zitejs 0.9.91 → 0.9.93

package/dist/cjs/auth/index.js

@@ -42,9 +42,17 @@ function loginWithRedirect(opts) {
     // any non-ASCII in the path fails its regex and the destination is dropped —
     // but never inspects the path of an absolute one. Normalising here means a
     // caller can pass whichever form reads best without having to know that.
-    const redirectUrl = new URL(opts?.redirectUrl ?? window.location.href, window.location.href).toString();
-    window.location.href =
-        '/auth/login?' + new URLSearchParams({ redirectUrl }).toString();
+    const target = new URL(opts?.redirectUrl ?? window.location.href, window.location.href);
+    // Say nothing when there's nothing to say. The sign-in page already returns
+    // people to the app root when it isn't told otherwise, so naming the root
+    // spells out the default — and puts an encoded copy of the app's own URL in
+    // the address bar of every logged-out visitor to the front page, which is the
+    // common case. Only pass a destination when it IS one.
+    const isRoot = target.pathname === '/' && target.search === '' && target.hash === '';
+    window.location.href = isRoot
+        ? '/auth/login'
+        : '/auth/login?' +
+            new URLSearchParams({ redirectUrl: target.toString() }).toString();
 }
 function logout(opts) {
     (0, exports.signOut)().then(() => {

package/dist/cjs/auth/index.test.js

@@ -83,6 +83,24 @@ function redirectParamOf(href) {
     });
 });
 (0, vitest_1.describe)('loginWithRedirect', () => {
+    (0, vitest_1.it)('says nothing when the destination is the app root', () => {
+        // The sign-in page already returns people to the root, so naming it would
+        // just put an encoded copy of the app's own URL in the address bar — and a
+        // logged-out visitor to the front page is the common case.
+        const location = stubLocation('https://app.zite.so/');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(location.href).toBe('/auth/login');
+    });
+    (0, vitest_1.it)('says nothing when an explicit redirectUrl is the app root', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/' });
+        (0, vitest_1.expect)(location.href).toBe('/auth/login');
+    });
+    (0, vitest_1.it)('still names a root path that carries a query or hash', () => {
+        const location = stubLocation('https://app.zite.so/?invite=abc');
+        authExports.loginWithRedirect();
+        (0, vitest_1.expect)(redirectParamOf(location.href)).toBe('https://app.zite.so/?invite=abc');
+    });
     (0, vitest_1.it)('captures the current URL when called with no arguments', () => {
         const location = stubLocation('https://app.zite.so/orders/123?tab=open');
         authExports.loginWithRedirect();

package/dist/cjs/auth/server.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Server-side auth hooks — the `ziteAuth({ hooks })` config an app
+ * default-exports from `zite.auth.ts` (app root). The platform bundles that
+ * file at build time and invokes the hooks at auth lifecycle moments
+ * (sign-up, sign-in, session checks). Hooks run like backend app code, so
+ * they can use the app's integrations and `zitejs/db`.
+ *
+ * All hooks fail open on error/timeout — a broken hook never locks users
+ * out. Gate hooks return allow / deny / defer; `verifySession` returns an
+ * active verdict and may enrich the app-visible user.
+ */
+export interface ZiteAuthHookUser {
+    id: string;
+    email: string;
+    name: string;
+}
+/**
+ * allow admits past disabled/domain-restricted signup; deny blocks with an
+ * optional reason; anything else (empty object / no return) defers to the
+ * platform rules.
+ */
+export type ZiteAuthGateDecision = {
+    allow: true;
+} | {
+    deny: true;
+    reason?: string;
+} | {
+    allow?: undefined;
+    deny?: undefined;
+} | void;
+/**
+ * active: false revokes the session; active: true keeps it, and `user`
+ * merges extra fields into the app-visible user.
+ */
+export type ZiteAuthSessionVerdict = {
+    active: false;
+    reason?: string;
+} | {
+    active: true;
+    user?: Record<string, unknown>;
+} | {
+    active?: undefined;
+} | void;
+export interface ZiteAuthHooks {
+    beforeSignUp?(input: {
+        email: string;
+        firstName?: string;
+        lastName?: string;
+    }): Promise<ZiteAuthGateDecision> | ZiteAuthGateDecision;
+    beforeSignIn?(input: {
+        email: string;
+    }): Promise<ZiteAuthGateDecision> | ZiteAuthGateDecision;
+    afterSignUp?(input: {
+        user: ZiteAuthHookUser;
+    }): Promise<unknown> | unknown;
+    afterSignIn?(input: {
+        user: ZiteAuthHookUser;
+    }): Promise<unknown> | unknown;
+    verifySession?(input: {
+        user: ZiteAuthHookUser;
+    }): Promise<ZiteAuthSessionVerdict> | ZiteAuthSessionVerdict;
+}
+export interface ZiteAuthConfig {
+    hooks?: ZiteAuthHooks;
+}
+export declare const ziteAuth: (config: ZiteAuthConfig) => ZiteAuthConfig;

