@authhero/cloudflare-adapter 2.35.1 → 2.36.0

package/dist/cloudflare-adapter.cjs

@@ -1,67 +1,67 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));let c=require("@authhero/adapter-interfaces"),l=require("@hono/zod-openapi"),u=require("hono/http-exception"),d=require("wretch");d=s(d);let f=require("wretch/middlewares");var p=l.z.object({code:l.z.number(),message:l.z.string()}),m=l.z.object({message:l.z.string()}),h=l.z.object({emails:l.z.array(l.z.string()).optional(),http_body:l.z.string().optional(),http_url:l.z.string().optional(),txt_name:l.z.string().optional(),txt_value:l.z.string().optional()}),g=l.z.object({ciphers:l.z.array(l.z.string()).optional(),early_hints:l.z.string().optional(),http2:l.z.string().optional(),min_tls_version:l.z.string().optional(),tls_1_3:l.z.string().optional()}),_=l.z.object({id:l.z.string(),bundle_method:l.z.string().optional(),certificate_authority:l.z.string(),custom_certificate:l.z.string().optional(),custom_csr_id:l.z.string().optional(),custom_key:l.z.string().optional(),expires_on:l.z.string().optional(),hosts:l.z.array(l.z.string()).optional(),issuer:l.z.string().optional(),method:l.z.string(),serial_number:l.z.string().optional(),settings:g.optional(),signature:l.z.string().optional(),type:l.z.string(),uploaded_on:l.z.string().optional(),validation_errors:l.z.array(m).optional(),validation_records:l.z.array(h).optional(),wildcard:l.z.boolean()}),ee=l.z.object({name:l.z.string(),type:l.z.string(),value:l.z.string()}),te=l.z.object({http_body:l.z.string().optional(),http_url:l.z.string().optional()}),v=l.z.object({id:l.z.string(),ssl:_,hostname:l.z.string(),custom_metadata:l.z.record(l.z.string(),l.z.string()).optional(),custom_origin_server:l.z.string().optional(),custom_origin_sni:l.z.string().optional(),ownership_verification:ee.optional(),ownership_verification_http:te.optional(),status:l.z.string(),verification_errors:l.z.array(l.z.string()).optional(),created_at:l.z.string()}),y=l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:v});l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:l.z.array(v)});function b(e){return(0,d.default)(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({"X-Auth-Email":e.authEmail,"X-Auth-Key":e.authKey,"Content-Type":`application/json`}).middlewares([(0,f.retry)(),(0,f.dedupe)()])}function x(e){let t={},n={};if(!e)return{sslOverrides:t,rest:n};for(let[r,i]of Object.entries(e))r.startsWith(`ssl.`)?t[r.slice(4)]=i:n[r]=i;return{sslOverrides:t,rest:n}}function S(e){let t=[];if(e.ssl.validation_records)for(let n of e.ssl.validation_records)n.txt_name&&n.txt_value&&t.push({name:`txt`,record:n.txt_value,domain:n.txt_name});if(e.ownership_verification&&t.push({name:`txt`,record:e.ownership_verification.value,domain:e.ownership_verification.name}),e.ownership_verification_http?.http_body&&e.ownership_verification_http?.http_url&&t.push({name:`http`,http_body:e.ownership_verification_http.http_body,http_url:e.ownership_verification_http.http_url}),e.ssl.validation_records)for(let n of e.ssl.validation_records)n.http_body&&n.http_url&&t.push({name:`http`,http_body:n.http_body,http_url:n.http_url});let n={...e.domain_metadata||{},"ssl.method":e.ssl.method,"ssl.type":e.ssl.type,"ssl.certificate_authority":e.ssl.certificate_authority};return{custom_domain_id:e.id,domain:e.hostname,primary:e.primary,status:e.status===`active`?`ready`:`pending`,type:e.type??`auth0_managed_certs`,verification:{methods:l.z.array(c.verificationMethodsSchema).parse(t)},domain_metadata:n}}function ne(e){return{create:async(t,n)=>{let{sslOverrides:r,rest:i}=x(n.domain_metadata),{result:a,errors:o,success:s}=y.parse(await b(e).post({hostname:n.domain,ssl:{method:`txt`,type:`dv`,...r},custom_metadata:e.enterprise?{tenant_id:t}:void 0},`/custom_hostnames`).json());if(!s)throw Error(JSON.stringify(o));let c=S({...a,primary:!1,type:n.type,domain_metadata:i});return await e.customDomainAdapter.create(t,{custom_domain_id:c.custom_domain_id,domain:c.domain,type:c.type,domain_metadata:n.domain_metadata}),await e.customDomainAdapter.update(t,c.custom_domain_id,{status:c.status,primary:c.primary,verification:c.verification}),c},get:async(t,n)=>{let r=await e.customDomainAdapter.get(t,n);if(!r)throw new u.HTTPException(404);let i;try{i=await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`,e instanceof Error?e.message:e),r}let a=y.safeParse(i);if(!a.success||!a.data.success)return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`,a.success?{cfErrors:a.data.errors}:{zodIssues:a.error.issues,body:i}),r;let{result:o}=a.data;if(e.enterprise&&o.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404);let s;try{s=S({...r,...o})}catch(e){return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`,e instanceof Error?e.message:e),r}if(s.status!==r.status||JSON.stringify(s.verification)!==JSON.stringify(r.verification))try{await e.customDomainAdapter.update(t,n,{status:s.status,verification:s.verification})}catch(e){console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`,e instanceof Error?e.message:e)}return s},getByDomain:async t=>e.customDomainAdapter.getByDomain(t),list:async t=>e.customDomainAdapter.list(t),remove:async(t,n)=>{if(e.enterprise){let{result:r,success:i}=y.parse(await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());if(!i||r.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404)}let r=await b(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();return r.ok&&await e.customDomainAdapter.remove(t,n),r.ok},update:async(t,n,r)=>{let{sslOverrides:i}=x(r.domain_metadata),a={};if(Object.keys(i).length>0){let t;try{t=await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){throw new u.HTTPException(503,{message:`Failed to fetch current custom hostname state: ${e instanceof Error?e.message:String(e)}`})}let r=y.safeParse(t);if(!r.success||!r.data.success)throw new u.HTTPException(503,{message:`Failed to parse current custom hostname state: ${JSON.stringify(r.success?r.data.errors:r.error.issues)}`});a.ssl={method:r.data.result.ssl.method,type:r.data.result.ssl.type,certificate_authority:r.data.result.ssl.certificate_authority,...i}}if(Object.keys(a).length>0){let t=await b(e).patch(a,`/custom_hostnames/${encodeURIComponent(n)}`).res().catch(e=>{throw new u.HTTPException(503,{message:`Failed to update custom hostname: ${e instanceof Error?e.message:String(e)}`})});if(!t.ok)throw new u.HTTPException(503,{message:await t.text()})}return e.customDomainAdapter.update(t,n,r)},uploadCertificate:async(t,n,r)=>{let i=await e.customDomainAdapter.get(t,n);if(!i)throw new u.HTTPException(404);let a=await b(e).patch({ssl:{custom_certificate:r.certificate,custom_key:r.private_key}},`/custom_hostnames/${encodeURIComponent(n)}`).json(),{result:o,errors:s,success:c}=y.parse(a);if(!c)throw new u.HTTPException(503,{message:JSON.stringify(s)});let l=S({...i,...o});return await e.customDomainAdapter.update(t,n,{status:l.status,verification:l.verification}),l}}}var re=class{config;cache=null;constructor(e){this.config=e}async getCache(){if(this.cache)return this.cache;if(typeof caches>`u`)throw Error(`caches API is not available - CloudflareCache should only be used in Cloudflare Workers`);return this.config.cacheName?this.cache=await caches.open(this.config.cacheName):this.cache=caches.default,this.cache}getKey(e){return this.config.keyPrefix?