@authhero/cloudflare-adapter 3.4.0 → 4.1.0

package/dist/cloudflare-adapter.mjs

@@ -142,7 +142,7 @@ async function ae(e, t, n) {
 	let a = i.data.result.find((e) => e.hostname.toLowerCase() === n.toLowerCase());
 	return !a || e.enterprise && a.custom_metadata?.tenant_id !== t ? null : a;
 }
-async function w(e, t, n, r) {
+async function oe(e, t, n, r) {
 	let i = n.custom_domain_id, a;
 	try {
 		a = C({
@@ -175,7 +175,7 @@ async function w(e, t, n, r) {
 		outcome: "updated"
 	};
 }
-function oe(e) {
+function se(e) {
 	return {
 		create: async (t, n) => {
 			let { sslOverrides: r, rest: i } = S(n.domain_metadata);
@@ -232,7 +232,7 @@ function oe(e) {
 			}), r;
 			let { result: o } = a.data;
 			if (e.enterprise && o.custom_metadata?.tenant_id !== t) throw new d(404);
-			let { domain: s } = await w(e, t, r, o);
+			let { domain: s } = await oe(e, t, r, o);
 			return s;
 		},
 		getByDomain: async (t) => e.customDomainAdapter.getByDomain(t),
@@ -292,7 +292,7 @@ function oe(e) {
 }
 //#endregion
 //#region src/cache/index.ts
-var se = class {
+var ce = class {
 	config;
 	cache = null;
 	constructor(e) {
@@ -366,8 +366,8 @@ var se = class {
 		console.warn("CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries");
 	}
 };
-function ce(e = {}) {
-	return new se({
+function le(e = {}) {
+	return new ce({
 		defaultTtlSeconds: 300,
 		keyPrefix: "authhero",
 		getTimeoutMs: 200,
@@ -376,14 +376,14 @@ function ce(e = {}) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/nanoid@5.1.11/node_modules/nanoid/url-alphabet/index.js
-var le = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", T = (e = 21) => {
+var ue = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", w = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += le[n[e] & 63];
+	for (; e--;) t += ue[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/r2-sql-logs/query.ts
-async function E(e, t) {
+async function T(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`, i = await fetch(n, {
@@ -403,15 +403,15 @@ async function E(e, t) {
 		clearTimeout(i);
 	}
 }
-function D(e) {
+function E(e) {
 	return `'${e.replace(/'/g, "''")}'`;
 }
-function O(e) {
+function D(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/r2-sql-logs/logs.ts
-function k(e) {
+function O(e) {
 	let t = (e) => {
 		if (!e) return "";
 		try {
@@ -451,16 +451,16 @@ function k(e) {
 		} : void 0
 	};
 }
-function ue(e) {
+function de(e) {
 	return async (t, n) => {
-		let r = n.log_id || T(), i = {
+		let r = n.log_id || w(), i = {
 			...n,
 			log_id: r
 		};
-		return await de(e, t, i), i;
+		return await fe(e, t, i), i;
 	};
 }
-async function de(e, t, n) {
+async function fe(e, t, n) {
 	let r = (e) => e ? JSON.stringify(e) : void 0, i = {
 		id: n.log_id,
 		tenant_id: t,
@@ -511,22 +511,22 @@ async function de(e, t, n) {
 		throw console.error("Failed to send log to Pipeline:", e), e;
 	}
 }
-function fe(e) {
+function pe(e) {
 	return async (t, n) => {
-		let r = e.namespace || "default", i = e.tableName || "logs", a = await E(e, `
-      SELECT * FROM ${O(r)}.${O(i)}
-      WHERE tenant_id = ${D(t)}
-        AND id = ${D(n)}
+		let r = e.namespace || "default", i = e.tableName || "logs", a = await T(e, `
+      SELECT * FROM ${D(r)}.${D(i)}
+      WHERE tenant_id = ${E(t)}
+        AND id = ${E(n)}
       LIMIT 1
     `);
 		if (a.length === 0) return null;
 		let o = a[0];
-		return o ? k(o) : null;
+		return o ? O(o) : null;
 	};
 }
 //#endregion
 //#region src/r2-sql-logs/list.ts
-function pe(e) {
+function me(e) {
 	let t = {}, n = /(\w+):(?:"([^"]*)"|(\S+))/g, r;
 	for (; (r = n.exec(e)) !== null;) {
 		let e = r[1], n = r[2] === void 0 ? r[3] : r[2];
@@ -534,40 +534,40 @@ function pe(e) {
 	}
 	return t;
 }
-function me(e) {
+function he(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = n.replace(/[^a-zA-Z0-9_]/g, "");
-		e && r && t.push(`${O(e)} = ${D(r)}`);
+		e && r && t.push(`${D(e)} = ${E(r)}`);
 	}
 	return t;
 }
