@authhero/cloudflare-adapter 2.36.1 → 2.37.1

package/dist/cloudflare-adapter.mjs

@@ -784,26 +784,26 @@ function me(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/stats.ts
-var N = ["s"], P = ["pwd_leak"];
-function F(e) {
+var N = ["s"], he = ["pwd_leak"];
+function P(e) {
 	return `${e.slice(0, 4)}-${e.slice(4, 6)}-${e.slice(6, 8)}`;
 }
-function I(e) {
+function F(e) {
 	return e.toISOString().split("T")[0];
 }
-function L(e) {
+function I(e) {
 	let t = e.dataset || "authhero_logs";
 	return {
 		async getDaily(n, r = {}) {
 			let { from: i, to: a } = r, o = /* @__PURE__ */ new Date(), s = new Date(o);
 			s.setDate(s.getDate() - 30);
-			let c = i ? F(i) : I(s), l = a ? F(a) : I(o), u = (/* @__PURE__ */ new Date(`${c}T00:00:00Z`)).getTime(), d = (/* @__PURE__ */ new Date(`${l}T23:59:59.999Z`)).getTime();
+			let c = i ? P(i) : F(s), l = a ? P(a) : F(o), u = (/* @__PURE__ */ new Date(`${c}T00:00:00Z`)).getTime(), d = (/* @__PURE__ */ new Date(`${l}T23:59:59.999Z`)).getTime();
 			return (await O(e, `
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
           SUM(CASE WHEN blob3 IN (${N.map((e) => k(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${P.map((e) => k(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${he.map((e) => k(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
@@ -839,7 +839,7 @@ function L(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/analytics.ts
-var R = {
+var L = {
 	"active-users": ["s", "seacft"],
 	logins: [
 		"s",
@@ -849,17 +849,17 @@ var R = {
 	signups: ["ss", "fs"],
 	"refresh-tokens": ["seacft", "fertft"],
 	sessions: ["slo"]
-}, z = {
+}, R = {
 	connection: "blob9",
 	client_id: "blob11",
 	user_type: "blob16",
 	event: "blob3"
-}, he = {
+}, ge = {
 	connection: "blob9",
 	client_id: "blob11",
 	user_type: "blob16",
 	user_id: "blob7"
-}, ge = {
+}, _e = {
 	"active-users": {
 		expr: "count(DISTINCT blob7)",
 		alias: "active_users",
@@ -886,7 +886,7 @@ var R = {
 		type: "UInt64"
 	}
 };
-function _e(e, t) {
+function ve(e, t) {
 	let n = `toDateTime(intDiv(double2, 1000), ${k(t)})`;
 	switch (e) {
 		case "hour": return `toStartOfHour(${n})`;
@@ -895,17 +895,17 @@ function _e(e, t) {
 		default: return `toStartOfDay(${n})`;
 	}
 }
-function ve(e) {
+function ye(e) {
 	return e === "hour" ? "DateTime" : "Date";
 }
-function ye(e, t, n) {
+function be(e, t, n) {
 	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => k(e)).join(", "), o = [
 		`index1 = ${k(t)}`,
 		`double2 >= ${r}`,
 		`double2 < ${i}`,
 		`blob3 IN (${a})`
 	];
-	for (let [t, n] of Object.entries(he)) {
+	for (let [t, n] of Object.entries(ge)) {
 		let r = e.filters[t];
 		if (r && r.length > 0) {
 			let e = r.map((e) => k(e)).join(", ");
@@ -914,25 +914,25 @@ function ye(e, t, n) {
 	}
 	return o.join(" AND ");
 }
-function be(e, t, n) {
+function xe(e, t, n) {
 	if (e.order_by) {
 		let t = e.order_by.startsWith("-");
 		return `${A(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
 	}
 	return t.length > 0 && t[0] === "time" ? `${A("time")} ASC` : `${A(n)} DESC`;
 }
-function B(e) {
+function z(e) {
 	let t = e.dataset || "authhero_logs";
 	return { async query(n, r, i) {
-		let a = R[r], o = ge[r], s = [], c = [];
+		let a = L[r], o = _e[r], s = [], c = [];
 		for (let e of i.group_by) if (e === "time") {
-			let e = _e(i.interval, i.tz);
+			let e = ve(i.interval, i.tz);
 			s.push(`${e} AS ${A("time")}`), c.push({
 				name: "time",
-				type: ve(i.interval)
+				type: ye(i.interval)
 			});
 		} else {
-			let t = z[e];
+			let t = R[e];
 			s.push(`${t} AS ${A(e)}`), c.push({
 				name: e,
 				type: "String"
@@ -942,10 +942,10 @@ function B(e) {
 			name: o.alias,
 			type: o.type
 		});
