@authhero/cloudflare-adapter 3.4.0 → 4.1.0

package/dist/cloudflare-adapter.cjs

@@ -11,59 +11,60 @@ Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{val
     `)).map(O);if(!a)return{logs:h,start:0,limit:0,length:0};let g=(await T(e,`
       SELECT COUNT(*) as count FROM ${D(c)}.${D(l)}
       WHERE ${d}
-    `))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function ge(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function _e(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:ue(e),list:he(e),get:fe(e)}}async function k(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function A(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function j(e){return`"${e.replace(/"/g,`""`)}"`}function M(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function ve(e){return async(t,n)=>{let r=n.log_id||w(),i={...n,log_id:r};return ye(e,t,i),i}}function ye(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function be(e){return async(t,n)=>{let r=await k(e,`
+    `))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function ge(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function k(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:ue(e),list:he(e),get:fe(e)}}async function A(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function j(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function M(e){return`"${e.replace(/"/g,`""`)}"`}function N(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function _e(e){return async(t,n)=>{let r=n.log_id||w(),i={...n,log_id:r};return ve(e,t,i),i}}function ve(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function ye(e){return async(t,n)=>{let r=await A(e,`
       SELECT *
-      FROM ${j(e.dataset||`authhero_logs`)}
-      WHERE index1 = ${A(t)}
-        AND blob1 = ${A(n)}
+      FROM ${M(e.dataset||`authhero_logs`)}
+      WHERE index1 = ${j(t)}
+        AND blob1 = ${j(n)}
       LIMIT 1
-    `);return r.length===0||!r[0]?null:M(r[0])}}function N(e){let t=e;return t.startsWith(`"`)&&t.endsWith(`"`)&&t.length>1&&(t=t.slice(1,-1)),(0,l.unescapeLuceneValue)(t)}function xe(e){let t={},n=[];for(let r of(0,l.tokenizeLuceneQuery)(e)){if(r===`OR`||r===`AND`)continue;let e=r.match(/^(\w+):([\s\S]*)$/);if(e){let n=e[1],r=N(e[2]);t[n]||(t[n]=[]),t[n].push(r)}else{let e=N(r);e&&n.push(e)}}return{fields:t,terms:n}}function P(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function Se(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=P(n);if(i)if(e.length===1)t.push(`${i} = ${A(e[0])}`);else{let n=e.map(e=>A(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function Ce(e){return e.filter(e=>e!==``).map(e=>{let t=A(e),n=A(`%${e}%`);return`(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`})}function we(e){return e===`date`?`double2`:P(e)||`timestamp`}function Te(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${A(t)}`];if(s){let{fields:e,terms:t}=xe(s);d.push(...Se(e)),d.push(...Ce(t))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${we(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await k(e,`
+    `);return r.length===0||!r[0]?null:N(r[0])}}function P(e){let t=e;return t.startsWith(`"`)&&t.endsWith(`"`)&&t.length>1&&(t=t.slice(1,-1)),(0,l.unescapeLuceneValue)(t)}function be(e){let t={},n=[];for(let r of(0,l.tokenizeLuceneQuery)(e)){if(r===`OR`||r===`AND`)continue;let e=r.match(/^(\w+):([\s\S]*)$/);if(e){let n=e[1],r=P(e[2]);t[n]||(t[n]=[]),t[n].push(r)}else{let e=P(r);e&&n.push(e)}}return{fields:t,terms:n}}function F(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function xe(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=F(n);if(i)if(e.length===1)t.push(`${i} = ${j(e[0])}`);else{let n=e.map(e=>j(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function Se(e){return e.filter(e=>e!==``).map(e=>{let t=j(e),n=j(`%${e}%`);return`(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`})}function Ce(e){return e===`date`?`double2`:F(e)||`timestamp`}function we(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${j(t)}`];if(s){let{fields:e,terms:t}=be(s);d.push(...xe(e)),d.push(...Se(t))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${Ce(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await A(e,`
       SELECT *
-      FROM ${j(u)}
+      FROM ${M(u)}
       WHERE ${f}
       ${p}
       ${h}
-    `)).map(M);if(!a)return{logs:g,start:0,limit:0,length:0};let _=`
+    `)).map(N);if(!a)return{logs:g,start:0,limit:0,length:0};let _=`
       SELECT count() as count
-      FROM ${j(u)}
+      FROM ${M(u)}
       WHERE ${f}
-    `;try{let t=(await k(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var F=[`s`],Ee=[`pwd_leak`];function I(e){return/^\d{8}$/.test(e)?`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`:e}function L(e){return e.toISOString().split(`T`)[0]}function R(e,t){let n=new Date(`${e}T${t===`end`?`23:59:59.999`:`00:00:00.000`}Z`).getTime();if(Number.isNaN(n))return NaN;let r=/^(\d{4})-(\d{2})-(\d{2})$/.exec(e);if(!r)return n;let i=new Date(n);return i.getUTCFullYear()!==Number(r[1])||i.getUTCMonth()+1!==Number(r[2])||i.getUTCDate()!==Number(r[3])?NaN:n}function z(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?I(i):L(s),l=a?I(a):L(o),u=R(c,`start`),d=R(l,`end`);if(Number.isNaN(u)||Number.isNaN(d))throw Error(`Invalid stats date range: from='${c}' to='${l}'`);return(await k(e,`
