@authhero/cloudflare-adapter 2.37.6 → 2.38.1

package/dist/cloudflare-adapter.cjs

@@ -1,23 +1,23 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));let c=require("@authhero/adapter-interfaces"),l=require("@hono/zod-openapi"),u=require("hono/http-exception"),d=require("wretch");d=s(d);let f=require("wretch/middlewares");var p=l.z.object({code:l.z.number(),message:l.z.string()}),m=l.z.object({message:l.z.string()}),h=l.z.object({emails:l.z.array(l.z.string()).optional(),http_body:l.z.string().optional(),http_url:l.z.string().optional(),txt_name:l.z.string().optional(),txt_value:l.z.string().optional()}),g=l.z.object({ciphers:l.z.array(l.z.string()).optional(),early_hints:l.z.string().optional(),http2:l.z.string().optional(),min_tls_version:l.z.string().optional(),tls_1_3:l.z.string().optional()}),_=l.z.object({id:l.z.string(),bundle_method:l.z.string().optional(),certificate_authority:l.z.string(),custom_certificate:l.z.string().optional(),custom_csr_id:l.z.string().optional(),custom_key:l.z.string().optional(),expires_on:l.z.string().optional(),hosts:l.z.array(l.z.string()).optional(),issuer:l.z.string().optional(),method:l.z.string(),serial_number:l.z.string().optional(),settings:g.optional(),signature:l.z.string().optional(),type:l.z.string(),uploaded_on:l.z.string().optional(),validation_errors:l.z.array(m).optional(),validation_records:l.z.array(h).optional(),wildcard:l.z.boolean()}),v=l.z.object({name:l.z.string(),type:l.z.string(),value:l.z.string()}),y=l.z.object({http_body:l.z.string().optional(),http_url:l.z.string().optional()}),b=l.z.object({id:l.z.string(),ssl:_,hostname:l.z.string(),custom_metadata:l.z.record(l.z.string(),l.z.string()).optional(),custom_origin_server:l.z.string().optional(),custom_origin_sni:l.z.string().optional(),ownership_verification:v.optional(),ownership_verification_http:y.optional(),status:l.z.string(),verification_errors:l.z.array(l.z.string()).optional(),created_at:l.z.string()}),x=l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:b});l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:l.z.array(b)});function S(e){return(0,d.default)(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({"X-Auth-Email":e.authEmail,"X-Auth-Key":e.authKey,"Content-Type":`application/json`}).middlewares([(0,f.retry)(),(0,f.dedupe)()])}function C(e){let t={},n={};if(!e)return{sslOverrides:t,rest:n};for(let[r,i]of Object.entries(e))r.startsWith(`ssl.`)?t[r.slice(4)]=i:n[r]=i;return{sslOverrides:t,rest:n}}function w(e){let t=[];if(e.ssl.validation_records)for(let n of e.ssl.validation_records)n.txt_name&&n.txt_value&&t.push({name:`txt`,record:n.txt_value,domain:n.txt_name});if(e.ownership_verification&&t.push({name:`txt`,record:e.ownership_verification.value,domain:e.ownership_verification.name}),e.ownership_verification_http?.http_body&&e.ownership_verification_http?.http_url&&t.push({name:`http`,http_body:e.ownership_verification_http.http_body,http_url:e.ownership_verification_http.http_url}),e.ssl.validation_records)for(let n of e.ssl.validation_records)n.http_body&&n.http_url&&t.push({name:`http`,http_body:n.http_body,http_url:n.http_url});let n={...e.domain_metadata||{},"ssl.method":e.ssl.method,"ssl.type":e.ssl.type,"ssl.certificate_authority":e.ssl.certificate_authority};return{custom_domain_id:e.id,domain:e.hostname,primary:e.primary,status:e.status===`active`?`ready`:`pending`,type:e.type??`auth0_managed_certs`,verification:{methods:l.z.array(c.verificationMethodsSchema).parse(t)},domain_metadata:n}}function ee(e){return{create:async(t,n)=>{let{sslOverrides:r,rest:i}=C(n.domain_metadata),{result:a,errors:o,success:s}=x.parse(await S(e).post({hostname:n.domain,ssl:{method:`txt`,type:`dv`,...r},custom_metadata:e.enterprise?{tenant_id:t}:void 0},`/custom_hostnames`).json());if(!s)throw Error(JSON.stringify(o));let c=w({...a,primary:!1,type:n.type,domain_metadata:i});return await e.customDomainAdapter.create(t,{custom_domain_id:c.custom_domain_id,domain:c.domain,type:c.type,domain_metadata:n.domain_metadata}),await e.customDomainAdapter.update(t,c.custom_domain_id,{status:c.status,primary:c.primary,verification:c.verification}),c},get:async(t,n)=>{let r=await e.customDomainAdapter.get(t,n);if(!r)throw new u.HTTPException(404);let i;try{i=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`,e instanceof Error?e.message:e),r}let a=x.safeParse(i);if(!a.success||!a.data.success)return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`,a.success?{cfErrors:a.data.errors}:{zodIssues:a.error.issues,body:i}),r;let{result:o}=a.data;if(e.enterprise&&o.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404);let s;try{s=w({...r,...o})}catch(e){return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`,e instanceof Error?e.message:e),r}if(s.status!==r.status||JSON.stringify(s.verification)!==JSON.stringify(r.verification))try{await e.customDomainAdapter.update(t,n,{status:s.status,verification:s.verification})}catch(e){console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`,e instanceof Error?e.message:e)}return s},getByDomain:async t=>e.customDomainAdapter.getByDomain(t),list:async t=>e.customDomainAdapter.list(t),remove:async(t,n)=>{if(e.enterprise){let{result:r,success:i}=x.parse(await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());if(!i||r.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404)}let r=await S(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();return r.ok&&await e.customDomainAdapter.remove(t,n),r.ok},update:async(t,n,r)=>{let{sslOverrides:i}=C(r.domain_metadata),a={};if(Object.keys(i).length>0){let t;try{t=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){throw new u.HTTPException(503,{message:`Failed to fetch current custom hostname state: ${e instanceof Error?e.message:String(e)}`})}let r=x.safeParse(t);if(!r.success||!r.data.success)throw new u.HTTPException(503,{message:`Failed to parse current custom hostname state: ${JSON.stringify(r.success?r.data.errors:r.error.issues)}`});a.ssl={method:r.data.result.ssl.method,type:r.data.result.ssl.type,certificate_authority:r.data.result.ssl.certificate_authority,...i}}if(Object.keys(a).length>0){let t=await S(e).patch(a,`/custom_hostnames/${encodeURIComponent(n)}`).res().catch(e=>{throw new u.HTTPException(503,{message:`Failed to update custom hostname: ${e instanceof Error?e.message:String(e)}`})});if(!t.ok)throw new u.HTTPException(503,{message:await t.text()})}return e.customDomainAdapter.update(t,n,r)},uploadCertificate:async(t,n,r)=>{let i=await e.customDomainAdapter.get(t,n);if(!i)throw new u.HTTPException(404);let a=await S(e).patch({ssl:{custom_certificate:r.certificate,custom_key:r.private_key}},`/custom_hostnames/${encodeURIComponent(n)}`).json(),{result:o,errors:s,success:c}=x.parse(a);if(!c)throw new u.HTTPException(503,{message:JSON.stringify(s)});let l=w({...i,...o});return await e.customDomainAdapter.update(t,n,{status:l.status,verification:l.verification}),l}}}var te=class{config;cache=null;constructor(e){this.config=e}async getCache(){if(this.cache)return this.cache;if(typeof caches>`u`)throw Error(`caches API is not available - CloudflareCache should only be used in Cloudflare Workers`);return this.config.cacheName?this.cache=await caches.open(this.config.cacheName):this.cache=caches.default,this.cache}getKey(e){return this.config.keyPrefix?`${this.config.keyPrefix}:${e}`:e}createRequest(e){return new Request(`https://cache.internal/${this.getKey(e)}`)}async matchWithTimeout(e,t){let n=this.config.getTimeoutMs??200;return n<=0?e.match(t):new Promise(r=>{let i=setTimeout(()=>r(void 0),n);e.match(t).then(e=>{clearTimeout(i),r(e)},()=>{clearTimeout(i),r(void 0)})})}async get(e){try{let t=await this.getCache(),n=this.createRequest(e),r=await this.matchWithTimeout(t,n);if(!r)return null;let i=await r.text();if(!i)return await this.delete(e),null;let a;try{a=JSON.parse(i)}catch{return await this.delete(e),null}return a.expiresAt&&new Date(a.expiresAt)<new Date?(await this.delete(e),null):a.value}catch(t){return console.error(`CloudflareCache: get error for key ${e}:`,t),null}}async set(e,t,n){try{let r=await this.getCache(),i=n??this.config.defaultTtlSeconds,a=i!