-		let l = [...s, `${o.expr} AS ${A(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => A(e === "time" ? "time" : e)).join(", ")}` : "", d = be(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
+		let l = [...s, `${o.expr} AS ${A(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => A(e === "time" ? "time" : e)).join(", ")}` : "", d = xe(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
         SELECT ${l.join(", ")}
         FROM ${A(t)}
-        WHERE ${ye(i, n, a)}
+        WHERE ${be(i, n, a)}
         ${u}
         ORDER BY ${d}
         LIMIT ${Math.max(0, i.limit)} OFFSET ${Math.max(0, i.offset)}
@@ -982,7 +982,7 @@ function B(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/index.ts
-function V(e) {
+function B(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No binding configured. Logs will not be written to Analytics Engine."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required for querying logs via SQL API."), {
 		create: ce(e),
 		list: me(e),
@@ -991,38 +991,38 @@ function V(e) {
 }
 //#endregion
 //#region src/analytics-engine-action-executions/actionExecutions.ts
-var xe = "authhero_action_executions", Se = 1024, Ce = "[truncated]";
-function H(e) {
+var Se = "authhero_action_executions", Ce = 1024, we = "[truncated]";
+function V(e) {
 	if (!(typeof e != "string" || e.length === 0)) try {
 		return JSON.parse(e);
 	} catch {
 		return;
 	}
 }
-function we(t) {
+function Te(t) {
 	let n = e.safeParse(t);
 	return n.success ? n.data : "unspecified";
 }
-function U(e, t = Se) {
-	return e.length <= t ? e : `${e.substring(0, t - 11)}${Ce}`;
+function H(e, t = Ce) {
+	return e.length <= t ? e : `${e.substring(0, t - 11)}${we}`;
 }
-function W(e) {
+function U(e) {
 	return e == null ? "" : JSON.stringify(e);
 }
-function Te(e) {
+function Ee(e) {
 	let t = typeof e.blob6 == "string" && e.blob6.length > 0 ? e.blob6 : typeof e.double1 == "number" ? new Date(e.double1).toISOString() : "", n = typeof e.blob7 == "string" && e.blob7.length > 0 ? e.blob7 : t;
 	return {
 		id: typeof e.blob1 == "string" ? e.blob1 : "",
 		tenant_id: typeof e.index1 == "string" ? e.index1 : "",
 		trigger_id: typeof e.blob2 == "string" ? e.blob2 : "",
-		status: we(e.blob3),
-		results: H(e.blob4) ?? [],
-		logs: H(e.blob5),
+		status: Te(e.blob3),
+		results: V(e.blob4) ?? [],
+		logs: V(e.blob5),
 		created_at: t,
 		updated_at: n
 	};
 }
-function Ee(e) {
+function De(e) {
 	return async (t, n) => {
 		let r = Date.now(), i = new Date(r).toISOString(), a = {
 			id: n.id,
@@ -1034,10 +1034,10 @@ function Ee(e) {
 			created_at: i,
 			updated_at: i
 		};
-		return De(e, t, a, r), a;
+		return Oe(e, t, a, r), a;
 	};
 }
-function De(e, t, n, r) {
+function Oe(e, t, n, r) {
 	if (!e.analyticsEngineBinding) {
 		console.error("Analytics Engine action_executions binding not configured; skipping write");
 		return;
@@ -1045,13 +1045,13 @@ function De(e, t, n, r) {
 	try {
 		e.analyticsEngineBinding.writeDataPoint({
 			blobs: [
-				U(n.id),
-				U(n.trigger_id),
-				U(n.status),
-				U(W(n.results)),
-				U(W(n.logs)),
-				U(n.created_at),
-				U(n.updated_at)
+				H(n.id),
+				H(n.trigger_id),
+				H(n.status),
+				H(U(n.results)),
+				H(U(n.logs)),
+				H(n.created_at),
+				H(n.updated_at)
 			],
 			doubles: [r],
 			indexes: [t.substring(0, 96)]
@@ -1060,29 +1060,29 @@ function De(e, t, n, r) {
 		console.error("Failed to write action_execution to Analytics Engine:", e);
 	}
 }
-function Oe(e) {
+function ke(e) {
 	return async (t, n) => {
 		let r = await O(e, `
       SELECT *
-      FROM ${A(e.dataset || xe)}
+      FROM ${A(e.dataset || Se)}
       WHERE index1 = ${k(t)}
         AND blob1 = ${k(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : Te(r[0]);
+		return r.length === 0 || !r[0] ? null : Ee(r[0]);
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/index.ts
-function G(e) {