`${this.config.keyPrefix}:${e}`:e}createRequest(e){return new Request(`https://cache.internal/${this.getKey(e)}`)}async matchWithTimeout(e,t){let n=this.config.getTimeoutMs??200;return n<=0?e.match(t):new Promise(r=>{let i=setTimeout(()=>r(void 0),n);e.match(t).then(e=>{clearTimeout(i),r(e)},()=>{clearTimeout(i),r(void 0)})})}async get(e){try{let t=await this.getCache(),n=this.createRequest(e),r=await this.matchWithTimeout(t,n);if(!r)return null;let i=await r.text();if(!i)return await this.delete(e),null;let a;try{a=JSON.parse(i)}catch{return await this.delete(e),null}return a.expiresAt&&new Date(a.expiresAt)<new Date?(await this.delete(e),null):a.value}catch(t){return console.error(`CloudflareCache: get error for key ${e}:`,t),null}}async set(e,t,n){try{let r=await this.getCache(),i=n??this.config.defaultTtlSeconds,a=i!==void 0,o=a?Math.max(0,i):0,s={value:t,expiresAt:a?new Date(Date.now()+(o>0?o*1e3:-1)).toISOString():void 0,cachedAt:new Date().toISOString()},c=this.createRequest(e),l={"Content-Type":`application/json`};a&&o>0&&(l[`Cache-Control`]=`max-age=${o}`);let u=new Response(JSON.stringify(s),{headers:l});await r.put(c,u)}catch(t){console.error(`CloudflareCache: set error for key ${e}:`,t)}}async delete(e){try{let t=await this.getCache(),n=this.createRequest(e);return await t.delete(n)}catch(t){return console.error(`CloudflareCache: delete error for key ${e}:`,t),!1}}async deleteByPrefix(e){return console.warn(`CloudflareCache.deleteByPrefix() is not implemented - Cloudflare Cache API does not support prefix-based deletion`),0}async clear(){console.warn(`CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries`)}};function ie(e={}){return new re({defaultTtlSeconds:300,keyPrefix:`authhero`,getTimeoutMs:200,...e})}var ae=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,C=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=ae[n[e]&63];return t};async function w(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e.authToken}`},body:JSON.stringify({query:t}),signal:r.signal});if(!i.ok)throw Error(`R2 SQL query failed: ${i.status} ${i.statusText}`);let a=await i.json();if(!a.success&&a.errors)throw Error(`R2 SQL error: ${a.errors.join(`, `)}`);return a.data||a.result?.data||[]}finally{clearTimeout(i)}}function T(e){return`'${e.replace(/'/g,`''`)}'`}function E(e){return`"${e.replace(/"/g,`""`)}"`}function D(e){let t=e=>{if(!e)return``;try{return JSON.parse(e)}catch{return e}};return{type:e.type,date:e.date,description:e.description,ip:e.ip,user_agent:e.user_agent,details:t(e.details),isMobile:!!e.isMobile,user_id:e.user_id,user_name:e.user_name,connection:e.connection,connection_id:e.connection_id,client_id:e.client_id,client_name:e.client_name,audience:e.audience,scope:e.scope,strategy:e.strategy,strategy_type:e.strategy_type,hostname:e.hostname,auth0_client:t(e.auth0_client),log_id:e.id,location_info:e.country_code||e.city_name||e.latitude||e.longitude||e.time_zone||e.continent_code?{country_code:e.country_code||``,city_name:e.city_name||``,latitude:e.latitude||``,longitude:e.longitude||``,time_zone:e.time_zone||``,continent_code:e.continent_code||``}:void 0}}function O(e){return async(t,n)=>{let r=n.log_id||C(),i={...n,log_id:r};return await oe(e,t,i),i}}async function oe(e,t,n){let r=e=>e?JSON.stringify(e):void 0,i={id:n.log_id,tenant_id:t,type:n.type,date:n.date,description:n.description?.substring(0,256),ip:n.ip,user_agent:n.user_agent,details:r(n.details)?.substring(0,8192),isMobile:+!!n.isMobile,user_id:n.user_id,user_name:n.user_name,connection:n.connection,connection_id:n.connection_id,client_id:n.client_id,client_name:n.client_name,audience:n.audience,scope:n.scope,strategy:n.strategy,strategy_type:n.strategy_type,hostname:n.hostname,auth0_client:r(n.auth0_client),log_id:n.log_id,country_code:n.location_info?.country_code,city_name:n.location_info?.city_name,latitude:n.location_info?.latitude,longitude:n.location_info?.longitude,time_zone:n.location_info?.time_zone,continent_code:n.location_info?.continent_code};try{if(e.pipelineBinding)await e.pipelineBinding.send([i]);else if(e.pipelineEndpoint){let t=e.timeout||3e4,n=new AbortController,r=setTimeout(()=>n.abort(),t);try{let t=await fetch(e.pipelineEndpoint,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify([i]),signal:n.signal});if(!t.ok)throw Error(`Pipeline ingestion failed: ${t.status} ${t.statusText}`)}finally{clearTimeout(r)}}else throw Error(`Either pipelineEndpoint or pipelineBinding must be configured`)}catch(e){throw console.error(`Failed to send log to Pipeline:`,e),e}}function se(e){return async(t,n)=>{let r=e.namespace||`default`,i=e.tableName||`logs`,a=await w(e,`
-      SELECT * FROM ${E(r)}.${E(i)}
-      WHERE tenant_id = ${T(t)}
-        AND id = ${T(n)}
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));let c=require("@authhero/adapter-interfaces"),l=require("@hono/zod-openapi"),u=require("hono/http-exception"),d=require("wretch");d=s(d);let f=require("wretch/middlewares");var p=l.z.object({code:l.z.number(),message:l.z.string()}),m=l.z.object({message:l.z.string()}),h=l.z.object({emails:l.z.array(l.z.string()).optional(),http_body:l.z.string().optional(),http_url:l.z.string().optional(),txt_name:l.z.string().optional(),txt_value:l.z.string().optional()}),g=l.z.object({ciphers:l.z.array(l.z.string()).optional(),early_hints:l.z.string().optional(),http2:l.z.string().optional(),min_tls_version:l.z.string().optional(),tls_1_3:l.z.string().optional()}),_=l.z.object({id:l.z.string(),bundle_method:l.z.string().optional(),certificate_authority:l.z.string(),custom_certificate:l.z.string().optional(),custom_csr_id:l.z.string().optional(),custom_key:l.z.string().optional(),expires_on:l.z.string().optional(),hosts:l.z.array(l.z.string()).optional(),issuer:l.z.string().optional(),method:l.z.string(),serial_number:l.z.string().optional(),settings:g.optional(),signature:l.z.string().optional(),type:l.z.string(),uploaded_on:l.z.string().optional(),validation_errors:l.z.array(m).optional(),validation_records:l.z.array(h).optional(),wildcard:l.z.boolean()}),v=l.z.object({name:l.z.string(),type:l.z.string(),value:l.z.string()}),y=l.z.object({http_body:l.z.string().optional(),http_url:l.z.string().optional()}),b=l.z.object({id:l.z.string(),ssl:_,hostname:l.z.string(),custom_metadata:l.z.record(l.z.string(),l.z.string()).optional(),custom_origin_server:l.z.string().optional(),custom_origin_sni:l.z.string().optional(),ownership_verification:v.optional(),ownership_verification_http:y.optional(),status:l.z.string(),verification_errors:l.z.array(l.z.string()).optional(),created_at:l.z.string()}),x=l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:b});l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:l.z.array(b)});function S(e){return(0,d.default)(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({"X-Auth-Email":e.authEmail,"X-Auth-Key":e.authKey,"Content-Type":`application/json`}).middlewares([(0,f.retry)(),(0,f.dedupe)()])}function C(e){let t={},n={};if(!e)return{sslOverrides:t,rest:n};for(let[r,i]of Object.entries(e))r.startsWith(`ssl.