@authhero/cloudflare-adapter 2.26.7 → 2.27.0

package/dist/cloudflare-adapter.d.ts

@@ -1040,7 +1040,7 @@ export interface DispatchNamespace {
 		fetch(request: Request | string, init?: RequestInit): Promise<Response>;
 	};
 }
-export interface CloudflareCodeExecutorConfig {
+export interface DispatchNamespaceCodeExecutorConfig {
 	/** Cloudflare account ID */
 	accountId: string;
 	/** API token with Workers Scripts write permission */
@@ -1066,15 +1066,20 @@ export interface CloudflareCodeExecutorConfig {
 	compatibilityDate?: string;
 }
 /**
- * Code executor that uses Cloudflare Workers for Platforms.
+ * Code executor that uses Cloudflare Workers for Platforms dispatch namespaces.
  *
- * User code is deployed as individual worker scripts in a dispatch namespace.
- * At execution time, the pre-deployed worker is invoked via the dispatch
- * namespace binding (in-worker) or via HTTP (external fallback).
+ * User code is deployed as individual worker scripts in a dispatch namespace
+ * (via the `deploy()` method, which calls the Cloudflare API). At execution
+ * time, the pre-deployed worker is invoked via the dispatch namespace binding
+ * (in-worker) or via HTTP (external fallback).
+ *
+ * Contrast with `WorkerLoaderCodeExecutor`, which creates isolates on the fly
+ * from in-memory code via the Worker Loader binding and does not require
+ * pre-deployment.
  *
  * Usage:
  * ```typescript
- * const codeExecutor = new CloudflareCodeExecutor({
+ * const codeExecutor = new DispatchNamespaceCodeExecutor({
  *   accountId: env.CF_ACCOUNT_ID,
  *   apiToken: env.CF_API_TOKEN,
  *   dispatchNamespace: "authhero-hooks",
@@ -1084,9 +1089,9 @@ export interface CloudflareCodeExecutorConfig {
  * const { app } = init({ dataAdapter, codeExecutor });
  * ```
  */
-export declare class CloudflareCodeExecutor implements CodeExecutor {
+export declare class DispatchNamespaceCodeExecutor implements CodeExecutor {
 	private config;
-	constructor(config: CloudflareCodeExecutorConfig);
+	constructor(config: DispatchNamespaceCodeExecutorConfig);
 	execute(params: {
 		code: string;
 		hookCodeId?: string;
@@ -1111,6 +1116,15 @@ export declare class CloudflareCodeExecutor implements CodeExecutor {
 	 */
 	remove(hookCodeId: string): Promise<void>;
 }
+/**
+ * @deprecated Renamed to `DispatchNamespaceCodeExecutor` to disambiguate from
+ * `WorkerLoaderCodeExecutor` (also Cloudflare-based, but using the Worker
+ * Loader binding instead of Workers for Platforms). This alias will be removed
+ * in the next major.
+ */
+export declare const CloudflareCodeExecutor: typeof DispatchNamespaceCodeExecutor;
+/** @deprecated Use `DispatchNamespaceCodeExecutorConfig`. */
+export type CloudflareCodeExecutorConfig = DispatchNamespaceCodeExecutorConfig;
 /**
  * Generates a Cloudflare Worker script that wraps user-authored code.
  *
@@ -1121,6 +1135,61 @@ export declare class CloudflareCodeExecutor implements CodeExecutor {
  * 4. Returns { success, apiCalls, error, durationMs } as JSON
  */
 export declare function generateWorkerScript(userCode: string): string;
+/**
+ * Worker Loader binding type (Cloudflare Dynamic Workers).
+ * Configure in wrangler.toml:
+ *   [[worker_loaders]]
+ *   binding = "LOADER"
+ */
+export interface WorkerLoader {
+	load(code: WorkerCode): WorkerStub;
+	get(id: string, callback: () => Promise<WorkerCode>): WorkerStub;
+}
+export interface WorkerCode {
+	compatibilityDate: string;
+	mainModule: string;
+	modules: Record<string, string>;
+}
+export interface WorkerStub {
+	getEntrypoint(): {
+		fetch(request: Request): Promise<Response>;
+	};
+}
+export interface WorkerLoaderCodeExecutorOptions {
+	loader: WorkerLoader;
+	compatibilityDate?: string;
+}
+/**
+ * Cloudflare Dynamic Workers code executor (Worker Loader binding).
+ * Spins up isolated Workers on demand from in-memory code to execute
+ * user-authored hook code in a sandboxed v8 isolate.
+ *
+ * Uses `env.LOADER.get(id, callback)` to cache workers by hookCodeId + code hash,
+ * so the same code stays warm across requests while code updates get a fresh worker.
+ *
+ * User code can make outbound `fetch()` calls. The Worker Loader still provides
+ * process isolation (separate v8 isolate, no access to the parent worker's
+ * bindings or env), so this only widens the network boundary, not the host
+ * boundary. Plan: a future AI/static-analysis layer inspects action code on
+ * upload to flag exfiltration patterns before they reach the executor.
+ *
+ * Contrast with `DispatchNamespaceCodeExecutor`, which uses Workers for
+ * Platforms dispatch namespaces and requires user code to be pre-deployed
+ * as individual worker scripts via the Cloudflare API.
+ */
+export declare class WorkerLoaderCodeExecutor implements CodeExecutor {
+	private loader;
+	private compatibilityDate;
+	constructor(options: WorkerLoaderCodeExecutorOptions);
+	execute(params: {
+		code: string;
+		hookCodeId?: string;
+		triggerId: string;
+		event: Record<string, unknown>;
+		timeoutMs?: number;
+		cpuLimitMs?: number;
+	}): Promise<CodeExecutionResult>;
+}
 export interface CloudflareAdapters {
 	customDomains: CustomDomainsAdapter;
 	cache: CacheAdapter;