+function W(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No action_executions binding configured. Executions will not be written."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API."), {
-		create: Ee(e),
-		get: Oe(e)
+		create: De(e),
+		get: ke(e)
 	};
 }
 //#endregion
 //#region src/geo/index.ts
-function ke() {
+function Ae() {
 	return { async getGeoInfo(e) {
 		try {
 			let t = e["cf-ipcountry"], n = e["cf-ipcity"], r = e["cf-iplatitude"], i = e["cf-iplongitude"], a = e["cf-timezone"], o = e["cf-ipcontinent"];
@@ -1101,7 +1101,7 @@ function ke() {
 }
 //#endregion
 //#region src/rate-limit/index.ts
-var Ae = class {
+var je = class {
 	bindings;
 	constructor(e) {
 		this.bindings = e;
@@ -1117,12 +1117,12 @@ var Ae = class {
 		}
 	}
 };
-function K(e) {
-	if (e && Object.keys(e).some((t) => e[t])) return new Ae(e);
+function G(e) {
+	if (e && Object.keys(e).some((t) => e[t])) return new je(e);
 }
 //#endregion
 //#region src/code-executor/worker-template.ts
-function q(e) {
+function K(e) {
 	return `// Auto-generated AuthHero code hook worker
 
 const fnNames = {
@@ -1230,7 +1230,7 @@ export default {
 }
 //#endregion
 //#region src/code-executor/index.ts
-var J = class {
+var q = class {
 	config;
 	constructor(e) {
 		this.config = e;
@@ -1291,7 +1291,7 @@ var J = class {
 		}
 	}
 	async deploy(e, t) {
-		let n = `hook-${e}`, r = q(t), i = `https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`, a = JSON.stringify({
+		let n = `hook-${e}`, r = K(t), i = `https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`, a = JSON.stringify({
 			main_module: "index.js",
 			compatibility_date: this.config.compatibilityDate ?? "2024-11-20"
 		}), o = new FormData();
@@ -1316,12 +1316,12 @@ var J = class {
 			throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`);
 		}
 	}
-}, je = J, Me = {
+}, Me = q, Ne = {
 	"post-user-login": "onExecutePostLogin",
 	"credentials-exchange": "onExecuteCredentialsExchange",
 	"pre-user-registration": "onExecutePreUserRegistration",
 	"post-user-registration": "onExecutePostUserRegistration"
-}, Ne = {
+}, Pe = {
 	"post-user-login": {
 		accessToken: ["setCustomClaim"],
 		idToken: ["setCustomClaim"],
@@ -1340,15 +1340,15 @@ var J = class {
 	},
 	"post-user-registration": {}
 };
-async function Pe(e) {
+async function Fe(e) {
 	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t), r = new Uint8Array(n), i = "";
 	for (let e of r) i += e.toString(16).padStart(2, "0");
 	return i;
 }
-function Fe(e) {
+function Ie(e) {
 	return `
-const TRIGGER_FN_NAMES = ${JSON.stringify(Me)};
-const API_SHAPES = ${JSON.stringify(Ne)};
+const TRIGGER_FN_NAMES = ${JSON.stringify(Ne)};
+const API_SHAPES = ${JSON.stringify(Pe)};
 const MAX_LOG_ENTRIES = 50;
 const MAX_LOG_LENGTH = 500;
 
@@ -1448,7 +1448,7 @@ export default {
 };
 `;
 }
-var Ie = class {
+var Le = class {
 	loader;
 	compatibilityDate;
 	constructor(e) {
@@ -1457,11 +1457,11 @@ var Ie = class {
 	async execute(e) {
 		let t = Date.now();
 		try {
-			let t = Fe(e.code), n = {
+			let t = Ie(e.code), n = {
 				compatibilityDate: this.compatibilityDate,
 				mainModule: "hook.js",
 				modules: { "hook.js": t }
-			}, r = e.hookCodeId ? `${e.hookCodeId}-${await Pe(e.code)}` : null;
+			}, r = e.hookCodeId ? `${e.hookCodeId}-${await Fe(e.code)}` : null;
 			return await (await (r ? this.loader.get(r, async () => n) : this.loader.load(n)).getEntrypoint().fetch(new Request("https://hook/execute", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
@@ -1479,19 +1479,19 @@ var Ie = class {
 			};
 		}
 	}
-}, Y = class extends Error {
+}, J = class extends Error {
 	status;
 	endpoint;
 	errors;
 	body;
 	constructor(e, t, n, r = []) {
-		super(`Cloudflare API ${e} ${t}: ${Le(n, 256)}`), this.name = "CloudflareApiError", this.status = e, this.endpoint = t, this.body = n, this.errors = r;