==void 0,o=a?Math.max(0,i):0,s={value:t,expiresAt:a?new Date(Date.now()+(o>0?o*1e3:-1)).toISOString():void 0,cachedAt:new Date().toISOString()},c=this.createRequest(e),l={"Content-Type":`application/json`};a&&o>0&&(l[`Cache-Control`]=`max-age=${o}`);let u=new Response(JSON.stringify(s),{headers:l});await r.put(c,u)}catch(t){console.error(`CloudflareCache: set error for key ${e}:`,t)}}async delete(e){try{let t=await this.getCache(),n=this.createRequest(e);return await t.delete(n)}catch(t){return console.error(`CloudflareCache: delete error for key ${e}:`,t),!1}}async deleteByPrefix(e){return console.warn(`CloudflareCache.deleteByPrefix() is not implemented - Cloudflare Cache API does not support prefix-based deletion`),0}async clear(){console.warn(`CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries`)}};function ne(e={}){return new te({defaultTtlSeconds:300,keyPrefix:`authhero`,getTimeoutMs:200,...e})}var re=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,T=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=re[n[e]&63];return t};async function E(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e.authToken}`},body:JSON.stringify({query:t}),signal:r.signal});if(!i.ok)throw Error(`R2 SQL query failed: ${i.status} ${i.statusText}`);let a=await i.json();if(!a.success&&a.errors)throw Error(`R2 SQL error: ${a.errors.join(`, `)}`);return a.data||a.result?.data||[]}finally{clearTimeout(i)}}function D(e){return`'${e.replace(/'/g,`''`)}'`}function O(e){return`"${e.replace(/"/g,`""`)}"`}function k(e){let t=e=>{if(!e)return``;try{return JSON.parse(e)}catch{return e}};return{type:e.type,date:e.date,description:e.description,ip:e.ip,user_agent:e.user_agent,details:t(e.details),isMobile:!!e.isMobile,user_id:e.user_id,user_name:e.user_name,connection:e.connection,connection_id:e.connection_id,client_id:e.client_id,client_name:e.client_name,audience:e.audience,scope:e.scope,strategy:e.strategy,strategy_type:e.strategy_type,hostname:e.hostname,auth0_client:t(e.auth0_client),log_id:e.id,location_info:e.country_code||e.city_name||e.latitude||e.longitude||e.time_zone||e.continent_code?{country_code:e.country_code||``,city_name:e.city_name||``,latitude:e.latitude||``,longitude:e.longitude||``,time_zone:e.time_zone||``,continent_code:e.continent_code||``}:void 0}}function ie(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return await ae(e,t,i),i}}async function ae(e,t,n){let r=e=>e?JSON.stringify(e):void 0,i={id:n.log_id,tenant_id:t,type:n.type,date:n.date,description:n.description?.substring(0,256),ip:n.ip,user_agent:n.user_agent,details:r(n.details)?.substring(0,8192),isMobile:+!!n.isMobile,user_id:n.user_id,user_name:n.user_name,connection:n.connection,connection_id:n.connection_id,client_id:n.client_id,client_name:n.client_name,audience:n.audience,scope:n.scope,strategy:n.strategy,strategy_type:n.strategy_type,hostname:n.hostname,auth0_client:r(n.auth0_client),log_id:n.log_id,country_code:n.location_info?.country_code,city_name:n.location_info?.city_name,latitude:n.location_info?.latitude,longitude:n.location_info?.longitude,time_zone:n.location_info?.time_zone,continent_code:n.location_info?.continent_code};try{if(e.pipelineBinding)await e.pipelineBinding.send([i]);else if(e.pipelineEndpoint){let t=e.timeout||3e4,n=new AbortController,r=setTimeout(()=>n.abort(),t);try{let t=await fetch(e.pipelineEndpoint,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify([i]),signal:n.signal});if(!t.ok)throw Error(`Pipeline ingestion failed: ${t.status} ${t.statusText}`)}finally{clearTimeout(r)}}else throw Error(`Either pipelineEndpoint or pipelineBinding must be configured`)}catch(e){throw console.error(`Failed to send log to Pipeline:`,e),e}}function oe(e){return async(t,n)=>{let r=e.namespace||`default`,i=e.tableName||`logs`,a=await E(e,`
-      SELECT * FROM ${O(r)}.${O(i)}
-      WHERE tenant_id = ${D(t)}
-        AND id = ${D(n)}
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));const c=require("./sync-defaults-errors-Htp1NWTq.js");let l=require("@authhero/adapter-interfaces"),u=require("@hono/zod-openapi"),d=require("hono/http-exception"),f=require("wretch");f=s(f);let p=require("wretch/middlewares");var m=u.z.object({code:u.z.number(),message:u.z.string()}),h=u.z.object({message:u.z.string()}),g=u.z.object({emails:u.z.array(u.z.string()).optional(),http_body:u.z.string().optional(),http_url:u.z.string().optional(),txt_name:u.z.string().optional(),txt_value:u.z.string().optional()}),_=u.z.object({ciphers:u.z.array(u.z.string()).optional(),early_hints:u.z.string().optional(),http2:u.z.string().optional(),min_tls_version:u.z.string().optional(),tls_1_3:u.z.string().optional()}),ee=u.z.object({id:u.z.string(),bundle_method:u.z.string().optional(),certificate_authority:u.z.string(),custom_certificate:u.z.string().optional(),custom_csr_id:u.z.string().optional(),custom_key:u.z.string().optional(),expires_on:u.z.string().optional(),hosts:u.z.array(u.z.string()).optional(),issuer:u.z.string().optional(),method:u.z.string(),serial_number:u.z.string().optional(),settings:_.optional(),signature:u.z.string().optional(),type:u.z.string(),uploaded_on:u.z.string().optional(),validation_errors:u.z.array(h).optional(),validation_records:u.z.array(g).optional(),wildcard:u.z.boolean()}),te=u.z.object({name:u.z.string(),type:u.z.string(),value:u.z.string()}),ne=u.z.object({http_body:u.z.string().optional(),http_url:u.z.string().optional()}),v=u.z.object({id:u.z.string(),ssl:ee,hostname:u.z.string(),custom_metadata:u.z.record(u.z.string(),u.z.string()).optional(),custom_origin_server:u.z.string().optional(),custom_origin_sni:u.z.string().optional(),ownership_verification:te.optional(),ownership_verification_http:ne.optional(),status:u.z.string(),verification_errors:u.z.array(u.z.string()).optional(),created_at:u.z.string()}),y=u.z.object({errors:u.z.array(m),messages:u.z.array(m),success:u.z.boolean(),result:v});u.z.object({errors:u.z.array(m),messages:u.z.array(m),success:u.z.boolean(),result:u.z.array(v)});function b(e){return(0,f.default)(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({"X-Auth-Email":e.authEmail,"X-Auth-Key":e.authKey,"Content-Type":`application/json`}).middlewares([(0,p.retry)(),(0,p.dedupe)()])}function x(e){let t={},n={};if(!e)return{sslOverrides:t,rest:n};for(let[r,i]of Object.entries(e))r.startsWith(`ssl.`)?t[r.slice(4)]=i:n[r]=i;return{sslOverrides:t,rest:n}}function S(e){let t=[];if(e.ssl.validation_records)for(let n of e.ssl.validation_records)n.txt_name&&n.txt_value&&t.push({name:`txt`,record:n.txt_value,domain:n.txt_name});if(e.ownership_verification&&t.push({name:`txt`,record:e.ownership_verification.value,domain:e.ownership_verification.name}),e.ownership_verification_http?.http_body&&e.ownership_verification_http?.http_url&&t.push({name:`http`,http_body:e.ownership_verification_http.http_body,http_url:e.ownership_verification_http.http_url}),e.ssl.validation_records)for(let n of e.ssl.validation_records)n.http_body&&n.http_url&&t.push({name:`http`,http_body:n.http_body,http_url:n.http_url});let n={...e.domain_metadata||{},"ssl.method":e.ssl.method,"ssl.type":e.ssl.type,"ssl.certificate_authority":e.ssl.certificate_authority};return{custom_domain_id:e.id,domain:e.hostname,primary:e.primary,status:e.status===`active`?`ready`:`pending`,type:e.type??`auth0_managed_certs`,verification:{methods:u.z.array(l.verificationMethodsSchema).parse(t)},domain_metadata:n}}function re(e){return{create:async(t,n)=>{let{sslOverrides:r,rest:i}=x(n.domain_metadata),{result:a,errors:o,success:s}=y.parse(await b(e).post({hostname:n.domain,ssl:{method:`txt`,type:`dv`,...r},custom_metadata:e.enterprise?{tenant_id:t}:void 0},`/custom_hostnames`).json());if(!s)throw Error(JSON.stringify(o));let c=S({...a,primary:!1,type:n.type,domain_metadata:i});return await e.customDomainAdapter.create(t,{custom_domain_id:c.custom_domain_id,domain:c.domain,type:c.type,domain_metadata:n.domain_metadata}),await e.customDomainAdapter.update(t,c.custom_domain_id,{status:c.status,primary:c.primary,verification:c.verification}),c},get:async(t,n)=>{let r=await e.customDomainAdapter.get(t,n);if(!r)throw new d.HTTPException(404);let i;try{i=await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`,e instanceof Error?e.message:e),r}let a=y.safeParse(i);if(!a.success||!a.data.success)return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`,a.success?{cfErrors:a.data.errors}:{zodIssues:a.error.issues,body:i}),r;let{result:o}=a.data;if(e.enterprise&&o.custom_metadata?.tenant_id!==t)throw new d.HTTPException(404);let s;try{s=S({...r,...o})}catch(e){return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`,e instanceof Error?e.message:e),r}if(s.status!==r.status||JSON.stringify(s.verification)!