+    `;try{let t=(await A(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var I=[`s`],Te=[`pwd_leak`];function L(e){return/^\d{8}$/.test(e)?`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`:e}function R(e){return e.toISOString().split(`T`)[0]}function z(e,t){let n=new Date(`${e}T${t===`end`?`23:59:59.999`:`00:00:00.000`}Z`).getTime();if(Number.isNaN(n))return NaN;let r=/^(\d{4})-(\d{2})-(\d{2})$/.exec(e);if(!r)return n;let i=new Date(n);return i.getUTCFullYear()!==Number(r[1])||i.getUTCMonth()+1!==Number(r[2])||i.getUTCDate()!==Number(r[3])?NaN:n}function B(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?L(i):R(s),l=a?L(a):R(o),u=z(c,`start`),d=z(l,`end`);if(Number.isNaN(u)||Number.isNaN(d))throw Error(`Invalid stats date range: from='${c}' to='${l}'`);return(await A(e,`
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
-          SUM(CASE WHEN blob3 IN (${F.map(e=>A(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
+          SUM(CASE WHEN blob3 IN (${I.map(e=>j(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${Ee.map(e=>A(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${Te.map(e=>j(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
-        WHERE index1 = ${A(n)}
+        WHERE index1 = ${j(n)}
           AND double2 >= ${u}
           AND double2 <= ${d}
         GROUP BY date
         ORDER BY date ASC
-      `)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=F.map(e=>A(e)).join(`, `),o=(await k(e,`
+      `)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=I.map(e=>j(e)).join(`, `),o=(await A(e,`
         SELECT COUNT(DISTINCT blob7) AS count
         FROM "${t}"
-        WHERE index1 = ${A(n)}
+        WHERE index1 = ${j(n)}
           AND double2 >= ${i}
           AND blob3 IN (${a})
           AND blob7 IS NOT NULL
           AND blob7 != ''
-      `))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var De={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`],logouts:[`slo`,`flo`],"password-changes":[`scp`,`fcp`,`scpr`,`fcpr`],"password-migrations":[`spm`],mfa:[`gd_auth_succeed`,`gd_auth_failed`,`gd_auth_rejected`],"email-verifications":[`sv`,`fv`,`svr`,`fvr`],"codes-sent":[`cls`,`cs`]},Oe={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},ke={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},Ae={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`},logouts:{expr:`count()`,alias:`logouts`,type:`UInt64`},"password-changes":{expr:`count()`,alias:`password_changes`,type:`UInt64`},"password-migrations":{expr:`count()`,alias:`password_migrations`,type:`UInt64`},mfa:{expr:`count()`,alias:`mfa`,type:`UInt64`},"email-verifications":{expr:`count()`,alias:`email_verifications`,type:`UInt64`},"codes-sent":{expr:`count()`,alias:`codes_sent`,type:`UInt64`}};function je(e,t){let n=`toDateTime(intDiv(double2, 1000), ${A(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function Me(e){return e===`hour`?`DateTime`:`Date`}function Ne(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>A(e)).join(`, `),o=[`index1 = ${A(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(ke)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>A(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function Pe(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${j(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${j(`time`)} ASC`:`${j(n)} DESC`}function B(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=De[r],o=Ae[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=je(i.interval,i.tz);s.push(`${e} AS ${j(`time`)}`),c.push({name:`time`,type:Me(i.interval)})}else{let t=Oe[e];s.push(`${t} AS ${j(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${j(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>j(e===`time`?`time`:e)).join(`, `)}`:``,d=Pe(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
+      `))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var Ee={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`],logouts:[`slo`,`flo`],"password-changes":[`scp`,`fcp`,`scpr`,`fcpr`],"password-migrations":[`spm`],mfa:[`gd_auth_succeed`,`gd_auth_failed`,`gd_auth_rejected`],"email-verifications":[`sv`,`fv`,`svr`,`fvr`],"codes-sent":[`cls`,`cs`]},De={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},Oe={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},ke={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`},logouts:{expr:`count()`,alias:`logouts`,type:`UInt64`},"password-changes":{expr:`count()`,alias:`password_changes`,type:`UInt64`},"password-migrations":{expr:`count()`,alias:`password_migrations`,type:`UInt64`},mfa:{expr:`count()`,alias:`mfa`,type:`UInt64`},"email-verifications":{expr:`count()`,alias:`email_verifications`,type:`UInt64`},"codes-sent":{expr:`count()`,alias:`codes_sent`,type:`UInt64`}};function Ae(e,t){let n=`toDateTime(intDiv(double2, 1000), ${j(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function je(e){return e===`hour`?`DateTime`:`Date`}function Me(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>j(e)).join(`, `),o=[`index1 = ${j(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(Oe)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>j(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function Ne(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${M(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${M(`time`)} ASC`:`${M(n)} DESC`}function V(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=Ee[r],o=ke[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=Ae(i.interval,i.tz);s.push(`${e} AS ${M(`time`)}`),c.push({name:`time`,type:je(i.interval)})}else{let t=De[e];s.push(`${t} AS ${M(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${M(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>M(e===`time`?`time`:e)).join(`, `)}`:``,d=Ne(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
         SELECT ${l.join(`, `)}
-        FROM ${j(t)}
-        WHERE ${Ne(i,n,a)}
