@authhero/cloudflare-adapter 2.37.6 → 2.38.1

package/dist/cloudflare-adapter.mjs

@@ -1,84 +1,85 @@
-import { actionExecutionStatusSchema as e, verificationMethodsSchema as t } from "@authhero/adapter-interfaces";
-import { z as n } from "@hono/zod-openapi";
-import { HTTPException as r } from "hono/http-exception";
-import i from "wretch";
-import { dedupe as a, retry as o } from "wretch/middlewares";
+import { a as e, i as t, n, t as r } from "./sync-defaults-errors-BlLZh6Gt.mjs";
+import { actionExecutionStatusSchema as i, verificationMethodsSchema as a } from "@authhero/adapter-interfaces";
+import { z as o } from "@hono/zod-openapi";
+import { HTTPException as s } from "hono/http-exception";
+import c from "wretch";
+import { dedupe as l, retry as u } from "wretch/middlewares";
 //#region src/types/CustomDomain.ts
-var s = n.object({
-	code: n.number(),
-	message: n.string()
-}), c = n.object({ message: n.string() }), l = n.object({
-	emails: n.array(n.string()).optional(),
-	http_body: n.string().optional(),
-	http_url: n.string().optional(),
-	txt_name: n.string().optional(),
-	txt_value: n.string().optional()
-}), u = n.object({
-	ciphers: n.array(n.string()).optional(),
-	early_hints: n.string().optional(),
-	http2: n.string().optional(),
-	min_tls_version: n.string().optional(),
-	tls_1_3: n.string().optional()
-}), d = n.object({
-	id: n.string(),
-	bundle_method: n.string().optional(),
-	certificate_authority: n.string(),
-	custom_certificate: n.string().optional(),
-	custom_csr_id: n.string().optional(),
-	custom_key: n.string().optional(),
-	expires_on: n.string().optional(),
-	hosts: n.array(n.string()).optional(),
-	issuer: n.string().optional(),
-	method: n.string(),
-	serial_number: n.string().optional(),
-	settings: u.optional(),
-	signature: n.string().optional(),
-	type: n.string(),
-	uploaded_on: n.string().optional(),
-	validation_errors: n.array(c).optional(),
-	validation_records: n.array(l).optional(),
-	wildcard: n.boolean()
-}), f = n.object({
-	name: n.string(),
-	type: n.string(),
-	value: n.string()
-}), p = n.object({
-	http_body: n.string().optional(),
-	http_url: n.string().optional()
-}), m = n.object({
-	id: n.string(),
-	ssl: d,
-	hostname: n.string(),
-	custom_metadata: n.record(n.string(), n.string()).optional(),
-	custom_origin_server: n.string().optional(),
-	custom_origin_sni: n.string().optional(),
-	ownership_verification: f.optional(),
-	ownership_verification_http: p.optional(),
-	status: n.string(),
-	verification_errors: n.array(n.string()).optional(),
-	created_at: n.string()
-}), h = n.object({
-	errors: n.array(s),
-	messages: n.array(s),
-	success: n.boolean(),
-	result: m
+var d = o.object({
+	code: o.number(),
+	message: o.string()
+}), f = o.object({ message: o.string() }), p = o.object({
+	emails: o.array(o.string()).optional(),
+	http_body: o.string().optional(),
+	http_url: o.string().optional(),
+	txt_name: o.string().optional(),
+	txt_value: o.string().optional()
+}), m = o.object({
+	ciphers: o.array(o.string()).optional(),
+	early_hints: o.string().optional(),
+	http2: o.string().optional(),
+	min_tls_version: o.string().optional(),
+	tls_1_3: o.string().optional()
+}), h = o.object({
+	id: o.string(),
+	bundle_method: o.string().optional(),
+	certificate_authority: o.string(),
+	custom_certificate: o.string().optional(),
+	custom_csr_id: o.string().optional(),
+	custom_key: o.string().optional(),
+	expires_on: o.string().optional(),
+	hosts: o.array(o.string()).optional(),
+	issuer: o.string().optional(),
+	method: o.string(),
+	serial_number: o.string().optional(),
+	settings: m.optional(),
+	signature: o.string().optional(),
+	type: o.string(),
+	uploaded_on: o.string().optional(),
+	validation_errors: o.array(f).optional(),
+	validation_records: o.array(p).optional(),
+	wildcard: o.boolean()
+}), g = o.object({
+	name: o.string(),
+	type: o.string(),
+	value: o.string()
+}), _ = o.object({
+	http_body: o.string().optional(),
+	http_url: o.string().optional()
+}), v = o.object({
+	id: o.string(),
+	ssl: h,
+	hostname: o.string(),
+	custom_metadata: o.record(o.string(), o.string()).optional(),
+	custom_origin_server: o.string().optional(),
+	custom_origin_sni: o.string().optional(),
+	ownership_verification: g.optional(),
+	ownership_verification_http: _.optional(),
+	status: o.string(),
+	verification_errors: o.array(o.string()).optional(),
+	created_at: o.string()
+}), y = o.object({
+	errors: o.array(d),
+	messages: o.array(d),
+	success: o.boolean(),
+	result: v
 });
-n.object({
-	errors: n.array(s),
-	messages: n.array(s),
-	success: n.boolean(),
-	result: n.array(m)
+o.object({
+	errors: o.array(d),
+	messages: o.array(d),
+	success: o.boolean(),
+	result: o.array(v)
 });
 //#endregion
 //#region src/customDomains/index.ts
-function g(e) {
-	return i(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({
+function b(e) {
+	return c(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({
 		"X-Auth-Email": e.authEmail,
 		"X-Auth-Key": e.authKey,
 		"Content-Type": "application/json"
-	}).middlewares([o(), a()]);
+	}).middlewares([u(), l()]);
 }
-function _(e) {
+function x(e) {
 	let t = {}, n = {};
 	if (!e) return {
 		sslOverrides: t,
@@ -90,27 +91,27 @@ function _(e) {
 		rest: n
 	};
 }
-function v(e) {
-	let r = [];
-	if (e.ssl.validation_records) for (let t of e.ssl.validation_records) t.txt_name && t.txt_value && r.push({
+function S(e) {
+	let t = [];
+	if (e.ssl.validation_records) for (let n of e.ssl.validation_records) n.txt_name && n.txt_value && t.push({
 		name: "txt",
-		record: t.txt_value,
-		domain: t.txt_name
+		record: n.txt_value,
+		domain: n.txt_name
 	});
-	if (e.ownership_verification && r.push({
+	if (e.ownership_verification && t.push({
 		name: "txt",
 		record: e.ownership_verification.value,
 		domain: e.ownership_verification.name
-	}), e.ownership_verification_http?.http_body && e.ownership_verification_http?.http_url && r.push({
+	}), e.ownership_verification_http?.http_body && e.ownership_verification_http?.http_url && t.push({
 		name: "http",
 		http_body: e.ownership_verification_http.http_body,
 		http_url: e.ownership_verification_http.http_url
-	}), e.ssl.validation_records) for (let t of e.ssl.validation_records) t.http_body && t.http_url && r.push({
+	}), e.ssl.validation_records) for (let n of e.ssl.validation_records) n.http_body && n.http_url && t.push({
 		name: "http",
-		http_body: t.http_body,
-		http_url: t.http_url