-function he(e) {
+function ge(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${D(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${E(t)}`];
 		if (s) {
-			let e = pe(s);
-			u.push(...me(e));
+			let e = me(s);
+			u.push(...he(e));
 		}
 		let d = u.join(" AND "), f = "ORDER BY date DESC";
 		if (o && o.sort_by) {
 			let e = o.sort_by.replace(/[^a-zA-Z0-9_]/g, ""), t = o.sort_order === "asc" ? "ASC" : "DESC";
-			f = `ORDER BY ${O(e)} ${t}`;
+			f = `ORDER BY ${D(e)} ${t}`;
 		}
-		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await E(e, `
-      SELECT * FROM ${O(c)}.${O(l)}
+		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await T(e, `
+      SELECT * FROM ${D(c)}.${D(l)}
       WHERE ${d}
       ${f}
       ${m}
-    `)).map(k);
+    `)).map(O);
 		if (!a) return {
 			logs: h,
 			start: 0,
 			limit: 0,
 			length: 0
 		};
-		let g = (await E(e, `
-      SELECT COUNT(*) as count FROM ${O(c)}.${O(l)}
+		let g = (await T(e, `
+      SELECT COUNT(*) as count FROM ${D(c)}.${D(l)}
       WHERE ${d}
     `))[0]?.count || 0;
 		return {
@@ -580,7 +580,7 @@ function he(e) {
 }
 //#endregion
 //#region src/r2-sql-logs/stats.ts
-function ge() {
+function _e() {
 	return {
 		async getDaily() {
 			throw Error("Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.");
@@ -592,20 +592,20 @@ function ge() {
 }
 //#endregion
 //#region src/r2-sql-logs/index.ts
-function A(e) {
+function k(e) {
 	let t = !!e.pipelineEndpoint, n = !!e.pipelineBinding;
 	if (!t && !n) throw Error("R2 SQL logs adapter requires one of: \"pipelineEndpoint\" or \"pipelineBinding\"");
 	if (!e.authToken) throw Error("R2 SQL logs adapter requires \"authToken\" configuration");
 	if (!e.warehouseName) throw Error("R2 SQL logs adapter requires \"warehouseName\" configuration");
 	return {
-		create: ue(e),
-		list: he(e),
-		get: fe(e)
+		create: de(e),
+		list: ge(e),
+		get: pe(e)
 	};
 }
 //#endregion
 //#region src/analytics-engine-logs/query.ts
-async function j(e, t) {
+async function A(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`, i = await fetch(n, {
@@ -628,15 +628,15 @@ async function j(e, t) {
 		clearTimeout(i);
 	}
 }
-function M(e) {
+function j(e) {
 	return `'${e.replace(/'/g, "''").replace(/\\/g, "\\\\")}'`;
 }
-function N(e) {
+function M(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/analytics-engine-logs/logs.ts
-function P(e) {
+function N(e) {
 	let t = (e) => {
 		if (e) try {
 			return JSON.parse(e);
@@ -668,16 +668,16 @@ function P(e) {
 		isMobile: e.double1 === 1
 	};
 }
-function _e(e) {
+function ve(e) {
 	return async (t, n) => {
-		let r = n.log_id || T(), i = {
+		let r = n.log_id || w(), i = {
 			...n,
 			log_id: r
 		};
-		return ve(e, t, i), i;
+		return ye(e, t, i), i;
 	};
 }
-function ve(e, t, n) {
+function ye(e, t, n) {
 	if (!e.analyticsEngineBinding) {
 		console.error("Analytics Engine binding not configured");
 		return;
@@ -714,34 +714,34 @@ function ve(e, t, n) {
 		console.error("Failed to write log to Analytics Engine:", e);
 	}
 }
-function ye(e) {
+function be(e) {
 	return async (t, n) => {
-		let r = await j(e, `
+		let r = await A(e, `
       SELECT *
-      FROM ${N(e.dataset || "authhero_logs")}
-      WHERE index1 = ${M(t)}
-        AND blob1 = ${M(n)}
+      FROM ${M(e.dataset || "authhero_logs")}
+      WHERE index1 = ${j(t)}
+        AND blob1 = ${j(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : P(r[0]);
+		return r.length === 0 || !r[0] ? null : N(r[0]);
 	};
 }
 //#endregion
 //#region src/analytics-engine-logs/list.ts
-function F(e) {
+function P(e) {
 	let t = e;
 	return t.startsWith("\"") && t.endsWith("\"") && t.length > 1 && (t = t.slice(1, -1)), c(t);
 }
-function be(e) {
+function xe(e) {
 	let t = {}, n = [];
 	for (let r of s(e)) {
 		if (r === "OR" || r === "AND") continue;
 		let e = r.match(/^(\w+):([\s\S]*)$/);
 		if (e) {
-			let n = e[1], r = F(e[2]);
+			let n = e[1], r = P(e[2]);
 			t[n] || (t[n] = []), t[n].push(r);