package/dist/cjs/auth/server.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Server-side auth hooks — the `ziteAuth({ hooks })` config an app
+ * default-exports from `zite.auth.ts` (app root). The platform bundles that
+ * file at build time and invokes the hooks at auth lifecycle moments
+ * (sign-up, sign-in, session checks). Hooks run like backend app code, so
+ * they can use the app's integrations and `zitejs/db`.
+ *
+ * All hooks fail open on error/timeout — a broken hook never locks users
+ * out. Gate hooks return allow / deny / defer; `verifySession` returns an
+ * active verdict and may enrich the app-visible user.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ziteAuth = void 0;
+const ziteAuth = (config) => config;
+exports.ziteAuth = ziteAuth;

package/dist/cjs/bundle/index.js

@@ -268,6 +268,16 @@ function createAliasPlugin(opts) {
                 }
                 return { path: 'zitejs/email', external: true };
             });
+            // zitejs/auth/server is types + an identity wrapper — inline a shim so
+            // zite.auth.ts bundles without resolving the installed package.
+            build.onResolve({ filter: /^zitejs\/auth\/server$/ }, () => ({
+                path: 'zitejs-auth-server-shim',
+                namespace: 'zite-virtual',
+            }));
+            build.onLoad({ filter: /.*/, namespace: 'zite-virtual' }, () => ({
+                contents: 'export const ziteAuth = (config) => config;',
+                loader: 'js',
+            }));
             // zitejs/runtime is NOT in PREBUNDLED_LIBS — it's a thin fetch()
             // wrapper that gets bundled inline by esbuild (no special handling).
             for (const [pkgName, modulePath] of Object.entries(PREBUNDLED_LIBS)) {
@@ -392,9 +402,78 @@ async function bundleEndpointsImpl(baseDir, endpointNames) {
             }
         }
     }
+    let bundledAuthHooks;
+    let authHooksError;
+    if (fs.existsSync(path.join(baseDir, 'zite.auth.ts'))) {
+        const runtimeInit = `import { __wrapSdkCall, initRuntime } from '@zite/endpoints-runtime-sdk';
+globalThis.__wrapSdkCall = __wrapSdkCall;
+initRuntime();`;
+        const dispatcherCode = `
+${runtimeInit}
+import { z } from 'zod';
+import { createEndpoint } from '${sdkSource}';
+import auth from '../zite.auth';
+
+const endpoint = createEndpoint({
+  description: 'Runs the auth lifecycle hooks defined in zite.auth.ts',
+  inputSchema: z.object({
+    hook: z.enum([
+      'beforeSignUp',
+      'afterSignUp',
+      'beforeSignIn',
+      'afterSignIn',
+      'verifySession',
+    ]),
+    payload: z.record(z.unknown()).default({}),
+  }),
+  execute: async ({ input }) => {
+    const hook = auth.hooks?.[input.hook];
+    if (!hook) return {};
+    return (await hook(input.payload as never)) ?? {};
+  },
+});
+globalThis.__endpoint = endpoint;
+`;
+        try {
+            const result = await esbuild.build({
+                ...BASE_BUILD_OPTIONS,
+                stdin: {
+                    contents: dispatcherCode,
+                    resolveDir: `${baseDir}/src`,
+                    loader: 'ts',
+                },
+                logLevel: 'warning',
+                plugins: [aliasPlugin],
+            });
+            if (result.outputFiles && result.outputFiles.length > 0) {
+                bundledAuthHooks = result.outputFiles[0].text;
+            }
+            else {
+                authHooksError = 'No output generated';
+            }
+        }
+        catch (err) {
+            const e = err;
+            if (e.errors && Array.isArray(e.errors)) {
+                authHooksError = e.errors
+                    .map(er => {
+                    const loc = er.location
+                        ? `${er.location.file || 'unknown'}:${er.location.line || '?'}:${er.location.column || '?'}`
+                        : 'unknown';
+                    return `${loc} - ${er.text}`;
+                })
+                    .join('\n');
+            }
+            else {
+                authHooksError = e.message || String(err);
+            }
+        }
+    }
     const output = JSON.stringify({
         bundledEndpoints,
         endpointErrors: Object.keys(endpointErrors).length > 0 ? endpointErrors : undefined,
+        bundledAuthHooks,
+        authHooksError,
     });
     fs.writeFileSync('/tmp/zitejs-bundle-result.json', output);
     console.log(output);
@@ -504,18 +583,13 @@ async function runBundle() {
     }
     else {
         const apiDir = path.join(baseDir, 'src', 'api');
-        if (!fs.existsSync(apiDir)) {
-            console.log(JSON.stringify({ bundledEndpoints: {} }));
-            return;
-        }
-        endpointNames = fs
-            .readdirSync(apiDir)
-            .filter(f => f.endsWith('.ts'))
-            .map(f => f.replace('.ts', ''));
-    }
-    if (endpointNames.length === 0) {
-        console.log(JSON.stringify({ bundledEndpoints: {} }));
-        return;
+        endpointNames = fs.existsSync(apiDir)
+            ? fs
+                .readdirSync(apiDir)
+                .filter(f => f.endsWith('.ts'))
+                .map(f => f.replace('.ts', ''))
+            : [];
     }
+    // Even with no endpoints, zite.auth.ts may still need bundling.
     return bundleEndpointsImpl(baseDir, endpointNames);
 }