+		super(`Cloudflare API ${e} ${t}: ${Re(n, 256)}`), this.name = "CloudflareApiError", this.status = e, this.endpoint = t, this.body = n, this.errors = r;
 	}
 };
-function Le(e, t) {
+function Re(e, t) {
 	return e.length <= t ? e : `${e.slice(0, t)}…`;
 }
-var X = class {
+var Y = class {
 	accountId;
 	apiToken;
 	fetchImpl;
@@ -1562,29 +1562,29 @@ var X = class {
 				let t = JSON.parse(c);
 				Array.isArray(t.errors) && (e = t.errors);
 			} catch {}
-			throw new Y(s.status, t, c, e);
+			throw new J(s.status, t, c, e);
 		}
 		if (!(c === "" || s.status === 204)) return JSON.parse(c);
 	}
-}, Re = "{tenant_id}", ze = "tenant-{tenant_id}", Be = "index.js", Ve = "2026-05-01";
+}, ze = "{tenant_id}", Be = "tenant-{tenant_id}", Ve = "index.js", He = "2026-05-01", X = 64;
 function Z(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function He(e) {
-	if (!(e instanceof Y)) return !1;
+function Q(e) {
+	if (!(e instanceof J)) return !1;
 	let t = e.body.toLowerCase();
 	return e.status === 409 || t.includes("already exists") || t.includes("name is already taken") || t.includes("already in use");
 }
-function Q(e) {
-	return e instanceof Y ? e.status === 404 : !1;
+function $(e) {
+	return e instanceof J ? e.status === 404 : !1;
 }
 function Ue(e) {
-	let t = new X({
+	let t = new Y({
 		accountId: e.accountId,
 		apiToken: e.apiToken,
 		fetch: e.fetch,
 		timeoutMs: e.timeoutMs
-	}), n = e.scriptNameTemplate ?? Re, r = e.d1NameTemplate ?? ze, i = e.scriptMetadata?.main_module ?? Be, a = e.scriptMetadata?.compatibility_date ?? Ve, o = e.scriptMetadata?.compatibility_flags ?? ["nodejs_compat"], s = e.dispatchNamespace, c = e.logger;
+	}), n = e.scriptNameTemplate ?? ze, r = e.d1NameTemplate ?? Be, i = e.scriptMetadata?.main_module ?? Ve, a = e.scriptMetadata?.compatibility_date ?? He, o = e.scriptMetadata?.compatibility_flags ?? ["nodejs_compat"], s = e.dispatchNamespace, c = e.logger;
 	async function l(e) {
 		let n = (await t.listD1Databases(e)).find((t) => t.name === e);
 		if (n) return {
@@ -1597,7 +1597,7 @@ function Ue(e) {
 				created: !0
 			};
 		} catch (n) {
-			if (!He(n)) throw n;
+			if (!Q(n)) throw n;
 			let r = (await t.listD1Databases(e)).find((t) => t.name === e);
 			if (r) return {
 				id: r.uuid,
@@ -1672,16 +1672,21 @@ function Ue(e) {
 	}
 	return {
 		async onProvision(t) {
-			let i = Z(n, t), a = Z(r, t), { id: o, created: s } = await l(a), u = s ? !1 : await f(o);
-			if (s || u) await p(o), await _(o);
+			let i = Z(n, t), a = Z(r, t), o = e.migrations[e.migrations.length - 1]?.name;
+			if (o !== void 0 && o.length > X) throw Error(`Migration name "${o}" exceeds the ${X}-character database_version limit.`);
+			let { id: s, created: u } = await l(a), d = u ? !1 : await f(s);
+			if (u || d) await p(s), await _(s);
 			else {
-				c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`), await p(o);
-				for (let t of e.migrations) await g(o, t.name);
+				c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`), await p(s);
+				for (let t of e.migrations) await g(s, t.name);
 			}
-			return await v(i, o), await y(i, t), {
-				d1DatabaseId: o,
+			return await v(i, s), await y(i, t), {
+				d1DatabaseId: s,
 				scriptName: i,
-				d1Name: a
+				d1Name: a,
+				bundleConfiguration: e.bundleConfiguration,
+				workerVersion: e.workerVersion,
+				databaseVersion: o
 			};
 		},
 		async onDeprovision(e) {
@@ -1689,14 +1694,14 @@ function Ue(e) {
 			try {
 				await t.deleteNamespacedScript(s, i);
 			} catch (e) {
-				Q(e) || o.push(e);
+				$(e) || o.push(e);
 			}
 			try {
 				let e = (await t.listD1Databases(a)).find((e) => e.name === a);
 				if (e) try {
 					await t.deleteD1Database(e.uuid);
 				} catch (e) {
-					Q(e) || o.push(e);