`)?t[r.slice(4)]=i:n[r]=i;return{sslOverrides:t,rest:n}}function w(e){let t=[];if(e.ssl.validation_records)for(let n of e.ssl.validation_records)n.txt_name&&n.txt_value&&t.push({name:`txt`,record:n.txt_value,domain:n.txt_name});if(e.ownership_verification&&t.push({name:`txt`,record:e.ownership_verification.value,domain:e.ownership_verification.name}),e.ownership_verification_http?.http_body&&e.ownership_verification_http?.http_url&&t.push({name:`http`,http_body:e.ownership_verification_http.http_body,http_url:e.ownership_verification_http.http_url}),e.ssl.validation_records)for(let n of e.ssl.validation_records)n.http_body&&n.http_url&&t.push({name:`http`,http_body:n.http_body,http_url:n.http_url});let n={...e.domain_metadata||{},"ssl.method":e.ssl.method,"ssl.type":e.ssl.type,"ssl.certificate_authority":e.ssl.certificate_authority};return{custom_domain_id:e.id,domain:e.hostname,primary:e.primary,status:e.status===`active`?`ready`:`pending`,type:e.type??`auth0_managed_certs`,verification:{methods:l.z.array(c.verificationMethodsSchema).parse(t)},domain_metadata:n}}function ee(e){return{create:async(t,n)=>{let{sslOverrides:r,rest:i}=C(n.domain_metadata),{result:a,errors:o,success:s}=x.parse(await S(e).post({hostname:n.domain,ssl:{method:`txt`,type:`dv`,...r},custom_metadata:e.enterprise?{tenant_id:t}:void 0},`/custom_hostnames`).json());if(!s)throw Error(JSON.stringify(o));let c=w({...a,primary:!1,type:n.type,domain_metadata:i});return await e.customDomainAdapter.create(t,{custom_domain_id:c.custom_domain_id,domain:c.domain,type:c.type,domain_metadata:n.domain_metadata}),await e.customDomainAdapter.update(t,c.custom_domain_id,{status:c.status,primary:c.primary,verification:c.verification}),c},get:async(t,n)=>{let r=await e.customDomainAdapter.get(t,n);if(!r)throw new u.HTTPException(404);let i;try{i=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`,e instanceof Error?e.message:e),r}let a=x.safeParse(i);if(!a.success||!a.data.success)return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`,a.success?{cfErrors:a.data.errors}:{zodIssues:a.error.issues,body:i}),r;let{result:o}=a.data;if(e.enterprise&&o.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404);let s;try{s=w({...r,...o})}catch(e){return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`,e instanceof Error?e.message:e),r}if(s.status!==r.status||JSON.stringify(s.verification)!==JSON.stringify(r.verification))try{await e.customDomainAdapter.update(t,n,{status:s.status,verification:s.verification})}catch(e){console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`,e instanceof Error?e.message:e)}return s},getByDomain:async t=>e.customDomainAdapter.getByDomain(t),list:async t=>e.customDomainAdapter.list(t),remove:async(t,n)=>{if(e.enterprise){let{result:r,success:i}=x.parse(await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());if(!i||r.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404)}let r=await S(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();return r.ok&&await e.customDomainAdapter.remove(t,n),r.ok},update:async(t,n,r)=>{let{sslOverrides:i}=C(r.domain_metadata),a={};if(Object.keys(i).length>0){let t;try{t=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){throw new u.HTTPException(503,{message:`Failed to fetch current custom hostname state: ${e instanceof Error?e.message:String(e)}`})}let r=x.safeParse(t);if(!r.success||!r.data.success)throw new u.HTTPException(503,{message:`Failed to parse current custom hostname state: ${JSON.stringify(r.success?r.data.errors:r.error.issues)}`});a.ssl={method:r.data.result.ssl.method,type:r.data.result.ssl.type,certificate_authority:r.data.result.ssl.certificate_authority,...i}}if(Object.keys(a).length>0){let t=await S(e).patch(a,`/custom_hostnames/${encodeURIComponent(n)}`).res().catch(e=>{throw new u.HTTPException(503,{message:`Failed to update custom hostname: ${e instanceof Error?e.message:String(e)}`})});if(!t.ok)throw new u.HTTPException(503,{message:await t.text()})}return e.customDomainAdapter.update(t,n,r)},uploadCertificate:async(t,n,r)=>{let i=await e.customDomainAdapter.get(t,n);if(!i)throw new u.HTTPException(404);let a=await S(e).patch({ssl:{custom_certificate:r.certificate,custom_key:r.private_key}},`/custom_hostnames/${encodeURIComponent(n)}`).json(),{result:o,errors:s,success:c}=x.parse(a);if(!c)throw new u.HTTPException(503,{message:JSON.stringify(s)});let l=w({...i,...o});return await e.customDomainAdapter.update(t,n,{status:l.status,verification:l.verification}),l}}}var te=class{config;cache=null;constructor(e){this.config=e}async getCache(){if(this.cache)return this.cache;if(typeof caches>`u`)throw Error(`caches API is not available - CloudflareCache should only be used in Cloudflare Workers`);return this.config.cacheName?this.cache=await caches.open(this.config.cacheName):this.cache=caches.default,this.cache}getKey(e){return this.config.keyPrefix?`${this.config.keyPrefix}:${e}`:e}createRequest(e){return new Request(`https://cache.internal/${this.getKey(e)}`)}async matchWithTimeout(e,t){let n=this.config.getTimeoutMs??200;return n<=0?e.match(t):new Promise(r=>{let i=setTimeout(()=>r(void 0),n);e.match(t).then(e=>{clearTimeout(i),r(e)},()=>{clearTimeout(i),r(void 0)})})}async get(e){try{let t=await this.getCache(),n=this.createRequest(e),r=await this.matchWithTimeout(t,n);if(!r)return null;let i=await r.text();if(!i)return await this.delete(e),null;let a;try{a=JSON.parse(i)}catch{return await this.delete(e),null}return a.expiresAt&&new Date(a.expiresAt)<new Date?(await this.delete(e),null):a.value}catch(t){return console.error(`CloudflareCache: get error for key ${e}:`,t),null}}async set(e,t,n){try{let r=await this.getCache(),i=n??this.config.defaultTtlSeconds,a=i!