@authhero/cloudflare-adapter 2.38.14 → 3.0.0

package/dist/cloudflare-adapter.mjs

@@ -1,83 +1,83 @@
-import { a as e, i as t, n, t as r } from "./sync-defaults-errors-3BT2TYx9.mjs";
-import { actionExecutionStatusSchema as i, verificationMethodsSchema as a } from "@authhero/adapter-interfaces";
-import { z as o } from "@hono/zod-openapi";
-import { HTTPException as s } from "hono/http-exception";
-import c from "wretch";
-import { dedupe as l, retry as u } from "wretch/middlewares";
+import { a as e, i as t, n, t as r } from "./sync-defaults-errors-BlLZh6Gt.mjs";
+import { TRIGGER_API_SHAPES as i, actionExecutionStatusSchema as a, verificationMethodsSchema as o } from "@authhero/adapter-interfaces";
+import { z as s } from "@hono/zod-openapi";
+import { HTTPException as c } from "hono/http-exception";
+import l from "wretch";
+import { dedupe as u, retry as d } from "wretch/middlewares";
 //#region src/types/CustomDomain.ts
-var d = o.object({
-	code: o.number(),
-	message: o.string()
-}), f = o.object({ message: o.string() }), p = o.object({
-	emails: o.array(o.string()).optional(),
-	http_body: o.string().optional(),
-	http_url: o.string().optional(),
-	txt_name: o.string().optional(),
-	txt_value: o.string().optional()
-}), m = o.object({
-	ciphers: o.array(o.string()).optional(),
-	early_hints: o.string().optional(),
-	http2: o.string().optional(),
-	min_tls_version: o.string().optional(),
-	tls_1_3: o.string().optional()
-}), h = o.object({
-	id: o.string(),
-	bundle_method: o.string().optional(),
-	certificate_authority: o.string(),
-	custom_certificate: o.string().optional(),
-	custom_csr_id: o.string().optional(),
-	custom_key: o.string().optional(),
-	expires_on: o.string().optional(),
-	hosts: o.array(o.string()).optional(),
-	issuer: o.string().optional(),
-	method: o.string(),
-	serial_number: o.string().optional(),
-	settings: m.optional(),
-	signature: o.string().optional(),
-	type: o.string(),
-	uploaded_on: o.string().optional(),
-	validation_errors: o.array(f).optional(),
-	validation_records: o.array(p).optional(),
-	wildcard: o.boolean()
-}), g = o.object({
-	name: o.string(),
-	type: o.string(),
-	value: o.string()
-}), _ = o.object({
-	http_body: o.string().optional(),
-	http_url: o.string().optional()
-}), v = o.object({
-	id: o.string(),
-	ssl: h,
-	hostname: o.string(),
-	custom_metadata: o.record(o.string(), o.string()).optional(),
-	custom_origin_server: o.string().optional(),
-	custom_origin_sni: o.string().optional(),
-	ownership_verification: g.optional(),
-	ownership_verification_http: _.optional(),
-	status: o.string(),
-	verification_errors: o.array(o.string()).optional(),
-	created_at: o.string()
-}), y = o.object({
-	errors: o.array(d),
-	messages: o.array(d),
-	success: o.boolean(),
+var f = s.object({
+	code: s.number(),
+	message: s.string()
+}), p = s.object({ message: s.string() }), m = s.object({
+	emails: s.array(s.string()).optional(),
+	http_body: s.string().optional(),
+	http_url: s.string().optional(),
+	txt_name: s.string().optional(),
+	txt_value: s.string().optional()
+}), h = s.object({
+	ciphers: s.array(s.string()).optional(),
+	early_hints: s.string().optional(),
+	http2: s.string().optional(),
+	min_tls_version: s.string().optional(),
+	tls_1_3: s.string().optional()
+}), g = s.object({
+	id: s.string(),
+	bundle_method: s.string().optional(),
+	certificate_authority: s.string(),
+	custom_certificate: s.string().optional(),
+	custom_csr_id: s.string().optional(),
+	custom_key: s.string().optional(),
+	expires_on: s.string().optional(),
+	hosts: s.array(s.string()).optional(),
+	issuer: s.string().optional(),
+	method: s.string(),
+	serial_number: s.string().optional(),
+	settings: h.optional(),
+	signature: s.string().optional(),
+	type: s.string(),
+	uploaded_on: s.string().optional(),
+	validation_errors: s.array(p).optional(),
+	validation_records: s.array(m).optional(),
+	wildcard: s.boolean()
+}), _ = s.object({
+	name: s.string(),
+	type: s.string(),
+	value: s.string()
+}), ee = s.object({
+	http_body: s.string().optional(),
+	http_url: s.string().optional()
+}), v = s.object({
+	id: s.string(),
+	ssl: g,
+	hostname: s.string(),
+	custom_metadata: s.record(s.string(), s.string()).optional(),
+	custom_origin_server: s.string().optional(),
+	custom_origin_sni: s.string().optional(),
+	ownership_verification: _.optional(),
+	ownership_verification_http: ee.optional(),
+	status: s.string(),
+	verification_errors: s.array(s.string()).optional(),
+	created_at: s.string()
+}), y = s.object({
+	errors: s.array(f),
+	messages: s.array(f),
+	success: s.boolean(),
 	result: v
 });
-o.object({
-	errors: o.array(d),
-	messages: o.array(d),
-	success: o.boolean(),
-	result: o.array(v)