package/dist/cjs/meta/index.d.ts

@@ -0,0 +1,14 @@
+export type ZiteProjectUser = {
+    uuid: string;
+    firstName: string | null;
+    lastName: string | null;
+    email: string;
+    profilePictureUrl: string | null;
+};
+export type MetaListUsersResult = {
+    users: ZiteProjectUser[];
+};
+export declare class ZiteMeta {
+    static listUsers(): Promise<MetaListUsersResult>;
+}
+export declare const Meta: typeof ZiteMeta;

package/dist/cjs/meta/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Meta = exports.ZiteMeta = void 0;
+const sdkCall_js_1 = require("../internal/sdkCall.js");
+const META_SDK_INTEGRATION_ID = '__meta__';
+class ZiteMeta {
+    static listUsers() {
+        return (0, sdkCall_js_1.getSdkCall)()(META_SDK_INTEGRATION_ID, 'ZiteMeta', 'listUsers', {});
+    }
+}
+exports.ZiteMeta = ZiteMeta;
+exports.Meta = ZiteMeta;

package/dist/cjs/runtime/index.d.ts

@@ -146,6 +146,13 @@ export interface SendEmailParams {
     replyTo?: string;
     /** 'formatted' (default) for styled HTML, 'plain' for text-only. */
     layout?: "formatted" | "plain";
+    /**
+     * Text direction of the email. Use 'rtl' for right-to-left languages
+     * (Hebrew, Arabic) — sets dir="rtl" on the email wrapper and right-aligns
+     * text blocks. HTML like `<div dir="rtl">` inside text blocks is stripped
+     * by the sanitizer and will NOT work. Defaults to 'ltr'.
+     */
+    direction?: "ltr" | "rtl";
     /** Custom logo shown above the email content (header area), for branding. */
     logo?: {
         url: string;

package/dist/cjs/sync/lib.js

@@ -738,6 +738,9 @@ function generateEmailSdk(integrationId) {
         "//",
         "//   await Email.send({ to, subject, body: [{ type: 'text', content: '...' }] })",
         "//     => { success: boolean; messageId: string }",
+        "//",
+        "//   RTL languages (Hebrew, Arabic): pass direction: 'rtl' — dir attributes",
+        "//   inside body text are stripped by the sanitizer and will not work.",
         "",
         "import { createEmailClient } from 'zitejs/runtime';",
         "",