==JSON.stringify(r.verification))try{await e.customDomainAdapter.update(t,n,{status:s.status,verification:s.verification})}catch(e){console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`,e instanceof Error?e.message:e)}return s},getByDomain:async t=>e.customDomainAdapter.getByDomain(t),list:async t=>e.customDomainAdapter.list(t),remove:async(t,n)=>{if(e.enterprise){let{result:r,success:i}=y.parse(await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());if(!i||r.custom_metadata?.tenant_id!==t)throw new d.HTTPException(404)}let r=await b(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();return r.ok&&await e.customDomainAdapter.remove(t,n),r.ok},update:async(t,n,r)=>{let{sslOverrides:i}=x(r.domain_metadata),a={};if(Object.keys(i).length>0){let t;try{t=await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){throw new d.HTTPException(503,{message:`Failed to fetch current custom hostname state: ${e instanceof Error?e.message:String(e)}`})}let r=y.safeParse(t);if(!r.success||!r.data.success)throw new d.HTTPException(503,{message:`Failed to parse current custom hostname state: ${JSON.stringify(r.success?r.data.errors:r.error.issues)}`});a.ssl={method:r.data.result.ssl.method,type:r.data.result.ssl.type,certificate_authority:r.data.result.ssl.certificate_authority,...i}}if(Object.keys(a).length>0){let t=await b(e).patch(a,`/custom_hostnames/${encodeURIComponent(n)}`).res().catch(e=>{throw new d.HTTPException(503,{message:`Failed to update custom hostname: ${e instanceof Error?e.message:String(e)}`})});if(!t.ok)throw new d.HTTPException(503,{message:await t.text()})}return e.customDomainAdapter.update(t,n,r)},uploadCertificate:async(t,n,r)=>{let i=await e.customDomainAdapter.get(t,n);if(!i)throw new d.HTTPException(404);let a=await b(e).patch({ssl:{custom_certificate:r.certificate,custom_key:r.private_key}},`/custom_hostnames/${encodeURIComponent(n)}`).json(),{result:o,errors:s,success:c}=y.parse(a);if(!c)throw new d.HTTPException(503,{message:JSON.stringify(s)});let l=S({...i,...o});return await e.customDomainAdapter.update(t,n,{status:l.status,verification:l.verification}),l}}}var C=class{config;cache=null;constructor(e){this.config=e}async getCache(){if(this.cache)return this.cache;if(typeof caches>`u`)throw Error(`caches API is not available - CloudflareCache should only be used in Cloudflare Workers`);return this.config.cacheName?this.cache=await caches.open(this.config.cacheName):this.cache=caches.default,this.cache}getKey(e){return this.config.keyPrefix?`${this.config.keyPrefix}:${e}`:e}createRequest(e){return new Request(`https://cache.internal/${this.getKey(e)}`)}async matchWithTimeout(e,t){let n=this.config.getTimeoutMs??200;return n<=0?e.match(t):new Promise(r=>{let i=setTimeout(()=>r(void 0),n);e.match(t).then(e=>{clearTimeout(i),r(e)},()=>{clearTimeout(i),r(void 0)})})}async get(e){try{let t=await this.getCache(),n=this.createRequest(e),r=await this.matchWithTimeout(t,n);if(!r)return null;let i=await r.text();if(!i)return await this.delete(e),null;let a;try{a=JSON.parse(i)}catch{return await this.delete(e),null}return a.expiresAt&&new Date(a.expiresAt)<new Date?(await this.delete(e),null):a.value}catch(t){return console.error(`CloudflareCache: get error for key ${e}:`,t),null}}async set(e,t,n){try{let r=await this.getCache(),i=n??this.config.defaultTtlSeconds,a=i!==void 0,o=a?Math.max(0,i):0,s={value:t,expiresAt:a?new Date(Date.now()+(o>0?o*1e3:-1)).toISOString():void 0,cachedAt:new Date().toISOString()},c=this.createRequest(e),l={"Content-Type":`application/json`};a&&o>0&&(l[`Cache-Control`]=`max-age=${o}`);let u=new Response(JSON.stringify(s),{headers:l});await r.put(c,u)}catch(t){console.error(`CloudflareCache: set error for key ${e}:`,t)}}async delete(e){try{let t=await this.getCache(),n=this.createRequest(e);return await t.delete(n)}catch(t){return console.error(`CloudflareCache: delete error for key ${e}:`,t),!1}}async deleteByPrefix(e){return console.warn(`CloudflareCache.deleteByPrefix() is not implemented - Cloudflare Cache API does not support prefix-based deletion`),0}async clear(){console.warn(`CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries`)}};function ie(e={}){return new C({defaultTtlSeconds:300,keyPrefix:`authhero`,getTimeoutMs:200,...e})}var ae=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,w=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=ae[n[e]&63];return t};async function T(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e.authToken}`},body:JSON.stringify({query:t}),signal:r.signal});if(!i.ok)throw Error(`R2 SQL query failed: ${i.status} ${i.statusText}`);let a=await i.json();if(!a.success&&a.errors)throw Error(`R2 SQL error: ${a.errors.join(`, `)}`);return a.data||a.result?.data||[]}finally{clearTimeout(i)}}function E(e){return`'${e.replace(/'/g,`''`)}'`}function D(e){return`"${e.replace(/"/g,`""`)}"`}function O(e){let t=e=>{if(!e)return``;try{return JSON.parse(e)}catch{return e}};return{type:e.type,date:e.date,description:e.description,ip:e.ip,user_agent:e.user_agent,details:t(e.details),isMobile:!!e.isMobile,user_id:e.user_id,user_name:e.user_name,connection:e.connection,connection_id:e.connection_id,client_id:e.client_id,client_name:e.client_name,audience:e.audience,scope:e.scope,strategy:e.strategy,strategy_type:e.strategy_type,hostname:e.hostname,auth0_client:t(e.auth0_client),log_id:e.id,location_info:e.country_code||e.city_name||e.latitude||e.longitude||e.time_zone||e.continent_code?{country_code:e.country_code||``,city_name:e.city_name||``,latitude:e.latitude||``,longitude:e.longitude||``,time_zone:e.time_zone||``,continent_code:e.continent_code||``}:void 0}}function oe(e){return async(t,n)=>{let r=n.log_id||w(),i={...n,log_id:r};return await k(e,t,i),i}}async function k(e,t,n){let r=e=>e?JSON.stringify(e):void 0,i={id:n.log_id,tenant_id:t,type:n.type,date:n.date,description:n.description?.substring(0,256),ip:n.ip,user_agent:n.user_agent,details:r(n.details)?.substring(0,8192),isMobile:+!!n.isMobile,user_id:n.user_id,user_name:n.user_name,connection:n.connection,connection_id:n.connection_id,client_id:n.client_id,client_name:n.client_name,audience:n.audience,scope:n.scope,strategy:n.strategy,strategy_type:n.strategy_type,hostname:n.hostname,auth0_client:r(n.auth0_client),log_id:n.log_id,country_code:n.location_info?.country_code,city_name:n.location_info?.city_name,latitude:n.location_info?.latitude,longitude:n.location_info?.longitude,time_zone:n.location_info?.time_zone,continent_code:n.location_info?.continent_code};try{if(e.pipelineBinding)await e.pipelineBinding.send([i]);else if(e.pipelineEndpoint){let t=e.timeout||3e4,n=new AbortController,r=setTimeout(()=>n.abort(),t);try{let t=await fetch(e.pipelineEndpoint,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify([i]),signal:n.signal});if(!t.ok)throw Error(`Pipeline ingestion failed: ${t.status} ${t.statusText}`)}finally{clearTimeout(r)}}else throw Error(`Either pipelineEndpoint or pipelineBinding must be configured`)}catch(e){throw console.error(`Failed to send log to Pipeline:`,e),e}}function se(e){return async(t,n)=>{let r=e.namespace||`default`,i=e.tableName||`logs`,a=await T(e,`
+      SELECT * FROM ${D(r)}.${D(i)}
+      WHERE tenant_id = ${E(t)}
+        AND id = ${E(n)}
       LIMIT 1
-    `);if(a.length===0)return null;let o=a[0];return o?k(o):null}}function se(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]=n)}return t}function ce(e){let t=[];for(let[n,r]of Object.entries(e)){let e=n.replace(/[^a-zA-Z0-9_]/g,``);e&&r&&t.push(`${O(e)} = ${D(r)}`)}return t}function le(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s}=n,c=e.namespace||`default`,l=e.tableName||`logs`,u=[`tenant_id = ${D(t)}`];if(s){let e=se(s);u.push(...ce(e))}let d=u.join(` AND `),f=`ORDER BY date DESC`;if(o&&o.sort_by){let e=o.sort_by.replace(/[^a-zA-Z0-9_]/g,``),t=o.sort_order===`asc`?`ASC`:`DESC`;f=`ORDER BY ${O(e)} ${t}`}let p=r*i,m=`LIMIT ${i} OFFSET ${p}`,h=(await E(e,`
-      SELECT * FROM ${O(c)}.${O(l)}
+    `);if(a.length===0)return null;let o=a[0];return o?O(o):null}}function ce(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]=n)}return t}function le(e){let t=[];for(let[n,r]of Object.entries(e)){let e=n.replace(/[^a-zA-Z0-9_]/g,``);e&&r&&t.push(`${D(e)} = ${E(r)}`)}return t}function ue(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s}=n,c=e.namespace||`default`,l=e.tableName||`logs`,u=[`tenant_id = ${E(t)}`];if(s){let e=ce(s);u.push(...le(e))}let d=u.join(` AND `),f=`ORDER BY date DESC`;if(o&&o.sort_by){let e=o.sort_by.replace(/[^a-zA-Z0-9_]/g,``),t=o.sort_order===`asc`?`ASC`:`DESC`;f=`ORDER BY ${D(e)} ${t}`}let p=r*i,m=`LIMIT ${i} OFFSET ${p}`,h=(await T(e,`
+      SELECT * FROM ${D(c)}.${D(l)}
       WHERE ${d}
       ${f}
       ${m}