+s.object({
+	errors: s.array(f),
+	messages: s.array(f),
+	success: s.boolean(),
+	result: s.array(v)
 });
 //#endregion
 //#region src/customDomains/index.ts
 function b(e) {
-	return c(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({
+	return l(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({
 		"X-Auth-Email": e.authEmail,
 		"X-Auth-Key": e.authKey,
 		"Content-Type": "application/json"
-	}).middlewares([u(), l()]);
+	}).middlewares([d(), u()]);
 }
 function x(e) {
 	let t = {}, n = {};
@@ -123,11 +123,11 @@ function S(e) {
 		primary: e.primary,
 		status: e.status === "active" ? "ready" : "pending",
 		type: e.type ?? "auth0_managed_certs",
-		verification: { methods: o.array(a).parse(t) },
+		verification: { methods: s.array(o).parse(t) },
 		domain_metadata: n
 	};
 }
-function ee(e) {
+function te(e) {
 	return {
 		create: async (t, n) => {
 			let { sslOverrides: r, rest: i } = x(n.domain_metadata), { result: a, errors: o, success: s } = y.parse(await b(e).post({
@@ -159,7 +159,7 @@ function ee(e) {
 		},
 		get: async (t, n) => {
 			let r = await e.customDomainAdapter.get(t, n);
-			if (!r) throw new s(404);
+			if (!r) throw new c(404);
 			let i;
 			try {
 				i = await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json();
@@ -172,32 +172,32 @@ function ee(e) {
 				body: i
 			}), r;
 			let { result: o } = a.data;
-			if (e.enterprise && o.custom_metadata?.tenant_id !== t) throw new s(404);
-			let c;
+			if (e.enterprise && o.custom_metadata?.tenant_id !== t) throw new c(404);
+			let s;
 			try {
-				c = S({
+				s = S({
 					...r,
 					...o
 				});
 			} catch (e) {
 				return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`, e instanceof Error ? e.message : e), r;
 			}
-			if (c.status !== r.status || JSON.stringify(c.verification) !== JSON.stringify(r.verification)) try {
+			if (s.status !== r.status || JSON.stringify(s.verification) !== JSON.stringify(r.verification)) try {
 				await e.customDomainAdapter.update(t, n, {
-					status: c.status,
-					verification: c.verification
+					status: s.status,
+					verification: s.verification
 				});
 			} catch (e) {
 				console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`, e instanceof Error ? e.message : e);
 			}
-			return c;
+			return s;
 		},
 		getByDomain: async (t) => e.customDomainAdapter.getByDomain(t),
 		list: async (t) => e.customDomainAdapter.list(t),
 		remove: async (t, n) => {
 			if (e.enterprise) {
 				let { result: r, success: i } = y.parse(await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());
-				if (!i || r.custom_metadata?.tenant_id !== t) throw new s(404);
+				if (!i || r.custom_metadata?.tenant_id !== t) throw new c(404);
 			}
 			let r = await b(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();
 			return r.ok && await e.customDomainAdapter.remove(t, n), r.ok;
@@ -209,10 +209,10 @@ function ee(e) {
 				try {
 					t = await b(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json();
 				} catch (e) {
-					throw new s(503, { message: `Failed to fetch current custom hostname state: ${e instanceof Error ? e.message : String(e)}` });
+					throw new c(503, { message: `Failed to fetch current custom hostname state: ${e instanceof Error ? e.message : String(e)}` });
 				}
 				let r = y.safeParse(t);
-				if (!r.success || !r.data.success) throw new s(503, { message: `Failed to parse current custom hostname state: ${JSON.stringify(r.success ? r.data.errors : r.error.issues)}` });
+				if (!r.success || !r.data.success) throw new c(503, { message: `Failed to parse current custom hostname state: ${JSON.stringify(r.success ? r.data.errors : r.error.issues)}` });
 				a.ssl = {
 					method: r.data.result.ssl.method,
 					type: r.data.result.ssl.type,
@@ -222,20 +222,20 @@ function ee(e) {
 			}
 			if (Object.keys(a).length > 0) {
 				let t = await b(e).patch(a, `/custom_hostnames/${encodeURIComponent(n)}`).res().catch((e) => {
-					throw new s(503, { message: `Failed to update custom hostname: ${e instanceof Error ? e.message : String(e)}` });
+					throw new c(503, { message: `Failed to update custom hostname: ${e instanceof Error ? e.message : String(e)}` });
 				});
-				if (!t.ok) throw new s(503, { message: await t.text() });
+				if (!t.ok) throw new c(503, { message: await t.text() });
 			}
 			return e.customDomainAdapter.update(t, n, r);
 		},
 		uploadCertificate: async (t, n, r) => {
 			let i = await e.customDomainAdapter.get(t, n);
-			if (!i) throw new s(404);
+			if (!i) throw new c(404);
 			let a = await b(e).patch({ ssl: {
 				custom_certificate: r.certificate,
 				custom_key: r.private_key
-			} }, `/custom_hostnames/${encodeURIComponent(n)}`).json(), { result: o, errors: c, success: l } = y.parse(a);
