }));
+        }
+        process.exit(1);
+    }
+}
+async function runBundle() {
+    const args = process.argv.slice(3); // skip 'node', 'zitejs', 'bundle'
+    const scriptFlagIndex = args.indexOf('--script');
+    if (scriptFlagIndex !== -1) {
+        const scriptPath = args[scriptFlagIndex + 1];
+        if (!scriptPath) {
+            console.log(JSON.stringify({ error: 'Usage: zitejs bundle --script <path> [--sdk <path>]' }));
+            process.exit(1);
+        }
+        const sdkFlagIndex = args.indexOf('--sdk');
+        const sdkPath = sdkFlagIndex !== -1 ? args[sdkFlagIndex + 1] : undefined;
+        return bundleOneOffScriptImpl(scriptPath, sdkPath);
+    }
+    // Endpoint mode: find all endpoints and bundle them
+    const appFlag = args.indexOf('--app');
+    let baseDir = process.cwd();
+    if (appFlag !== -1 && args[appFlag + 1]) {
+        baseDir = path.resolve(baseDir, 'apps', args[appFlag + 1]);
+    }
+    // If explicit endpoint names passed, use those; otherwise find all
+    const explicitNames = args.filter(a => !a.startsWith('--'));
+    let endpointNames;
+    if (explicitNames.length > 0) {
+        endpointNames = explicitNames;
+    }
+    else {
+        const apiDir = path.join(baseDir, 'src', 'api');
+        if (!fs.existsSync(apiDir)) {
+            console.log(JSON.stringify({ bundledEndpoints: {} }));
+            return;
+        }
+        endpointNames = fs
+            .readdirSync(apiDir)
+            .filter(f => f.endsWith('.ts'))
+            .map(f => f.replace('.ts', ''));
+    }
+    if (endpointNames.length === 0) {
+        console.log(JSON.stringify({ bundledEndpoints: {} }));
+        return;
+    }
+    return bundleEndpointsImpl(baseDir, endpointNames);
+}

package/dist/cjs/caller/index.js

@@ -11,19 +11,36 @@ function getRunnerUrl() {
     const env = (0, env_js_1.getEnv)('ZITE_ENV', 'VITE_ZITE_ENV') ?? 'production';
     return (0, env_js_1.getEnv)('ZITE_RUNNER_URL', 'VITE_ZITE_RUNNER_URL') ?? ENVIRONMENTS[env] ?? ENVIRONMENTS.production;
 }
-function getToken() {
-    return (0, env_js_1.getEnv)('ZITE_DB_TOKEN', 'VITE_ZITE_DB_TOKEN') ?? '';
+/**
+ * Get the user's usage token for endpoint auth.
+ * In internal mode: injected by app-runtime as window._ziteUsageToken
+ * In external mode: stored in localStorage by the auth flow
+ */
+function getUsageToken() {
+    if (typeof window !== 'undefined') {
+        const win = window;
+        if (typeof win._ziteUsageToken === 'string')
+            return win._ziteUsageToken;
+    }
+    // Fallback to stored auth token (external mode)
+    if (typeof localStorage !== 'undefined') {
+        const stored = localStorage.getItem('zite.auth.token');
+        if (stored)
+            return stored;
+    }
+    return '';
 }
 function createCaller(endpoint, name, flowId) {
     return async (input) => {
         const appId = flowId ?? (0, env_js_1.getEnv)('ZITE_FLOW_ID', 'VITE_ZITE_FLOW_ID') ?? '';
+        const token = getUsageToken();
         const res = await fetch(getRunnerUrl() + '/public/' + appId + '/api/' + name, {
             method: 'POST',
             headers: {
-                Authorization: `Bearer ${getToken()}`,
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
                 'Content-Type': 'application/json',
             },
-            body: JSON.stringify({ ...input, mode: 'preview', usageToken: getToken() }),
+            body: JSON.stringify({ ...input, mode: 'preview', usageToken: token }),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => '');