+        FROM ${M(t)}
+        WHERE ${Me(i,n,a)}
         ${u}
         ORDER BY ${d}
         LIMIT ${Math.max(0,i.limit)} OFFSET ${Math.max(0,i.offset)}
         FORMAT JSON
-      `,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function V(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:ve(e),list:Te(e),get:be(e)}}var Fe=`authhero_action_executions`,Ie=1024,Le=`[truncated]`;function H(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function Re(e){let t=l.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function U(e,t=Ie){return e.length<=t?e:`${e.substring(0,t-11)}${Le}`}function W(e){return e==null?``:JSON.stringify(e)}function ze(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:Re(e.blob3),results:H(e.blob4)??[],logs:H(e.blob5),created_at:t,updated_at:n}}function Be(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Ve(e,t,a,r),a}}function Ve(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[U(n.id),U(n.trigger_id),U(n.status),U(W(n.results)),U(W(n.logs)),U(n.created_at),U(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function He(e){return async(t,n)=>{let r=await k(e,`
+      `,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function H(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:_e(e),list:we(e),get:ye(e)}}var Pe=`authhero_action_executions`,Fe=1024,Ie=`[truncated]`;function U(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function Le(e){let t=l.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function W(e,t=Fe){return e.length<=t?e:`${e.substring(0,t-11)}${Ie}`}function G(e){return e==null?``:JSON.stringify(e)}function Re(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:Le(e.blob3),results:U(e.blob4)??[],logs:U(e.blob5),created_at:t,updated_at:n}}function ze(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Be(e,t,a,r),a}}function Be(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[W(n.id),W(n.trigger_id),W(n.status),W(G(n.results)),W(G(n.logs)),W(n.created_at),W(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function Ve(e){return async(t,n)=>{let r=await A(e,`
       SELECT *
-      FROM ${j(e.dataset||Fe)}
-      WHERE index1 = ${A(t)}
-        AND blob1 = ${A(n)}
+      FROM ${M(e.dataset||Pe)}
+      WHERE index1 = ${j(t)}
+        AND blob1 = ${j(n)}
       LIMIT 1
-    `);return r.length===0||!r[0]?null:ze(r[0])}}function G(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No action_executions binding configured. Executions will not be written.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API.`),{create:Be(e),get:He(e)}}function Ue(){return{async getGeoInfo(e){try{let t=e[`cf-ipcountry`],n=e[`cf-ipcity`],r=e[`cf-iplatitude`],i=e[`cf-iplongitude`],a=e[`cf-timezone`],o=e[`cf-ipcontinent`];return t?{country_code:t,city_name:n||``,latitude:r||``,longitude:i||``,time_zone:a||``,continent_code:o||``}:null}catch(e){return console.warn(`Failed to get geo info from Cloudflare headers:`,e),null}}}}var We=class{bindings;constructor(e){this.bindings=e}async consume(e,t){let n=this.bindings[e];if(!n)return{allowed:!0};try{let{success:e}=await n.limit({key:t});return{allowed:e}}catch(t){return console.error(`CloudflareRateLimit: limit() error for scope ${e}:`,t),{allowed:!0}}}};function K(e){if(e&&Object.keys(e).some(t=>e[t]))return new We(e)}var Ge=5,Ke=1e3,q=50;async function qe(e,t={}){let n=Math.trunc(t.perPage??q),r=Number.isFinite(n)?Math.min(Ke,Math.max(Ge,n)):q,i=t.maxPages??200,a={scanned:0,matched:0,updated:0,unknown:0,mismatched:0,errors:0};for(let t=1;t<=i;t++){let n;try{n=await x(e).get(`/custom_hostnames?page=${t}&per_page=${r}`).json()}catch(n){return console.warn(`[custom-domains] sync failed to list page ${t} of zone ${e.zoneId}; stopping the sweep:`,n instanceof Error?n.message:n),a.errors++,a}let i=b.safeParse(n);if(!i.success||!i.data.success)return console.warn(`[custom-domains] sync got an unparseable listing for page ${t} of zone ${e.zoneId}; stopping the sweep.`,i.success?{cfErrors:i.data.errors}:{zodIssues:i.error.issues}),a.errors++,a;let o=i.data.result;for(let t of o){a.scanned++;try{let n=await e.customDomainAdapter.getByDomain(t.hostname);if(!n){a.unknown++;continue}if(e.enterprise&&t.custom_metadata?.tenant_id!==n.tenant_id){console.warn(`[custom-domains] sync skipping ${t.hostname}: zone says tenant=${t.custom_metadata?.tenant_id}, database says tenant=${n.tenant_id}.`),a.mismatched++;continue}if(n.custom_domain_id!==t.id){console.warn(`[custom-domains] sync skipping ${t.hostname} (tenant=${n.tenant_id}): stored id ${n.custom_domain_id} no longer matches the zone's ${t.id}.`),a.mismatched++;continue}a.matched++;let{outcome:r}=await ae(e,n.tenant_id,n,t);r===`updated`?a.updated++:r===`failed`&&a.errors++}catch(e){console.warn(`[custom-domains] sync failed for ${t.hostname}:`,e instanceof Error?e.message:e),a.errors++}}if(o.length<r)return a}return console.warn(`[custom-domains] sync hit the ${i}-page limit for zone ${e.zoneId}; the tail of the zone was not swept.`),a}function J(e){return`// Auto-generated AuthHero code hook worker