+		http_body: n.http_body,
+		http_url: n.http_url
 	});
-	let i = {
+	let n = {
 		...e.domain_metadata || {},
 		"ssl.method": e.ssl.method,
 		"ssl.type": e.ssl.type,
@@ -122,14 +123,14 @@ function v(e) {
 		primary: e.primary,
 		status: e.status === "active" ? "ready" : "pending",
 		type: e.type ?? "auth0_managed_certs",
-		verification: { methods: n.array(t).parse(r) },
-		domain_metadata: i
+		verification: { methods: o.array(a).parse(t) },
+		domain_metadata: n
 	};
 }
-function y(e) {
+function ee(e) {
 	return {
 		create: async (t, n) => {
-			let { sslOverrides: r, rest: i } = _(n.domain_metadata), { result: a, errors: o, success: s } = h.parse(await g(e).post({
+			let { sslOverrides: r, rest: i } = x(n.domain_metadata), { result: a, errors: o, success: s } = y.parse(await b(e).post({
 				hostname: n.domain,
 				ssl: {
 					method: "txt",
@@ -139,7 +140,7 @@ function y(e) {
 				custom_metadata: e.enterprise ? { tenant_id: t } : void 0
 			}, "/custom_hostnames").json());
 			if (!s) throw Error(JSON.stringify(o));
-			let c = v({
+			let c = S({
 				...a,
 				primary: !1,
 				type: n.type,
@@ -157,31 +158,31 @@ function y(e) {
 			}), c;
 		},
 		get: async (t, n) => {
-			let i = await e.customDomainAdapter.get(t, n);
-			if (!i) throw new r(404);
-			let a;
+			let r = await e.customDomainAdapter.get(t, n);
+			if (!r) throw new s(404);
+			let i;
 			try {
-				a = await g(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json();
+				i = await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json();
 			} catch (e) {
-				return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`, e instanceof Error ? e.message : e), i;
+				return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`, e instanceof Error ? e.message : e), r;
 			}
-			let o = h.safeParse(a);
-			if (!o.success || !o.data.success) return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`, o.success ? { cfErrors: o.data.errors } : {
-				zodIssues: o.error.issues,
-				body: a
-			}), i;
-			let { result: s } = o.data;
-			if (e.enterprise && s.custom_metadata?.tenant_id !== t) throw new r(404);
+			let a = y.safeParse(i);
+			if (!a.success || !a.data.success) return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`, a.success ? { cfErrors: a.data.errors } : {
+				zodIssues: a.error.issues,
+				body: i
+			}), r;
+			let { result: o } = a.data;
+			if (e.enterprise && o.custom_metadata?.tenant_id !== t) throw new s(404);
 			let c;
 			try {
-				c = v({
-					...i,
-					...s
+				c = S({
+					...r,
+					...o
 				});
 			} catch (e) {
-				return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`, e instanceof Error ? e.message : e), i;
+				return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`, e instanceof Error ? e.message : e), r;
 			}
-			if (c.status !== i.status || JSON.stringify(c.verification) !== JSON.stringify(i.verification)) try {
+			if (c.status !== r.status || JSON.stringify(c.verification) !== JSON.stringify(r.verification)) try {
 				await e.customDomainAdapter.update(t, n, {
 					status: c.status,
 					verification: c.verification
@@ -195,49 +196,49 @@ function y(e) {
 		list: async (t) => e.customDomainAdapter.list(t),
 		remove: async (t, n) => {
 			if (e.enterprise) {
-				let { result: i, success: a } = h.parse(await g(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());
-				if (!a || i.custom_metadata?.tenant_id !== t) throw new r(404);
+				let { result: r, success: i } = y.parse(await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());
+				if (!i || r.custom_metadata?.tenant_id !== t) throw new s(404);
 			}
-			let i = await g(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();
-			return i.ok && await e.customDomainAdapter.remove(t, n), i.ok;
+			let r = await b(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();
+			return r.ok && await e.customDomainAdapter.remove(t, n), r.ok;
 		},
-		update: async (t, n, i) => {
-			let { sslOverrides: a } = _(i.domain_metadata), o = {};
-			if (Object.keys(a).length > 0) {
+		update: async (t, n, r) => {
+			let { sslOverrides: i } = x(r.domain_metadata), a = {};
+			if (Object.keys(i).length > 0) {
 				let t;
 				try {
-					t = await g(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json();
+					t = await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json();
 				} catch (e) {
-					throw new r(503, { message: `Failed to fetch current custom hostname state: ${e instanceof Error ? e.message : String(e)}` });
+					throw new s(503, { message: `Failed to fetch current custom hostname state: ${e instanceof Error ? e.message : String(e)}` });
 				}
-				let i = h.safeParse(t);
-				if (!i.success || !i.data.success) throw new r(503, { message: `Failed to parse current custom hostname state: ${JSON.stringify(i.success ? i.data.errors : i.error.issues)}` });
-				o.ssl = {
-					method: i.data.result.ssl.method,
-					type: i.data.result.ssl.type,
-					certificate_authority: i.data.result.ssl.certificate_authority,
-					...a
+				let r = y.safeParse(t);
+				if (!r.success || !r.data.success) throw new s(503, { message: `Failed to parse current custom hostname state: ${JSON.stringify(r.success ? r.data.errors : r.error.issues)}` });
+				a.ssl = {
+					method: r.data.result.ssl.method,
+					type: r.data.result.ssl.type,
+					certificate_authority: r.data.result.ssl.certificate_authority,
+					...i
 				};
 			}
-			if (Object.keys(o).length > 0) {
-				let t = await g(e).patch(o, `/custom_hostnames/${encodeURIComponent(n)}`).res().catch((e) => {
-					throw new r(503, { message: `Failed to update custom hostname: ${e instanceof Error ? e.message : String(e)}` });
+			if (Object.keys(a).length > 0) {
+				let t = await b(e).patch(a, `/custom_hostnames/${encodeURIComponent(n)}`).res().catch((e) => {
+					throw new s(503, { message: `Failed to update custom hostname: ${e instanceof Error ? e.message : String(e)}` });
 				});
-				if (!t.ok) throw new r(503, { message: await t.text() });
+				if (!t.ok) throw new s(503, { message: await t.text() });
 			}
-			return e.customDomainAdapter.update(t, n, i);
+			return e.customDomainAdapter.update(t, n, r);
 		},
-		uploadCertificate: async (t, n, i) => {
-			let a = await e.customDomainAdapter.get(t, n);
-			if (!a) throw new r(404);
-			let o = await g(e).patch({ ssl: {
-				custom_certificate: i.certificate,
-				custom_key: i.private_key