package/dist/esm/auth/index.js

@@ -35,9 +35,17 @@ export function loginWithRedirect(opts) {
     // any non-ASCII in the path fails its regex and the destination is dropped —
     // but never inspects the path of an absolute one. Normalising here means a
     // caller can pass whichever form reads best without having to know that.
-    const redirectUrl = new URL(opts?.redirectUrl ?? window.location.href, window.location.href).toString();
-    window.location.href =
-        '/auth/login?' + new URLSearchParams({ redirectUrl }).toString();
+    const target = new URL(opts?.redirectUrl ?? window.location.href, window.location.href);
+    // Say nothing when there's nothing to say. The sign-in page already returns
+    // people to the app root when it isn't told otherwise, so naming the root
+    // spells out the default — and puts an encoded copy of the app's own URL in
+    // the address bar of every logged-out visitor to the front page, which is the
+    // common case. Only pass a destination when it IS one.
+    const isRoot = target.pathname === '/' && target.search === '' && target.hash === '';
+    window.location.href = isRoot
+        ? '/auth/login'
+        : '/auth/login?' +
+            new URLSearchParams({ redirectUrl: target.toString() }).toString();
 }
 export function logout(opts) {
     signOut().then(() => {

package/dist/esm/auth/index.test.js

@@ -48,6 +48,24 @@ describe('zitejs/auth exports', () => {
     });
 });
 describe('loginWithRedirect', () => {
+    it('says nothing when the destination is the app root', () => {
+        // The sign-in page already returns people to the root, so naming it would
+        // just put an encoded copy of the app's own URL in the address bar — and a
+        // logged-out visitor to the front page is the common case.
+        const location = stubLocation('https://app.zite.so/');
+        authExports.loginWithRedirect();
+        expect(location.href).toBe('/auth/login');
+    });
+    it('says nothing when an explicit redirectUrl is the app root', () => {
+        const location = stubLocation('https://app.zite.so/pricing');
+        authExports.loginWithRedirect({ redirectUrl: '/' });
+        expect(location.href).toBe('/auth/login');
+    });
+    it('still names a root path that carries a query or hash', () => {
+        const location = stubLocation('https://app.zite.so/?invite=abc');
+        authExports.loginWithRedirect();
+        expect(redirectParamOf(location.href)).toBe('https://app.zite.so/?invite=abc');
+    });
     it('captures the current URL when called with no arguments', () => {
         const location = stubLocation('https://app.zite.so/orders/123?tab=open');
         authExports.loginWithRedirect();

package/dist/esm/auth/server.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Server-side auth hooks — the `ziteAuth({ hooks })` config an app
+ * default-exports from `zite.auth.ts` (app root). The platform bundles that
+ * file at build time and invokes the hooks at auth lifecycle moments
+ * (sign-up, sign-in, session checks). Hooks run like backend app code, so
+ * they can use the app's integrations and `zitejs/db`.
+ *
+ * All hooks fail open on error/timeout — a broken hook never locks users
+ * out. Gate hooks return allow / deny / defer; `verifySession` returns an
+ * active verdict and may enrich the app-visible user.
+ */
+export interface ZiteAuthHookUser {
+    id: string;
+    email: string;
+    name: string;
+}
+/**
+ * allow admits past disabled/domain-restricted signup; deny blocks with an
+ * optional reason; anything else (empty object / no return) defers to the
+ * platform rules.
+ */
+export type ZiteAuthGateDecision = {
+    allow: true;
+} | {
+    deny: true;
+    reason?: string;
+} | {
+    allow?: undefined;
+    deny?: undefined;
+} | void;
+/**
+ * active: false revokes the session; active: true keeps it, and `user`
+ * merges extra fields into the app-visible user.
+ */
+export type ZiteAuthSessionVerdict = {
+    active: false;
+    reason?: string;
+} | {
+    active: true;
+    user?: Record<string, unknown>;
+} | {
+    active?: undefined;
+} | void;
+export interface ZiteAuthHooks {
+    beforeSignUp?(input: {
+        email: string;
+        firstName?: string;
+        lastName?: string;
+    }): Promise<ZiteAuthGateDecision> | ZiteAuthGateDecision;
+    beforeSignIn?(input: {
+        email: string;
+    }): Promise<ZiteAuthGateDecision> | ZiteAuthGateDecision;
+    afterSignUp?(input: {
+        user: ZiteAuthHookUser;
+    }): Promise<unknown> | unknown;
+    afterSignIn?(input: {
+        user: ZiteAuthHookUser;
+    }): Promise<unknown> | unknown;
+    verifySession?(input: {
+        user: ZiteAuthHookUser;
+    }): Promise<ZiteAuthSessionVerdict> | ZiteAuthSessionVerdict;
+}
+export interface ZiteAuthConfig {
+    hooks?: ZiteAuthHooks;
+}
+export declare const ziteAuth: (config: ZiteAuthConfig) => ZiteAuthConfig;