==void 0,o=a?Math.max(0,i):0,s={value:t,expiresAt:a?new Date(Date.now()+(o>0?o*1e3:-1)).toISOString():void 0,cachedAt:new Date().toISOString()},c=this.createRequest(e),l={"Content-Type":`application/json`};a&&o>0&&(l[`Cache-Control`]=`max-age=${o}`);let u=new Response(JSON.stringify(s),{headers:l});await r.put(c,u)}catch(t){console.error(`CloudflareCache: set error for key ${e}:`,t)}}async delete(e){try{let t=await this.getCache(),n=this.createRequest(e);return await t.delete(n)}catch(t){return console.error(`CloudflareCache: delete error for key ${e}:`,t),!1}}async deleteByPrefix(e){return console.warn(`CloudflareCache.deleteByPrefix() is not implemented - Cloudflare Cache API does not support prefix-based deletion`),0}async clear(){console.warn(`CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries`)}};function ne(e={}){return new te({defaultTtlSeconds:300,keyPrefix:`authhero`,getTimeoutMs:200,...e})}var re=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,T=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=re[n[e]&63];return t};async function E(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e.authToken}`},body:JSON.stringify({query:t}),signal:r.signal});if(!i.ok)throw Error(`R2 SQL query failed: ${i.status} ${i.statusText}`);let a=await i.json();if(!a.success&&a.errors)throw Error(`R2 SQL error: ${a.errors.join(`, `)}`);return a.data||a.result?.data||[]}finally{clearTimeout(i)}}function D(e){return`'${e.replace(/'/g,`''`)}'`}function O(e){return`"${e.replace(/"/g,`""`)}"`}function k(e){let t=e=>{if(!e)return``;try{return JSON.parse(e)}catch{return e}};return{type:e.type,date:e.date,description:e.description,ip:e.ip,user_agent:e.user_agent,details:t(e.details),isMobile:!!e.isMobile,user_id:e.user_id,user_name:e.user_name,connection:e.connection,connection_id:e.connection_id,client_id:e.client_id,client_name:e.client_name,audience:e.audience,scope:e.scope,strategy:e.strategy,strategy_type:e.strategy_type,hostname:e.hostname,auth0_client:t(e.auth0_client),log_id:e.id,location_info:e.country_code||e.city_name||e.latitude||e.longitude||e.time_zone||e.continent_code?{country_code:e.country_code||``,city_name:e.city_name||``,latitude:e.latitude||``,longitude:e.longitude||``,time_zone:e.time_zone||``,continent_code:e.continent_code||``}:void 0}}function ie(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return await ae(e,t,i),i}}async function ae(e,t,n){let r=e=>e?JSON.stringify(e):void 0,i={id:n.log_id,tenant_id:t,type:n.type,date:n.date,description:n.description?.substring(0,256),ip:n.ip,user_agent:n.user_agent,details:r(n.details)?.substring(0,8192),isMobile:+!!n.isMobile,user_id:n.user_id,user_name:n.user_name,connection:n.connection,connection_id:n.connection_id,client_id:n.client_id,client_name:n.client_name,audience:n.audience,scope:n.scope,strategy:n.strategy,strategy_type:n.strategy_type,hostname:n.hostname,auth0_client:r(n.auth0_client),log_id:n.log_id,country_code:n.location_info?.country_code,city_name:n.location_info?.city_name,latitude:n.location_info?.latitude,longitude:n.location_info?.longitude,time_zone:n.location_info?.time_zone,continent_code:n.location_info?.continent_code};try{if(e.pipelineBinding)await e.pipelineBinding.send([i]);else if(e.pipelineEndpoint){let t=e.timeout||3e4,n=new AbortController,r=setTimeout(()=>n.abort(),t);try{let t=await fetch(e.pipelineEndpoint,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify([i]),signal:n.signal});if(!t.ok)throw Error(`Pipeline ingestion failed: ${t.status} ${t.statusText}`)}finally{clearTimeout(r)}}else throw Error(`Either pipelineEndpoint or pipelineBinding must be configured`)}catch(e){throw console.error(`Failed to send log to Pipeline:`,e),e}}function A(e){return async(t,n)=>{let r=e.namespace||`default`,i=e.tableName||`logs`,a=await E(e,`
+      SELECT * FROM ${O(r)}.${O(i)}
+      WHERE tenant_id = ${D(t)}
+        AND id = ${D(n)}
       LIMIT 1
-    `);if(a.length===0)return null;let o=a[0];return o?D(o):null}}function ce(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]=n)}return t}function le(e){let t=[];for(let[n,r]of Object.entries(e)){let e=n.replace(/[^a-zA-Z0-9_]/g,``);e&&r&&t.push(`${E(e)} = ${T(r)}`)}return t}function ue(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s}=n,c=e.namespace||`default`,l=e.tableName||`logs`,u=[`tenant_id = ${T(t)}`];if(s){let e=ce(s);u.push(...le(e))}let d=u.join(` AND `),f=`ORDER BY date DESC`;if(o&&o.sort_by){let e=o.sort_by.replace(/[^a-zA-Z0-9_]/g,``),t=o.sort_order===`asc`?`ASC`:`DESC`;f=`ORDER BY ${E(e)} ${t}`}let p=r*i,m=`LIMIT ${i} OFFSET ${p}`,h=(await w(e,`
-      SELECT * FROM ${E(c)}.${E(l)}
+    `);if(a.length===0)return null;let o=a[0];return o?k(o):null}}function oe(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]=n)}return t}function se(e){let t=[];for(let[n,r]of Object.entries(e)){let e=n.replace(/[^a-zA-Z0-9_]/g,``);e&&r&&t.push(`${O(e)} = ${D(r)}`)}return t}function ce(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s}=n,c=e.namespace||`default`,l=e.tableName||`logs`,u=[`tenant_id = ${D(t)}`];if(s){let e=oe(s);u.push(...se(e))}let d=u.join(` AND `),f=`ORDER BY date DESC`;if(o&&o.sort_by){let e=o.sort_by.replace(/[^a-zA-Z0-9_]/g,``),t=o.sort_order===`asc`?`ASC`:`DESC`;f=`ORDER BY ${O(e)} ${t}`}let p=r*i,m=`LIMIT ${i} OFFSET ${p}`,h=(await E(e,`
+      SELECT * FROM ${O(c)}.${O(l)}
       WHERE ${d}
       ${f}
       ${m}
-    `)).map(D);if(!a)return{logs:h,start:0,limit:0,length:0};let g=(await w(e,`
-      SELECT COUNT(*) as count FROM ${E(c)}.${E(l)}
+    `)).map(k);if(!a)return{logs:h,start:0,limit:0,length:0};let g=(await E(e,`
+      SELECT COUNT(*) as count FROM ${O(c)}.${O(l)}
       WHERE ${d}
-    `))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function de(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function k(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:O(e),list:ue(e),get:se(e)}}async function A(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function j(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function M(e){return`"${e.replace(/"/g,`""`)}"`}function N(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function fe(e){return async(t,n)=>{let r=n.log_id||C(),i={...n,log_id:r};return pe(e,t,i),i}}function pe(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function me(e){return async(t,n)=>{let r=await A(e,`