-			if (!l) throw new s(503, { message: JSON.stringify(c) });
+			} }, `/custom_hostnames/${encodeURIComponent(n)}`).json(), { result: o, errors: s, success: l } = y.parse(a);
+			if (!l) throw new c(503, { message: JSON.stringify(s) });
 			let u = S({
 				...i,
 				...o
@@ -249,7 +249,7 @@ function ee(e) {
 }
 //#endregion
 //#region src/cache/index.ts
-var te = class {
+var ne = class {
 	config;
 	cache = null;
 	constructor(e) {
@@ -323,8 +323,8 @@ var te = class {
 		console.warn("CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries");
 	}
 };
-function ne(e = {}) {
-	return new te({
+function re(e = {}) {
+	return new ne({
 		defaultTtlSeconds: 300,
 		keyPrefix: "authhero",
 		getTimeoutMs: 200,
@@ -332,15 +332,15 @@ function ne(e = {}) {
 	});
 }
 //#endregion
-//#region ../../node_modules/.pnpm/nanoid@5.1.16/node_modules/nanoid/url-alphabet/index.js
-var re = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", C = (e = 21) => {
+//#region ../../node_modules/.pnpm/nanoid@5.1.11/node_modules/nanoid/url-alphabet/index.js
+var C = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", w = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += re[n[e] & 63];
+	for (; e--;) t += C[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/r2-sql-logs/query.ts
-async function w(e, t) {
+async function T(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`, i = await fetch(n, {
@@ -360,15 +360,15 @@ async function w(e, t) {
 		clearTimeout(i);
 	}
 }
-function T(e) {
+function E(e) {
 	return `'${e.replace(/'/g, "''")}'`;
 }
-function E(e) {
+function D(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/r2-sql-logs/logs.ts
-function D(e) {
+function O(e) {
 	let t = (e) => {
 		if (!e) return "";
 		try {
@@ -410,7 +410,7 @@ function D(e) {
 }
 function ie(e) {
 	return async (t, n) => {
-		let r = n.log_id || C(), i = {
+		let r = n.log_id || w(), i = {
 			...n,
 			log_id: r
 		};
@@ -468,22 +468,22 @@ async function ae(e, t, n) {
 		throw console.error("Failed to send log to Pipeline:", e), e;
 	}
 }
-function oe(e) {
+function k(e) {
 	return async (t, n) => {
-		let r = e.namespace || "default", i = e.tableName || "logs", a = await w(e, `
-      SELECT * FROM ${E(r)}.${E(i)}
-      WHERE tenant_id = ${T(t)}
-        AND id = ${T(n)}
+		let r = e.namespace || "default", i = e.tableName || "logs", a = await T(e, `
+      SELECT * FROM ${D(r)}.${D(i)}
+      WHERE tenant_id = ${E(t)}
+        AND id = ${E(n)}
       LIMIT 1
     `);
 		if (a.length === 0) return null;
 		let o = a[0];
-		return o ? D(o) : null;
+		return o ? O(o) : null;
 	};
 }
 //#endregion
 //#region src/r2-sql-logs/list.ts
-function O(e) {
+function oe(e) {
 	let t = {}, n = /(\w+):(?:"([^"]*)"|(\S+))/g, r;
 	for (; (r = n.exec(e)) !== null;) {
 		let e = r[1], n = r[2] === void 0 ? r[3] : r[2];
@@ -495,36 +495,36 @@ function se(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = n.replace(/[^a-zA-Z0-9_]/g, "");
-		e && r && t.push(`${E(e)} = ${T(r)}`);
+		e && r && t.push(`${D(e)} = ${E(r)}`);
 	}
 	return t;
 }
 function ce(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${T(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${E(t)}`];
 		if (s) {
-			let e = O(s);
+			let e = oe(s);
 			u.push(...se(e));
 		}
 		let d = u.join(" AND "), f = "ORDER BY date DESC";
 		if (o && o.sort_by) {
 			let e = o.sort_by.replace(/[^a-zA-Z0-9_]/g, ""), t = o.sort_order === "asc" ? "ASC" : "DESC";
-			f = `ORDER BY ${E(e)} ${t}`;
+			f = `ORDER BY ${D(e)} ${t}`;
 		}
-		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await w(e, `
-      SELECT * FROM ${E(c)}.${E(l)}
+		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await T(e, `
+      SELECT * FROM ${D(c)}.${D(l)}
       WHERE ${d}
       ${f}
       ${m}
-    `)).map(D);
+    `)).map(O);
 		if (!a) return {
 			logs: h,
 			start: 0,
 			limit: 0,
 			length: 0
 		};
-		let g = (await w(e, `
-      SELECT COUNT(*) as count FROM ${E(c)}.${E(l)}
+		let g = (await T(e, `
+      SELECT COUNT(*) as count FROM ${D(c)}.${D(l)}
       WHERE ${d}
     `))[0]?.count || 0;
 		return {
@@ -549,7 +549,7 @@ function le() {
 }
 //#endregion
 //#region src/r2-sql-logs/index.ts
-function k(e) {
+function A(e) {
 	let t = !!e.pipelineEndpoint, n = !!e.pipelineBinding;
 	if (!t && !n) throw Error("R2 SQL logs adapter requires one of: \"pipelineEndpoint\" or \"pipelineBinding\"");
 	if (!e.authToken) throw Error("R2 SQL logs adapter requires \"authToken\" configuration");
@@ -557,12 +557,12 @@ function k(e) {
 	return {
 		create: ie(e),
 		list: ce(e),
-		get: oe(e)
+		get: k(e)
 	};
 }
 //#endregion
 //#region src/analytics-engine-logs/query.ts