-			} }, `/custom_hostnames/${encodeURIComponent(n)}`).json(), { result: s, errors: c, success: l } = h.parse(o);
-			if (!l) throw new r(503, { message: JSON.stringify(c) });
-			let u = v({
-				...a,
-				...s
+		uploadCertificate: async (t, n, r) => {
+			let i = await e.customDomainAdapter.get(t, n);
+			if (!i) throw new s(404);
+			let a = await b(e).patch({ ssl: {
+				custom_certificate: r.certificate,
+				custom_key: r.private_key
+			} }, `/custom_hostnames/${encodeURIComponent(n)}`).json(), { result: o, errors: c, success: l } = y.parse(a);
+			if (!l) throw new s(503, { message: JSON.stringify(c) });
+			let u = S({
+				...i,
+				...o
 			});
 			return await e.customDomainAdapter.update(t, n, {
 				status: u.status,
@@ -248,7 +249,7 @@ function y(e) {
 }
 //#endregion
 //#region src/cache/index.ts
-var ee = class {
+var te = class {
 	config;
 	cache = null;
 	constructor(e) {
@@ -322,8 +323,8 @@ var ee = class {
 		console.warn("CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries");
 	}
 };
-function te(e = {}) {
-	return new ee({
+function ne(e = {}) {
+	return new te({
 		defaultTtlSeconds: 300,
 		keyPrefix: "authhero",
 		getTimeoutMs: 200,
@@ -332,14 +333,14 @@ function te(e = {}) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
-var ne = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", b = (e = 21) => {
+var re = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", C = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += ne[n[e] & 63];
+	for (; e--;) t += re[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/r2-sql-logs/query.ts
-async function x(e, t) {
+async function w(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`, i = await fetch(n, {
@@ -359,15 +360,15 @@ async function x(e, t) {
 		clearTimeout(i);
 	}
 }
-function S(e) {
+function T(e) {
 	return `'${e.replace(/'/g, "''")}'`;
 }
-function C(e) {
+function E(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/r2-sql-logs/logs.ts
-function w(e) {
+function D(e) {
 	let t = (e) => {
 		if (!e) return "";
 		try {
@@ -407,16 +408,16 @@ function w(e) {
 		} : void 0
 	};
 }
-function re(e) {
+function ie(e) {
 	return async (t, n) => {
-		let r = n.log_id || b(), i = {
+		let r = n.log_id || C(), i = {
 			...n,
 			log_id: r
 		};
-		return await ie(e, t, i), i;
+		return await ae(e, t, i), i;
 	};
 }
-async function ie(e, t, n) {
+async function ae(e, t, n) {
 	let r = (e) => e ? JSON.stringify(e) : void 0, i = {
 		id: n.log_id,
 		tenant_id: t,
@@ -467,22 +468,22 @@ async function ie(e, t, n) {
 		throw console.error("Failed to send log to Pipeline:", e), e;
 	}
 }
-function ae(e) {
+function oe(e) {
 	return async (t, n) => {
-		let r = e.namespace || "default", i = e.tableName || "logs", a = await x(e, `
-      SELECT * FROM ${C(r)}.${C(i)}
-      WHERE tenant_id = ${S(t)}
-        AND id = ${S(n)}
+		let r = e.namespace || "default", i = e.tableName || "logs", a = await w(e, `
+      SELECT * FROM ${E(r)}.${E(i)}
+      WHERE tenant_id = ${T(t)}
+        AND id = ${T(n)}
       LIMIT 1
     `);
 		if (a.length === 0) return null;
 		let o = a[0];
-		return o ? w(o) : null;
+		return o ? D(o) : null;
 	};
 }
 //#endregion
 //#region src/r2-sql-logs/list.ts
-function oe(e) {
+function O(e) {
 	let t = {}, n = /(\w+):(?:"([^"]*)"|(\S+))/g, r;
 	for (; (r = n.exec(e)) !== null;) {
 		let e = r[1], n = r[2] === void 0 ? r[3] : r[2];
@@ -490,40 +491,40 @@ function oe(e) {
 	}
 	return t;
 }
-function T(e) {
+function se(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = n.replace(/[^a-zA-Z0-9_]/g, "");
-		e && r && t.push(`${C(e)} = ${S(r)}`);
+		e && r && t.push(`${E(e)} = ${T(r)}`);
 	}
 	return t;
 }
-function E(e) {
+function ce(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${S(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${T(t)}`];
 		if (s) {
-			let e = oe(s);
-			u.push(...T(e));
+			let e = O(s);
+			u.push(...se(e));
 		}
 		let d = u.join(" AND "), f = "ORDER BY date DESC";
 		if (o && o.sort_by) {
 			let e = o.sort_by.replace(/[^a-zA-Z0-9_]/g, ""), t = o.sort_order === "asc" ? "ASC" : "DESC";
-			f = `ORDER BY ${C(e)} ${t}`;
+			f = `ORDER BY ${E(e)} ${t}`;
 		}
-		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await x(e, `
-      SELECT * FROM ${C(c)}.${C(l)}
+		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await w(e, `
+      SELECT * FROM ${E(c)}.${E(l)}
       WHERE ${d}
       ${f}
       ${m}
-    `)).map(w);
+    `)).map(D);
 		if (!a) return {
 			logs: h,
 			start: 0,
 			limit: 0,
 			length: 0
 		};
-		let g = (await x(e, `
-      SELECT COUNT(*) as count FROM ${C(c)}.${C(l)}
+		let g = (await w(e, `
+      SELECT COUNT(*) as count FROM ${E(c)}.${E(l)}
       WHERE ${d}
     `))[0]?.count || 0;
 		return {
@@ -536,7 +537,7 @@ function E(e) {
 }
 //#endregion
 //#region src/r2-sql-logs/stats.ts
-function se() {
+function le() {
 	return {
 		async getDaily() {
 			throw Error("Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.");
@@ -548,20 +549,20 @@ function se() {
 }
 //#endregion
 //#region src/r2-sql-logs/index.ts
-function D(e) {
+function k(e) {
 	let t = !!e.pipelineEndpoint, n = !!e.pipelineBinding;
 	if (!t && !n) throw Error("R2 SQL logs adapter requires one of: \"pipelineEndpoint\" or \"pipelineBinding\"");
 	if (!e.authToken) throw Error("R2 SQL logs adapter requires \"authToken\" configuration");
 	if (!e.warehouseName) throw Error("R2 SQL logs adapter requires \"warehouseName\" configuration");
 	return {
-		create: re(e),
-		list: E(e),
-		get: ae(e)
+		create: ie(e),
+		list: ce(e),
+		get: oe(e)
 	};
 }
 //#endregion
 //#region src/analytics-engine-logs/query.ts
-async function O(e, t) {
+async function A(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`, i = await fetch(n, {
@@ -584,15 +585,15 @@ async function O(e, t) {
 		clearTimeout(i);
 	}
 }
-function k(e) {
+function j(e) {
 	return `'${e.replace(/'/g, "''").replace(/\\/g, "\\\\")}'`;
 }
-function A(e) {
+function M(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/analytics-engine-logs/logs.ts
-function j(e) {
+function N(e) {
 	let t = (e) => {
 		if (e) try {
 			return JSON.parse(e);
@@ -624,16 +625,16 @@ function j(e) {
 		isMobile: e.double1 === 1
 	};
 }
-function ce(e) {
+function ue(e) {
 	return async (t, n) => {
-		let r = n.log_id || b(), i = {
+		let r = n.log_id || C(), i = {
 			...n,
 			log_id: r
 		};
-		return le(e, t, i), i;
+		return de(e, t, i), i;
 	};
 }
-function le(e, t, n) {
+function de(e, t, n) {