+    `))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function le(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function j(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:ie(e),list:ce(e),get:A(e)}}async function M(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function N(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function P(e){return`"${e.replace(/"/g,`""`)}"`}function F(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function ue(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return de(e,t,i),i}}function de(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function fe(e){return async(t,n)=>{let r=await M(e,`
       SELECT *
-      FROM ${M(e.dataset||`authhero_logs`)}
-      WHERE index1 = ${j(t)}
-        AND blob1 = ${j(n)}
+      FROM ${P(e.dataset||`authhero_logs`)}
+      WHERE index1 = ${N(t)}
+        AND blob1 = ${N(n)}
       LIMIT 1
-    `);return r.length===0||!r[0]?null:N(r[0])}}function he(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]||(t[e]=[]),t[e].push(n))}return t}function P(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function ge(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=P(n);if(i)if(e.length===1)t.push(`${i} = ${j(e[0])}`);else{let n=e.map(e=>j(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function F(e){return e===`date`?`double2`:P(e)||`timestamp`}function I(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${j(t)}`];if(s){let e=he(s);d.push(...ge(e))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${F(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await A(e,`
+    `);return r.length===0||!r[0]?null:F(r[0])}}function pe(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]||(t[e]=[]),t[e].push(n))}return t}function I(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function me(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=I(n);if(i)if(e.length===1)t.push(`${i} = ${N(e[0])}`);else{let n=e.map(e=>N(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function he(e){return e===`date`?`double2`:I(e)||`timestamp`}function ge(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${N(t)}`];if(s){let e=pe(s);d.push(...me(e))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${he(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await M(e,`
       SELECT *
-      FROM ${M(u)}
+      FROM ${P(u)}
       WHERE ${f}
       ${p}
       ${h}
-    `)).map(N);if(!a)return{logs:g,start:0,limit:0,length:0};let _=`
+    `)).map(F);if(!a)return{logs:g,start:0,limit:0,length:0};let _=`
       SELECT count() as count
-      FROM ${M(u)}
+      FROM ${P(u)}
       WHERE ${f}
-    `;try{let t=(await A(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var L=[`s`],_e=[`pwd_leak`];function R(e){return`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`}function z(e){return e.toISOString().split(`T`)[0]}function ve(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?R(i):z(s),l=a?R(a):z(o),u=new Date(`${c}T00:00:00Z`).getTime(),d=new Date(`${l}T23:59:59.999Z`).getTime();return(await A(e,`
+    `;try{let t=(await M(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var L=[`s`],_e=[`pwd_leak`];function R(e){return`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`}function z(e){return e.toISOString().split(`T`)[0]}function ve(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?R(i):z(s),l=a?R(a):z(o),u=new Date(`${c}T00:00:00Z`).getTime(),d=new Date(`${l}T23:59:59.999Z`).getTime();return(await M(e,`
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
-          SUM(CASE WHEN blob3 IN (${L.map(e=>j(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
+          SUM(CASE WHEN blob3 IN (${L.map(e=>N(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${_e.map(e=>j(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${_e.map(e=>N(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
-        WHERE index1 = ${j(n)}
+        WHERE index1 = ${N(n)}
           AND double2 >= ${u}
           AND double2 <= ${d}
         GROUP BY date
         ORDER BY date ASC
-      `)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=L.map(e=>j(e)).join(`, `),o=(await A(e,`
+      `)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=L.map(e=>N(e)).join(`, `),o=(await M(e,`
         SELECT COUNT(DISTINCT blob7) AS count
         FROM "${t}"
-        WHERE index1 = ${j(n)}
+        WHERE index1 = ${N(n)}
           AND double2 >= ${i}
           AND blob3 IN (${a})
           AND blob7 IS NOT NULL
           AND blob7 != ''
-      `))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var ye={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`]},be={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},xe={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},Se={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`}};function Ce(e,t){let n=`toDateTime(intDiv(double2, 1000), ${j(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function we(e){return e===`hour`?`DateTime`:`Date`}function Te(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>j(e)).join(`, `),o=[`index1 = ${j(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(xe)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>j(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function Ee(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${M(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${M(`time`)} ASC`:`${M(n)} DESC`}function B(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=ye[r],o=Se[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=Ce(i.interval,i.tz);s.push(`${e} AS ${M(`time`)}`),c.push({name:`time`,type:we(i.interval)})}else{let t=be[e];s.push(`${t} AS ${M(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${M(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>M(e===`time`?`time`:e)).join(`, `)}`:``,d=Ee(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
+      `))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var ye={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`]},be={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},xe={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},Se={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`}};function Ce(e,t){let n=`toDateTime(intDiv(double2, 1000), ${N(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function we(e){return e===`hour`?`DateTime`:`Date`}function Te(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>N(e)).join(`, `),o=[`index1 = ${N(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(xe)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>N(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function Ee(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${P(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${P(`time`)} ASC`:`${P(n)} DESC`}function B(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=ye[r],o=Se[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=Ce(i.interval,i.tz);s.push(`${e} AS ${P(`time`)}`),c.push({name:`time`,type:we(i.interval)})}else{let t=be[e];s.push(`${t} AS ${P(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${P(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>P(e===`time`?`time`:e)).join(`, `)}`:``,d=Ee(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