package/dist/cjs/cli.js

@@ -55,15 +55,21 @@ async function main() {
             await runCheck();
             break;
         }
+        case 'bundle': {
+            const { runBundle } = await Promise.resolve().then(() => __importStar(require('./bundle/index.js')));
+            await runBundle();
+            break;
+        }
         default:
             console.error(command
                 ? `Unknown command: ${command}`
-                : 'Usage: zitejs <sync|dev|check>');
+                : 'Usage: zitejs <sync|dev|check|bundle>');
             console.error('');
             console.error('Commands:');
             console.error('  sync    Generate .zite/db.ts and .zite/api.ts from your database schema');
             console.error('  dev     Run sync then watch for changes (like npx convex dev)');
             console.error('  check   Run tsc --noEmit and vite build for all apps');
+            console.error('  bundle  Bundle src/api/*.ts endpoints for cloudflare-lambda');
             process.exit(1);
     }
 }

package/dist/esm/bundle/index.d.ts

@@ -0,0 +1 @@
+export declare function runBundle(): Promise<void>;

package/dist/esm/bundle/index.js

@@ -0,0 +1,440 @@
+/**
+ * `npx zitejs bundle` — Bundle endpoint files for cloudflare-lambda deployment.
+ *
+ * Replaces the legacy `scripts/bundle-endpoints.js` from zitejs-starter.
+ * Reads endpoints from src/api/*.ts, resolves SDK imports via .zite/backend.ts
+ * (monorepo) or src/__zite__/integrations.ts (legacy), and outputs bundled ESM
+ * code suitable for the cloudflare-lambda worker runtime.
+ *
+ * Usage:
+ *   npx zitejs bundle                     # bundle all endpoints
+ *   npx zitejs bundle --app admin-panel   # bundle endpoints for a specific app
+ *   npx zitejs bundle --script <path>     # bundle a one-off script
+ *
+ * Output: JSON to stdout
+ *   { bundledEndpoints: Record<string, string>, endpointErrors?: Record<string, string> }
+ *   or for --script: { bundledCode: string } or { error: string }
+ *
+ * Dependencies (add to zitejs package.json):
+ *   "esbuild": "^0.25.0"
+ *   "@babel/parser": "^7.26.0"
+ */
+import * as esbuild from 'esbuild';
+import * as path from 'path';
+import * as fs from 'fs';
+import { parse } from '@babel/parser';
+const _NODE_BUILTIN_NAMES = [
+    'http', 'https', 'http2', 'stream', 'buffer', 'util', 'events', 'crypto',
+    'path', 'fs', 'url', 'querystring', 'zlib', 'net', 'tls', 'os', 'assert',
+    'process', 'child_process', 'cluster', 'dgram', 'dns', 'inspector', 'module',
+    'perf_hooks', 'readline', 'repl', 'string_decoder', 'timers', 'tty', 'v8',
+    'vm', 'worker_threads', 'async_hooks', 'trace_events', 'punycode',
+];
+const NODE_BUILTINS = _NODE_BUILTIN_NAMES.flatMap(m => [m, `node:${m}`]);
+const PREBUNDLED_LIBS = {
+    '@zite/endpoints-runtime-sdk': '__zite-runtime__.js',
+    'zod': '__zod__.js',
+    'openai': '__openai__.js',
+    '@anthropic-ai/sdk': '__anthropic__.js',
+    'stripe': '__stripe__.js',
+    'airtable': '__airtable__.js',
+    '@notionhq/client': '__notion__.js',
+    '@slack/web-api': '__slack__.js',
+    'googleapis': '__googleapis__.js',
+    '@mailchimp/mailchimp_marketing': '__mailchimp__.js',
+    '@hubspot/api-client': '__hubspot__.js',
+    'jsforce': '__jsforce__.js',
+    '@linear/sdk': '__linear__.js',
+    '@microsoft/microsoft-graph-client': '__microsoft-graph__.js',
+    'twilio': '__twilio__.js',
+    'intercom-client': '__intercom__.js',
+    '@google/generative-ai': '__gemini__.js',
+};
+const BASE_BUILD_OPTIONS = {
+    bundle: true,
+    write: false,
+    format: 'esm',
+    platform: 'neutral',
+    target: 'es2022',
+    treeShaking: true,
+    external: NODE_BUILTINS,
+    mainFields: ['module', 'main'],
+    conditions: ['worker', 'browser', 'import', 'default'],
+};
+function getUsedSdkImports(endpointCode) {
+    try {
+        const ast = parse(endpointCode, {
+            sourceType: 'module',
+            plugins: ['typescript'],
+        });
+        const usedImports = new Set();
+        const sdkSources = [
+            'zite-integrations-backend-sdk',
+            'zitejs/backend',
+            'zitejs/backend/base',
+        ];
+        for (const node of ast.program.body) {
+            if (node.type === 'ImportDeclaration' &&
+                sdkSources.includes(node.source.value)) {
+                if (node.importKind === 'type')
+                    continue;
+                for (const spec of node.specifiers) {