+    `);return r.length===0||!r[0]?null:Re(r[0])}}function K(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No action_executions binding configured. Executions will not be written.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API.`),{create:ze(e),get:Ve(e)}}function He(){return{async getGeoInfo(e){try{let t=e[`cf-ipcountry`],n=e[`cf-ipcity`],r=e[`cf-iplatitude`],i=e[`cf-iplongitude`],a=e[`cf-timezone`],o=e[`cf-ipcontinent`];return t?{country_code:t,city_name:n||``,latitude:r||``,longitude:i||``,time_zone:a||``,continent_code:o||``}:null}catch(e){return console.warn(`Failed to get geo info from Cloudflare headers:`,e),null}}}}var Ue=class{bindings;constructor(e){this.bindings=e}async consume(e,t){let n=this.bindings[e];if(!n)return{allowed:!0};try{let{success:e}=await n.limit({key:t});return{allowed:e}}catch(t){return console.error(`CloudflareRateLimit: limit() error for scope ${e}:`,t),{allowed:!0}}}};function q(e){if(e&&Object.keys(e).some(t=>e[t]))return new Ue(e)}var We=class{config;models=[`glm`,`deepseek`,`qwen`];constructor(e){this.config=e}async generate(e){let t=e.triggerId===`post-login`?`post-user-login`:e.triggerId,n=Object.hasOwn(l.TRIGGER_FUNCTION_NAMES,t)?l.TRIGGER_FUNCTION_NAMES[t]:void 0;if(!n)throw Error(`Unsupported action trigger`);let r={glm:`@cf/zai-org/glm-4.7-flash`,deepseek:`@cf/deepseek-ai/deepseek-v4-flash-0731`,qwen:`@cf/qwen/qwen3.8-27b`,...this.config.models},i=await(this.config.fetch??globalThis.fetch)(`https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(this.config.accountId)}/ai/v1/chat/completions`,{method:`POST`,headers:{Authorization:`Bearer ${this.config.apiToken}`,"content-type":`application/json`,"cf-aig-gateway-id":this.config.gatewayId,"cf-aig-collect-log":`false`,"cf-aig-skip-cache":`true`},signal:AbortSignal.timeout(this.config.timeoutMs??6e4),body:JSON.stringify({model:r[e.model],max_tokens:8192,stream:!1,messages:[{role:`system`,content:[`Generate an AuthHero Action as plain JavaScript source only. No Markdown, prose, or reasoning.`,`Define exports.${n} = async (event, api) => { ... }; at the top level.`,`The only available api namespaces and methods are: ${JSON.stringify(l.TRIGGER_API_SHAPES[t])}. Do not invent APIs.`,`Use the following TypeScript API declarations as reference for parameter types, optional arguments, and return values. The handler's api parameter has type ActionAPI. Output JavaScript only; do not copy type declarations or type annotations into the action.`,e.apiTypes,`This runs in a Web Worker. Use fetch and Web Crypto; no require, imports, npm modules, process, filesystem, or Node APIs.`,`Read credentials and configurable endpoint URLs from event.secrets. Never embed credentials. Comment with the secret names needed.`,`Treat event data as untrusted. Validate tokens before using their claims. Handle fetch failures and use bounded timeouts.`,t===`custom-token-exchange`?`Validate event.transaction.subject_token before calling exactly one api.authentication.setUserById or setUserByConnection, or reject with api.access.rejectInvalidSubjectToken.`:``].filter(Boolean).join(`
+`)},{role:`user`,content:e.prompt}]})});if(!i.ok)throw Error(`AI Gateway request failed (${i.status})`);let a=(await i.json()).choices?.[0];if(a?.finish_reason!==`stop`||typeof a.message?.content!=`string`)throw Error(`AI Gateway did not return a complete action`);let o=a.message.content.trim().replace(/^```(?:javascript|js)?\s*\n([\s\S]*?)\n```$/,`$1`).trim();if(!o||o.length>1e5)throw Error(`AI Gateway returned invalid action source`);return{code:o}}},Ge=5,Ke=1e3,J=50;async function qe(e,t={}){let n=Math.trunc(t.perPage??J),r=Number.isFinite(n)?Math.min(Ke,Math.max(Ge,n)):J,i=t.maxPages??200,a={scanned:0,matched:0,updated:0,unknown:0,mismatched:0,errors:0};for(let t=1;t<=i;t++){let n;try{n=await x(e).get(`/custom_hostnames?page=${t}&per_page=${r}`).json()}catch(n){return console.warn(`[custom-domains] sync failed to list page ${t} of zone ${e.zoneId}; stopping the sweep:`,n instanceof Error?n.message:n),a.errors++,a}let i=b.safeParse(n);if(!i.success||!i.data.success)return console.warn(`[custom-domains] sync got an unparseable listing for page ${t} of zone ${e.zoneId}; stopping the sweep.`,i.success?{cfErrors:i.data.errors}:{zodIssues:i.error.issues}),a.errors++,a;let o=i.data.result;for(let t of o){a.scanned++;try{let n=await e.customDomainAdapter.getByDomain(t.hostname);if(!n){a.unknown++;continue}if(e.enterprise&&t.custom_metadata?.tenant_id!==n.tenant_id){console.warn(`[custom-domains] sync skipping ${t.hostname}: zone says tenant=${t.custom_metadata?.tenant_id}, database says tenant=${n.tenant_id}.`),a.mismatched++;continue}if(n.custom_domain_id!==t.id){console.warn(`[custom-domains] sync skipping ${t.hostname} (tenant=${n.tenant_id}): stored id ${n.custom_domain_id} no longer matches the zone's ${t.id}.`),a.mismatched++;continue}a.matched++;let{outcome:r}=await ae(e,n.tenant_id,n,t);r===`updated`?a.updated++:r===`failed`&&a.errors++}catch(e){console.warn(`[custom-domains] sync failed for ${t.hostname}:`,e instanceof Error?e.message:e),a.errors++}}if(o.length<r)return a}return console.warn(`[custom-domains] sync hit the ${i}-page limit for zone ${e.zoneId}; the tail of the zone was not swept.`),a}function Y(e){return`// Auto-generated AuthHero code hook worker
 
 const fnNames = ${JSON.stringify(l.TRIGGER_FUNCTION_NAMES)};
 
@@ -145,9 +146,9 @@ export default {
     }
   },
 };
