@authhero/cloudflare-adapter 3.3.0 → 4.0.0

package/dist/cloudflare-adapter.cjs

@@ -245,4 +245,4 @@ export default {
     }
   },
 };
-`}var $e=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Qe(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Ze(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},X=new TextEncoder;function Z(e,t){if(X.encode(e).length<=t)return e;let n=0,r=``;for(let i of e){let e=X.encode(i).length;if(n+e>t)break;n+=e,r+=i}return r}var Q=(e,t=1024)=>Z(e,t);function et(e){let t=e.analyticsEngineBinding;return e=>{if(t)try{t.writeDataPoint({blobs:[Q(e.name),Q(e.tenantId),Q(e.eventType),Q(e.source),Q(e.destination??``),Q(e.error??``)],doubles:[e.value,e.retryCount??0,Date.now()],indexes:[Z(e.tenantId,96)]})}catch(e){console.error(`Failed to write outbox metric to Analytics Engine:`,e)}}}function tt(e){let t=c.n(e);return{async onProvision(e){let{scriptName:n,databaseName:r}=t.names(e),{databaseVersion:i,bundleConfiguration:a,workerVersion:o}=t.validate(),{id:s,created:c}=await t.findOrCreateDatabase(r);return await t.applyMigrations(s,c),await t.uploadScript(n,s),await t.uploadSecrets(n,e),{d1DatabaseId:s,scriptName:n,d1Name:r,bundleConfiguration:a,workerVersion:o,databaseVersion:i}},async onDeprovision(e){await t.deprovision(e)}}}function nt(e){return e.deployment_type===`wfp`}var rt=2048;function $(e){let t;if(e instanceof Error)t=e.message;else try{t=String(e)}catch{t=Object.prototype.toString.call(e)}return t.slice(0,rt)}function it(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??nt,a=e.logger;async function o(e,t){try{await n.update(e,{provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e,i){let s=async(t,n,r)=>{if(i)try{await i(t,n,r)}catch(n){a?.warn(`Failed to report provisioning step "${t}" for tenant ${e}:`,n)}};await s(`provision-resources`,`started`);let l;try{l=await t.onProvision(e)}catch(t){throw await s(`provision-resources`,`failed`,{message:$(t)}),await o(e,t),t}let u={d1_database_id:l.d1DatabaseId,worker_script_name:l.scriptName,bundle_configuration:l.bundleConfiguration,worker_version:l.workerVersion,database_version:l.databaseVersion};await s(`provision-resources`,`succeeded`,{...u});try{if(r){await s(`seed-defaults`,`started`);try{let t=c.t(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`);await s(`seed-defaults`,`succeeded`)}catch(e){throw await s(`seed-defaults`,`failed`,{message:$(e)}),e}}await n.update(e,{...u,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){try{await n.update(e,{...u,provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e,t){let r=await n.get(e);r&&i(r)&&await s(e,t)},async onUpgrade(e,t){let r=await n.get(e);if(!r)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(r))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e,t)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var at=`DISPATCHER`,ot=`tenant-{tenant_id}-auth`,st=[`/u/widget/`];function ct(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function lt(e,t){return e.replace(/\{tenant_id\}/g,t)}function ut(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=at,scriptNameTemplate:i=ot,resolveTenantId:a=e=>e.req.header(`tenant-id`),localPaths:o=st}=e;return async(e,s)=>{if(o.length>0){let t=e.req.path;if(o.some(e=>t.startsWith(e)))return s()}let c=await a(e);if(!c||c===n)return s();let l=await t.get(c);if(!l||l.deployment_type!