-async function A(e, t) {
+async function j(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`, i = await fetch(n, {
@@ -585,15 +585,15 @@ async function A(e, t) {
 		clearTimeout(i);
 	}
 }
-function j(e) {
+function M(e) {
 	return `'${e.replace(/'/g, "''").replace(/\\/g, "\\\\")}'`;
 }
-function M(e) {
+function N(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/analytics-engine-logs/logs.ts
-function N(e) {
+function P(e) {
 	let t = (e) => {
 		if (e) try {
 			return JSON.parse(e);
@@ -627,7 +627,7 @@ function N(e) {
 }
 function ue(e) {
 	return async (t, n) => {
-		let r = n.log_id || C(), i = {
+		let r = n.log_id || w(), i = {
 			...n,
 			log_id: r
 		};
@@ -673,14 +673,14 @@ function de(e, t, n) {
 }
 function fe(e) {
 	return async (t, n) => {
-		let r = await A(e, `
+		let r = await j(e, `
       SELECT *
-      FROM ${M(e.dataset || "authhero_logs")}
-      WHERE index1 = ${j(t)}
-        AND blob1 = ${j(n)}
+      FROM ${N(e.dataset || "authhero_logs")}
+      WHERE index1 = ${M(t)}
+        AND blob1 = ${M(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : N(r[0]);
+		return r.length === 0 || !r[0] ? null : P(r[0]);
 	};
 }
 //#endregion
@@ -696,20 +696,20 @@ function me(e) {
 	}
 	return n.trim() && t.push(n.trim()), t;
 }
-function P(e) {
+function F(e) {
 	let t = e;
 	return t.startsWith("\"") && t.endsWith("\"") && t.length > 1 && (t = t.slice(1, -1)), pe(t);
 }
-function F(e) {
+function I(e) {
 	let t = {}, n = [];
 	for (let r of me(e)) {
 		if (r === "OR" || r === "AND") continue;
 		let e = r.match(/^(\w+):([\s\S]*)$/);
 		if (e) {
-			let n = e[1], r = P(e[2]);
+			let n = e[1], r = F(e[2]);
 			t[n] || (t[n] = []), t[n].push(r);
 		} else {
-			let e = P(r);
+			let e = F(r);
 			e && n.push(e);
 		}
 	}
@@ -718,7 +718,7 @@ function F(e) {
 		terms: n
 	};
 }
-function I(e) {
+function L(e) {
 	return {
 		log_id: "blob1",
 		tenant_id: "blob2",
@@ -739,7 +739,7 @@ function I(e) {
 		hostname: "blob17"
 	}[e] || null;
 }
-function L(e) {
+function R(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = r.filter((e) => e !== "");
@@ -750,41 +750,41 @@ function L(e) {
 			n.length > 0 && t.push(`(${n.join(" OR ")})`);
 			continue;
 		}
-		let i = I(n);
-		if (i) if (e.length === 1) t.push(`${i} = ${j(e[0])}`);
+		let i = L(n);
+		if (i) if (e.length === 1) t.push(`${i} = ${M(e[0])}`);
 		else {
-			let n = e.map((e) => j(e)).join(", ");
+			let n = e.map((e) => M(e)).join(", ");
 			t.push(`${i} IN (${n})`);
 		}
 	}
 	return t;
 }
-function R(e) {
+function z(e) {
 	return e.filter((e) => e !== "").map((e) => {
-		let t = j(e), n = j(`%${e}%`);
+		let t = M(e), n = M(`%${e}%`);
 		return `(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`;
 	});
 }
-function z(e) {
-	return e === "date" ? "double2" : I(e) || "timestamp";
-}
 function he(e) {
+	return e === "date" ? "double2" : L(e) || "timestamp";
+}
+function ge(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s, from_date: c, to_date: l } = n, u = e.dataset || "authhero_logs", d = [`index1 = ${j(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s, from_date: c, to_date: l } = n, u = e.dataset || "authhero_logs", d = [`index1 = ${M(t)}`];
 		if (s) {
-			let { fields: e, terms: t } = F(s);
-			d.push(...L(e)), d.push(...R(t));
+			let { fields: e, terms: t } = I(s);
+			d.push(...R(e)), d.push(...z(t));
 		}
 		typeof c == "number" && Number.isFinite(c) && d.push(`double2 >= ${Math.floor(c) * 1e3}`), typeof l == "number" && Number.isFinite(l) && d.push(`double2 <= ${Math.floor(l) * 1e3}`);
 		let f = d.join(" AND "), p = "ORDER BY timestamp DESC";
-		o && o.sort_by && (p = `ORDER BY ${z(o.sort_by)} ${o.sort_order === "asc" ? "ASC" : "DESC"}`);
-		let m = r * i, h = `LIMIT ${i} OFFSET ${m}`, g = (await A(e, `
+		o && o.sort_by && (p = `ORDER BY ${he(o.sort_by)} ${o.sort_order === "asc" ? "ASC" : "DESC"}`);
+		let m = r * i, h = `LIMIT ${i} OFFSET ${m}`, g = (await j(e, `
       SELECT *
-      FROM ${M(u)}
+      FROM ${N(u)}
       WHERE ${f}
       ${p}
       ${h}
-    `)).map(N);
+    `)).map(P);
 		if (!a) return {
 			logs: g,
 			start: 0,
@@ -793,11 +793,11 @@ function he(e) {
 		};
 		let _ = `
       SELECT count() as count
-      FROM ${M(u)}
+      FROM ${N(u)}
       WHERE ${f}
     `;
 		try {
-			let t = (await A(e, _))[0]?.count || 0;
+			let t = (await j(e, _))[0]?.count || 0;
 			return {
 				logs: g,
 				start: m,
@@ -816,30 +816,30 @@ function he(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/stats.ts
-var B = ["s"], ge = ["pwd_leak"];
+var B = ["s"], _e = ["pwd_leak"];
 function V(e) {
 	return `${e.slice(0, 4)}-${e.slice(4, 6)}-${e.slice(6, 8)}`;
 }
 function H(e) {
 	return e.toISOString().split("T")[0];
 }