-    `)).map(k);if(!a)return{logs:h,start:0,limit:0,length:0};let g=(await E(e,`
-      SELECT COUNT(*) as count FROM ${O(c)}.${O(l)}
+    `)).map(O);if(!a)return{logs:h,start:0,limit:0,length:0};let g=(await T(e,`
+      SELECT COUNT(*) as count FROM ${D(c)}.${D(l)}
       WHERE ${d}
-    `))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function ue(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function A(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:ie(e),list:le(e),get:oe(e)}}async function j(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function M(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function N(e){return`"${e.replace(/"/g,`""`)}"`}function P(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function de(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return fe(e,t,i),i}}function fe(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function pe(e){return async(t,n)=>{let r=await j(e,`
+    `))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function de(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function A(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:oe(e),list:ue(e),get:se(e)}}async function j(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function M(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function N(e){return`"${e.replace(/"/g,`""`)}"`}function P(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function fe(e){return async(t,n)=>{let r=n.log_id||w(),i={...n,log_id:r};return pe(e,t,i),i}}function pe(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function me(e){return async(t,n)=>{let r=await j(e,`
       SELECT *
       FROM ${N(e.dataset||`authhero_logs`)}
       WHERE index1 = ${M(t)}
         AND blob1 = ${M(n)}
       LIMIT 1
-    `);return r.length===0||!r[0]?null:P(r[0])}}function me(e){return e.replace(/\\([\\"+\-!(){}[\]^~*?:/&|])/g,`$1`)}function he(e){let t=[],n=``,r=!1;for(let i=0;i<e.length;i++){let a=e[i];a===`"`?(r=!r,n+=a):a===` `&&!r?(n.trim()&&t.push(n.trim()),n=``):n+=a}return n.trim()&&t.push(n.trim()),t}function F(e){let t=e;return t.startsWith(`"`)&&t.endsWith(`"`)&&t.length>1&&(t=t.slice(1,-1)),me(t)}function ge(e){let t={},n=[];for(let r of he(e)){if(r===`OR`||r===`AND`)continue;let e=r.match(/^(\w+):([\s\S]*)$/);if(e){let n=e[1],r=F(e[2]);t[n]||(t[n]=[]),t[n].push(r)}else{let e=F(r);e&&n.push(e)}}return{fields:t,terms:n}}function I(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function _e(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=I(n);if(i)if(e.length===1)t.push(`${i} = ${M(e[0])}`);else{let n=e.map(e=>M(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function ve(e){return e.filter(e=>e!==``).map(e=>{let t=M(e),n=M(`%${e}%`);return`(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`})}function ye(e){return e===`date`?`double2`:I(e)||`timestamp`}function be(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${M(t)}`];if(s){let{fields:e,terms:t}=ge(s);d.push(..._e(e)),d.push(...ve(t))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${ye(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await j(e,`
+    `);return r.length===0||!r[0]?null:P(r[0])}}function F(e){return e.replace(/\\([\\"+\-!(){}[\]^~*?:/&|])/g,`$1`)}function I(e){let t=[],n=``,r=!1;for(let i=0;i<e.length;i++){let a=e[i];a===`"`?(r=!r,n+=a):a===` `&&!r?(n.trim()&&t.push(n.trim()),n=``):n+=a}return n.trim()&&t.push(n.trim()),t}function L(e){let t=e;return t.startsWith(`"`)&&t.endsWith(`"`)&&t.length>1&&(t=t.slice(1,-1)),F(t)}function R(e){let t={},n=[];for(let r of I(e)){if(r===`OR`||r===`AND`)continue;let e=r.match(/^(\w+):([\s\S]*)$/);if(e){let n=e[1],r=L(e[2]);t[n]||(t[n]=[]),t[n].push(r)}else{let e=L(r);e&&n.push(e)}}return{fields:t,terms:n}}function z(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function he(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=z(n);if(i)if(e.length===1)t.push(`${i} = ${M(e[0])}`);else{let n=e.map(e=>M(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function ge(e){return e.filter(e=>e!==``).map(e=>{let t=M(e),n=M(`%${e}%`);return`(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`})}function _e(e){return e===`date`?`double2`:z(e)||`timestamp`}function ve(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${M(t)}`];if(s){let{fields:e,terms:t}=R(s);d.push(...he(e)),d.push(...ge(t))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${_e(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await j(e,`
       SELECT *
       FROM ${N(u)}
       WHERE ${f}
@@ -27,12 +27,12 @@ Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{val
       SELECT count() as count
       FROM ${N(u)}
       WHERE ${f}
-    `;try{let t=(await j(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var L=[`s`],xe=[`pwd_leak`];function R(e){return`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`}function z(e){return e.toISOString().split(`T`)[0]}function Se(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?R(i):z(s),l=a?R(a):z(o),u=new Date(`${c}T00:00:00Z`).getTime(),d=new Date(`${l}T23:59:59.999Z`).getTime();return(await j(e,`
+    `;try{let t=(await j(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var B=[`s`],ye=[`pwd_leak`];function V(e){return`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`}function H(e){return e.toISOString().split(`T`)[0]}function be(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?V(i):H(s),l=a?V(a):H(o),u=new Date(`${c}T00:00:00Z`).getTime(),d=new Date(`${l}T23:59:59.999Z`).getTime();return(await j(e,`
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
-          SUM(CASE WHEN blob3 IN (${L.map(e=>M(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
+          SUM(CASE WHEN blob3 IN (${B.map(e=>M(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${xe.map(e=>M(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${ye.map(e=>M(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
@@ -41,7 +41,7 @@ Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{val
           AND double2 <= ${d}
         GROUP BY date
         ORDER BY date ASC
-      `)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=L.map(e=>M(e)).join(`, `),o=(await j(e,`
+      `)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=B.map(e=>M(e)).join(`, `),o=(await j(e,`
         SELECT COUNT(DISTINCT blob7) AS count
         FROM "${t}"
         WHERE index1 = ${M(n)}
@@ -49,21 +49,21 @@ Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{val
           AND blob3 IN (${a})
           AND blob7 IS NOT NULL
           AND blob7 != ''
-      `))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var Ce={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`],logouts:[`slo`,`flo`],"password-changes":[`scp`,`fcp`,`scpr`,`fcpr`],mfa:[`gd_auth_succeed`,`gd_auth_failed`,`gd_auth_rejected`],"email-verifications":[`sv`,`fv`,`svr`,`fvr`],"codes-sent":[`cls`,`cs`]},we={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},Te={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},Ee={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`},logouts:{expr:`count()`,alias:`logouts`,type:`UInt64`},"password-changes":{expr:`count()`,alias:`password_changes`,type:`UInt64`},mfa:{expr:`count()`,alias:`mfa`,type:`UInt64`},"email-verifications":{expr:`count()`,alias:`email_verifications`,type:`UInt64`},"codes-sent":{expr:`count()`,alias:`codes_sent`,type:`UInt64`}};function De(e,t){let n=`toDateTime(intDiv(double2, 1000), ${M(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function Oe(e){return e===`hour`?`DateTime`:`Date`}function ke(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>M(e)).join(`, `),o=[`index1 = ${M(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(Te)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>M(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function Ae(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${N(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${N(`time`)} ASC`:`${N(n)} DESC`}function B(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=Ce[r],o=Ee[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=De(i.interval,i.tz);s.push(`${e} AS ${N(`time`)}`),c.push({name:`time`,type:Oe(i.interval)})}else{let t=we[e];s.push(`${t} AS ${N(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${N(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>N(e===`time`?`time`:e)).join(`, `)}`:``,d=Ae(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