 	if (!e.analyticsEngineBinding) {
 		console.error("Analytics Engine binding not configured");
 		return;
@@ -670,24 +671,24 @@ function le(e, t, n) {
 		console.error("Failed to write log to Analytics Engine:", e);
 	}
 }
-function ue(e) {
+function fe(e) {
 	return async (t, n) => {
-		let r = await O(e, `
+		let r = await A(e, `
       SELECT *
-      FROM ${A(e.dataset || "authhero_logs")}
-      WHERE index1 = ${k(t)}
-        AND blob1 = ${k(n)}
+      FROM ${M(e.dataset || "authhero_logs")}
+      WHERE index1 = ${j(t)}
+        AND blob1 = ${j(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : j(r[0]);
+		return r.length === 0 || !r[0] ? null : N(r[0]);
 	};
 }
 //#endregion
 //#region src/analytics-engine-logs/list.ts
-function de(e) {
+function pe(e) {
 	return e.replace(/\\([\\"+\-!(){}[\]^~*?:/&|])/g, "$1");
 }
-function fe(e) {
+function me(e) {
 	let t = [], n = "", r = !1;
 	for (let i = 0; i < e.length; i++) {
 		let a = e[i];
@@ -695,20 +696,20 @@ function fe(e) {
 	}
 	return n.trim() && t.push(n.trim()), t;
 }
-function M(e) {
+function P(e) {
 	let t = e;
-	return t.startsWith("\"") && t.endsWith("\"") && t.length > 1 && (t = t.slice(1, -1)), de(t);
+	return t.startsWith("\"") && t.endsWith("\"") && t.length > 1 && (t = t.slice(1, -1)), pe(t);
 }
-function pe(e) {
+function F(e) {
 	let t = {}, n = [];
-	for (let r of fe(e)) {
+	for (let r of me(e)) {
 		if (r === "OR" || r === "AND") continue;
 		let e = r.match(/^(\w+):([\s\S]*)$/);
 		if (e) {
-			let n = e[1], r = M(e[2]);
+			let n = e[1], r = P(e[2]);
 			t[n] || (t[n] = []), t[n].push(r);
 		} else {
-			let e = M(r);
+			let e = P(r);
 			e && n.push(e);
 		}
 	}
@@ -717,7 +718,7 @@ function pe(e) {
 		terms: n
 	};
 }
-function N(e) {
+function I(e) {
 	return {
 		log_id: "blob1",
 		tenant_id: "blob2",
@@ -738,7 +739,7 @@ function N(e) {
 		hostname: "blob17"
 	}[e] || null;
 }
-function me(e) {
+function L(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = r.filter((e) => e !== "");
@@ -749,41 +750,41 @@ function me(e) {
 			n.length > 0 && t.push(`(${n.join(" OR ")})`);
 			continue;
 		}
-		let i = N(n);
-		if (i) if (e.length === 1) t.push(`${i} = ${k(e[0])}`);
+		let i = I(n);
+		if (i) if (e.length === 1) t.push(`${i} = ${j(e[0])}`);
 		else {
-			let n = e.map((e) => k(e)).join(", ");
+			let n = e.map((e) => j(e)).join(", ");
 			t.push(`${i} IN (${n})`);
 		}
 	}
 	return t;
 }
-function he(e) {
+function R(e) {
 	return e.filter((e) => e !== "").map((e) => {
-		let t = k(e), n = k(`%${e}%`);
+		let t = j(e), n = j(`%${e}%`);
 		return `(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`;
 	});
 }
-function ge(e) {
-	return e === "date" ? "double2" : N(e) || "timestamp";
+function z(e) {
+	return e === "date" ? "double2" : I(e) || "timestamp";
 }
-function P(e) {
+function he(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s, from_date: c, to_date: l } = n, u = e.dataset || "authhero_logs", d = [`index1 = ${k(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s, from_date: c, to_date: l } = n, u = e.dataset || "authhero_logs", d = [`index1 = ${j(t)}`];
 		if (s) {
-			let { fields: e, terms: t } = pe(s);
-			d.push(...me(e)), d.push(...he(t));
+			let { fields: e, terms: t } = F(s);
+			d.push(...L(e)), d.push(...R(t));
 		}
 		typeof c == "number" && Number.isFinite(c) && d.push(`double2 >= ${Math.floor(c) * 1e3}`), typeof l == "number" && Number.isFinite(l) && d.push(`double2 <= ${Math.floor(l) * 1e3}`);
 		let f = d.join(" AND "), p = "ORDER BY timestamp DESC";
-		o && o.sort_by && (p = `ORDER BY ${ge(o.sort_by)} ${o.sort_order === "asc" ? "ASC" : "DESC"}`);
-		let m = r * i, h = `LIMIT ${i} OFFSET ${m}`, g = (await O(e, `
+		o && o.sort_by && (p = `ORDER BY ${z(o.sort_by)} ${o.sort_order === "asc" ? "ASC" : "DESC"}`);
+		let m = r * i, h = `LIMIT ${i} OFFSET ${m}`, g = (await A(e, `
       SELECT *
-      FROM ${A(u)}
+      FROM ${M(u)}
       WHERE ${f}
       ${p}
       ${h}
-    `)).map(j);
+    `)).map(N);
 		if (!a) return {
 			logs: g,
 			start: 0,
@@ -792,11 +793,11 @@ function P(e) {
 		};
 		let _ = `
       SELECT count() as count
-      FROM ${A(u)}
+      FROM ${M(u)}
       WHERE ${f}
     `;
 		try {
-			let t = (await O(e, _))[0]?.count || 0;
+			let t = (await A(e, _))[0]?.count || 0;
 			return {
 				logs: g,
 				start: m,
@@ -815,11 +816,11 @@ function P(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/stats.ts
-var F = ["s"], I = ["pwd_leak"];
-function L(e) {
+var B = ["s"], ge = ["pwd_leak"];
+function V(e) {
 	return `${e.slice(0, 4)}-${e.slice(4, 6)}-${e.slice(6, 8)}`;
 }
-function R(e) {
+function H(e) {
 	return e.toISOString().split("T")[0];
 }
 function _e(e) {
@@ -828,17 +829,17 @@ function _e(e) {
 		async getDaily(n, r = {}) {
 			let { from: i, to: a } = r, o = /* @__PURE__ */ new Date(), s = new Date(o);
 			s.setDate(s.getDate() - 30);
-			let c = i ? L(i) : R(s), l = a ? L(a) : R(o), u = (/* @__PURE__ */ new Date(`${c}T00:00:00Z`)).getTime(), d = (/* @__PURE__ */ new Date(`${l}T23:59:59.999Z`)).getTime();
-			return (await O(e, `
+			let c = i ? V(i) : H(s), l = a ? V(a) : H(o), u = (/* @__PURE__ */ new Date(`${c}T00:00:00Z`)).getTime(), d = (/* @__PURE__ */ new Date(`${l}T23:59:59.999Z`)).getTime();
+			return (await A(e, `
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
-          SUM(CASE WHEN blob3 IN (${F.map((e) => k(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
+          SUM(CASE WHEN blob3 IN (${B.map((e) => j(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${I.map((e) => k(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${ge.map((e) => j(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
-        WHERE index1 = ${k(n)}
+        WHERE index1 = ${j(n)}
           AND double2 >= ${u}
           AND double2 <= ${d}
         GROUP BY date
@@ -855,10 +856,10 @@ function _e(e) {
 		async getActiveUsers(n) {
 			let r = /* @__PURE__ */ new Date();
 			r.setDate(r.getDate() - 30);
-			let i = r.getTime(), a = F.map((e) => k(e)).join(", "), o = (await O(e, `
+			let i = r.getTime(), a = B.map((e) => j(e)).join(", "), o = (await A(e, `
         SELECT COUNT(DISTINCT blob7) AS count
         FROM "${t}"
-        WHERE index1 = ${k(n)}
+        WHERE index1 = ${j(n)}
           AND double2 >= ${i}
           AND blob3 IN (${a})
           AND blob7 IS NOT NULL
@@ -887,6 +888,7 @@ var ve = {
 		"scpr",
 		"fcpr"
 	],
+	"password-migrations": ["spm"],
 	mfa: [
 		"gd_auth_succeed",