==`wfp`||l.provisioning_state&&l.provisioning_state!==`ready`)return s();let u=Reflect.get(e.env??{},r);if(!ct(u))return s();let d=lt(i,c),f;try{f=await u.get(d).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${c} script=${d}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,c),e.json({error:i,detail:r?`Tenant '${c}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.`:`The worker for tenant '${c}' could not be reached.`,tenant_id:c},r?503:502)}if(f.status>=500){let e=f.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${f.status}${e?` (${e})`:``} tenant=${c} script=${d}`)}let p=Reflect.get(f,`webSocket`);if(f.status===101||p!=null)return f;let m=new Response(f.body,f);return m.headers.set(`X-Wfp-Tenant`,c),m}}function dt(e){let t={customDomains:oe(e),cache:ce({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Ue()};e.r2SqlLogs?t.logs=_e(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs),t.stats=z(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=c.i,exports.CloudflareApiError=c.a,exports.CloudflareCodeExecutor=Je,exports.DispatchNamespaceCodeExecutor=Y,exports.WorkerLoaderCodeExecutor=$e,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineOutboxMetricsSink=et,exports.createAnalyticsEngineStatsAdapter=z,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=tt,exports.createR2SQLLogsAdapter=_e,exports.createR2SQLStatsAdapter=ge,exports.createWfpForwardMiddleware=ut,exports.createWfpProvisionerSteps=c.n,exports.createWfpTenantProvisioningHook=it,exports.default=dt,exports.generateWorkerScript=J,exports.syncCustomDomains=qe;
+`}var $e=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Qe(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Ze(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},X=new TextEncoder;function Z(e,t){if(X.encode(e).length<=t)return e;let n=0,r=``;for(let i of e){let e=X.encode(i).length;if(n+e>t)break;n+=e,r+=i}return r}var Q=(e,t=1024)=>Z(e,t);function et(e){let t=e.analyticsEngineBinding;return e=>{if(t)try{t.writeDataPoint({blobs:[Q(e.name),Q(e.tenantId),Q(e.eventType),Q(e.source),Q(e.destination??``),Q(e.error??``)],doubles:[e.value,e.retryCount??0,Date.now()],indexes:[Z(e.tenantId,96)]})}catch(e){console.error(`Failed to write outbox metric to Analytics Engine:`,e)}}}function tt(e){let t=c.n(e);return{async onProvision(e){let{scriptName:n,databaseName:r}=t.names(e),{databaseVersion:i,bundleConfiguration:a,workerVersion:o}=t.validate(),{id:s,created:c}=await t.findOrCreateDatabase(r);return await t.applyMigrations(s,c),await t.uploadScript(n,s),await t.uploadSecrets(n,e),{d1DatabaseId:s,scriptName:n,d1Name:r,bundleConfiguration:a,workerVersion:o,databaseVersion:i}},async onDeprovision(e){await t.deprovision(e)}}}function nt(e){return e.deployment_type===`wfp`}var rt=2048;function $(e){let t;if(e instanceof Error)t=e.message;else try{t=String(e)}catch{t=Object.prototype.toString.call(e)}return t.slice(0,rt)}function it(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??nt,a=e.logger;async function o(e,t){try{await n.update(e,{provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e,i){let s=async(t,n,r)=>{if(i)try{await i(t,n,r)}catch(n){a?.warn(`Failed to report