-function _e(e) {
+function ve(e) {
 	let t = e.dataset || "authhero_logs";
 	return {
 		async getDaily(n, r = {}) {
 			let { from: i, to: a } = r, o = /* @__PURE__ */ new Date(), s = new Date(o);
 			s.setDate(s.getDate() - 30);
 			let c = i ? V(i) : H(s), l = a ? V(a) : H(o), u = (/* @__PURE__ */ new Date(`${c}T00:00:00Z`)).getTime(), d = (/* @__PURE__ */ new Date(`${l}T23:59:59.999Z`)).getTime();
-			return (await A(e, `
+			return (await j(e, `
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
-          SUM(CASE WHEN blob3 IN (${B.map((e) => j(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
+          SUM(CASE WHEN blob3 IN (${B.map((e) => M(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${ge.map((e) => j(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${_e.map((e) => M(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
-        WHERE index1 = ${j(n)}
+        WHERE index1 = ${M(n)}
           AND double2 >= ${u}
           AND double2 <= ${d}
         GROUP BY date
@@ -856,10 +856,10 @@ function _e(e) {
 		async getActiveUsers(n) {
 			let r = /* @__PURE__ */ new Date();
 			r.setDate(r.getDate() - 30);
-			let i = r.getTime(), a = B.map((e) => j(e)).join(", "), o = (await A(e, `
+			let i = r.getTime(), a = B.map((e) => M(e)).join(", "), o = (await j(e, `
         SELECT COUNT(DISTINCT blob7) AS count
         FROM "${t}"
-        WHERE index1 = ${j(n)}
+        WHERE index1 = ${M(n)}
           AND double2 >= ${i}
           AND blob3 IN (${a})
           AND blob7 IS NOT NULL
@@ -871,7 +871,7 @@ function _e(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/analytics.ts
-var ve = {
+var ye = {
 	"active-users": ["s", "seacft"],
 	logins: [
 		"s",
@@ -901,17 +901,17 @@ var ve = {
 		"fvr"
 	],
 	"codes-sent": ["cls", "cs"]
-}, ye = {
+}, be = {
 	connection: "blob9",
 	client_id: "blob11",
 	user_type: "blob16",
 	event: "blob3"
-}, be = {
+}, xe = {
 	connection: "blob9",
 	client_id: "blob11",
 	user_type: "blob16",
 	user_id: "blob7"
-}, xe = {
+}, Se = {
 	"active-users": {
 		expr: "count(DISTINCT blob7)",
 		alias: "active_users",
@@ -968,8 +968,8 @@ var ve = {
 		type: "UInt64"
 	}
 };
-function Se(e, t) {
-	let n = `toDateTime(intDiv(double2, 1000), ${j(t)})`;
+function Ce(e, t) {
+	let n = `toDateTime(intDiv(double2, 1000), ${M(t)})`;
 	switch (e) {
 		case "hour": return `toStartOfHour(${n})`;
 		case "week": return `toStartOfWeek(${n})`;
@@ -977,45 +977,45 @@ function Se(e, t) {
 		default: return `toStartOfDay(${n})`;
 	}
 }
-function Ce(e) {
+function we(e) {
 	return e === "hour" ? "DateTime" : "Date";
 }
-function we(e, t, n) {
-	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => j(e)).join(", "), o = [
-		`index1 = ${j(t)}`,
+function Te(e, t, n) {
+	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => M(e)).join(", "), o = [
+		`index1 = ${M(t)}`,
 		`double2 >= ${r}`,
 		`double2 < ${i}`,
 		`blob3 IN (${a})`
 	];
-	for (let [t, n] of Object.entries(be)) {
+	for (let [t, n] of Object.entries(xe)) {
 		let r = e.filters[t];
 		if (r && r.length > 0) {
-			let e = r.map((e) => j(e)).join(", ");
+			let e = r.map((e) => M(e)).join(", ");
 			o.push(`${n} IN (${e})`);
 		}
 	}
 	return o.join(" AND ");
 }
-function Te(e, t, n) {
+function Ee(e, t, n) {
 	if (e.order_by) {
 		let t = e.order_by.startsWith("-");
-		return `${M(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
+		return `${N(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
 	}
-	return t.length > 0 && t[0] === "time" ? `${M("time")} ASC` : `${M(n)} DESC`;
+	return t.length > 0 && t[0] === "time" ? `${N("time")} ASC` : `${N(n)} DESC`;
 }
 function U(e) {
 	let t = e.dataset || "authhero_logs";
 	return { async query(n, r, i) {
-		let a = ve[r], o = xe[r], s = [], c = [];
+		let a = ye[r], o = Se[r], s = [], c = [];
 		for (let e of i.group_by) if (e === "time") {
-			let e = Se(i.interval, i.tz);
-			s.push(`${e} AS ${M("time")}`), c.push({
+			let e = Ce(i.interval, i.tz);
+			s.push(`${e} AS ${N("time")}`), c.push({
 				name: "time",
-				type: Ce(i.interval)
+				type: we(i.interval)
 			});
 		} else {
-			let t = ye[e];
-			s.push(`${t} AS ${M(e)}`), c.push({
+			let t = be[e];
+			s.push(`${t} AS ${N(e)}`), c.push({
 				name: e,
 				type: "String"
 			});
@@ -1024,10 +1024,10 @@ function U(e) {
 			name: o.alias,
 			type: o.type
 		});
-		let l = [...s, `${o.expr} AS ${M(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => M(e === "time" ? "time" : e)).join(", ")}` : "", d = Te(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
+		let l = [...s, `${o.expr} AS ${N(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => N(e === "time" ? "time" : e)).join(", ")}` : "", d = Ee(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