+                    if (spec.type === 'ImportSpecifier') {
+                        if (spec.importKind === 'type')
+                            continue;
+                        const importedName = spec.imported.type === 'Identifier'
+                            ? spec.imported.name
+                            : spec.imported.value;
+                        usedImports.add(importedName);
+                    }
+                    else if (spec.type === 'ImportNamespaceSpecifier') {
+                        return null;
+                    }
+                }
+            }
+        }
+        return Array.from(usedImports);
+    }
+    catch {
+        return null;
+    }
+}
+function getSdkExportKinds(sdkCode) {
+    try {
+        const ast = parse(sdkCode, {
+            sourceType: 'module',
+            plugins: ['typescript'],
+        });
+        const typeExports = new Set();
+        const valueExports = new Set();
+        for (const node of ast.program.body) {
+            if (node.type === 'ExportNamedDeclaration') {
+                if (node.declaration?.type === 'TSTypeAliasDeclaration') {
+                    typeExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'TSInterfaceDeclaration') {
+                    typeExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'ClassDeclaration' && node.declaration.id) {
+                    valueExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'FunctionDeclaration' && node.declaration.id) {
+                    valueExports.add(node.declaration.id.name);
+                }
+                else if (node.declaration?.type === 'VariableDeclaration') {
+                    for (const decl of node.declaration.declarations) {
+                        if (decl.id.type === 'Identifier') {
+                            valueExports.add(decl.id.name);
+                        }
+                    }
+                }
+                else if (node.specifiers && node.specifiers.length > 0) {
+                    for (const spec of node.specifiers) {
+                        if (spec.type === 'ExportSpecifier') {
+                            const name = spec.exported.type === 'Identifier'
+                                ? spec.exported.name
+                                : spec.exported.value;
+                            if (spec.exportKind === 'type') {
+                                typeExports.add(name);
+                            }
+                            else {
+                                valueExports.add(name);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        return { typeExports, valueExports };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the backend SDK file path. Tries monorepo layout first
+ * (.zite/backend.ts), falls back to legacy (__zite__/integrations.ts).
+ */
+function findSdkPath(baseDir) {
+    const monorepoPath = path.resolve(baseDir, '.zite/backend.ts');
+    if (fs.existsSync(monorepoPath))
+        return monorepoPath;
+    const legacyPath = path.resolve(baseDir, 'src/__zite__/integrations.ts');
+    if (fs.existsSync(legacyPath))
+        return legacyPath;
+    return null;
+}
+/**
+ * Determine which import source the endpoint uses for the SDK.
+ * Returns the source string so we can generate the correct wrapper.
+ */
+function getSdkImportSource(baseDir) {
+    if (fs.existsSync(path.resolve(baseDir, '.zite/backend.ts'))) {
+        return 'zitejs/backend';
+    }
+    return 'zite-integrations-backend-sdk';
+}
+function createAliasPlugin(opts) {
+    return {
+        name: 'zite-alias',
+        setup(build) {
+            const sdkSources = [
+                /^zite-integrations-backend-sdk$/,
+                /^zitejs\/backend$/,
+                /^zitejs\/backend\/base$/,
+            ];
+            for (const filter of sdkSources) {
+                build.onResolve({ filter }, () => {
+                    if (opts.sdkPath)
+                        return { path: path.resolve(opts.sdkPath) };
+                    if (opts.baseDir) {
+                        const sdkPath = findSdkPath(opts.baseDir);
+                        if (sdkPath)
+                            return { path: sdkPath };
+                    }
+                    return { path: 'zitejs/backend', external: true };
+                });
+            }
+            // Resolve zitejs/db to .zite/db.ts
+            build.onResolve({ filter: /^zitejs\/db$/ }, () => {
+                if (opts.baseDir) {