         SELECT ${l.join(`, `)}
-        FROM ${M(t)}
+        FROM ${P(t)}
         WHERE ${Te(i,n,a)}
         ${u}
         ORDER BY ${d}
         LIMIT ${Math.max(0,i.limit)} OFFSET ${Math.max(0,i.offset)}
         FORMAT JSON
-      `,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function V(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:fe(e),list:I(e),get:me(e)}}var De=`authhero_action_executions`,Oe=1024,ke=`[truncated]`;function H(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function Ae(e){let t=c.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function U(e,t=Oe){return e.length<=t?e:`${e.substring(0,t-11)}${ke}`}function W(e){return e==null?``:JSON.stringify(e)}function je(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:Ae(e.blob3),results:H(e.blob4)??[],logs:H(e.blob5),created_at:t,updated_at:n}}function Me(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Ne(e,t,a,r),a}}function Ne(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[U(n.id),U(n.trigger_id),U(n.status),U(W(n.results)),U(W(n.logs)),U(n.created_at),U(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function Pe(e){return async(t,n)=>{let r=await A(e,`
+      `,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function V(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:ue(e),list:ge(e),get:fe(e)}}var De=`authhero_action_executions`,Oe=1024,ke=`[truncated]`;function H(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function Ae(e){let t=c.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function U(e,t=Oe){return e.length<=t?e:`${e.substring(0,t-11)}${ke}`}function W(e){return e==null?``:JSON.stringify(e)}function je(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:Ae(e.blob3),results:H(e.blob4)??[],logs:H(e.blob5),created_at:t,updated_at:n}}function Me(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Ne(e,t,a,r),a}}function Ne(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[U(n.id),U(n.trigger_id),U(n.status),U(W(n.results)),U(W(n.logs)),U(n.created_at),U(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function Pe(e){return async(t,n)=>{let r=await M(e,`
       SELECT *
-      FROM ${M(e.dataset||De)}
-      WHERE index1 = ${j(t)}
-        AND blob1 = ${j(n)}
+      FROM ${P(e.dataset||De)}
+      WHERE index1 = ${N(t)}
+        AND blob1 = ${N(n)}
       LIMIT 1
     `);return r.length===0||!r[0]?null:je(r[0])}}function G(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No action_executions binding configured. Executions will not be written.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API.`),{create:Me(e),get:Pe(e)}}function Fe(){return{async getGeoInfo(e){try{let t=e[`cf-ipcountry`],n=e[`cf-ipcity`],r=e[`cf-iplatitude`],i=e[`cf-iplongitude`],a=e[`cf-timezone`],o=e[`cf-ipcontinent`];return t?{country_code:t,city_name:n||``,latitude:r||``,longitude:i||``,time_zone:a||``,continent_code:o||``}:null}catch(e){return console.warn(`Failed to get geo info from Cloudflare headers:`,e),null}}}}var Ie=class{bindings;constructor(e){this.bindings=e}async consume(e,t){let n=this.bindings[e];if(!n)return{allowed:!0};try{let{success:e}=await n.limit({key:t});return{allowed:e}}catch(t){return console.error(`CloudflareRateLimit: limit() error for scope ${e}:`,t),{allowed:!0}}}};function K(e){if(e&&Object.keys(e).some(t=>e[t]))return new Ie(e)}function q(e){return`// Auto-generated AuthHero code hook worker
 
@@ -266,4 +266,4 @@ export default {
     }
   },
 };
-`}var He=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Ve(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Be(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},Y=class extends Error{status;endpoint;errors;body;constructor(e,t,n,r=[]){super(`Cloudflare API ${e} ${t}: ${Ue(n,256)}`),this.name=`CloudflareApiError`,this.status=e,this.endpoint=t,this.body=n,this.errors=r}};function Ue(e,t){return e.length<=t?e:`${e.slice(0,t)}…`}var X=class{accountId;apiToken;fetchImpl;timeoutMs;baseUrl;constructor(e){this.accountId=e.accountId,this.apiToken=e.apiToken,this.fetchImpl=e.fetch??((...e)=>fetch(...e)),this.timeoutMs=e.timeoutMs??3e4,this.baseUrl=(e.baseUrl??`https://api.cloudflare.com/client/v4`).replace(/\/+$/,``)}async createD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database`;return(await this.request(`POST`,t,{body:JSON.stringify({name:e})})).result}async listD1Databases(e){let t=e?`?name=${encodeURIComponent(e)}`:``,n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database${t}`;return(await this.request(`GET`,n)).result??[]}async deleteD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}`;await this.request(`DELETE`,t)}async execD1(e,t){let n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}/query`;return(await this.request(`POST`,n,{body:JSON.stringify({sql:t})})).result??[]}async uploadNamespacedScript(e,t,n){let r=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`,i={main_module:n.mainModule,compatibility_date:n.compatibilityDate,compatibility_flags:n.compatibilityFlags??[],bindings:n.bindings??[],tags:n.tags},a=new FormData;a.append(`metadata`,new Blob([JSON.stringify(i)],{type:`application/json`})),a.append(n.mainModule,new Blob([n.script],{type:`application/javascript+module`}),n.mainModule),await this.request(`PUT`,r,{body:a})}async deleteNamespacedScript(e,t){let n=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`;await this.request(`DELETE`,n)}async setNamespacedScriptSecret(e,t,n,r){let i=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}/secrets`;await this.request(`PUT`,i,{body:JSON.stringify({name:n,text:r,type:`secret_text`})})}async request(e,t,n){let r=`${this.baseUrl}${t}`,i=new AbortController,a=setTimeout(()=>i.abort(),this.timeoutMs),o={Authorization:`Bearer ${this.apiToken}`,...n?.headers??{}};n?.body&&!(n.body instanceof FormData)&&!o[`Content-Type`]&&(o[`Content-Type`]=`application/json`);let s;try{s=await this.fetchImpl(r,{method:e,headers:o,body:n?.body,signal:i.signal})}finally{clearTimeout(a)}let c=await s.text();if(!s.ok){let e=[];try{let t=JSON.parse(c);Array.isArray(t.errors)&&(e=t.errors)}catch{}throw new Y(s.status,t,c,e)}if(!(c===``||s.status===204))return JSON.parse(c)}},Z=`{tenant_id}`,We=`tenant-{tenant_id}`,Ge=`index.js`,Ke=`2026-05-01`;function Q(e,t){return e.replace(/\{tenant_id\}/g,t)}function qe(e){if(!