+					$(e) || o.push(e);
 				}
 			} catch (e) {
 				o.push(e);
@@ -1713,13 +1718,13 @@ function Ue(e) {
 function We(e) {
 	return e.deployment_type === "wfp";
 }
-function $(e) {
+function Ge(e) {
 	if (typeof e != "object" || !e) return [];
 	let t = [];
 	for (let n of Object.values(e)) if (typeof n == "object" && n && "errors" in n && Array.isArray(n.errors)) for (let e of n.errors) typeof e == "string" && t.push(e);
 	return t;
 }
-function Ge(e) {
+function Ke(e) {
 	let { provisioner: t, tenants: n, syncDefaults: r } = e, i = e.shouldProvision ?? We, a = e.logger;
 	async function o(e, t) {
 		let r = t instanceof Error ? t.message : String(t);
@@ -1733,45 +1738,65 @@ function Ge(e) {
 			a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
 		}
 	}
-	return {
-		async onProvision(e) {
-			let s = await n.get(e);
-			if (!s || !i(s)) return;
-			let c;
-			try {
-				c = await t.onProvision(e);
-			} catch (t) {
-				throw await o(e, t), t;
-			}
-			let l = {
-				d1_database_id: c.d1DatabaseId,
-				worker_script_name: c.scriptName
-			};
-			try {
-				if (r) {
-					let t = $(await r(e));
-					if (t.length > 0) throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join("; ")}`);
-				}
-			} catch (t) {
-				let r = t instanceof Error ? t.message : String(t);
-				try {
-					await n.update(e, {
-						...l,
-						provisioning_state: "failed",
-						provisioning_error: r.slice(0, 2048),
-						provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
-					});
-				} catch (t) {
-					a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
-				}
-				throw t;
+	async function s(e) {
+		let i;
+		try {
+			i = await t.onProvision(e);
+		} catch (t) {
+			throw await o(e, t), t;
+		}
+		let s = {
+			d1_database_id: i.d1DatabaseId,
+			worker_script_name: i.scriptName,
+			bundle_configuration: i.bundleConfiguration,
+			worker_version: i.workerVersion,
+			database_version: i.databaseVersion
+		};
+		try {
+			if (r) {
+				let t = Ge(await r(e));
+				if (t.length > 0) throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join("; ")}`);
 			}
 			await n.update(e, {
-				...l,
+				...s,
 				provisioning_state: "ready",
 				provisioning_error: void 0,
 				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
+		} catch (t) {
+			let r = t instanceof Error ? t.message : String(t);
+			try {
+				await n.update(e, {
+					...s,
+					provisioning_state: "failed",
+					provisioning_error: r.slice(0, 2048),
+					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+				});
+			} catch (t) {
+				a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
+			}
+			throw t;
+		}
+	}
+	return {
+		async onProvision(e) {
+			let t = await n.get(e);
+			t && i(t) && await s(e);
+		},
+		async onUpgrade(e) {
+			let t = await n.get(e);
+			if (!t) throw Error(`Cannot upgrade tenant "${e}": not found.`);
+			if (!i(t)) throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);
+			try {
+				await n.update(e, {
+					provisioning_state: "pending",
+					provisioning_error: void 0,
+					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+				});
+			} catch (t) {
+				a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`, t);
+			}
+			await s(e);
 		},
 		async onDeprovision(e) {
 			let r = await n.get(e);
@@ -1781,29 +1806,46 @@ function Ge(e) {
 }
 //#endregion
 //#region src/wfp-provisioner/wfp-forward.ts
-var Ke = "DISPATCHER", qe = "tenant-{tenant_id}-auth";
-function Je(e) {
+var qe = "DISPATCHER", Je = "tenant-{tenant_id}-auth";
+function Ye(e) {
 	return typeof e == "object" && !!e && "get" in e && typeof Reflect.get(e, "get") == "function";
 }
-function Ye(e, t) {
+function Xe(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function Xe(e) {