+                    const dbPath = path.resolve(opts.baseDir, '.zite/db.ts');
+                    if (fs.existsSync(dbPath))
+                        return { path: dbPath };
+                }
+                return { path: 'zitejs/db', external: true };
+            });
+            // Resolve zitejs/runtime
+            build.onResolve({ filter: /^zitejs\/runtime$/ }, () => {
+                return { path: 'zitejs/runtime', external: true };
+            });
+            for (const [pkgName, modulePath] of Object.entries(PREBUNDLED_LIBS)) {
+                const escapedName = pkgName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                const filter = new RegExp(`^${escapedName}$`);
+                build.onResolve({ filter }, () => ({
+                    path: `./${modulePath}`,
+                    external: true,
+                }));
+            }
+        },
+    };
+}
+function generateEndpointWrapper(endpointName, usedImports, sdkExportKinds, sdkSource) {
+    if (usedImports === null) {
+        return `
+import * as sdk from '${sdkSource}';
+Object.assign(globalThis, sdk);
+import endpoint from './api/${endpointName}';
+globalThis.__endpoint = endpoint;
+`;
+    }
+    if (usedImports.length === 0) {
+        return `
+import endpoint from './api/${endpointName}';
+globalThis.__endpoint = endpoint;
+`;
+    }
+    const typeImports = [];
+    const valueImports = [];
+    for (const name of usedImports) {
+        if (sdkExportKinds?.typeExports.has(name)) {
+            typeImports.push(name);
+        }
+        else {
+            valueImports.push(name);
+        }
+    }
+    const importStatements = [];
+    if (typeImports.length > 0) {
+        importStatements.push(`import type { ${typeImports.join(', ')} } from '${sdkSource}';`);
+    }
+    if (valueImports.length > 0) {
+        importStatements.push(`import { ${valueImports.join(', ')} } from '${sdkSource}';`);
+    }
+    const globalAssign = valueImports.length > 0
+        ? `Object.assign(globalThis, { ${valueImports.join(', ')} });`
+        : '';
+    return `
+${importStatements.join('\n')}
+${globalAssign}
+import endpoint from './api/${endpointName}';
+globalThis.__endpoint = endpoint;
+`;
+}
+async function bundleEndpointsImpl(baseDir, endpointNames) {
+    const bundledEndpoints = {};
+    const endpointErrors = {};
+    const aliasPlugin = createAliasPlugin({ baseDir });
+    const sdkSource = getSdkImportSource(baseDir);
+    let sdkExportKinds = null;
+    try {
+        const sdkPath = findSdkPath(baseDir);
+        if (sdkPath) {
+            const sdkCode = fs.readFileSync(sdkPath, 'utf-8');
+            sdkExportKinds = getSdkExportKinds(sdkCode);
+        }
+    }
+    catch { }
+    for (const name of endpointNames) {
+        let usedImports = null;
+        try {
+            const endpointPath = path.join(baseDir, 'src', 'api', `${name}.ts`);
+            const endpointCode = fs.readFileSync(endpointPath, 'utf-8');
+            usedImports = getUsedSdkImports(endpointCode);
+        }
+        catch { }
+        const wrapperCode = generateEndpointWrapper(name, usedImports, sdkExportKinds, sdkSource);
+        try {
+            const result = await esbuild.build({
+                ...BASE_BUILD_OPTIONS,
+                stdin: {
+                    contents: wrapperCode,
+                    resolveDir: `${baseDir}/src`,
+                    loader: 'ts',
+                },
+                logLevel: 'warning',
+                plugins: [aliasPlugin],
+            });
+            if (result.warnings && result.warnings.length > 0) {
+                const msgs = result.warnings.map(w => `${w.location?.file || 'unknown'}:${w.location?.line || '?'} - ${w.text}`);
+                endpointErrors[name] = `Warnings: ${msgs.join('; ')}`;
+            }
+            if (result.outputFiles && result.outputFiles.length > 0) {
+                bundledEndpoints[name] = result.outputFiles[0].text;
+            }
+            else {
+                endpointErrors[name] = 'No output generated';
+            }
+        }
+        catch (err) {
+            const e = err;
+            if (e.errors && Array.isArray(e.errors)) {
+                const msgs = e.errors.map(er => {
+                    const loc = er.location
+                        ? `${er.location.file || 'unknown'}:${er.location.line || '?'}:${er.location.column || '?'}`
+                        : 'unknown';
+                    return `${loc} - ${er.text}`;
+                });