(e instanceof Y))return!1;let t=e.body.toLowerCase();return e.status===409||t.includes(`already exists`)||t.includes(`name is already taken`)||t.includes(`already in use`)}function $(e){return e instanceof Y?e.status===404:!1}function Je(e){let t=new X({accountId:e.accountId,apiToken:e.apiToken,fetch:e.fetch,timeoutMs:e.timeoutMs}),n=e.scriptNameTemplate??Z,r=e.d1NameTemplate??We,i=e.scriptMetadata?.main_module??Ge,a=e.scriptMetadata?.compatibility_date??Ke,o=e.scriptMetadata?.compatibility_flags??[`nodejs_compat`],s=e.dispatchNamespace;async function c(e){let n=(await t.listD1Databases(e)).find(t=>t.name===e);if(n)return n.uuid;try{return(await t.createD1Database(e)).uuid}catch(n){if(!qe(n))throw n;let r=(await t.listD1Databases(e)).find(t=>t.name===e);if(r)return r.uuid;throw n}}async function l(n){for(let r of e.migrations)try{await t.execD1(n,r.sql)}catch(e){throw e instanceof Error?Error(`Failed to apply migration "${r.name}" to D1 ${n}: ${e.message}`,{cause:e}):e}}async function u(n,r){let c=[{type:`d1`,name:`AUTH_DB`,id:r},{type:`plain_text`,name:`CONTROL_PLANE_BASE_URL`,text:e.controlPlaneBaseUrl},...e.extraBindings??[]];await t.uploadNamespacedScript(s,n,{script:e.tenantWorkerScript,mainModule:i,compatibilityDate:a,compatibilityFlags:o,bindings:c,tags:[`authhero-tenant`,`tenant:${n}`]})}async function d(n,r){let i=await e.secrets(r);for(let[e,r]of Object.entries(i))await t.setNamespacedScriptSecret(s,n,e,r)}return{async onProvision(e){let t=Q(n,e),i=Q(r,e),a=await c(i);return await l(a),await u(t,a),await d(t,e),{d1DatabaseId:a,scriptName:t,d1Name:i}},async onDeprovision(e){let i=Q(n,e),a=Q(r,e);try{await t.deleteNamespacedScript(s,i)}catch(e){if(!$(e))throw e}let o=(await t.listD1Databases(a)).find(e=>e.name===a);if(o)try{await t.deleteD1Database(o.uuid)}catch(e){if(!$(e))throw e}}}}function Ye(e){return e.deployment_type===`wfp`}function Xe(e){let{provisioner:t,tenants:n}=e,r=e.shouldProvision??Ye,i=e.logger;async function a(e,t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){i?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}return{async onProvision(e){let i=await n.get(e);if(i&&r(i))try{let r=await t.onProvision(e);await n.update(e,{d1_database_id:r.d1DatabaseId,worker_script_name:r.scriptName,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){throw await a(e,t),t}},async onDeprovision(e){let i=await n.get(e);i&&!r(i)||await t.onDeprovision(e)}}}var Ze=`DISPATCHER`,Qe=`tenant-{tenant_id}-auth`;function $e(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function et(e,t){return e.replace(/\{tenant_id\}/g,t)}function tt(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=Ze,scriptNameTemplate:i=Qe,resolveTenantId:a=e=>e.req.header(`tenant-id`)}=e;return async(e,o)=>{let s=await a(e);if(!s||s===n)return o();let c=await t.get(s);if(!c||c.deployment_type!==`wfp`||c.provisioning_state&&c.provisioning_state!==`ready`)return o();let l=Reflect.get(e.env??{},r);if(!$e(l))return o();let u=et(i,s);return l.get(u).fetch(e.req.raw)}}function nt(e){let t={customDomains:ne(e),cache:ie({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Fe()};e.r2SqlLogs?t.logs=k(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=X,exports.CloudflareApiError=Y,exports.CloudflareCodeExecutor=Le,exports.DispatchNamespaceCodeExecutor=J,exports.WorkerLoaderCodeExecutor=He,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineStatsAdapter=ve,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=Je,exports.createR2SQLLogsAdapter=k,exports.createR2SQLStatsAdapter=de,exports.createWfpForwardMiddleware=tt,exports.createWfpTenantProvisioningHook=Xe,exports.default=nt,exports.generateWorkerScript=q;
+`}var He=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Ve(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Be(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},Y=class extends Error{status;endpoint;errors;body;constructor(e,t,n,r=[]){super(`Cloudflare API ${e} ${t}: ${Ue(n,256)}`),this.name=`CloudflareApiError`,this.status=e,this.endpoint=t,this.body=n,this.errors=r}};function Ue(e,t){return e.length<=t?e:`${e.slice(0,t)}…`}var X=class{accountId;apiToken;fetchImpl;timeoutMs;baseUrl;constructor(e){this.accountId=e.accountId,this.apiToken=e.apiToken,this.fetchImpl=e.fetch??((...e)=>fetch(...e)),this.timeoutMs=e.timeoutMs??3e4,this.baseUrl=(e.baseUrl??`https://api.cloudflare.com/client/v4`).replace(/\/+$/,``)}async createD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database`;return(await this.request(`POST`,t,{body:JSON.stringify({name:e})})).result}async listD1Databases(e){let t=e?`?name=${encodeURIComponent(e)}`:``,n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database${t}`;return(await this.request(`GET`,n)).result??[]}async deleteD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}`;await this.request(`DELETE`,t)}async execD1(e,t){let n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}/query`;return(await this.request(`POST`,n,{body:JSON.stringify({sql:t})})).result??[]}async uploadNamespacedScript(e,t,n){let r=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`,i={main_module:n.mainModule,compatibility_date:n.compatibilityDate,compatibility_flags:n.compatibilityFlags??[],bindings:n.bindings??[],tags:n.tags},a=new FormData;a.append(`metadata`,new Blob([JSON.stringify(i)],{type:`application/json`})),a.append(n.mainModule,new Blob([n.script],{type:`application/javascript+module`}),n.mainModule),await this.request(`PUT`,r,{body:a})}async deleteNamespacedScript(e,t){let n=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`;await this.request(`DELETE`,n)}async setNamespacedScriptSecret(e,t,n,r){let i=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}/secrets`;await this.request(`PUT`,i,{body:JSON.stringify({name:n,text:r,type:`secret_text`})})}async request(e,t,n){let r=`${this.baseUrl}${t}`,i=new AbortController,a=setTimeout(()=>i.abort(),this.timeoutMs),o={Authorization:`Bearer ${this.apiToken}`,...n?.headers??{}};n?.body&&!(n.body instanceof FormData)&&!o[`Content-Type`]&&(o[`Content-Type`]=`application/json`);let s;try{s=await this.fetchImpl(r,{method:e,headers:o,body:n?.body,signal:i.signal})}finally{clearTimeout(a)}let c=await s.text();if(!s.ok){let e=[];try{let t=JSON.parse(c);Array.isArray(t.errors)&&(e=t.errors)}catch{}throw new Y(s.status,t,c,e)}if(!(c===``||s.status===204))return JSON.parse(c)}},We=`{tenant_id}`,Ge=`tenant-{tenant_id}`,Ke=`index.js`,qe=`2026-05-01`;function Z(e,t){return e.replace(/\{tenant_id\}/g,t)}function Je(e){if(!(e instanceof Y))return!1;let t=e.body.toLowerCase();return e.status===409||t.includes(`already exists`)||t.includes(`name is already taken`)||t.includes(`already in use`)}function Q(e){return e instanceof Y?e.status===404:!1}function $(e){let t=new X({accountId:e.accountId,apiToken:e.apiToken,fetch:e.fetch,timeoutMs:e.timeoutMs}),n=e.scriptNameTemplate??We,r=e.d1NameTemplate??Ge,i=e.scriptMetadata?.main_module??Ke,a=e.scriptMetadata?.compatibility_date??qe,o=e.scriptMetadata?.compatibility_flags??