 		"gd_auth_failed",
@@ -945,6 +947,11 @@ var ve = {
 		alias: "password_changes",
 		type: "UInt64"
 	},
+	"password-migrations": {
+		expr: "count()",
+		alias: "password_migrations",
+		type: "UInt64"
+	},
 	mfa: {
 		expr: "count()",
 		alias: "mfa",
@@ -962,7 +969,7 @@ var ve = {
 	}
 };
 function Se(e, t) {
-	let n = `toDateTime(intDiv(double2, 1000), ${k(t)})`;
+	let n = `toDateTime(intDiv(double2, 1000), ${j(t)})`;
 	switch (e) {
 		case "hour": return `toStartOfHour(${n})`;
 		case "week": return `toStartOfWeek(${n})`;
@@ -974,8 +981,8 @@ function Ce(e) {
 	return e === "hour" ? "DateTime" : "Date";
 }
 function we(e, t, n) {
-	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => k(e)).join(", "), o = [
-		`index1 = ${k(t)}`,
+	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => j(e)).join(", "), o = [
+		`index1 = ${j(t)}`,
 		`double2 >= ${r}`,
 		`double2 < ${i}`,
 		`blob3 IN (${a})`
@@ -983,7 +990,7 @@ function we(e, t, n) {
 	for (let [t, n] of Object.entries(be)) {
 		let r = e.filters[t];
 		if (r && r.length > 0) {
-			let e = r.map((e) => k(e)).join(", ");
+			let e = r.map((e) => j(e)).join(", ");
 			o.push(`${n} IN (${e})`);
 		}
 	}
@@ -992,23 +999,23 @@ function we(e, t, n) {
 function Te(e, t, n) {
 	if (e.order_by) {
 		let t = e.order_by.startsWith("-");
-		return `${A(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
+		return `${M(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
 	}
-	return t.length > 0 && t[0] === "time" ? `${A("time")} ASC` : `${A(n)} DESC`;
+	return t.length > 0 && t[0] === "time" ? `${M("time")} ASC` : `${M(n)} DESC`;
 }
-function z(e) {
+function U(e) {
 	let t = e.dataset || "authhero_logs";
 	return { async query(n, r, i) {
 		let a = ve[r], o = xe[r], s = [], c = [];
 		for (let e of i.group_by) if (e === "time") {
 			let e = Se(i.interval, i.tz);
-			s.push(`${e} AS ${A("time")}`), c.push({
+			s.push(`${e} AS ${M("time")}`), c.push({
 				name: "time",
 				type: Ce(i.interval)
 			});
 		} else {
 			let t = ye[e];
-			s.push(`${t} AS ${A(e)}`), c.push({
+			s.push(`${t} AS ${M(e)}`), c.push({
 				name: e,
 				type: "String"
 			});
@@ -1017,9 +1024,9 @@ function z(e) {
 			name: o.alias,
 			type: o.type
 		});
-		let l = [...s, `${o.expr} AS ${A(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => A(e === "time" ? "time" : e)).join(", ")}` : "", d = Te(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
+		let l = [...s, `${o.expr} AS ${M(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => M(e === "time" ? "time" : e)).join(", ")}` : "", d = Te(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
         SELECT ${l.join(", ")}
-        FROM ${A(t)}
+        FROM ${M(t)}
         WHERE ${we(i, n, a)}
         ${u}
         ORDER BY ${d}
@@ -1057,47 +1064,47 @@ function z(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/index.ts
-function B(e) {
+function W(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No binding configured. Logs will not be written to Analytics Engine."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required for querying logs via SQL API."), {
-		create: ce(e),
-		list: P(e),
-		get: ue(e)
+		create: ue(e),
+		list: he(e),
+		get: fe(e)
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/actionExecutions.ts
-var Ee = "authhero_action_executions", De = 1024, Oe = "[truncated]";
-function V(e) {
+var Ee = "authhero_action_executions", De = 1024, G = "[truncated]";
+function K(e) {
 	if (!(typeof e != "string" || e.length === 0)) try {
 		return JSON.parse(e);
 	} catch {
 		return;
 	}
 }
-function ke(t) {
-	let n = e.safeParse(t);
-	return n.success ? n.data : "unspecified";
+function Oe(e) {
+	let t = i.safeParse(e);
+	return t.success ? t.data : "unspecified";
 }
-function H(e, t = De) {
-	return e.length <= t ? e : `${e.substring(0, t - 11)}${Oe}`;
+function q(e, t = De) {
+	return e.length <= t ? e : `${e.substring(0, t - 11)}${G}`;
 }
-function U(e) {
+function J(e) {
 	return e == null ? "" : JSON.stringify(e);
 }
-function Ae(e) {
+function ke(e) {
 	let t = typeof e.blob6 == "string" && e.blob6.length > 0 ? e.blob6 : typeof e.double1 == "number" ? new Date(e.double1).toISOString() : "", n = typeof e.blob7 == "string" && e.blob7.length > 0 ? e.blob7 : t;
 	return {
 		id: typeof e.blob1 == "string" ? e.blob1 : "",
 		tenant_id: typeof e.index1 == "string" ? e.index1 : "",
 		trigger_id: typeof e.blob2 == "string" ? e.blob2 : "",
-		status: ke(e.blob3),
-		results: V(e.blob4) ?? [],
-		logs: V(e.blob5),
+		status: Oe(e.blob3),
+		results: K(e.blob4) ?? [],
+		logs: K(e.blob5),
 		created_at: t,
 		updated_at: n
 	};
 }
-function je(e) {
+function Ae(e) {
 	return async (t, n) => {
 		let r = Date.now(), i = new Date(r).toISOString(), a = {
 			id: n.id,
@@ -1109,10 +1116,10 @@ function je(e) {
 			created_at: i,
 			updated_at: i
 		};
-		return Me(e, t, a, r), a;
+		return je(e, t, a, r), a;
 	};
 }
-function Me(e, t, n, r) {
+function je(e, t, n, r) {
 	if (!e.analyticsEngineBinding) {
 		console.error("Analytics Engine action_executions binding not configured; skipping write");
 		return;
@@ -1120,13 +1127,13 @@ function Me(e, t, n, r) {
 	try {
 		e.analyticsEngineBinding.writeDataPoint({
 			blobs: [
-				H(n.id),
-				H(n.trigger_id),
-				H(n.status),
-				H(U(n.results)),
-				H(U(n.logs)),
-				H(n.created_at),
-				H(n.updated_at)
+				q(n.id),
+				q(n.trigger_id),
+				q(n.status),
+				q(J(n.results)),
+				q(J(n.logs)),
+				q(n.created_at),
+				q(n.updated_at)
 			],
 			doubles: [r],
 			indexes: [t.substring(0, 96)]
@@ -1135,29 +1142,29 @@ function Me(e, t, n, r) {
 		console.error("Failed to write action_execution to Analytics Engine:", e);
 	}
 }
-function Ne(e) {
+function Me(e) {
 	return async (t, n) => {
-		let r = await O(e, `
+		let r = await A(e, `
       SELECT *
-      FROM ${A(e.dataset || Ee)}
-      WHERE index1 = ${k(t)}
-        AND blob1 = ${k(n)}
+      FROM ${M(e.dataset || Ee)}
+      WHERE index1 = ${j(t)}
+        AND blob1 = ${j(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : Ae(r[0]);
+		return r.length === 0 || !r[0] ? null : ke(r[0]);
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/index.ts
-function W(e) {
+function Y(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No action_executions binding configured. Executions will not be written."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API."), {
-		create: je(e),
-		get: Ne(e)
+		create: Ae(e),
+		get: Me(e)