package/dist/esm/auth/server.js

@@ -0,0 +1,12 @@
+/**
+ * Server-side auth hooks — the `ziteAuth({ hooks })` config an app
+ * default-exports from `zite.auth.ts` (app root). The platform bundles that
+ * file at build time and invokes the hooks at auth lifecycle moments
+ * (sign-up, sign-in, session checks). Hooks run like backend app code, so
+ * they can use the app's integrations and `zitejs/db`.
+ *
+ * All hooks fail open on error/timeout — a broken hook never locks users
+ * out. Gate hooks return allow / deny / defer; `verifySession` returns an
+ * active verdict and may enrich the app-visible user.
+ */
+export const ziteAuth = (config) => config;

package/dist/esm/bundle/index.js

@@ -232,6 +232,16 @@ function createAliasPlugin(opts) {
                 }
                 return { path: 'zitejs/email', external: true };
             });
+            // zitejs/auth/server is types + an identity wrapper — inline a shim so
+            // zite.auth.ts bundles without resolving the installed package.
+            build.onResolve({ filter: /^zitejs\/auth\/server$/ }, () => ({
+                path: 'zitejs-auth-server-shim',
+                namespace: 'zite-virtual',
+            }));
+            build.onLoad({ filter: /.*/, namespace: 'zite-virtual' }, () => ({
+                contents: 'export const ziteAuth = (config) => config;',
+                loader: 'js',
+            }));
             // zitejs/runtime is NOT in PREBUNDLED_LIBS — it's a thin fetch()
             // wrapper that gets bundled inline by esbuild (no special handling).
             for (const [pkgName, modulePath] of Object.entries(PREBUNDLED_LIBS)) {
@@ -356,9 +366,78 @@ async function bundleEndpointsImpl(baseDir, endpointNames) {
             }
         }
     }
+    let bundledAuthHooks;
+    let authHooksError;
+    if (fs.existsSync(path.join(baseDir, 'zite.auth.ts'))) {
+        const runtimeInit = `import { __wrapSdkCall, initRuntime } from '@zite/endpoints-runtime-sdk';
+globalThis.__wrapSdkCall = __wrapSdkCall;
+initRuntime();`;
+        const dispatcherCode = `
+${runtimeInit}
+import { z } from 'zod';
+import { createEndpoint } from '${sdkSource}';
+import auth from '../zite.auth';
+
+const endpoint = createEndpoint({
+  description: 'Runs the auth lifecycle hooks defined in zite.auth.ts',
+  inputSchema: z.object({
+    hook: z.enum([
+      'beforeSignUp',
+      'afterSignUp',
+      'beforeSignIn',
+      'afterSignIn',
+      'verifySession',
+    ]),
+    payload: z.record(z.unknown()).default({}),
+  }),
+  execute: async ({ input }) => {
+    const hook = auth.hooks?.[input.hook];
+    if (!hook) return {};
+    return (await hook(input.payload as never)) ?? {};
+  },
+});
+globalThis.__endpoint = endpoint;
+`;
+        try {
+            const result = await esbuild.build({
+                ...BASE_BUILD_OPTIONS,
+                stdin: {
+                    contents: dispatcherCode,
+                    resolveDir: `${baseDir}/src`,
+                    loader: 'ts',
+                },
+                logLevel: 'warning',
+                plugins: [aliasPlugin],
+            });
+            if (result.outputFiles && result.outputFiles.length > 0) {
+                bundledAuthHooks = result.outputFiles[0].text;
+            }
+            else {
+                authHooksError = 'No output generated';
+            }
+        }
+        catch (err) {
+            const e = err;
+            if (e.errors && Array.isArray(e.errors)) {
+                authHooksError = e.errors
+                    .map(er => {
+                    const loc = er.location
+                        ? `${er.location.file || 'unknown'}:${er.location.line || '?'}:${er.location.column || '?'}`
+                        : 'unknown';
+                    return `${loc} - ${er.text}`;
+                })
+                    .join('\n');
+            }
+            else {
+                authHooksError = e.message || String(err);
+            }
+        }
+    }
     const output = JSON.stringify({
         bundledEndpoints,
         endpointErrors: Object.keys(endpointErrors).length > 0 ? endpointErrors : undefined,
+        bundledAuthHooks,
+        authHooksError,
     });
     fs.writeFileSync('/tmp/zitejs-bundle-result.json', output);
     console.log(output);
@@ -468,18 +547,13 @@ export async function runBundle() {
     }
     else {
         const apiDir = path.join(baseDir, 'src', 'api');
-        if (!fs.existsSync(apiDir)) {
-            console.log(JSON.stringify({ bundledEndpoints: {} }));
-            return;
-        }
-        endpointNames = fs
-            .readdirSync(apiDir)
-            .filter(f => f.endsWith('.ts'))
-            .map(f => f.replace('.ts', ''));
-    }
-    if (endpointNames.length === 0) {
-        console.log(JSON.stringify({ bundledEndpoints: {} }));
-        return;
+        endpointNames = fs.existsSync(apiDir)
+            ? fs
+                .readdirSync(apiDir)
+                .filter(f => f.endsWith('.ts'))
+                .map(f => f.replace('.ts', ''))
+            : [];
     }
+    // Even with no endpoints, zite.auth.ts may still need bundling.
     return bundleEndpointsImpl(baseDir, endpointNames);
 }