         SELECT ${l.join(", ")}
-        FROM ${M(t)}
-        WHERE ${we(i, n, a)}
+        FROM ${N(t)}
+        WHERE ${Te(i, n, a)}
         ${u}
         ORDER BY ${d}
         LIMIT ${Math.max(0, i.limit)} OFFSET ${Math.max(0, i.offset)}
@@ -1067,13 +1067,13 @@ function U(e) {
 function W(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No binding configured. Logs will not be written to Analytics Engine."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required for querying logs via SQL API."), {
 		create: ue(e),
-		list: he(e),
+		list: ge(e),
 		get: fe(e)
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/actionExecutions.ts
-var Ee = "authhero_action_executions", De = 1024, G = "[truncated]";
+var De = "authhero_action_executions", G = 1024, Oe = "[truncated]";
 function K(e) {
 	if (!(typeof e != "string" || e.length === 0)) try {
 		return JSON.parse(e);
@@ -1081,30 +1081,30 @@ function K(e) {
 		return;
 	}
 }
-function Oe(e) {
-	let t = i.safeParse(e);
+function ke(e) {
+	let t = a.safeParse(e);
 	return t.success ? t.data : "unspecified";
 }
-function q(e, t = De) {
-	return e.length <= t ? e : `${e.substring(0, t - 11)}${G}`;
+function q(e, t = G) {
+	return e.length <= t ? e : `${e.substring(0, t - 11)}${Oe}`;
 }
 function J(e) {
 	return e == null ? "" : JSON.stringify(e);
 }
-function ke(e) {
+function Ae(e) {
 	let t = typeof e.blob6 == "string" && e.blob6.length > 0 ? e.blob6 : typeof e.double1 == "number" ? new Date(e.double1).toISOString() : "", n = typeof e.blob7 == "string" && e.blob7.length > 0 ? e.blob7 : t;
 	return {
 		id: typeof e.blob1 == "string" ? e.blob1 : "",
 		tenant_id: typeof e.index1 == "string" ? e.index1 : "",
 		trigger_id: typeof e.blob2 == "string" ? e.blob2 : "",
-		status: Oe(e.blob3),
+		status: ke(e.blob3),
 		results: K(e.blob4) ?? [],
 		logs: K(e.blob5),
 		created_at: t,
 		updated_at: n
 	};
 }
-function Ae(e) {
+function je(e) {
 	return async (t, n) => {
 		let r = Date.now(), i = new Date(r).toISOString(), a = {
 			id: n.id,
@@ -1116,10 +1116,10 @@ function Ae(e) {
 			created_at: i,
 			updated_at: i
 		};
-		return je(e, t, a, r), a;
+		return Me(e, t, a, r), a;
 	};
 }
-function je(e, t, n, r) {
+function Me(e, t, n, r) {
 	if (!e.analyticsEngineBinding) {
 		console.error("Analytics Engine action_executions binding not configured; skipping write");
 		return;
@@ -1142,29 +1142,29 @@ function je(e, t, n, r) {
 		console.error("Failed to write action_execution to Analytics Engine:", e);
 	}
 }
-function Me(e) {
+function Ne(e) {
 	return async (t, n) => {
-		let r = await A(e, `
+		let r = await j(e, `
       SELECT *
-      FROM ${M(e.dataset || Ee)}
-      WHERE index1 = ${j(t)}
-        AND blob1 = ${j(n)}
+      FROM ${N(e.dataset || De)}
+      WHERE index1 = ${M(t)}
+        AND blob1 = ${M(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : ke(r[0]);
+		return r.length === 0 || !r[0] ? null : Ae(r[0]);
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/index.ts
 function Y(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No action_executions binding configured. Executions will not be written."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API."), {
-		create: Ae(e),
-		get: Me(e)
+		create: je(e),
+		get: Ne(e)
 	};
 }
 //#endregion
 //#region src/geo/index.ts
-function Ne() {
+function Pe() {
 	return { async getGeoInfo(e) {
 		try {
 			let t = e["cf-ipcountry"], n = e["cf-ipcity"], r = e["cf-iplatitude"], i = e["cf-iplongitude"], a = e["cf-timezone"], o = e["cf-ipcontinent"];
@@ -1183,7 +1183,7 @@ function Ne() {
 }
 //#endregion
 //#region src/rate-limit/index.ts
-var Pe = class {
+var Fe = class {
 	bindings;
 	constructor(e) {
 		this.bindings = e;
@@ -1200,7 +1200,7 @@ var Pe = class {
 	}
 };
 function X(e) {
-	if (e && Object.keys(e).some((t) => e[t])) return new Pe(e);
+	if (e && Object.keys(e).some((t) => e[t])) return new Fe(e);
 }
 //#endregion
 //#region src/code-executor/worker-template.ts
@@ -1214,25 +1214,9 @@ const fnNames = {
   "post-user-registration": "onExecutePostUserRegistration",
 };
 
-const apiShapes = {
-  "post-user-login": {
-    accessToken: ["setCustomClaim"],
-    idToken: ["setCustomClaim"],
-    access: ["deny"],
-    prompt: ["render"],
-    redirect: ["sendUserTo"],
-  },
-  "credentials-exchange": {
-    accessToken: ["setCustomClaim"],
-    idToken: ["setCustomClaim"],
-    access: ["deny"],
-  },
-  "pre-user-registration": {
-    user: ["setUserMetadata", "setLinkedTo"],
-    access: ["deny"],
-  },
-  "post-user-registration": {},
-};
+// Shared source of truth for the per-trigger API allowlist — see
+// TRIGGER_API_SHAPES in @authhero/adapter-interfaces.