-`}var Y=class{config;constructor(e){this.config=e}async execute(e){let t=Date.now();if(!e.hookCodeId)return{success:!1,error:`DispatchNamespaceCodeExecutor requires hookCodeId`,durationMs:Date.now()-t,apiCalls:[]};let n=`hook-${e.hookCodeId}`,r=JSON.stringify({triggerId:e.triggerId,event:e.event});try{let i;if(this.config.dispatcher)i=await this.config.dispatcher.get(n,{},{limits:{cpuMs:e.cpuLimitMs??5e3}}).fetch(new Request(`https://hook.internal/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:r}));else if(this.config.dispatchUrl)i=await fetch(`${this.config.dispatchUrl}/${n}`,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${this.config.apiToken}`},body:r});else return{success:!1,error:`No dispatcher binding or dispatchUrl configured`,durationMs:Date.now()-t,apiCalls:[]};if(!i.ok){let e=await i.text();return{success:!1,error:`Worker invocation failed (${i.status}): ${e}`,durationMs:Date.now()-t,apiCalls:[]}}return{...await i.json(),durationMs:Date.now()-t}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}async deploy(e,t){let n=`hook-${e}`,r=J(t),i=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`,a=JSON.stringify({main_module:`index.js`,compatibility_date:this.config.compatibilityDate??`2024-11-20`}),o=new FormData;o.append(`metadata`,new Blob([a],{type:`application/json`})),o.append(`index.js`,new Blob([r],{type:`application/javascript+module`}),`index.js`);let s=await fetch(i,{method:`PUT`,headers:{Authorization:`Bearer ${this.config.apiToken}`},body:o});if(!s.ok){let e=await s.text();throw Error(`Failed to deploy hook worker ${n}: ${s.status} ${e}`)}}async remove(e){let t=`hook-${e}`,n=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${t}`,r=await fetch(n,{method:`DELETE`,headers:{Authorization:`Bearer ${this.config.apiToken}`}});if(!r.ok&&r.status!==404){let e=await r.text();throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`)}}},Je=Y,Ye=l.TRIGGER_FUNCTION_NAMES,Xe=l.TRIGGER_API_SHAPES;async function Ze(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n),i=``;for(let e of r)i+=e.toString(16).padStart(2,`0`);return i}function Qe(e){return`
-const TRIGGER_FN_NAMES = ${JSON.stringify(Ye)};
-const API_SHAPES = ${JSON.stringify(Xe)};
+`}var Je=class{config;constructor(e){this.config=e}async execute(e){let t=Date.now();if(!e.hookCodeId)return{success:!1,error:`DispatchNamespaceCodeExecutor requires hookCodeId`,durationMs:Date.now()-t,apiCalls:[]};let n=`hook-${e.hookCodeId}`,r=JSON.stringify({triggerId:e.triggerId,event:e.event});try{let i;if(this.config.dispatcher)i=await this.config.dispatcher.get(n,{},{limits:{cpuMs:e.cpuLimitMs??5e3}}).fetch(new Request(`https://hook.internal/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:r}));else if(this.config.dispatchUrl)i=await fetch(`${this.config.dispatchUrl}/${n}`,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${this.config.apiToken}`},body:r});else return{success:!1,error:`No dispatcher binding or dispatchUrl configured`,durationMs:Date.now()-t,apiCalls:[]};if(!i.ok){let e=await i.text();return{success:!1,error:`Worker invocation failed (${i.status}): ${e}`,durationMs:Date.now()-t,apiCalls:[]}}return{...await i.json(),durationMs:Date.now()-t}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}async deploy(e,t){let n=`hook-${e}`,r=Y(t),i=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`,a=JSON.stringify({main_module:`index.js`,compatibility_date:this.config.compatibilityDate??`2024-11-20`}),o=new FormData;o.append(`metadata`,new Blob([a],{type:`application/json`})),o.append(`index.js`,new Blob([r],{type:`application/javascript+module`}),`index.js`);let s=await fetch(i,{method:`PUT`,headers:{Authorization:`Bearer ${this.config.apiToken}`},body:o});if(!s.ok){let e=await s.text();throw Error(`Failed to deploy hook worker ${n}: ${s.status} ${e}`)}}async remove(e){let t=`hook-${e}`,n=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${t}`,r=await fetch(n,{method:`DELETE`,headers:{Authorization:`Bearer ${this.config.apiToken}`}});if(!r.ok&&r.status!==404){let e=await r.text();throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`)}}},Ye=Je,Xe=l.TRIGGER_FUNCTION_NAMES,Ze=l.TRIGGER_API_SHAPES;async function Qe(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n),i=``;for(let e of r)i+=e.toString(16).padStart(2,`0`);return i}function $e(e){return`
+const TRIGGER_FN_NAMES = ${JSON.stringify(Xe)};
+const API_SHAPES = ${JSON.stringify(Ze)};
 const MAX_LOG_ENTRIES = 50;
 const MAX_LOG_LENGTH = 500;
 
@@ -245,4 +246,4 @@ export default {
     }
   },
 };
-`}var $e=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Qe(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Ze(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},X=new TextEncoder;function Z(e,t){if(X.encode(e).length<=t)return e;let n=0,r=``;for(let i of e){let e=X.encode(i).length;if(n+e>t)break;n+=e,r+=i}return r}var Q=(e,t=1024)=>Z(e,t);function et(e){let t=e.analyticsEngineBinding;return e=>{if(t)try{t.writeDataPoint({blobs:[Q(e.name),Q(e.tenantId),Q(e.eventType),Q(e.source),Q(e.destination??``),Q(e.error??``)],doubles:[e.value,e.retryCount??0,Date.now()],indexes:[Z(e.tenantId,96)]})}catch(e){console.error(`Failed to write outbox metric to Analytics Engine:`,e)}}}function tt(e){let t=c.n(e);return{async onProvision(e){let{scriptName:n,databaseName:r}=t.names(e),{databaseVersion:i,bundleConfiguration:a,workerVersion:o}=t.validate(),{id:s,created:c}=await t.findOrCreateDatabase(r);return await t.applyMigrations(s,c),await t.uploadScript(n,s),await t.uploadSecrets(n,e),{d1DatabaseId:s,scriptName:n,d1Name:r,bundleConfiguration:a,workerVersion:o,databaseVersion:i}},async onDeprovision(e){await t.deprovision(e)}}}function nt(e){return e.deployment_type===`wfp`}var rt=2048;function $(e){let t;if(e instanceof Error)t=e.message;else try{t=String(e)}catch{t=Object.prototype.toString.call(e)}return t.slice(0,rt)}function it(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??nt,a=e.logger;async function o(e,t){try{await n.update(e,{provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e,i){let s=async(t,n,r)=>{if(i)try{await i(t,n,r)}catch(n){a?.warn(`Failed to report provisioning step "${t}" for tenant ${e}:`,n)}};await s(`provision-resources`,`started`);let l;try{l=await t.onProvision(e)}catch(t){throw await s(`provision-resources`,`failed`,{message:$(t)}),await