+      `))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var xe={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`],logouts:[`slo`,`flo`],"password-changes":[`scp`,`fcp`,`scpr`,`fcpr`],"password-migrations":[`spm`],mfa:[`gd_auth_succeed`,`gd_auth_failed`,`gd_auth_rejected`],"email-verifications":[`sv`,`fv`,`svr`,`fvr`],"codes-sent":[`cls`,`cs`]},Se={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},Ce={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},we={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`},logouts:{expr:`count()`,alias:`logouts`,type:`UInt64`},"password-changes":{expr:`count()`,alias:`password_changes`,type:`UInt64`},"password-migrations":{expr:`count()`,alias:`password_migrations`,type:`UInt64`},mfa:{expr:`count()`,alias:`mfa`,type:`UInt64`},"email-verifications":{expr:`count()`,alias:`email_verifications`,type:`UInt64`},"codes-sent":{expr:`count()`,alias:`codes_sent`,type:`UInt64`}};function Te(e,t){let n=`toDateTime(intDiv(double2, 1000), ${M(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function Ee(e){return e===`hour`?`DateTime`:`Date`}function De(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>M(e)).join(`, `),o=[`index1 = ${M(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(Ce)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>M(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function Oe(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${N(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${N(`time`)} ASC`:`${N(n)} DESC`}function U(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=xe[r],o=we[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=Te(i.interval,i.tz);s.push(`${e} AS ${N(`time`)}`),c.push({name:`time`,type:Ee(i.interval)})}else{let t=Se[e];s.push(`${t} AS ${N(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${N(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>N(e===`time`?`time`:e)).join(`, `)}`:``,d=Oe(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
         SELECT ${l.join(`, `)}
         FROM ${N(t)}
-        WHERE ${ke(i,n,a)}
+        WHERE ${De(i,n,a)}
         ${u}
         ORDER BY ${d}
         LIMIT ${Math.max(0,i.limit)} OFFSET ${Math.max(0,i.offset)}
         FORMAT JSON
-      `,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function V(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:de(e),list:be(e),get:pe(e)}}var je=`authhero_action_executions`,Me=1024,Ne=`[truncated]`;function H(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function Pe(e){let t=c.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function U(e,t=Me){return e.length<=t?e:`${e.substring(0,t-11)}${Ne}`}function W(e){return e==null?``:JSON.stringify(e)}function Fe(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:Pe(e.blob3),results:H(e.blob4)??[],logs:H(e.blob5),created_at:t,updated_at:n}}function Ie(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Le(e,t,a,r),a}}function Le(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[U(n.id),U(n.trigger_id),U(n.status),U(W(n.results)),U(W(n.logs)),U(n.created_at),U(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function Re(e){return async(t,n)=>{let r=await j(e,`
+      `,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function W(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:fe(e),list:ve(e),get:me(e)}}var ke=`authhero_action_executions`,Ae=1024,je=`[truncated]`;function G(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function Me(e){let t=l.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function K(e,t=Ae){return e.length<=t?e:`${e.substring(0,t-11)}${je}`}function q(e){return e==null?``:JSON.stringify(e)}function Ne(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:Me(e.blob3),results:G(e.blob4)??[],logs:G(e.blob5),created_at:t,updated_at:n}}function Pe(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Fe(e,t,a,r),a}}function Fe(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[K(n.id),K(n.trigger_id),K(n.status),K(q(n.results)),K(q(n.logs)),K(n.created_at),K(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function Ie(e){return async(t,n)=>{let r=await j(e,`
       SELECT *
-      FROM ${N(e.dataset||je)}
+      FROM ${N(e.dataset||ke)}
       WHERE index1 = ${M(t)}
         AND blob1 = ${M(n)}
       LIMIT 1
-    `);return r.length===0||!r[0]?null:Fe(r[0])}}function G(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No action_executions binding configured. Executions will not be written.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API.`),{create:Ie(e),get:Re(e)}}function ze(){return{async getGeoInfo(e){try{let t=e[`cf-ipcountry`],n=e[`cf-ipcity`],r=e[`cf-iplatitude`],i=e[`cf-iplongitude`],a=e[`cf-timezone`],o=e[`cf-ipcontinent`];return t?{country_code:t,city_name:n||``,latitude:r||``,longitude:i||``,time_zone:a||``,continent_code:o||``}:null}catch(e){return console.warn(`Failed to get geo info from Cloudflare headers:`,e),null}}}}var Be=class{bindings;constructor(e){this.bindings=e}async consume(e,t){let n=this.bindings[e];if(!n)return{allowed:!0};try{let{success:e}=await n.limit({key:t});return{allowed:e}}catch(t){return console.error(`CloudflareRateLimit: limit() error for scope ${e}:`,t),{allowed:!0}}}};function K(e){if(e&&Object.keys(e).some(t=>e[t]))return new Be(e)}function q(e){return`// Auto-generated AuthHero code hook worker
+    `);return r.length===0||!r[0]?null:Ne(r[0])}}function J(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No action_executions binding configured. Executions will not be written.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API.`),{create:Pe(e),get:Ie(e)}}function Le(){return{async getGeoInfo(e){try{let t=e[`cf-ipcountry`],n=e[`cf-ipcity`],r=e[`cf-iplatitude`],i=e[`cf-iplongitude`],a=e[`cf-timezone`],o=e[`cf-ipcontinent`];return t?{country_code:t,city_name:n||``,latitude:r||``,longitude:i||``,time_zone:a||``,continent_code:o||``}:null}catch(e){return console.warn(`Failed to get geo info from Cloudflare headers:`,e),null}}}}var Re=class{bindings;constructor(e){this.bindings=e}async consume(e,t){let n=this.bindings[e];if(!n)return{allowed:!0};try{let{success:e}=await n.limit({key:t});return{allowed:e}}catch(t){return console.error(`CloudflareRateLimit: limit() error for scope ${e}:`,t),{allowed:!0}}}};function Y(e){if(e&&Object.keys(e).some(t=>e[t]))return new Re(e)}function X(e){return`// Auto-generated AuthHero code hook worker
 
 const fnNames = {
   "post-user-login": "onExecutePostLogin",
@@ -166,9 +166,9 @@ export default {
     }
   },
 };
-`}var J=class{config;constructor(e){this.config=e}async execute(e){let t=Date.now();if(!e.hookCodeId)return{success:!1,error:`DispatchNamespaceCodeExecutor requires hookCodeId`,durationMs:Date.now()-t,apiCalls:[]};let n=`hook-${e.hookCodeId}`,r=JSON.stringify({triggerId:e.triggerId,event:e.event});try{let i;if(this.config.dispatcher)i=await this.config.dispatcher.get(n,{},{limits:{cpuMs:e.cpuLimitMs??5e3}}).fetch(new Request(`https://hook.internal/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:r}));else if(this.config.dispatchUrl)i=await fetch(`${this.config.dispatchUrl}/${n}`,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${this.config.apiToken}`},body:r});else return{success:!1,error:`No dispatcher binding or dispatchUrl configured`,durationMs:Date.now()-t,apiCalls:[]};if(!i.ok){let e=await i.text();return{success:!1,error:`Worker invocation failed (${i.status}): ${e}`,durationMs:Date.now()-t,apiCalls:[]}}return{...await i.json(),durationMs:Date.now()-t}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}async deploy(e,t){let n=`hook-${e}`,r=q(t),i=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`,a=JSON.stringify({main_module:`index.js`,compatibility_date:this.config.compatibilityDate??`2024-11-20`}),o=new FormData;o.append(`metadata`,new Blob([a],{type:`application/json`})),o.append(`index.js`,new Blob([r],{type:`application/javascript+module`}),`index.js`);let s=await fetch(i,{method:`PUT`,headers:{Authorization:`Bearer ${this.config.apiToken}`},body:o});if(!s.ok){let e=await s.text();throw Error(`Failed to deploy hook worker ${n}: ${s.status} ${e}`)}}async remove(e){let t=`hook-${e}`,n=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${t}`,r=await fetch(n,{method:`DELETE`,headers:{Authorization:`Bearer ${this.config.apiToken}`}});if(!r.ok&&r.status!==404){let e=await r.text();throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`)}}},Ve=J,He={"post-user-login":`onExecutePostLogin`,"credentials-exchange":`onExecuteCredentialsExchange`,"pre-user-registration":`onExecutePreUserRegistration`,"post-user-registration":`onExecutePostUserRegistration`},Ue={"post-user-login":{accessToken:[`setCustomClaim`],idToken:[`setCustomClaim`],access:[`deny`],prompt:[`render`],redirect:[`sendUserTo`]},"credentials-exchange":{accessToken:[`setCustomClaim`],idToken:[`setCustomClaim`],access:[`deny`]},"pre-user-registration":{user:[`setUserMetadata`,`setLinkedTo`],access:[`deny`]},"post-user-registration":{}};async function We(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n),i=``;for(let e of r)i+=e.toString(16).padStart(2,`0`);return i}function Ge(e){return`