package/dist/esm/meta/index.d.ts

@@ -0,0 +1,14 @@
+export type ZiteProjectUser = {
+    uuid: string;
+    firstName: string | null;
+    lastName: string | null;
+    email: string;
+    profilePictureUrl: string | null;
+};
+export type MetaListUsersResult = {
+    users: ZiteProjectUser[];
+};
+export declare class ZiteMeta {
+    static listUsers(): Promise<MetaListUsersResult>;
+}
+export declare const Meta: typeof ZiteMeta;

package/dist/esm/meta/index.js

@@ -0,0 +1,8 @@
+import { getSdkCall } from '../internal/sdkCall.js';
+const META_SDK_INTEGRATION_ID = '__meta__';
+export class ZiteMeta {
+    static listUsers() {
+        return getSdkCall()(META_SDK_INTEGRATION_ID, 'ZiteMeta', 'listUsers', {});
+    }
+}
+export const Meta = ZiteMeta;

package/dist/esm/runtime/index.d.ts

@@ -146,6 +146,13 @@ export interface SendEmailParams {
     replyTo?: string;
     /** 'formatted' (default) for styled HTML, 'plain' for text-only. */
     layout?: "formatted" | "plain";
+    /**
+     * Text direction of the email. Use 'rtl' for right-to-left languages
+     * (Hebrew, Arabic) — sets dir="rtl" on the email wrapper and right-aligns
+     * text blocks. HTML like `<div dir="rtl">` inside text blocks is stripped
+     * by the sanitizer and will NOT work. Defaults to 'ltr'.
+     */
+    direction?: "ltr" | "rtl";
     /** Custom logo shown above the email content (header area), for branding. */
     logo?: {
         url: string;

package/dist/esm/sync/lib.js

@@ -728,6 +728,9 @@ export function generateEmailSdk(integrationId) {
         "//",
         "//   await Email.send({ to, subject, body: [{ type: 'text', content: '...' }] })",
         "//     => { success: boolean; messageId: string }",
+        "//",
+        "//   RTL languages (Hebrew, Arabic): pass direction: 'rtl' — dir attributes",
+        "//   inside body text are stripped by the sanitizer and will not work.",
         "",
         "import { createEmailClient } from 'zitejs/runtime';",
         "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.91",
+  "version": "0.9.93",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",
@@ -47,6 +47,12 @@
       "import": "./dist/esm/auth/index.js",
       "require": "./dist/cjs/auth/index.js"
     },
+    "./auth/server": {
+      "types": "./dist/esm/auth/server.d.ts",
+      "import": "./dist/esm/auth/server.js",
+      "require": "./dist/cjs/auth/server.js",
+      "default": "./dist/esm/auth/server.js"
+    },
     "./auth-server": {
       "types": "./dist/esm/auth-server/index.d.ts",
       "import": "./dist/esm/auth-server/index.js",