o(e,t),t}let u={d1_database_id:l.d1DatabaseId,worker_script_name:l.scriptName,bundle_configuration:l.bundleConfiguration,worker_version:l.workerVersion,database_version:l.databaseVersion};await s(`provision-resources`,`succeeded`,{...u});try{if(r){await s(`seed-defaults`,`started`);try{let t=c.t(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`);await s(`seed-defaults`,`succeeded`)}catch(e){throw await s(`seed-defaults`,`failed`,{message:$(e)}),e}}await n.update(e,{...u,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){try{await n.update(e,{...u,provisioning_state:`failed`,provisioning_error:$(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e,t){let r=await n.get(e);r&&i(r)&&await s(e,t)},async onUpgrade(e,t){let r=await n.get(e);if(!r)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(r))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e,t)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var at=`DISPATCHER`,ot=`tenant-{tenant_id}-auth`,st=[`/u/widget/`];function ct(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function lt(e,t){return e.replace(/\{tenant_id\}/g,t)}function ut(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=at,scriptNameTemplate:i=ot,resolveTenantId:a=e=>e.req.header(`tenant-id`),localPaths:o=st}=e;return async(e,s)=>{if(o.length>0){let t=e.req.path;if(o.some(e=>t.startsWith(e)))return s()}let c=await a(e);if(!c||c===n)return s();let l=await t.get(c);if(!l||l.deployment_type!==`wfp`||l.provisioning_state&&l.provisioning_state!==`ready`)return s();let u=Reflect.get(e.env??{},r);if(!ct(u))return s();let d=lt(i,c),f;try{f=await u.get(d).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${c} script=${d}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,c),e.json({error:i,detail:r?`Tenant '${c}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.`:`The worker for tenant '${c}' could not be reached.`,tenant_id:c},r?503:502)}if(f.status>=500){let e=f.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${f.status}${e?` (${e})`:``} tenant=${c} script=${d}`)}let p=Reflect.get(f,`webSocket`);if(f.status===101||p!=null)return f;let m=new Response(f.body,f);return m.headers.set(`X-Wfp-Tenant`,c),m}}function dt(e){let t={customDomains:oe(e),cache:ce({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Ue()};e.r2SqlLogs?t.logs=_e(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs),t.stats=z(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=c.i,exports.CloudflareApiError=c.a,exports.CloudflareCodeExecutor=Je,exports.DispatchNamespaceCodeExecutor=Y,exports.WorkerLoaderCodeExecutor=$e,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineOutboxMetricsSink=et,exports.createAnalyticsEngineStatsAdapter=z,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=tt,exports.createR2SQLLogsAdapter=_e,exports.createR2SQLStatsAdapter=ge,exports.createWfpForwardMiddleware=ut,exports.createWfpProvisionerSteps=c.n,exports.createWfpTenantProvisioningHook=it,exports.default=dt,exports.generateWorkerScript=J,exports.syncCustomDomains=qe;
+`}var et=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=$e(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Qe(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},X=new TextEncoder;function tt(e,t){if(X.encode(e).length<=t)return e;let n=0,r=``;for(let i of e){let e=X.encode(i).length;if(n+e>t)break;n+=e,r+=i}return r}var Z=(e,t=1024)=>tt(e,t);function nt(e){let t=e.analyticsEngineBinding;return e=>{if(t)try{t.writeDataPoint({blobs:[Z(e.name),Z(e.tenantId),Z(e.eventType),Z(e.source),Z(e.destination??``),Z(e.error??``)],doubles:[e.value,e.retryCount??0,Date.now()],indexes:[tt(e.tenantId,96)]})}catch(e){console.error(`Failed to write outbox metric to Analytics Engine:`,e)}}}function rt(e){let t=c.n(e);return{async onProvision(e){let{scriptName:n,databaseName:r}=t.names(e),{databaseVersion:i,bundleConfiguration:a,workerVersion:o}=t.validate(),{id:s,created:c}=await t.findOrCreateDatabase(r);return await t.applyMigrations(s,c),await t.uploadScript(n,s),await t.uploadSecrets(n,e),{d1DatabaseId:s,scriptName:n,d1Name:r,bundleConfiguration:a,workerVersion:o,databaseVersion:i}},async onDeprovision(e){await t.deprovision(e)}}}function it(e){return e.deployment_type===`wfp`}var at=2048;function Q(e){let t;if(e instanceof Error)t=e.message;else try{t=String(e)}catch{t=Object.prototype.toString.call(e)}return t.slice(0,at)}function ot(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??it,a=e.logger;async function o(e,t){try{await n.update(e,{provisioning_state:`failed`,provisioning_error:Q(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e,i){let s=async(t,n,r)=>{if(i)try{await i(t,n,r)}catch(n){a?.warn(`Failed to report provisioning step "${t}" for tenant ${e}:`,n)}};await s(`provision-resources`,`started`);let l;try{l=await t.onProvision(e)}catch(t){throw await s(`provision-resources`,`failed`,{message:Q(t)}),await o(e,t),t}let u={d1_database_id:l.d1DatabaseId,worker_script_name:l.scriptName,bundle_configuration:l.bundleConfiguration,worker_version:l.workerVersion,database_version:l.databaseVersion};await s(`provision-resources`,`succeeded`,{...u});try{if(r){await s(`seed-defaults`,`started`);try{let t=c.t(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`);await s(`seed-defaults`,`succeeded`)}catch(e){throw await s(`seed-defaults`,`failed`,{message:Q(e)}),e}}await n.update(e,{...u,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){try{await n.update(e,{...u,provisioning_state:`failed`,provisioning_error:Q(t),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e,t){let r=await n.get(e);r&&i(r)&&await s(e,t)},async onUpgrade(e,t){let r=await n.get(e);if(!r)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(r))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e,t)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var st=`DISPATCHER`,ct=`tenant-{tenant_id}-auth`,$=[`/u/widget/`];function lt(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function ut(e,t){return e.replace(/\{tenant_id\}/g,t)}function dt(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=st,scriptNameTemplate:i=ct,resolveTenantId:a=e=>e.req.header(`tenant-id`),localPaths:o=[],includeDefaultLocalPaths:s=!0}=e;e.localPaths?.length===0&&e.includeDefaultLocalPaths===void 0&&console.warn("[authhero] createWfpForwardMiddleware: `localPaths: []` no longer turns off DEFAULT_LOCAL_PATHS; pass `includeDefaultLocalPaths: false` to dispatch them.");let c=[...s?