+const apiShapes = ${JSON.stringify(i)};
 
 function createRecordingApiProxy(triggerId) {
   const calls = [];
@@ -1398,39 +1382,21 @@ var Q = class {
 			throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`);
 		}
 	}
-}, Fe = Q, Ie = {
+}, Ie = Q, Le = {
 	"post-user-login": "onExecutePostLogin",
 	"credentials-exchange": "onExecuteCredentialsExchange",
 	"pre-user-registration": "onExecutePreUserRegistration",
 	"post-user-registration": "onExecutePostUserRegistration"
-}, Le = {
-	"post-user-login": {
-		accessToken: ["setCustomClaim"],
-		idToken: ["setCustomClaim"],
-		access: ["deny"],
-		prompt: ["render"],
-		redirect: ["sendUserTo"]
-	},
-	"credentials-exchange": {
-		accessToken: ["setCustomClaim"],
-		idToken: ["setCustomClaim"],
-		access: ["deny"]
-	},
-	"pre-user-registration": {
-		user: ["setUserMetadata", "setLinkedTo"],
-		access: ["deny"]
-	},
-	"post-user-registration": {}
-};
-async function Re(e) {
+}, Re = i;
+async function ze(e) {
 	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t), r = new Uint8Array(n), i = "";
 	for (let e of r) i += e.toString(16).padStart(2, "0");
 	return i;
 }
-function ze(e) {
+function Be(e) {
 	return `
-const TRIGGER_FN_NAMES = ${JSON.stringify(Ie)};
-const API_SHAPES = ${JSON.stringify(Le)};
+const TRIGGER_FN_NAMES = ${JSON.stringify(Le)};
+const API_SHAPES = ${JSON.stringify(Re)};
 const MAX_LOG_ENTRIES = 50;
 const MAX_LOG_LENGTH = 500;
 
@@ -1530,7 +1496,7 @@ export default {
 };
 `;
 }
-var Be = class {
+var Ve = class {
 	loader;
 	compatibilityDate;
 	constructor(e) {
@@ -1539,11 +1505,11 @@ var Be = class {
 	async execute(e) {
 		let t = Date.now();
 		try {
-			let t = ze(e.code), n = {
+			let t = Be(e.code), n = {
 				compatibilityDate: this.compatibilityDate,
 				mainModule: "hook.js",
 				modules: { "hook.js": t }
-			}, r = e.hookCodeId ? `${e.hookCodeId}-${await Re(e.code)}` : null;
+			}, r = e.hookCodeId ? `${e.hookCodeId}-${await ze(e.code)}` : null;
 			return await (await (r ? this.loader.get(r, async () => n) : this.loader.load(n)).getEntrypoint().fetch(new Request("https://hook/execute", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
@@ -1564,7 +1530,7 @@ var Be = class {
 };
 //#endregion
 //#region src/wfp-provisioner/provisioner.ts
-function Ve(e) {
+function He(e) {
 	let t = n(e);
 	return {
 		async onProvision(e) {
@@ -1585,10 +1551,10 @@ function Ve(e) {
 }
 //#endregion
 //#region src/wfp-provisioner/tenant-hook.ts
-function He(e) {
+function Ue(e) {
 	return e.deployment_type === "wfp";
 }
-var Ue = 2048;
+var We = 2048;
 function $(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
@@ -1597,10 +1563,10 @@ function $(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, Ue);
+	return t.slice(0, We);
 }
-function We(e) {
-	let { provisioner: t, tenants: n, syncDefaults: i } = e, a = e.shouldProvision ?? He, o = e.logger;
+function Ge(e) {
+	let { provisioner: t, tenants: n, syncDefaults: i } = e, a = e.shouldProvision ?? Ue, o = e.logger;
 	async function s(e, t) {
 		try {
 			await n.update(e, {
@@ -1694,58 +1660,62 @@ function We(e) {
 }
 //#endregion
 //#region src/wfp-provisioner/wfp-forward.ts
-var Ge = "DISPATCHER", Ke = "tenant-{tenant_id}-auth";
-function qe(e) {
+var Ke = "DISPATCHER", qe = "tenant-{tenant_id}-auth", Je = ["/u/widget/"];
+function Ye(e) {
 	return typeof e == "object" && !!e && "get" in e && typeof Reflect.get(e, "get") == "function";
 }
-function Je(e, t) {
+function Xe(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function Ye(e) {
-	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ge, scriptNameTemplate: i = Ke, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
-	return async (e, o) => {
-		let s = await a(e);
-		if (!s || s === n) return o();
-		let c = await t.get(s);
-		if (!c || c.deployment_type !== "wfp" || c.provisioning_state && c.provisioning_state !== "ready") return o();
-		let l = Reflect.get(e.env ?? {}, r);
-		if (!qe(l)) return o();
-		let u = Je(i, s), d;
+function Ze(e) {
+	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ke, scriptNameTemplate: i = qe, resolveTenantId: a = (e) => e.req.header("tenant-id"), localPaths: o = Je } = e;
+	return async (e, s) => {
+		if (o.length > 0) {