-const TRIGGER_FN_NAMES = ${JSON.stringify(He)};
-const API_SHAPES = ${JSON.stringify(Ue)};
+`}var Z=class{config;constructor(e){this.config=e}async execute(e){let t=Date.now();if(!e.hookCodeId)return{success:!1,error:`DispatchNamespaceCodeExecutor requires hookCodeId`,durationMs:Date.now()-t,apiCalls:[]};let n=`hook-${e.hookCodeId}`,r=JSON.stringify({triggerId:e.triggerId,event:e.event});try{let i;if(this.config.dispatcher)i=await this.config.dispatcher.get(n,{},{limits:{cpuMs:e.cpuLimitMs??5e3}}).fetch(new Request(`https://hook.internal/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:r}));else if(this.config.dispatchUrl)i=await fetch(`${this.config.dispatchUrl}/${n}`,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${this.config.apiToken}`},body:r});else return{success:!1,error:`No dispatcher binding or dispatchUrl configured`,durationMs:Date.now()-t,apiCalls:[]};if(!i.ok){let e=await i.text();return{success:!1,error:`Worker invocation failed (${i.status}): ${e}`,durationMs:Date.now()-t,apiCalls:[]}}return{...await i.json(),durationMs:Date.now()-t}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}async deploy(e,t){let n=`hook-${e}`,r=X(t),i=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`,a=JSON.stringify({main_module:`index.js`,compatibility_date:this.config.compatibilityDate??`2024-11-20`}),o=new FormData;o.append(`metadata`,new Blob([a],{type:`application/json`})),o.append(`index.js`,new Blob([r],{type:`application/javascript+module`}),`index.js`);let s=await fetch(i,{method:`PUT`,headers:{Authorization:`Bearer ${this.config.apiToken}`},body:o});if(!s.ok){let e=await s.text();throw Error(`Failed to deploy hook worker ${n}: ${s.status} ${e}`)}}async remove(e){let t=`hook-${e}`,n=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${t}`,r=await fetch(n,{method:`DELETE`,headers:{Authorization:`Bearer ${this.config.apiToken}`}});if(!r.ok&&r.status!==404){let e=await r.text();throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`)}}},ze=Z,Be={"post-user-login":`onExecutePostLogin`,"credentials-exchange":`onExecuteCredentialsExchange`,"pre-user-registration":`onExecutePreUserRegistration`,"post-user-registration":`onExecutePostUserRegistration`},Ve={"post-user-login":{accessToken:[`setCustomClaim`],idToken:[`setCustomClaim`],access:[`deny`],prompt:[`render`],redirect:[`sendUserTo`]},"credentials-exchange":{accessToken:[`setCustomClaim`],idToken:[`setCustomClaim`],access:[`deny`]},"pre-user-registration":{user:[`setUserMetadata`,`setLinkedTo`],access:[`deny`]},"post-user-registration":{}};async function He(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n),i=``;for(let e of r)i+=e.toString(16).padStart(2,`0`);return i}function Ue(e){return`
+const TRIGGER_FN_NAMES = ${JSON.stringify(Be)};
+const API_SHAPES = ${JSON.stringify(Ve)};
 const MAX_LOG_ENTRIES = 50;
 const MAX_LOG_LENGTH = 500;
 
@@ -266,4 +266,4 @@ export default {
     }
   },
 };
-`}var Ke=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Ge(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await We(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},Y=class extends Error{status;endpoint;errors;body;constructor(e,t,n,r=[]){super(`Cloudflare API ${e} ${t}: ${qe(n,256)}`),this.name=`CloudflareApiError`,this.status=e,this.endpoint=t,this.body=n,this.errors=r}};function qe(e,t){return e.length<=t?e:`${e.slice(0,t)}…`}var X=class{accountId;apiToken;fetchImpl;timeoutMs;baseUrl;constructor(e){this.accountId=e.accountId,this.apiToken=e.apiToken,this.fetchImpl=e.fetch??((...e)=>fetch(...e)),this.timeoutMs=e.timeoutMs??3e4,this.baseUrl=(e.baseUrl??`https://api.cloudflare.com/client/v4`).replace(/\/+$/,``)}async createD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database`;return(await this.request(`POST`,t,{body:JSON.stringify({name:e})})).result}async listD1Databases(e){let t=e?`?name=${encodeURIComponent(e)}`:``,n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database${t}`;return(await this.request(`GET`,n)).result??[]}async deleteD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}`;await this.request(`DELETE`,t)}async execD1(e,t){let n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}/query`;return(await this.request(`POST`,n,{body:JSON.stringify({sql:t})})).result??[]}async uploadNamespacedScript(e,t,n){let r=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`,i={main_module:n.mainModule,compatibility_date:n.compatibilityDate,compatibility_flags:n.compatibilityFlags??[],bindings:n.bindings??[],tags:n.tags},a=new FormData;a.append(`metadata`,new Blob([JSON.stringify(i)],{type:`application/json`})),a.append(n.mainModule,new Blob([n.script],{type:`application/javascript+module`}),n.mainModule),await this.request(`PUT`,r,{body:a})}async deleteNamespacedScript(e,t){let n=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`;await this.request(`DELETE`,n)}async setNamespacedScriptSecret(e,t,n,r){let i=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}/secrets`;await this.request(`PUT`,i,{body:JSON.stringify({name:n,text:r,type:`secret_text`})})}async request(e,t,n){let r=`${this.baseUrl}${t}`,i=new AbortController,a=setTimeout(()=>i.abort(),this.timeoutMs),o={Authorization:`Bearer ${this.apiToken}`,...n?.headers??{}};n?.body&&!(n.body instanceof FormData)&&!o[`Content-Type`]&&(o[`Content-Type`]=`application/json`);let s;try{s=await this.fetchImpl(r,{method:e,headers:o,body:n?.body,signal:i.signal})}finally{clearTimeout(a)}let c=await s.text();if(!s.ok){let e=[];try{let t=JSON.parse(c);Array.isArray(t.errors)&&(e=t.errors)}catch{}throw new Y(s.status,t,c,e)}if(!(c===``||s.status===204))return JSON.parse(c)}},Je=`{tenant_id}`,Ye=`tenant-{tenant_id}`,Xe=`index.js`,Ze=`2026-05-01`,Z=64;function Q(e,t){return e.replace(/\{tenant_id\}/g,t)}function Qe(e){if(!(e instanceof Y))return!1;let t=e.body.toLowerCase();return e.status===409||t.includes(`already exists`)||t.includes(`name is already taken`)||t.includes(`already in use`)}function $(e){return e instanceof Y?e.status===404:!1}function $e(e){let t=new X({accountId:e.accountId,apiToken:e.apiToken,fetch:e.fetch,timeoutMs:e.timeoutMs}),n=e.scriptNameTemplate??Je,r=e.d1NameTemplate??Ye,i=e.scriptMetadata?.main_module??Xe,a=e.scriptMetadata?.compatibility_date??Ze,o=e.scriptMetadata?.compatibility_flags??[`nodejs_compat`],s=e.dispatchNamespace,c=e.logger;async function l(e){let n=(await t.listD1Databases(e)).find(t=>t.name===e);if(n)return{id:n.uuid,created:!1};try{return{id:(await t.createD1Database(e)).uuid,created:!0}}catch(n){if(!Qe(n))throw n;let r=(await t.listD1Databases(e)).find(t=>t.name===e);if(r)return{id:r.uuid,created:!1};throw n}}let u=`_authhero_provisioner_migrations`;function d(e,t){let n=[];for(let r of e)for(let e of r.results??[])if(e&&typeof e==`object`&&t in e){let r=e[t];typeof r==`string`&&n.push(r)}return n}async function f(e){return d(await t.execD1(e,`SELECT name FROM sqlite_master WHERE type='table' AND name='${u}';`),`name`).length>0}async function p(e){await t.execD1(e,`CREATE TABLE IF NOT EXISTS ${u} (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);`)}async function m(e){let n=await t.execD1(e,`SELECT name FROM ${u};`);return new Set(d(n,`name`))}function h(e){return e.replace(/'/g,`''`)}async function g(e,n){let r=new Date().toISOString();await t.execD1(e,`INSERT OR IGNORE INTO ${u} (name, applied_at) VALUES ('${h(n)}', '${h(r)}');`)}async function _(n){let r=await m(n);for(let i of e.migrations)if(!r.has(i.name)){try{await t.execD1(n,i.sql)}catch(e){throw e instanceof Error?Error(`Failed to apply migration "${i.name}" to D1 ${n}: ${e.message}`,{cause:e}):e}await g(n,i.name)}}async function v(n,r){let c=[{type:`d1`,name:`AUTH_DB`,id:r},{type:`plain_text`,name:`CONTROL_PLANE_BASE_URL`,text:e.controlPlaneBaseUrl},...e.extraBindings??[]];await t.uploadNamespacedScript(s,n,{script:e.tenantWorkerScript,mainModule:i,compatibilityDate:a,compatibilityFlags:o,bindings:c,tags:[`authhero-tenant`,`tenant:${n}`]})}async function y(n,r){let i=await e.secrets(r);for(let[e,r]of Object.entries(i))await t.setNamespacedScriptSecret(s,n,e,r)}return{async onProvision(t){let i=Q(n,t),a=Q(r,t),o=e.migrations[e.migrations.length-1]?.name;if(o!