 	};
 }
 //#endregion
 //#region src/geo/index.ts
-function Pe() {
+function Ne() {
 	return { async getGeoInfo(e) {
 		try {
 			let t = e["cf-ipcountry"], n = e["cf-ipcity"], r = e["cf-iplatitude"], i = e["cf-iplongitude"], a = e["cf-timezone"], o = e["cf-ipcontinent"];
@@ -1176,7 +1183,7 @@ function Pe() {
 }
 //#endregion
 //#region src/rate-limit/index.ts
-var Fe = class {
+var Pe = class {
 	bindings;
 	constructor(e) {
 		this.bindings = e;
@@ -1192,12 +1199,12 @@ var Fe = class {
 		}
 	}
 };
-function G(e) {
-	if (e && Object.keys(e).some((t) => e[t])) return new Fe(e);
+function X(e) {
+	if (e && Object.keys(e).some((t) => e[t])) return new Pe(e);
 }
 //#endregion
 //#region src/code-executor/worker-template.ts
-function K(e) {
+function Z(e) {
 	return `// Auto-generated AuthHero code hook worker
 
 const fnNames = {
@@ -1305,7 +1312,7 @@ export default {
 }
 //#endregion
 //#region src/code-executor/index.ts
-var q = class {
+var Q = class {
 	config;
 	constructor(e) {
 		this.config = e;
@@ -1366,7 +1373,7 @@ var q = class {
 		}
 	}
 	async deploy(e, t) {
-		let n = `hook-${e}`, r = K(t), i = `https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`, a = JSON.stringify({
+		let n = `hook-${e}`, r = Z(t), i = `https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`, a = JSON.stringify({
 			main_module: "index.js",
 			compatibility_date: this.config.compatibilityDate ?? "2024-11-20"
 		}), o = new FormData();
@@ -1391,12 +1398,12 @@ var q = class {
 			throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`);
 		}
 	}
-}, Ie = q, Le = {
+}, Fe = Q, Ie = {
 	"post-user-login": "onExecutePostLogin",
 	"credentials-exchange": "onExecuteCredentialsExchange",
 	"pre-user-registration": "onExecutePreUserRegistration",
 	"post-user-registration": "onExecutePostUserRegistration"
-}, Re = {
+}, Le = {
 	"post-user-login": {
 		accessToken: ["setCustomClaim"],
 		idToken: ["setCustomClaim"],
@@ -1415,15 +1422,15 @@ var q = class {
 	},
 	"post-user-registration": {}
 };
-async function ze(e) {
+async function Re(e) {
 	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t), r = new Uint8Array(n), i = "";
 	for (let e of r) i += e.toString(16).padStart(2, "0");
 	return i;
 }
-function Be(e) {
+function ze(e) {
 	return `
-const TRIGGER_FN_NAMES = ${JSON.stringify(Le)};
-const API_SHAPES = ${JSON.stringify(Re)};
+const TRIGGER_FN_NAMES = ${JSON.stringify(Ie)};
+const API_SHAPES = ${JSON.stringify(Le)};
 const MAX_LOG_ENTRIES = 50;
 const MAX_LOG_LENGTH = 500;
 
@@ -1523,7 +1530,7 @@ export default {
 };
 `;
 }
-var Ve = class {
+var Be = class {
 	loader;
 	compatibilityDate;
 	constructor(e) {
@@ -1532,11 +1539,11 @@ var Ve = class {
 	async execute(e) {
 		let t = Date.now();
 		try {
-			let t = Be(e.code), n = {
+			let t = ze(e.code), n = {
 				compatibilityDate: this.compatibilityDate,
 				mainModule: "hook.js",
 				modules: { "hook.js": t }
-			}, r = e.hookCodeId ? `${e.hookCodeId}-${await ze(e.code)}` : null;
+			}, r = e.hookCodeId ? `${e.hookCodeId}-${await Re(e.code)}` : null;
 			return await (await (r ? this.loader.get(r, async () => n) : this.loader.load(n)).getEntrypoint().fetch(new Request("https://hook/execute", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
@@ -1554,314 +1561,120 @@ var Ve = class {
 			};
 		}
 	}
-}, J = class extends Error {
-	status;
-	endpoint;
-	errors;
-	body;
-	constructor(e, t, n, r = []) {
-		super(`Cloudflare API ${e} ${t}: ${He(n, 256)}`), this.name = "CloudflareApiError", this.status = e, this.endpoint = t, this.body = n, this.errors = r;
-	}
 };
-function He(e, t) {
-	return e.length <= t ? e : `${e.slice(0, t)}…`;
-}
-var Y = class {
-	accountId;
-	apiToken;
-	fetchImpl;
-	timeoutMs;
-	baseUrl;
-	constructor(e) {
-		this.accountId = e.accountId, this.apiToken = e.apiToken, this.fetchImpl = e.fetch ?? ((...e) => fetch(...e)), this.timeoutMs = e.timeoutMs ?? 3e4, this.baseUrl = (e.baseUrl ?? "https://api.cloudflare.com/client/v4").replace(/\/+$/, "");
-	}
-	async createD1Database(e) {
-		let t = `/accounts/${encodeURIComponent(this.accountId)}/d1/database`;
-		return (await this.request("POST", t, { body: JSON.stringify({ name: e }) })).result;
-	}
-	async listD1Databases(e) {
-		let t = e ? `?name=${encodeURIComponent(e)}` : "", n = `/accounts/${encodeURIComponent(this.accountId)}/d1/database${t}`;
-		return (await this.request("GET", n)).result ?? [];
-	}
-	async deleteD1Database(e) {
-		let t = `/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}`;
-		await this.request("DELETE", t);
-	}
-	async execD1(e, t) {
-		let n = `/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}/query`;
-		return (await this.request("POST", n, { body: JSON.stringify({ sql: t }) })).result ?? [];
-	}
-	async uploadNamespacedScript(e, t, n) {
-		let r = `/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`, i = {
-			main_module: n.mainModule,
-			compatibility_date: n.compatibilityDate,
-			compatibility_flags: n.compatibilityFlags ?? [],
-			bindings: n.bindings ?? [],
-			tags: n.tags
-		}, a = new FormData();
-		a.append("metadata", new Blob([JSON.stringify(i)], { type: "application/json" })), a.append(n.mainModule, new Blob([n.script], { type: "application/javascript+module" }), n.mainModule), await this.request("PUT", r, { body: a });
-	}
-	async deleteNamespacedScript(e, t) {
-		let n = `/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`;
-		await this.request("DELETE", n);
-	}
-	async setNamespacedScriptSecret(e, t, n, r) {
-		let i = `/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}/secrets`;
-		await this.request("PUT", i, { body: JSON.stringify({
-			name: n,
-			text: r,
-			type: "secret_text"
-		}) });
-	}
-	async request(e, t, n) {
-		let r = `${this.baseUrl}${t}`, i = new AbortController(), a = setTimeout(() => i.abort(), this.timeoutMs), o = {
-			Authorization: `Bearer ${this.apiToken}`,
-			...n?.headers ?? {}
-		};
-		n?.body && !(n.body instanceof FormData) && !o["Content-Type"] && (o["Content-Type"] = "application/json");
-		let s;
-		try {
-			s = await this.fetchImpl(r, {
-				method: e,
-				headers: o,
-				body: n?.body,
-				signal: i.signal
-			});
-		} finally {
-			clearTimeout(a);
-		}
-		let c = await s.text();
-		if (!s.ok) {
-			let e = [];
-			try {
-				let t = JSON.parse(c);
-				Array.isArray(t.errors) && (e = t.errors);
-			} catch {}
-			throw new J(s.status, t, c, e);
-		}
-		if (!(c === "" || s.status === 204)) return JSON.parse(c);