+			let t = e.req.path;
+			if (o.some((e) => t.startsWith(e))) return s();
+		}
+		let c = await a(e);
+		if (!c || c === n) return s();
+		let l = await t.get(c);
+		if (!l || l.deployment_type !== "wfp" || l.provisioning_state && l.provisioning_state !== "ready") return s();
+		let u = Reflect.get(e.env ?? {}, r);
+		if (!Ye(u)) return s();
+		let d = Xe(i, c), f;
 		try {
-			d = await l.get(u).fetch(e.req.raw);
+			f = await u.get(d).fetch(e.req.raw);
 		} catch (t) {
 			let n = t instanceof Error ? t.message : String(t), r = /not\s*found|no\s*such|does not exist/i.test(n), i = r ? "wfp_worker_not_found" : "wfp_dispatch_failed";
-			return console.error(`[wfp-forward] ${i} tenant=${s} script=${u}: ${n}`), e.header("X-Authhero-Error", i), e.header("X-Wfp-Tenant", s), e.json({
+			return console.error(`[wfp-forward] ${i} tenant=${c} script=${d}: ${n}`), e.header("X-Authhero-Error", i), e.header("X-Wfp-Tenant", c), e.json({
 				error: i,
-				detail: r ? `Tenant '${s}' is marked ready but its worker '${u}' is not deployed in the dispatch namespace.` : `The worker for tenant '${s}' could not be reached.`,
-				tenant_id: s
+				detail: r ? `Tenant '${c}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.` : `The worker for tenant '${c}' could not be reached.`,
+				tenant_id: c
 			}, r ? 503 : 502);
 		}
-		if (d.status >= 500) {
-			let e = d.headers.get("X-Authhero-Error");
-			console.error(`[wfp-forward] tenant worker ${d.status}${e ? ` (${e})` : ""} tenant=${s} script=${u}`);
+		if (f.status >= 500) {
+			let e = f.headers.get("X-Authhero-Error");
+			console.error(`[wfp-forward] tenant worker ${f.status}${e ? ` (${e})` : ""} tenant=${c} script=${d}`);
 		}
-		let f = Reflect.get(d, "webSocket");
-		if (d.status === 101 || f != null) return d;
-		let p = new Response(d.body, d);
-		return p.headers.set("X-Wfp-Tenant", s), p;
+		let p = Reflect.get(f, "webSocket");
+		if (f.status === 101 || p != null) return f;
+		let m = new Response(f.body, f);
+		return m.headers.set("X-Wfp-Tenant", c), m;
 	};
 }
 //#endregion
 //#region src/index.ts
-function Xe(e) {
+function Qe(e) {
 	let t = {
-		customDomains: ee(e),
-		cache: ne({
+		customDomains: te(e),
+		cache: re({
 			...e.cacheName && { cacheName: e.cacheName },
 			...e.defaultTtlSeconds !== void 0 && { defaultTtlSeconds: e.defaultTtlSeconds },
 			...e.keyPrefix && { keyPrefix: e.keyPrefix }
 		}),
-		geo: Ne()
+		geo: Pe()
 	};
-	e.r2SqlLogs ? t.logs = k(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = W(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = U(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = Y(e.analyticsEngineActionExecutions));
+	e.r2SqlLogs ? t.logs = A(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = W(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = U(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = Y(e.analyticsEngineActionExecutions));
 	let n = X(e.rateLimitBindings);
 	return n && (t.rateLimit = n), t;
 }
 //#endregion
-export { t as CloudflareApiClient, e as CloudflareApiError, Fe as CloudflareCodeExecutor, Q as DispatchNamespaceCodeExecutor, Be as WorkerLoaderCodeExecutor, Y as createAnalyticsEngineActionExecutionsAdapter, U as createAnalyticsEngineAnalyticsAdapter, W as createAnalyticsEngineLogsAdapter, _e as createAnalyticsEngineStatsAdapter, X as createCloudflareRateLimitAdapter, Ve as createCloudflareWfpD1Provisioner, k as createR2SQLLogsAdapter, le as createR2SQLStatsAdapter, Ye as createWfpForwardMiddleware, n as createWfpProvisionerSteps, We as createWfpTenantProvisioningHook, Xe as default, Z as generateWorkerScript };
+export { t as CloudflareApiClient, e as CloudflareApiError, Ie as CloudflareCodeExecutor, Q as DispatchNamespaceCodeExecutor, Ve as WorkerLoaderCodeExecutor, Y as createAnalyticsEngineActionExecutionsAdapter, U as createAnalyticsEngineAnalyticsAdapter, W as createAnalyticsEngineLogsAdapter, ve as createAnalyticsEngineStatsAdapter, X as createCloudflareRateLimitAdapter, He as createCloudflareWfpD1Provisioner, A as createR2SQLLogsAdapter, le as createR2SQLStatsAdapter, Ze as createWfpForwardMiddleware, n as createWfpProvisionerSteps, Ge as createWfpTenantProvisioningHook, Qe as default, Z as generateWorkerScript };