$:[],...o];return async(e,o)=>{if(c.length>0){let t=e.req.path;if(c.some(e=>t.startsWith(e)))return o()}let s=await a(e);if(!s||s===n)return o();let l=await t.get(s);if(!l||l.deployment_type!==`wfp`||l.provisioning_state&&l.provisioning_state!==`ready`)return o();let u=Reflect.get(e.env??{},r);if(!lt(u))return o();let d=ut(i,s),f;try{f=await u.get(d).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${s} script=${d}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,s),e.json({error:i,detail:r?`Tenant '${s}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.`:`The worker for tenant '${s}' could not be reached.`,tenant_id:s},r?503:502)}if(f.status>=500){let e=f.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${f.status}${e?` (${e})`:``} tenant=${s} script=${d}`)}let p=Reflect.get(f,`webSocket`);if(f.status===101||p!=null)return f;let m=new Response(f.body,f);return m.headers.set(`X-Wfp-Tenant`,s),m}}function ft(e){let t={customDomains:oe(e),cache:ce({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:He()};e.r2SqlLogs?t.logs=k(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=H(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=V(e.analyticsEngineLogs),t.stats=B(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=K(e.analyticsEngineActionExecutions));let n=q(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareActionCodeGenerator=We,exports.CloudflareApiClient=c.i,exports.CloudflareApiError=c.a,exports.CloudflareCodeExecutor=Ye,exports.DEFAULT_LOCAL_PATHS=$,exports.DispatchNamespaceCodeExecutor=Je,exports.WorkerLoaderCodeExecutor=et,exports.createAnalyticsEngineActionExecutionsAdapter=K,exports.createAnalyticsEngineAnalyticsAdapter=V,exports.createAnalyticsEngineLogsAdapter=H,exports.createAnalyticsEngineOutboxMetricsSink=nt,exports.createAnalyticsEngineStatsAdapter=B,exports.createCloudflareRateLimitAdapter=q,exports.createCloudflareWfpD1Provisioner=rt,exports.createR2SQLLogsAdapter=k,exports.createR2SQLStatsAdapter=ge,exports.createWfpForwardMiddleware=dt,exports.createWfpProvisionerSteps=c.n,exports.createWfpTenantProvisioningHook=ot,exports.default=ft,exports.generateWorkerScript=Y,exports.syncCustomDomains=qe;

package/dist/cloudflare-adapter.d.ts

@@ -1,4 +1,4 @@
-import { StatsAdapter, LogsDataAdapter, AnalyticsAdapter, ActionExecutionsAdapter, RateLimitScope, RateLimitAdapter, CustomDomainsAdapter, CodeExecutor, CodeExecutionResult, TenantsDataAdapter, CacheAdapter, GeoAdapter } from '@authhero/adapter-interfaces';
+import { StatsAdapter, LogsDataAdapter, AnalyticsAdapter, ActionExecutionsAdapter, RateLimitScope, RateLimitAdapter, CustomDomainsAdapter, ActionCodeGenerator, ActionGenerationModel, CodeExecutor, CodeExecutionResult, TenantsDataAdapter, CacheAdapter, GeoAdapter } from '@authhero/adapter-interfaces';
 import { Context, MiddlewareHandler } from 'hono';
 
 interface R2SQLLogsAdapterConfig {
@@ -336,6 +336,26 @@ interface CloudflareConfig {
     rateLimitBindings?: CloudflareRateLimitBindings;
 }
 
+interface CloudflareActionCodeGeneratorConfig {
+    accountId: string;
+    gatewayId: string;
+    apiToken: string;
+    /** Override model IDs without changing core or the admin UI. */
+    models?: Partial<Record<ActionGenerationModel, string>>;
+    timeoutMs?: number;
+    /** Optional transport for platform integrations and local HTTP simulations. */
+    fetch?: typeof globalThis.fetch;
+}
+/** Cloudflare AI Gateway REST API; no provider SDK required. */
+declare class CloudflareActionCodeGenerator implements ActionCodeGenerator {
+    private readonly config;
+    readonly models: readonly ["glm", "deepseek", "qwen"];
+    constructor(config: CloudflareActionCodeGeneratorConfig);
+    generate(params: Parameters<ActionCodeGenerator["generate"]>[0]): Promise<{
+        code: string;
+    }>;
+}
+
 interface SyncCustomDomainsOptions {
     /**
      * Hostnames fetched per Cloudflare API call. Cloudflare accepts 5 to 1000
@@ -1146,6 +1166,19 @@ interface WfpTenantProvisioningHook {
 }
 declare function createWfpTenantProvisioningHook(options: WfpTenantProvisioningHookOptions): WfpTenantProvisioningHook;
 
+/**
+ * Path prefixes served from the control plane rather than dispatched to a
+ * tenant worker. These are shared static assets that are byte-identical across
+ * tenants and only exist on the control plane's deployment.
+ *
+ * `/u/widget/` is the universal-login (u2) widget bundle. It's a multi-file
+ * Stencil bundle the SSR'd pages load as an ES module to hydrate the form. A
+ * per-tenant dispatch worker has no static-assets binding and no configured
+ * `widgetHandler`, so forwarding these requests 404s and the u2 buttons render
+ * inert. Serving them from the control plane — where the assets live — keeps
+ * zero per-tenant weight.