-	}
-}, Ue = "{tenant_id}", We = "tenant-{tenant_id}", X = "index.js", Ge = "2026-05-01", Z = 64;
-function Q(e, t) {
-	return e.replace(/\{tenant_id\}/g, t);
-}
-function Ke(e) {
-	if (!(e instanceof J)) return !1;
-	let t = e.body.toLowerCase();
-	return e.status === 409 || t.includes("already exists") || t.includes("name is already taken") || t.includes("already in use");
-}
-function $(e) {
-	return e instanceof J ? e.status === 404 : !1;
-}
-function qe(e) {
-	let t = new Y({
-		accountId: e.accountId,
-		apiToken: e.apiToken,
-		fetch: e.fetch,
-		timeoutMs: e.timeoutMs
-	}), n = e.scriptNameTemplate ?? Ue, r = e.d1NameTemplate ?? We, i = e.scriptMetadata?.main_module ?? X, a = e.scriptMetadata?.compatibility_date ?? Ge, o = e.scriptMetadata?.compatibility_flags ?? ["nodejs_compat"], s = e.dispatchNamespace, c = e.logger;
-	async function l(e) {
-		let n = (await t.listD1Databases(e)).find((t) => t.name === e);
-		if (n) return {
-			id: n.uuid,
-			created: !1
-		};
-		try {
-			return {
-				id: (await t.createD1Database(e)).uuid,
-				created: !0
-			};
-		} catch (n) {
-			if (!Ke(n)) throw n;
-			let r = (await t.listD1Databases(e)).find((t) => t.name === e);
-			if (r) return {
-				id: r.uuid,
-				created: !1
-			};
-			throw n;
-		}
-	}
-	let u = "_authhero_provisioner_migrations";
-	function d(e, t) {
-		let n = [];
-		for (let r of e) for (let e of r.results ?? []) if (e && typeof e == "object" && t in e) {
-			let r = e[t];
-			typeof r == "string" && n.push(r);
-		}
-		return n;
-	}
-	async function f(e) {
-		return d(await t.execD1(e, `SELECT name FROM sqlite_master WHERE type='table' AND name='${u}';`), "name").length > 0;
-	}
-	async function p(e) {
-		await t.execD1(e, `CREATE TABLE IF NOT EXISTS ${u} (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);`);
-	}
-	async function m(e) {
-		let n = await t.execD1(e, `SELECT name FROM ${u};`);
-		return new Set(d(n, "name"));
-	}
-	function h(e) {
-		return e.replace(/'/g, "''");
-	}
-	async function g(e, n) {
-		let r = (/* @__PURE__ */ new Date()).toISOString();
-		await t.execD1(e, `INSERT OR IGNORE INTO ${u} (name, applied_at) VALUES ('${h(n)}', '${h(r)}');`);
-	}
-	async function _(n) {
-		let r = await m(n);
-		for (let i of e.migrations) if (!r.has(i.name)) {
-			try {
-				await t.execD1(n, i.sql);
-			} catch (e) {
-				throw e instanceof Error ? Error(`Failed to apply migration "${i.name}" to D1 ${n}: ${e.message}`, { cause: e }) : e;
-			}
-			await g(n, i.name);
-		}
-	}
-	async function v(n, r) {
-		let c = [
-			{
-				type: "d1",
-				name: "AUTH_DB",
-				id: r
-			},
-			{
-				type: "plain_text",
-				name: "CONTROL_PLANE_BASE_URL",
-				text: e.controlPlaneBaseUrl
-			},
-			...e.extraBindings ?? []
-		];
-		await t.uploadNamespacedScript(s, n, {
-			script: e.tenantWorkerScript,
-			mainModule: i,
-			compatibilityDate: a,
-			compatibilityFlags: o,
-			bindings: c,
-			tags: ["authhero-tenant", `tenant:${n}`]
-		});
-	}
-	async function y(n, r) {
-		let i = await e.secrets(r);
-		for (let [e, r] of Object.entries(i)) await t.setNamespacedScriptSecret(s, n, e, r);
-	}
+//#endregion
+//#region src/wfp-provisioner/provisioner.ts
+function Ve(e) {
+	let t = n(e);
 	return {
-		async onProvision(t) {
-			let i = Q(n, t), a = Q(r, t), o = e.migrations[e.migrations.length - 1]?.name;
-			if (o !== void 0 && o.length > Z) throw Error(`Migration name "${o}" exceeds the ${Z}-character database_version limit.`);
-			let { id: s, created: u } = await l(a), d = u ? !1 : await f(s);
-			if (u || d) await p(s), await _(s);
-			else {
-				c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`), await p(s);
-				for (let t of e.migrations) await g(s, t.name);
-			}
-			return await v(i, s), await y(i, t), {
+		async onProvision(e) {
+			let { scriptName: n, databaseName: r } = t.names(e), { databaseVersion: i, bundleConfiguration: a, workerVersion: o } = t.validate(), { id: s, created: c } = await t.findOrCreateDatabase(r);
+			return await t.applyMigrations(s, c), await t.uploadScript(n, s), await t.uploadSecrets(n, e), {
 				d1DatabaseId: s,
-				scriptName: i,
-				d1Name: a,
-				bundleConfiguration: e.bundleConfiguration,
-				workerVersion: e.workerVersion,
-				databaseVersion: o
+				scriptName: n,
+				d1Name: r,
+				bundleConfiguration: a,
+				workerVersion: o,
+				databaseVersion: i
 			};
 		},
 		async onDeprovision(e) {
-			let i = Q(n, e), a = Q(r, e), o = [];
-			try {
-				await t.deleteNamespacedScript(s, i);
-			} catch (e) {
-				$(e) || o.push(e);
-			}
-			try {
-				let e = (await t.listD1Databases(a)).find((e) => e.name === a);
-				if (e) try {
-					await t.deleteD1Database(e.uuid);
-				} catch (e) {
-					$(e) || o.push(e);
-				}
-			} catch (e) {
-				o.push(e);
-			}
-			if (o.length > 0) {
-				let t = o.map((e) => e instanceof Error ? e.message : String(e)).join("; ");
-				throw Error(`Deprovision of tenant "${e}" had ${o.length} failure(s): ${t}`, { cause: o[0] });
-			}
+			await t.deprovision(e);
 		}
 	};
 }
 //#endregion
 //#region src/wfp-provisioner/tenant-hook.ts
-function Je(e) {
+function He(e) {
 	return e.deployment_type === "wfp";
 }
-function Ye(e) {
-	if (typeof e != "object" || !e) return [];
-	let t = [];
-	for (let n of Object.values(e)) if (typeof n == "object" && n && "errors" in n && Array.isArray(n.errors)) for (let e of n.errors) typeof e == "string" && t.push(e);
-	return t;
+var Ue = 2048;
+function $(e) {
+	let t;
+	if (e instanceof Error) t = e.message;
+	else try {
+		t = String(e);
+	} catch {
+		t = Object.prototype.toString.call(e);
+	}
+	return t.slice(0, Ue);
 }
-function Xe(e) {
-	let { provisioner: t, tenants: n, syncDefaults: r } = e, i = e.shouldProvision ?? Je, a = e.logger;
-	async function o(e, t) {
-		let r = t instanceof Error ? t.message : String(t);
+function We(e) {
+	let { provisioner: t, tenants: n, syncDefaults: i } = e, a = e.shouldProvision ?? He, o = e.logger;
+	async function s(e, t) {
 		try {
 			await n.update(e, {
 				provisioning_state: "failed",
-				provisioning_error: r.slice(0, 2048),
+				provisioning_error: $(t),
 				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		} catch (t) {
-			a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
+			o?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
 		}
 	}
-	async function s(e) {
-		let i;
+	async function c(e, a) {
+		let c = async (t, n, r) => {
+			if (a) try {
+				await a(t, n, r);
+			} catch (n) {