[`nodejs_compat`],s=e.dispatchNamespace,c=e.logger;async function l(e){let n=(await t.listD1Databases(e)).find(t=>t.name===e);if(n)return{id:n.uuid,created:!1};try{return{id:(await t.createD1Database(e)).uuid,created:!0}}catch(n){if(!Je(n))throw n;let r=(await t.listD1Databases(e)).find(t=>t.name===e);if(r)return{id:r.uuid,created:!1};throw n}}let u=`_authhero_provisioner_migrations`;function d(e,t){let n=[];for(let r of e)for(let e of r.results??[])if(e&&typeof e==`object`&&t in e){let r=e[t];typeof r==`string`&&n.push(r)}return n}async function f(e){return d(await t.execD1(e,`SELECT name FROM sqlite_master WHERE type='table' AND name='${u}';`),`name`).length>0}async function p(e){await t.execD1(e,`CREATE TABLE IF NOT EXISTS ${u} (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);`)}async function m(e){let n=await t.execD1(e,`SELECT name FROM ${u};`);return new Set(d(n,`name`))}function h(e){return e.replace(/'/g,`''`)}async function g(e,n){let r=new Date().toISOString();await t.execD1(e,`INSERT OR IGNORE INTO ${u} (name, applied_at) VALUES ('${h(n)}', '${h(r)}');`)}async function _(n){let r=await m(n);for(let i of e.migrations)if(!r.has(i.name)){try{await t.execD1(n,i.sql)}catch(e){throw e instanceof Error?Error(`Failed to apply migration "${i.name}" to D1 ${n}: ${e.message}`,{cause:e}):e}await g(n,i.name)}}async function v(n,r){let c=[{type:`d1`,name:`AUTH_DB`,id:r},{type:`plain_text`,name:`CONTROL_PLANE_BASE_URL`,text:e.controlPlaneBaseUrl},...e.extraBindings??[]];await t.uploadNamespacedScript(s,n,{script:e.tenantWorkerScript,mainModule:i,compatibilityDate:a,compatibilityFlags:o,bindings:c,tags:[`authhero-tenant`,`tenant:${n}`]})}async function y(n,r){let i=await e.secrets(r);for(let[e,r]of Object.entries(i))await t.setNamespacedScriptSecret(s,n,e,r)}return{async onProvision(t){let i=Z(n,t),a=Z(r,t),{id:o,created:s}=await l(a),u=s?!1:await f(o);if(s||u)await p(o),await _(o);else{c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`),await p(o);for(let t of e.migrations)await g(o,t.name)}return await v(i,o),await y(i,t),{d1DatabaseId:o,scriptName:i,d1Name:a}},async onDeprovision(e){let i=Z(n,e),a=Z(r,e),o=[];try{await t.deleteNamespacedScript(s,i)}catch(e){Q(e)||o.push(e)}try{let e=(await t.listD1Databases(a)).find(e=>e.name===a);if(e)try{await t.deleteD1Database(e.uuid)}catch(e){Q(e)||o.push(e)}}catch(e){o.push(e)}if(o.length>0){let t=o.map(e=>e instanceof Error?e.message:String(e)).join(`; `);throw Error(`Deprovision of tenant "${e}" had ${o.length} failure(s): ${t}`,{cause:o[0]})}}}}function Ye(e){return e.deployment_type===`wfp`}function Xe(e){if(typeof e!=`object`||!e)return[];let t=[];for(let n of Object.values(e))if(typeof n==`object`&&n&&`errors`in n&&Array.isArray(n.errors))for(let e of n.errors)typeof e==`string`&&t.push(e);return t}function Ze(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??Ye,a=e.logger;async function o(e,t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}return{async onProvision(e){let s=await n.get(e);if(!s||!i(s))return;let c;try{c=await t.onProvision(e)}catch(t){throw await o(e,t),t}let l={d1_database_id:c.d1DatabaseId,worker_script_name:c.scriptName};try{if(r){let t=Xe(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`)}}catch(t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{...l,provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}await n.update(e,{...l,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var Qe=`DISPATCHER`,$e=`tenant-{tenant_id}-auth`;function et(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function tt(e,t){return e.replace(/\{tenant_id\}/g,t)}function nt(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=Qe,scriptNameTemplate:i=$e,resolveTenantId:a=e=>e.req.header(`tenant-id`)}=e;return async(e,o)=>{let s=await a(e);if(!s||s===n)return o();let c=await t.get(s);if(!c||c.deployment_type!==`wfp`||c.provisioning_state&&c.provisioning_state!==`ready`)return o();let l=Reflect.get(e.env??{},r);if(!et(l))return o();let u=tt(i,s);return l.get(u).fetch(e.req.raw)}}function rt(e){let t={customDomains:ee(e),cache:ne({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Fe()};e.r2SqlLogs?t.logs=j(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=X,exports.CloudflareApiError=Y,exports.CloudflareCodeExecutor=Le,exports.DispatchNamespaceCodeExecutor=J,exports.WorkerLoaderCodeExecutor=He,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineStatsAdapter=ve,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=$,exports.createR2SQLLogsAdapter=j,exports.createR2SQLStatsAdapter=le,exports.createWfpForwardMiddleware=nt,exports.createWfpTenantProvisioningHook=Ze,exports.default=rt,exports.generateWorkerScript=q;

package/dist/cloudflare-adapter.d.ts

@@ -733,6 +733,12 @@ interface CloudflareWfpD1ProvisionerOptions {
      * tenant bundle also takes a noticeable chunk of that.
      */
     timeoutMs?: number;
+    /**
+     * Optional `console`-compatible logger. Used to note non-fatal recovery
+     * decisions — e.g. skipping migrations while re-provisioning to heal an
+     * orphaned worker over an existing D1. Defaults to silent.
+     */
+    logger?: Pick<Console, "warn">;
 }
 /**
  * Outcome of a successful `onProvision` — returned so the caller can persist
@@ -864,6 +870,23 @@ interface WfpTenantProvisioningHookOptions {
      * a silent no-op so this module stays test-quiet.
      */
     logger?: Pick<Console, "warn">;
+    /**
+     * Optional post-provision seed run *after* the CF resources exist but
+     * *before* the tenant is marked `ready` — typically
+     * `createDispatchSyncDefaults(...)`, which projects the control plane's
+     * defaults (and the FK-target tenant rows) into the fresh D1.
+     *
+     * Folding the seed into provisioning closes the "ready but empty D1" gap: a
+     * best-effort seed fired separately after this hook can be lost, leaving a
+     * tenant marked `ready` whose D1 has no tenant row and no projected defaults.
+     * Here, if the seed throws — or resolves with collected per-entity errors
+     * (the seed applies with `continueOnError`, so failures surface in the
+     * result rather than as a rejection) — the tenant is marked `failed`
+     * (resource ids are still persisted so a re-provision can find them) and the
+     * error is re-thrown. Leave unset to mark `ready` as soon as the resources
+     * exist.
+     */
+    syncDefaults?: (tenantId: string) => Promise<unknown>;
 }
 interface WfpTenantProvisioningHook {
     onProvision(tenantId: string): Promise<void>;