provisioning step "${t}" for tenant ${e}:`,n)}};await s(`provision-resources`,`started`);let l;try{l=await t.onProvision(e)}catch(t){throw await s(`provision-resources`,`failed`,{message:$(t)}),await o(e,t),t}let u={d1_database_id:l.d1DatabaseId,worker_script_name:l.scriptName,bundle_configuration:l.bundleConfiguration,worker_version:l.workerVersion,database_version:l.databaseVersion};await s(`provision-resources`,`succeeded`,{...u});try{if(r){await s(`seed-defaults`,`started`);try{let t=c.t(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`);await s(`seed-defaults`,`succeeded`)}catch(e){throw await s(`seed-defaults`,`failed`,{message:$(e)}),e}}await n.update(e,{...u,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){try{await n.update(e,{...u,provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e,t){let r=await n.get(e);r&&i(r)&&await s(e,t)},async onUpgrade(e,t){let r=await n.get(e);if(!r)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(r))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e,t)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var at=`DISPATCHER`,ot=`tenant-{tenant_id}-auth`,st=[`/u/widget/`];function ct(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function lt(e,t){return e.replace(/\{tenant_id\}/g,t)}function ut(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=at,scriptNameTemplate:i=ot,resolveTenantId:a=e=>e.req.header(`tenant-id`),localPaths:o=[],includeDefaultLocalPaths:s=!0}=e,c=[...s?st:[],...o];return async(e,o)=>{if(c.length>0){let t=e.req.path;if(c.some(e=>t.startsWith(e)))return o()}let s=await a(e);if(!s||s===n)return o();let l=await t.get(s);if(!l||l.deployment_type!==`wfp`||l.provisioning_state&&l.provisioning_state!==`ready`)return o();let u=Reflect.get(e.env??{},r);if(!ct(u))return o();let d=lt(i,s),f;try{f=await u.get(d).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${s} script=${d}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,s),e.json({error:i,detail:r?`Tenant '${s}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.`:`The worker for tenant '${s}' could not be reached.`,tenant_id:s},r?503:502)}if(f.status>=500){let e=f.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${f.status}${e?` (${e})`:``} tenant=${s} script=${d}`)}let p=Reflect.get(f,`webSocket`);if(f.status===101||p!=null)return f;let m=new Response(f.body,f);return m.headers.set(`X-Wfp-Tenant`,s),m}}function dt(e){let t={customDomains:oe(e),cache:ce({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Ue()};e.r2SqlLogs?t.logs=_e(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs),t.stats=z(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=c.i,exports.CloudflareApiError=c.a,exports.CloudflareCodeExecutor=Je,exports.DEFAULT_LOCAL_PATHS=st,exports.DispatchNamespaceCodeExecutor=Y,exports.WorkerLoaderCodeExecutor=$e,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineOutboxMetricsSink=et,exports.createAnalyticsEngineStatsAdapter=z,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=tt,exports.createR2SQLLogsAdapter=_e,exports.createR2SQLStatsAdapter=ge,exports.createWfpForwardMiddleware=ut,exports.createWfpProvisionerSteps=c.n,exports.createWfpTenantProvisioningHook=it,exports.default=dt,exports.generateWorkerScript=J,exports.syncCustomDomains=qe;