+				o?.warn(`Failed to report provisioning step "${t}" for tenant ${e}:`, n);
+			}
+		};
+		await c("provision-resources", "started");
+		let l;
 		try {
-			i = await t.onProvision(e);
+			l = await t.onProvision(e);
 		} catch (t) {
-			throw await o(e, t), t;
+			throw await c("provision-resources", "failed", { message: $(t) }), await s(e, t), t;
 		}
-		let s = {
-			d1_database_id: i.d1DatabaseId,
-			worker_script_name: i.scriptName,
-			bundle_configuration: i.bundleConfiguration,
-			worker_version: i.workerVersion,
-			database_version: i.databaseVersion
+		let u = {
+			d1_database_id: l.d1DatabaseId,
+			worker_script_name: l.scriptName,
+			bundle_configuration: l.bundleConfiguration,
+			worker_version: l.workerVersion,
+			database_version: l.databaseVersion
 		};
+		await c("provision-resources", "succeeded", { ...u });
 		try {
-			if (r) {
-				let t = Ye(await r(e));
-				if (t.length > 0) throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join("; ")}`);
+			if (i) {
+				await c("seed-defaults", "started");
+				try {
+					let t = r(await i(e));
+					if (t.length > 0) throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join("; ")}`);
+					await c("seed-defaults", "succeeded");
+				} catch (e) {
+					throw await c("seed-defaults", "failed", { message: $(e) }), e;
+				}
 			}
 			await n.update(e, {
-				...s,
+				...u,
 				provisioning_state: "ready",
 				provisioning_error: void 0,
 				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		} catch (t) {
-			let r = t instanceof Error ? t.message : String(t);
 			try {
 				await n.update(e, {
-					...s,
+					...u,
 					provisioning_state: "failed",
-					provisioning_error: r.slice(0, 2048),
+					provisioning_error: $(t),
 					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 				});
 			} catch (t) {
-				a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
+				o?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
 			}
 			throw t;
 		}
 	}
 	return {
-		async onProvision(e) {
-			let t = await n.get(e);
-			t && i(t) && await s(e);
+		async onProvision(e, t) {
+			let r = await n.get(e);
+			r && a(r) && await c(e, t);
 		},
-		async onUpgrade(e) {
-			let t = await n.get(e);
-			if (!t) throw Error(`Cannot upgrade tenant "${e}": not found.`);
-			if (!i(t)) throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);
+		async onUpgrade(e, t) {
+			let r = await n.get(e);
+			if (!r) throw Error(`Cannot upgrade tenant "${e}": not found.`);
+			if (!a(r)) throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);
 			try {
 				await n.update(e, {
 					provisioning_state: "pending",
@@ -1869,35 +1682,35 @@ function Xe(e) {
 					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 				});
 			} catch (t) {
-				a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`, t);
+				o?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`, t);
 			}
-			await s(e);
+			await c(e, t);
 		},
 		async onDeprovision(e) {
 			let r = await n.get(e);
-			r && !i(r) || await t.onDeprovision(e);
+			r && !a(r) || await t.onDeprovision(e);
 		}
 	};
 }
 //#endregion
 //#region src/wfp-provisioner/wfp-forward.ts
-var Ze = "DISPATCHER", Qe = "tenant-{tenant_id}-auth";
-function $e(e) {
+var Ge = "DISPATCHER", Ke = "tenant-{tenant_id}-auth";
+function qe(e) {
 	return typeof e == "object" && !!e && "get" in e && typeof Reflect.get(e, "get") == "function";
 }
-function et(e, t) {
+function Je(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function tt(e) {
-	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ze, scriptNameTemplate: i = Qe, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
+function Ye(e) {
+	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ge, scriptNameTemplate: i = Ke, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
 	return async (e, o) => {
 		let s = await a(e);
 		if (!s || s === n) return o();
 		let c = await t.get(s);
 		if (!c || c.deployment_type !== "wfp" || c.provisioning_state && c.provisioning_state !== "ready") return o();
 		let l = Reflect.get(e.env ?? {}, r);
-		if (!$e(l)) return o();
-		let u = et(i, s), d;
+		if (!qe(l)) return o();
+		let u = Je(i, s), d;
 		try {
 			d = await l.get(u).fetch(e.req.raw);
 		} catch (t) {
@@ -1920,19 +1733,19 @@ function tt(e) {
 }
 //#endregion
 //#region src/index.ts
-function nt(e) {
+function Xe(e) {
 	let t = {
-		customDomains: y(e),
-		cache: te({
+		customDomains: ee(e),
+		cache: ne({
 			...e.cacheName && { cacheName: e.cacheName },
 			...e.defaultTtlSeconds !== void 0 && { defaultTtlSeconds: e.defaultTtlSeconds },
 			...e.keyPrefix && { keyPrefix: e.keyPrefix }
 		}),
-		geo: Pe()
+		geo: Ne()
 	};
-	e.r2SqlLogs ? t.logs = D(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = B(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = z(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = W(e.analyticsEngineActionExecutions));
-	let n = G(e.rateLimitBindings);
+	e.r2SqlLogs ? t.logs = k(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = W(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = U(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = Y(e.analyticsEngineActionExecutions));
+	let n = X(e.rateLimitBindings);
 	return n && (t.rateLimit = n), t;
 }
 //#endregion
-export { Y as CloudflareApiClient, J as CloudflareApiError, Ie as CloudflareCodeExecutor, q as DispatchNamespaceCodeExecutor, Ve as WorkerLoaderCodeExecutor, W as createAnalyticsEngineActionExecutionsAdapter, z as createAnalyticsEngineAnalyticsAdapter, B as createAnalyticsEngineLogsAdapter, _e as createAnalyticsEngineStatsAdapter, G as createCloudflareRateLimitAdapter, qe as createCloudflareWfpD1Provisioner, D as createR2SQLLogsAdapter, se as createR2SQLStatsAdapter, tt as createWfpForwardMiddleware, Xe as createWfpTenantProvisioningHook, nt as default, K as generateWorkerScript };
+export { t as CloudflareApiClient, e as CloudflareApiError, Fe as CloudflareCodeExecutor, Q as DispatchNamespaceCodeExecutor, Be as WorkerLoaderCodeExecutor, Y as createAnalyticsEngineActionExecutionsAdapter, U as createAnalyticsEngineAnalyticsAdapter, W as createAnalyticsEngineLogsAdapter, _e as createAnalyticsEngineStatsAdapter, X as createCloudflareRateLimitAdapter, Ve as createCloudflareWfpD1Provisioner, k as createR2SQLLogsAdapter, le as createR2SQLStatsAdapter, Ye as createWfpForwardMiddleware, n as createWfpProvisionerSteps, We as createWfpTenantProvisioningHook, Xe as default, Z as generateWorkerScript };