+                endpointErrors[name] = msgs.join('\n');
+            }
+            else {
+                endpointErrors[name] = e.message || String(err);
+            }
+        }
+    }
+    console.log(JSON.stringify({
+        bundledEndpoints,
+        endpointErrors: Object.keys(endpointErrors).length > 0 ? endpointErrors : undefined,
+    }));
+}
+async function bundleOneOffScriptImpl(scriptPath, sdkPath) {
+    const rawScript = fs.readFileSync(scriptPath, 'utf-8');
+    const plugin = createAliasPlugin({ sdkPath });
+    let importSection = '';
+    let bodySection = rawScript;
+    try {
+        const ast = parse(rawScript, {
+            sourceType: 'module',
+            plugins: ['typescript'],
+            allowReturnOutsideFunction: true,
+        });
+        let lastImportEnd = 0;
+        for (const node of ast.program.body) {
+            if (node.type === 'ImportDeclaration' && node.end) {
+                lastImportEnd = node.end;
+            }
+        }
+        if (lastImportEnd > 0) {
+            importSection = rawScript.slice(0, lastImportEnd);
+            bodySection = rawScript.slice(lastImportEnd);
+        }
+    }
+    catch { }
+    const wrappedScript = `${importSection}
+export async function execute() {
+${bodySection}
+}`;
+    try {
+        const result = await esbuild.build({
+            ...BASE_BUILD_OPTIONS,
+            stdin: {
+                contents: wrappedScript,
+                loader: 'ts',
+                resolveDir: process.cwd(),
+            },
+            minify: false,
+            logLevel: 'silent',
+            plugins: [plugin],
+        });
+        if (result.errors.length > 0) {
+            console.log(JSON.stringify({ error: result.errors.map(e => e.text).join('\n') }));
+            process.exit(1);
+        }
+        if (!result.outputFiles || result.outputFiles.length === 0) {
+            console.log(JSON.stringify({ error: 'esbuild produced no output' }));
+            process.exit(1);
+        }
+        const esbuildOutput = result.outputFiles[0].text;
+        console.log(JSON.stringify({
+            bundledCode: `${esbuildOutput}\nglobalThis.__endpoint = { execute };\n`,
+        }));
+    }
+    catch (err) {
+        const e = err;
+        if (e.errors && Array.isArray(e.errors)) {
+            const msgs = e.errors.map(er => {
+                const loc = er.location
+                    ? `${er.location.file || 'unknown'}:${er.location.line || '?'}`
+                    : 'unknown';
+                return `${loc} - ${er.text}`;
+            });
+            console.log(JSON.stringify({ error: msgs.join('\n') }));
+        }
+        else {
+            console.log(JSON.stringify({ error: e.message || String(err) }));
+        }
+        process.exit(1);
+    }
+}
+export async function runBundle() {
+    const args = process.argv.slice(3); // skip 'node', 'zitejs', 'bundle'
+    const scriptFlagIndex = args.indexOf('--script');
+    if (scriptFlagIndex !== -1) {
+        const scriptPath = args[scriptFlagIndex + 1];
+        if (!scriptPath) {
+            console.log(JSON.stringify({ error: 'Usage: zitejs bundle --script <path> [--sdk <path>]' }));
+            process.exit(1);
+        }
+        const sdkFlagIndex = args.indexOf('--sdk');
+        const sdkPath = sdkFlagIndex !== -1 ? args[sdkFlagIndex + 1] : undefined;
+        return bundleOneOffScriptImpl(scriptPath, sdkPath);
+    }
+    // Endpoint mode: find all endpoints and bundle them
+    const appFlag = args.indexOf('--app');
+    let baseDir = process.cwd();
+    if (appFlag !== -1 && args[appFlag + 1]) {
+        baseDir = path.resolve(baseDir, 'apps', args[appFlag + 1]);
+    }
+    // If explicit endpoint names passed, use those; otherwise find all
+    const explicitNames = args.filter(a => !a.startsWith('--'));
+    let endpointNames;
+    if (explicitNames.length > 0) {
+        endpointNames = explicitNames;
+    }
+    else {
+        const apiDir = path.join(baseDir, 'src', 'api');
+        if (!fs.existsSync(apiDir)) {
+            console.log(JSON.stringify({ bundledEndpoints: {} }));
+            return;
+        }
+        endpointNames = fs
+            .readdirSync(apiDir)
+            .filter(f => f.endsWith('.ts'))
+            .map(f => f.replace('.ts', ''));
+    }
+    if (endpointNames.length === 0) {
+        console.log(JSON.stringify({ bundledEndpoints: {} }));
+        return;
+    }
+    return bundleEndpointsImpl(baseDir, endpointNames);
+}