package/dist/cloudflare-adapter.d.ts

@@ -1146,6 +1146,19 @@ interface WfpTenantProvisioningHook {
 }
 declare function createWfpTenantProvisioningHook(options: WfpTenantProvisioningHookOptions): WfpTenantProvisioningHook;
 
+/**
+ * Path prefixes served from the control plane rather than dispatched to a
+ * tenant worker. These are shared static assets that are byte-identical across
+ * tenants and only exist on the control plane's deployment.
+ *
+ * `/u/widget/` is the universal-login (u2) widget bundle. It's a multi-file
+ * Stencil bundle the SSR'd pages load as an ES module to hydrate the form. A
+ * per-tenant dispatch worker has no static-assets binding and no configured
+ * `widgetHandler`, so forwarding these requests 404s and the u2 buttons render
+ * inert. Serving them from the control plane — where the assets live — keeps
+ * zero per-tenant weight.
+ */
+declare const DEFAULT_LOCAL_PATHS: readonly string[];
 interface WfpForwardOptions {
     /** Tenants adapter, used to look up the resolved tenant's `deployment_type`. */
     tenants: TenantsDataAdapter;
@@ -1175,11 +1188,16 @@ interface WfpForwardOptions {
      * handlers.
      *
      * Use this for shared static assets that only the control plane can serve —
-     * a per-tenant dispatch worker has no static-assets binding. Defaults to
-     * `["/u/widget/"]` (the universal-login widget bundle); pass `[]` to disable
-     * the carve-out entirely, or extend the list for other shared assets.
+     * a per-tenant dispatch worker has no static-assets binding. These are added
+     * to `DEFAULT_LOCAL_PATHS` (the universal-login widget bundle), so a default
+     * added later is not lost by anyone who passes their own list.
      */
     localPaths?: string[];
+    /**
+     * Whether `DEFAULT_LOCAL_PATHS` apply. Defaults to `true`; pass `false` to
+     * dispatch even the default paths and carve out only `localPaths`.
+     */
+    includeDefaultLocalPaths?: boolean;
 }
 /**
  * Hono middleware that forwards a request to its tenant's WFP worker over a
@@ -1195,9 +1213,9 @@ interface WfpForwardOptions {
  * The tenant worker receives the original request verbatim and owns the full
  * response.
  *
- * Requests whose path matches `localPaths` (default `["/u/widget/"]`) are also
- * never dispatched — they are shared static assets that only the control plane
- * can serve, so a per-tenant worker would 404 them. See `DEFAULT_LOCAL_PATHS`.
+ * Requests whose path matches `DEFAULT_LOCAL_PATHS` (`["/u/widget/"]`) or the
+ * extra `localPaths` are also never dispatched — they are shared static assets
+ * that only the control plane can serve, so a per-tenant worker would 404 them.
  */
 declare function createWfpForwardMiddleware(options: WfpForwardOptions): MiddlewareHandler;
 
@@ -1213,5 +1231,5 @@ interface CloudflareAdapters {
 }
 declare function createAdapters(config: CloudflareConfig): CloudflareAdapters;
 
-export { CloudflareApiClient, CloudflareApiError, CloudflareCodeExecutor, DispatchNamespaceCodeExecutor, WorkerLoaderCodeExecutor, createAnalyticsEngineActionExecutionsAdapter, createAnalyticsEngineAnalyticsAdapter, createAnalyticsEngineLogsAdapter, createAnalyticsEngineOutboxMetricsSink, createAnalyticsEngineStatsAdapter, createCloudflareRateLimitAdapter, createCloudflareWfpD1Provisioner, createR2SQLLogsAdapter, createR2SQLStatsAdapter, createWfpForwardMiddleware, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createAdapters as default, generateWorkerScript, syncCustomDomains };
+export { CloudflareApiClient, CloudflareApiError, CloudflareCodeExecutor, DEFAULT_LOCAL_PATHS, DispatchNamespaceCodeExecutor, WorkerLoaderCodeExecutor, createAnalyticsEngineActionExecutionsAdapter, createAnalyticsEngineAnalyticsAdapter, createAnalyticsEngineLogsAdapter, createAnalyticsEngineOutboxMetricsSink, createAnalyticsEngineStatsAdapter, createCloudflareRateLimitAdapter, createCloudflareWfpD1Provisioner, createR2SQLLogsAdapter, createR2SQLStatsAdapter, createWfpForwardMiddleware, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createAdapters as default, generateWorkerScript, syncCustomDomains };
 export type { AnalyticsEngineActionExecutionsAdapterConfig, AnalyticsEngineDataset, AnalyticsEngineLogsAdapterConfig, AnalyticsEngineOutboxMetricsConfig, CfApiClientOptions, CloudflareAdapters, CloudflareCodeExecutorConfig, CloudflareConfig, CloudflareRateLimitBinding, CloudflareRateLimitBindings, CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, D1Database, D1QueryResult, DispatchNamespace, DispatchNamespaceCodeExecutorConfig, OutboxMetricRecord, ProvisionResult, ProvisionerMigration, R2SQLLogsAdapterConfig, ScriptBinding, ScriptUploadOptions, SyncCustomDomainsOptions, SyncCustomDomainsResult, TenantProvisionNames, TenantProvisionerSteps, TenantSecretsResolver, WfpForwardOptions, WfpProvisionerSteps, WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, WorkerCode, WorkerLoader, WorkerLoaderCodeExecutorOptions, WorkerStub };