==void 0&&o.length>Z)throw Error(`Migration name "${o}" exceeds the ${Z}-character database_version limit.`);let{id:s,created:u}=await l(a),d=u?!1:await f(s);if(u||d)await p(s),await _(s);else{c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`),await p(s);for(let t of e.migrations)await g(s,t.name)}return await v(i,s),await y(i,t),{d1DatabaseId:s,scriptName:i,d1Name:a,bundleConfiguration:e.bundleConfiguration,workerVersion:e.workerVersion,databaseVersion:o}},async onDeprovision(e){let i=Q(n,e),a=Q(r,e),o=[];try{await t.deleteNamespacedScript(s,i)}catch(e){$(e)||o.push(e)}try{let e=(await t.listD1Databases(a)).find(e=>e.name===a);if(e)try{await t.deleteD1Database(e.uuid)}catch(e){$(e)||o.push(e)}}catch(e){o.push(e)}if(o.length>0){let t=o.map(e=>e instanceof Error?e.message:String(e)).join(`; `);throw Error(`Deprovision of tenant "${e}" had ${o.length} failure(s): ${t}`,{cause:o[0]})}}}}function et(e){return e.deployment_type===`wfp`}function tt(e){if(typeof e!=`object`||!e)return[];let t=[];for(let n of Object.values(e))if(typeof n==`object`&&n&&`errors`in n&&Array.isArray(n.errors))for(let e of n.errors)typeof e==`string`&&t.push(e);return t}function nt(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??et,a=e.logger;async function o(e,t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e){let i;try{i=await t.onProvision(e)}catch(t){throw await o(e,t),t}let s={d1_database_id:i.d1DatabaseId,worker_script_name:i.scriptName,bundle_configuration:i.bundleConfiguration,worker_version:i.workerVersion,database_version:i.databaseVersion};try{if(r){let t=tt(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`)}await n.update(e,{...s,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{...s,provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e){let t=await n.get(e);t&&i(t)&&await s(e)},async onUpgrade(e){let t=await n.get(e);if(!t)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(t))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var rt=`DISPATCHER`,it=`tenant-{tenant_id}-auth`;function at(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function ot(e,t){return e.replace(/\{tenant_id\}/g,t)}function st(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=rt,scriptNameTemplate:i=it,resolveTenantId:a=e=>e.req.header(`tenant-id`)}=e;return async(e,o)=>{let s=await a(e);if(!s||s===n)return o();let c=await t.get(s);if(!c||c.deployment_type!==`wfp`||c.provisioning_state&&c.provisioning_state!==`ready`)return o();let l=Reflect.get(e.env??{},r);if(!at(l))return o();let u=ot(i,s),d;try{d=await l.get(u).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${s} script=${u}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,s),e.json({error:i,detail:r?`Tenant '${s}' is marked ready but its worker '${u}' is not deployed in the dispatch namespace.`:`The worker for tenant '${s}' could not be reached.`,tenant_id:s},r?503:502)}if(d.status>=500){let e=d.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${d.status}${e?` (${e})`:``} tenant=${s} script=${u}`)}let f=Reflect.get(d,`webSocket`);if(d.status===101||f!=null)return d;let p=new Response(d.body,d);return p.headers.set(`X-Wfp-Tenant`,s),p}}function ct(e){let t={customDomains:ee(e),cache:ne({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:ze()};e.r2SqlLogs?t.logs=A(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=X,exports.CloudflareApiError=Y,exports.CloudflareCodeExecutor=Ve,exports.DispatchNamespaceCodeExecutor=J,exports.WorkerLoaderCodeExecutor=Ke,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineStatsAdapter=Se,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=$e,exports.createR2SQLLogsAdapter=A,exports.createR2SQLStatsAdapter=ue,exports.createWfpForwardMiddleware=st,exports.createWfpTenantProvisioningHook=nt,exports.default=ct,exports.generateWorkerScript=q;
+`}var We=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Ue(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await He(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}};function Q(e){let t=c.n(e);return{async onProvision(e){let{scriptName:n,databaseName:r}=t.names(e),{databaseVersion:i,bundleConfiguration:a,workerVersion:o}=t.validate(),{id:s,created:c}=await t.findOrCreateDatabase(r);return await t.applyMigrations(s,c),await t.uploadScript(n,s),await t.uploadSecrets(n,e),{d1DatabaseId:s,scriptName:n,d1Name:r,bundleConfiguration:a,workerVersion:o,databaseVersion:i}},async onDeprovision(e){await t.deprovision(e)}}}function Ge(e){return e.deployment_type===`wfp`}var Ke=2048;function $(e){let t;if(e instanceof Error)t=e.message;else try{t=String(e)}catch{t=Object.prototype.toString.call(e)}return t.slice(0,Ke)}function qe(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??Ge,a=e.logger;async function o(e,t){try{await n.update(e,{provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e,i){let s=async(t,n,r)=>{if(i)try{await i(t,n,r)}catch(n){a?.warn(`Failed to report provisioning step "${t}" for tenant ${e}:`,n)}};await s(`provision-resources`,`started`);let l;try{l=await t.onProvision(e)}catch(t){throw await s(`provision-resources`,`failed`,{message:$(t)}),await o(e,t),t}let u={d1_database_id:l.d1DatabaseId,worker_script_name:l.scriptName,bundle_configuration:l.bundleConfiguration,worker_version:l.workerVersion,database_version:l.databaseVersion};await s(`provision-resources`,`succeeded`,{...u});try{if(r){await s(`seed-defaults`,`started`);try{let t=c.t(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`);await s(`seed-defaults`,`succeeded`)}catch(e){throw await s(`seed-defaults`,`failed`,{message:$(e)}),e}}await n.update(e,{...u,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){try{await n.update(e,{...u,provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e,t){let r=await n.get(e);r&&i(r)&&await s(e,t)},async onUpgrade(e,t){let r=await n.get(e);if(!r)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(r))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e,t)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var Je=`DISPATCHER`,Ye=`tenant-{tenant_id}-auth`;function Xe(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function Ze(e,t){return e.replace(/\{tenant_id\}/g,t)}function Qe(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=Je,scriptNameTemplate:i=Ye,resolveTenantId:a=e=>e.req.header(`tenant-id`)}=e;return async(e,o)=>{let s=await a(e);if(!s||s===n)return o();let c=await t.get(s);if(!c||c.deployment_type!==`wfp`||c.provisioning_state&&c.provisioning_state!==`ready`)return o();let l=Reflect.get(e.env??{},r);if(!Xe(l))return o();let u=Ze(i,s),d;try{d=await l.get(u).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${s} script=${u}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,s),e.json({error:i,detail:r?`Tenant '${s}' is marked ready but its worker '${u}' is not deployed in the dispatch namespace.`:`The worker for tenant '${s}' could not be reached.`,tenant_id:s},r?503:502)}if(d.status>=500){let e=d.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${d.status}${e?` (${e})`:``} tenant=${s} script=${u}`)}let f=Reflect.get(d,`webSocket`);if(d.status===101||f!=null)return d;let p=new Response(d.body,d);return p.headers.set(`X-Wfp-Tenant`,s),p}}function $e(e){let t={customDomains:re(e),cache:ie({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Le()};e.r2SqlLogs?t.logs=A(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=W(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=U(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=J(e.analyticsEngineActionExecutions));let n=Y(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=c.i,exports.CloudflareApiError=c.a,exports.CloudflareCodeExecutor=ze,exports.DispatchNamespaceCodeExecutor=Z,exports.WorkerLoaderCodeExecutor=We,exports.createAnalyticsEngineActionExecutionsAdapter=J,exports.createAnalyticsEngineAnalyticsAdapter=U,exports.createAnalyticsEngineLogsAdapter=W,exports.createAnalyticsEngineStatsAdapter=be,exports.createCloudflareRateLimitAdapter=Y,exports.createCloudflareWfpD1Provisioner=Q,exports.createR2SQLLogsAdapter=A,exports.createR2SQLStatsAdapter=de,exports.createWfpForwardMiddleware=Qe,exports.createWfpProvisionerSteps=c.n,exports.createWfpTenantProvisioningHook=qe,exports.default=$e,exports.generateWorkerScript=X;

package/dist/cloudflare-adapter.d.ts

@@ -844,9 +844,64 @@ interface CloudflareWfpD1Provisioner {
  * partial migrations applied) are NOT rolled back. The operator should
  * treat re-running `onProvision(tenantId)` as safe; each step is idempotent
  * on "already exists".