+ */
+declare const DEFAULT_LOCAL_PATHS: readonly string[];
 interface WfpForwardOptions {
     /** Tenants adapter, used to look up the resolved tenant's `deployment_type`. */
     tenants: TenantsDataAdapter;
@@ -1175,11 +1208,16 @@ interface WfpForwardOptions {
      * handlers.
      *
      * Use this for shared static assets that only the control plane can serve —
-     * a per-tenant dispatch worker has no static-assets binding. Defaults to
-     * `["/u/widget/"]` (the universal-login widget bundle); pass `[]` to disable
-     * the carve-out entirely, or extend the list for other shared assets.
+     * a per-tenant dispatch worker has no static-assets binding. These are added
+     * to `DEFAULT_LOCAL_PATHS` (the universal-login widget bundle), so a default
+     * added later is not lost by anyone who passes their own list.
      */
     localPaths?: string[];
+    /**
+     * Whether `DEFAULT_LOCAL_PATHS` apply. Defaults to `true`; pass `false` to
+     * dispatch even the default paths and carve out only `localPaths`.
+     */
+    includeDefaultLocalPaths?: boolean;
 }
 /**
  * Hono middleware that forwards a request to its tenant's WFP worker over a
@@ -1195,9 +1233,9 @@ interface WfpForwardOptions {
  * The tenant worker receives the original request verbatim and owns the full
  * response.
  *
- * Requests whose path matches `localPaths` (default `["/u/widget/"]`) are also
- * never dispatched — they are shared static assets that only the control plane
- * can serve, so a per-tenant worker would 404 them. See `DEFAULT_LOCAL_PATHS`.
+ * Requests whose path matches `DEFAULT_LOCAL_PATHS` (`["/u/widget/"]`) or the
+ * extra `localPaths` are also never dispatched — they are shared static assets
+ * that only the control plane can serve, so a per-tenant worker would 404 them.
  */
 declare function createWfpForwardMiddleware(options: WfpForwardOptions): MiddlewareHandler;
 
@@ -1213,5 +1251,5 @@ interface CloudflareAdapters {
 }
 declare function createAdapters(config: CloudflareConfig): CloudflareAdapters;
 
-export { CloudflareApiClient, CloudflareApiError, CloudflareCodeExecutor, DispatchNamespaceCodeExecutor, WorkerLoaderCodeExecutor, createAnalyticsEngineActionExecutionsAdapter, createAnalyticsEngineAnalyticsAdapter, createAnalyticsEngineLogsAdapter, createAnalyticsEngineOutboxMetricsSink, createAnalyticsEngineStatsAdapter, createCloudflareRateLimitAdapter, createCloudflareWfpD1Provisioner, createR2SQLLogsAdapter, createR2SQLStatsAdapter, createWfpForwardMiddleware, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createAdapters as default, generateWorkerScript, syncCustomDomains };
-export type { AnalyticsEngineActionExecutionsAdapterConfig, AnalyticsEngineDataset, AnalyticsEngineLogsAdapterConfig, AnalyticsEngineOutboxMetricsConfig, CfApiClientOptions, CloudflareAdapters, CloudflareCodeExecutorConfig, CloudflareConfig, CloudflareRateLimitBinding, CloudflareRateLimitBindings, CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, D1Database, D1QueryResult, DispatchNamespace, DispatchNamespaceCodeExecutorConfig, OutboxMetricRecord, ProvisionResult, ProvisionerMigration, R2SQLLogsAdapterConfig, ScriptBinding, ScriptUploadOptions, SyncCustomDomainsOptions, SyncCustomDomainsResult, TenantProvisionNames, TenantProvisionerSteps, TenantSecretsResolver, WfpForwardOptions, WfpProvisionerSteps, WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, WorkerCode, WorkerLoader, WorkerLoaderCodeExecutorOptions, WorkerStub };
+export { CloudflareActionCodeGenerator, CloudflareApiClient, CloudflareApiError, CloudflareCodeExecutor, DEFAULT_LOCAL_PATHS, DispatchNamespaceCodeExecutor, WorkerLoaderCodeExecutor, createAnalyticsEngineActionExecutionsAdapter, createAnalyticsEngineAnalyticsAdapter, createAnalyticsEngineLogsAdapter, createAnalyticsEngineOutboxMetricsSink, createAnalyticsEngineStatsAdapter, createCloudflareRateLimitAdapter, createCloudflareWfpD1Provisioner, createR2SQLLogsAdapter, createR2SQLStatsAdapter, createWfpForwardMiddleware, createWfpProvisionerSteps, createWfpTenantProvisioningHook, createAdapters as default, generateWorkerScript, syncCustomDomains };
+export type { AnalyticsEngineActionExecutionsAdapterConfig, AnalyticsEngineDataset, AnalyticsEngineLogsAdapterConfig, AnalyticsEngineOutboxMetricsConfig, CfApiClientOptions, CloudflareActionCodeGeneratorConfig, CloudflareAdapters, CloudflareCodeExecutorConfig, CloudflareConfig, CloudflareRateLimitBinding, CloudflareRateLimitBindings, CloudflareWfpD1Provisioner, CloudflareWfpD1ProvisionerOptions, D1Database, D1QueryResult, DispatchNamespace, DispatchNamespaceCodeExecutorConfig, OutboxMetricRecord, ProvisionResult, ProvisionerMigration, R2SQLLogsAdapterConfig, ScriptBinding, ScriptUploadOptions, SyncCustomDomainsOptions, SyncCustomDomainsResult, TenantProvisionNames, TenantProvisionerSteps, TenantSecretsResolver, WfpForwardOptions, WfpProvisionerSteps, WfpTenantProvisioningHook, WfpTenantProvisioningHookOptions, WorkerCode, WorkerLoader, WorkerLoaderCodeExecutorOptions, WorkerStub };