package/dist/esm/caller/index.js

@@ -8,19 +8,36 @@ function getRunnerUrl() {
     const env = getEnv('ZITE_ENV', 'VITE_ZITE_ENV') ?? 'production';
     return getEnv('ZITE_RUNNER_URL', 'VITE_ZITE_RUNNER_URL') ?? ENVIRONMENTS[env] ?? ENVIRONMENTS.production;
 }
-function getToken() {
-    return getEnv('ZITE_DB_TOKEN', 'VITE_ZITE_DB_TOKEN') ?? '';
+/**
+ * Get the user's usage token for endpoint auth.
+ * In internal mode: injected by app-runtime as window._ziteUsageToken
+ * In external mode: stored in localStorage by the auth flow
+ */
+function getUsageToken() {
+    if (typeof window !== 'undefined') {
+        const win = window;
+        if (typeof win._ziteUsageToken === 'string')
+            return win._ziteUsageToken;
+    }
+    // Fallback to stored auth token (external mode)
+    if (typeof localStorage !== 'undefined') {
+        const stored = localStorage.getItem('zite.auth.token');
+        if (stored)
+            return stored;
+    }
+    return '';
 }
 export function createCaller(endpoint, name, flowId) {
     return async (input) => {
         const appId = flowId ?? getEnv('ZITE_FLOW_ID', 'VITE_ZITE_FLOW_ID') ?? '';
+        const token = getUsageToken();
         const res = await fetch(getRunnerUrl() + '/public/' + appId + '/api/' + name, {
             method: 'POST',
             headers: {
-                Authorization: `Bearer ${getToken()}`,
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
                 'Content-Type': 'application/json',
             },
-            body: JSON.stringify({ ...input, mode: 'preview', usageToken: getToken() }),
+            body: JSON.stringify({ ...input, mode: 'preview', usageToken: token }),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => '');

package/dist/esm/cli.js

@@ -20,15 +20,21 @@ async function main() {
             await runCheck();
             break;
         }
+        case 'bundle': {
+            const { runBundle } = await import('./bundle/index.js');
+            await runBundle();
+            break;
+        }
         default:
             console.error(command
                 ? `Unknown command: ${command}`
-                : 'Usage: zitejs <sync|dev|check>');
+                : 'Usage: zitejs <sync|dev|check|bundle>');
             console.error('');
             console.error('Commands:');
             console.error('  sync    Generate .zite/db.ts and .zite/api.ts from your database schema');
             console.error('  dev     Run sync then watch for changes (like npx convex dev)');
             console.error('  check   Run tsc --noEmit and vite build for all apps');
+            console.error('  bundle  Bundle src/api/*.ts endpoints for cloudflare-lambda');
             process.exit(1);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/runtime/index.js",
@@ -111,6 +111,8 @@
     "url": "https://github.com/zite/zitejs"
   },
   "dependencies": {
-    "dotenv": "^17.4.2"
+    "@babel/parser": "^7.29.7",
+    "dotenv": "^17.4.2",
+    "esbuild": "^0.28.0"
   }
 }