+ *
+ * The individual steps live in `createWfpProvisionerSteps` so the durable
+ * workflow executor (issue #1026 phase 2) can run the same units with
+ * per-step retries; this factory is a thin inline sequence over them.
  */
 declare function createCloudflareWfpD1Provisioner(options: CloudflareWfpD1ProvisionerOptions): CloudflareWfpD1Provisioner;
 
+interface TenantProvisionNames {
+    scriptName: string;
+    databaseName: string;
+}
+/**
+ * Provider-agnostic contract for the individual, idempotent units of
+ * tenant provisioning. Deliberately free of Cloudflare/D1 terminology so
+ * the durable operation orchestration (issue #1026 phase 2) — and any
+ * future provider (e.g. Bunny with its SQLite databases) — can run against
+ * it. `createWfpProvisionerSteps` is the Cloudflare Workers-for-Platforms
+ * + D1 implementation.
+ */
+interface TenantProvisionerSteps {
+    names(tenantId: string): TenantProvisionNames;
+    /**
+     * Validate the version token persisted into `tenants.database_version`
+     * BEFORE any provider side effects. Returns the recorded versions.
+     */
+    validate(): {
+        databaseVersion?: string;
+        bundleConfiguration?: string;
+        workerVersion?: string;
+    };
+    findOrCreateDatabase(name: string): Promise<{
+        id: string;
+        created: boolean;
+    }>;
+    /**
+     * Reconcile migrations against the provisioner-owned tracking table
+     * (`_authhero_provisioner_migrations`), including the legacy backfill
+     * branch for pre-tracking databases.
+     */
+    applyMigrations(databaseId: string, created: boolean): Promise<void>;
+    uploadScript(scriptName: string, databaseId: string): Promise<void>;
+    uploadSecrets(scriptName: string, tenantId: string): Promise<void>;
+    /** Best-effort teardown of both resources; throws a combined error. */
+    deprovision(tenantId: string): Promise<void>;
+}
+/**
+ * The Cloudflare WFP + D1 implementation of `TenantProvisionerSteps`,
+ * extracted from `createCloudflareWfpD1Provisioner` so each unit can run
+ * as its own durable workflow step while the inline provisioner keeps
+ * running them as one sequence. No behavior change from the original
+ * closures — the provisioner is a thin sequence over this object.
+ */
+interface WfpProvisionerSteps extends TenantProvisionerSteps {
+    /** Underlying REST client — shared with deprovision and the verify step. */
+    client: CloudflareApiClient;
+}
+declare function createWfpProvisionerSteps(options: CloudflareWfpD1ProvisionerOptions): WfpProvisionerSteps;
+
 /**
  * Adapt the provisioner to `@authhero/multi-tenancy`'s
  * `databaseIsolation.onProvision` / `onDeprovision` contract by:
@@ -925,8 +980,16 @@ interface WfpTenantProvisioningHookOptions {
      */
     syncDefaults?: (tenantId: string) => Promise<unknown>;
 }
+/**
+ * Structural mirror of `@authhero/multi-tenancy`'s `StepReporter` — kept
+ * local so this module carries no multi-tenancy dependency. When the
+ * control plane records provisions as tenant operations (issue #1026),
+ * the hook receives this callback and surfaces coarse step boundaries
+ * (`provision-resources`, `seed-defaults`) in the operation history.
+ */
+type WfpProvisioningStepReporter = (step: string, outcome: "started" | "succeeded" | "failed", detail?: Record<string, unknown>) => Promise<void>;
 interface WfpTenantProvisioningHook {
-    onProvision(tenantId: string): Promise<void>;
+    onProvision(tenantId: string, report?: WfpProvisioningStepReporter): Promise<void>;
     onDeprovision(tenantId: string): Promise<void>;
     /**
      * Re-run provisioning for an already-existing WFP tenant to pull it onto the
@@ -940,7 +1003,7 @@ interface WfpTenantProvisioningHook {
      * Throws if the tenant doesn't exist or isn't WFP-provisioned — callers
      * (e.g. a management-API redeploy endpoint) surface that as a 4xx.
      */
-    onUpgrade(tenantId: string): Promise<void>;
+    onUpgrade(tenantId: string, report?: WfpProvisioningStepReporter): Promise<void>;
 }
 declare function createWfpTenantProvisioningHook(options: WfpTenantProvisioningHookOptions): WfpTenantProvisioningHook;
 
@@ -994,5 +1057,5 @@ interface CloudflareAdapters {
 }
 declare function createAdapters(config: CloudflareConfig): CloudflareAdapters;
 
-export { CloudflareApiClient, CloudflareApiError, CloudflareCodeExecutor, DispatchNamespaceCodeExecutor, WorkerLoaderCodeExecutor, createAnalyticsEngineActionExecutionsAdapter, createAnalyticsEngineAnalyticsAdapter, createAnalyticsEngineLogsAdapter, createAnalyticsEngineStatsAdapter, createCloudflareRateLimitAdapter, createCloudflareWfpD1Provisioner, createR2SQLLogsAdapter, createR2SQLStatsAdapter, createWfpForwardMiddleware, createWfpTenantProvisioningHook, createAdapters as default, generateWorkerScript };
-export type { AnalyticsEngineActionExecutionsAdapterConfig, AnalyticsEngineDataset, AnalyticsEngineLogsAdapterConfig, CfApiClientOptions, CloudflareAdapters, CloudflareCodeExecutorConfig, CloudflareConfig, CloudflareRateLimitBinding, CloudflareRateLimitBindings, CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, D1Database, D1QueryResult, DispatchNamespace, DispatchNamespaceCodeExecutorConfig, ProvisionResult, ProvisionerMigration, R2SQLLogsAdapterConfig, ScriptBinding, ScriptUploadOptions, TenantSecretsResolver, WfpForwardOptions, WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, WorkerCode, WorkerLoader, WorkerLoaderCodeExecutorOptions, WorkerStub };
+export { CloudflareApiClient, CloudflareApiError, CloudflareCodeExecutor, DispatchNamespaceCodeExecutor, WorkerLoaderCodeExecutor, createAnalyticsEngineActionExecutionsAdapter, createAnalyticsEngineAnalyticsAdapter, createAnalyticsEngineLogsAdapter, createAnalyticsEngineStatsAdapter, createCloudflareRateLimitAdapter, createCloudflareWfpD1Provisioner, createR2SQLLogsAdapter, createR2SQLStatsAdapter, createWfpForwardMiddleware, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createAdapters as default, generateWorkerScript };
+export type { AnalyticsEngineActionExecutionsAdapterConfig, AnalyticsEngineDataset, AnalyticsEngineLogsAdapterConfig, CfApiClientOptions, CloudflareAdapters, CloudflareCodeExecutorConfig, CloudflareConfig, CloudflareRateLimitBinding, CloudflareRateLimitBindings, CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, D1Database, D1QueryResult, DispatchNamespace, DispatchNamespaceCodeExecutorConfig, ProvisionResult, ProvisionerMigration, R2SQLLogsAdapterConfig, ScriptBinding, ScriptUploadOptions, TenantProvisionNames, TenantProvisionerSteps, TenantSecretsResolver, WfpForwardOptions, WfpProvisionerSteps, WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, WorkerCode, WorkerLoader, WorkerLoaderCodeExecutorOptions, WorkerStub };