-	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ke, scriptNameTemplate: i = qe, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
+function Ze(e) {
+	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = qe, scriptNameTemplate: i = Je, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
 	return async (e, o) => {
 		let s = await a(e);
 		if (!s || s === n) return o();
 		let c = await t.get(s);
 		if (!c || c.deployment_type !== "wfp" || c.provisioning_state && c.provisioning_state !== "ready") return o();
 		let l = Reflect.get(e.env ?? {}, r);
-		if (!Je(l)) return o();
-		let u = Ye(i, s), d = await l.get(u).fetch(e.req.raw);
-		return d.status === 101 || "webSocket" in d ? d : new Response(d.body, d);
+		if (!Ye(l)) return o();
+		let u = Xe(i, s), d;
+		try {
+			d = await l.get(u).fetch(e.req.raw);
+		} catch (t) {
+			let n = t instanceof Error ? t.message : String(t), r = /not\s*found|no\s*such|does not exist/i.test(n), i = r ? "wfp_worker_not_found" : "wfp_dispatch_failed";
+			return console.error(`[wfp-forward] ${i} tenant=${s} script=${u}: ${n}`), e.header("X-Authhero-Error", i), e.header("X-Wfp-Tenant", s), e.json({
+				error: i,
+				detail: r ? `Tenant '${s}' is marked ready but its worker '${u}' is not deployed in the dispatch namespace.` : `The worker for tenant '${s}' could not be reached.`,
+				tenant_id: s
+			}, r ? 503 : 502);
+		}
+		if (d.status >= 500) {
+			let e = d.headers.get("X-Authhero-Error");
+			console.error(`[wfp-forward] tenant worker ${d.status}${e ? ` (${e})` : ""} tenant=${s} script=${u}`);
+		}
+		let f = Reflect.get(d, "webSocket");
+		if (d.status === 101 || f != null) return d;
+		let p = new Response(d.body, d);
+		return p.headers.set("X-Wfp-Tenant", s), p;
 	};
 }
 //#endregion
 //#region src/index.ts
-function Ze(e) {
+function Qe(e) {
 	let t = {
 		customDomains: y(e),
 		cache: te({
@@ -1811,11 +1853,11 @@ function Ze(e) {
 			...e.defaultTtlSeconds !== void 0 && { defaultTtlSeconds: e.defaultTtlSeconds },
 			...e.keyPrefix && { keyPrefix: e.keyPrefix }
 		}),
-		geo: ke()
+		geo: Ae()
 	};
-	e.r2SqlLogs ? t.logs = D(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = V(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = B(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = G(e.analyticsEngineActionExecutions));
-	let n = K(e.rateLimitBindings);
+	e.r2SqlLogs ? t.logs = D(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = B(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = z(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = W(e.analyticsEngineActionExecutions));
+	let n = G(e.rateLimitBindings);
 	return n && (t.rateLimit = n), t;
 }
 //#endregion
-export { X as CloudflareApiClient, Y as CloudflareApiError, je as CloudflareCodeExecutor, J as DispatchNamespaceCodeExecutor, Ie as WorkerLoaderCodeExecutor, G as createAnalyticsEngineActionExecutionsAdapter, B as createAnalyticsEngineAnalyticsAdapter, V as createAnalyticsEngineLogsAdapter, L as createAnalyticsEngineStatsAdapter, K as createCloudflareRateLimitAdapter, Ue as createCloudflareWfpD1Provisioner, D as createR2SQLLogsAdapter, se as createR2SQLStatsAdapter, Xe as createWfpForwardMiddleware, Ge as createWfpTenantProvisioningHook, Ze as default, q as generateWorkerScript };
+export { Y as CloudflareApiClient, J as CloudflareApiError, Me as CloudflareCodeExecutor, q as DispatchNamespaceCodeExecutor, Le as WorkerLoaderCodeExecutor, W as createAnalyticsEngineActionExecutionsAdapter, z as createAnalyticsEngineAnalyticsAdapter, B as createAnalyticsEngineLogsAdapter, I as createAnalyticsEngineStatsAdapter, G as createCloudflareRateLimitAdapter, Ue as createCloudflareWfpD1Provisioner, D as createR2SQLLogsAdapter, se as createR2SQLStatsAdapter, Ze as createWfpForwardMiddleware, Ke as createWfpTenantProvisioningHook, Qe as default, K as generateWorkerScript };