 		} else {
-			let e = F(r);
+			let e = P(r);
 			e && n.push(e);
 		}
 	}
@@ -750,7 +750,7 @@ function be(e) {
 		terms: n
 	};
 }
-function I(e) {
+function F(e) {
 	return {
 		log_id: "blob1",
 		tenant_id: "blob2",
@@ -771,7 +771,7 @@ function I(e) {
 		hostname: "blob17"
 	}[e] || null;
 }
-function xe(e) {
+function Se(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = r.filter((e) => e !== "");
@@ -782,41 +782,41 @@ function xe(e) {
 			n.length > 0 && t.push(`(${n.join(" OR ")})`);
 			continue;
 		}
-		let i = I(n);
-		if (i) if (e.length === 1) t.push(`${i} = ${M(e[0])}`);
+		let i = F(n);
+		if (i) if (e.length === 1) t.push(`${i} = ${j(e[0])}`);
 		else {
-			let n = e.map((e) => M(e)).join(", ");
+			let n = e.map((e) => j(e)).join(", ");
 			t.push(`${i} IN (${n})`);
 		}
 	}
 	return t;
 }
-function Se(e) {
+function Ce(e) {
 	return e.filter((e) => e !== "").map((e) => {
-		let t = M(e), n = M(`%${e}%`);
+		let t = j(e), n = j(`%${e}%`);
 		return `(blob7 = ${t} OR blob5 LIKE ${n} OR blob4 LIKE ${n})`;
 	});
 }
-function Ce(e) {
-	return e === "date" ? "double2" : I(e) || "timestamp";
-}
 function we(e) {
+	return e === "date" ? "double2" : F(e) || "timestamp";
+}
+function Te(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s, from_date: c, to_date: l } = n, u = e.dataset || "authhero_logs", d = [`index1 = ${M(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s, from_date: c, to_date: l } = n, u = e.dataset || "authhero_logs", d = [`index1 = ${j(t)}`];
 		if (s) {
-			let { fields: e, terms: t } = be(s);
-			d.push(...xe(e)), d.push(...Se(t));
+			let { fields: e, terms: t } = xe(s);
+			d.push(...Se(e)), d.push(...Ce(t));
 		}
 		typeof c == "number" && Number.isFinite(c) && d.push(`double2 >= ${Math.floor(c) * 1e3}`), typeof l == "number" && Number.isFinite(l) && d.push(`double2 <= ${Math.floor(l) * 1e3}`);
 		let f = d.join(" AND "), p = "ORDER BY timestamp DESC";
-		o && o.sort_by && (p = `ORDER BY ${Ce(o.sort_by)} ${o.sort_order === "asc" ? "ASC" : "DESC"}`);
-		let m = r * i, h = `LIMIT ${i} OFFSET ${m}`, g = (await j(e, `
+		o && o.sort_by && (p = `ORDER BY ${we(o.sort_by)} ${o.sort_order === "asc" ? "ASC" : "DESC"}`);
+		let m = r * i, h = `LIMIT ${i} OFFSET ${m}`, g = (await A(e, `
       SELECT *
-      FROM ${N(u)}
+      FROM ${M(u)}
       WHERE ${f}
       ${p}
       ${h}
-    `)).map(P);
+    `)).map(N);
 		if (!a) return {
 			logs: g,
 			start: 0,
@@ -825,11 +825,11 @@ function we(e) {
 		};
 		let _ = `
       SELECT count() as count
-      FROM ${N(u)}
+      FROM ${M(u)}
       WHERE ${f}
     `;
 		try {
-			let t = (await j(e, _))[0]?.count || 0;
+			let t = (await A(e, _))[0]?.count || 0;
 			return {
 				logs: g,
 				start: m,
@@ -848,14 +848,14 @@ function we(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/stats.ts
-var L = ["s"], Te = ["pwd_leak"];
-function R(e) {
+var I = ["s"], Ee = ["pwd_leak"];
+function L(e) {
 	return /^\d{8}$/.test(e) ? `${e.slice(0, 4)}-${e.slice(4, 6)}-${e.slice(6, 8)}` : e;
 }
-function z(e) {
+function R(e) {
 	return e.toISOString().split("T")[0];
 }
-function B(e, t) {
+function z(e, t) {
 	let n = (/* @__PURE__ */ new Date(`${e}T${t === "end" ? "23:59:59.999" : "00:00:00.000"}Z`)).getTime();
 	if (Number.isNaN(n)) return NaN;
 	let r = /^(\d{4})-(\d{2})-(\d{2})$/.exec(e);
@@ -863,24 +863,24 @@ function B(e, t) {
 	let i = new Date(n);
 	return i.getUTCFullYear() !== Number(r[1]) || i.getUTCMonth() + 1 !== Number(r[2]) || i.getUTCDate() !== Number(r[3]) ? NaN : n;
 }
-function V(e) {
+function B(e) {
 	let t = e.dataset || "authhero_logs";
 	return {
 		async getDaily(n, r = {}) {
 			let { from: i, to: a } = r, o = /* @__PURE__ */ new Date(), s = new Date(o);
 			s.setDate(s.getDate() - 30);
-			let c = i ? R(i) : z(s), l = a ? R(a) : z(o), u = B(c, "start"), d = B(l, "end");
+			let c = i ? L(i) : R(s), l = a ? L(a) : R(o), u = z(c, "start"), d = z(l, "end");
 			if (Number.isNaN(u) || Number.isNaN(d)) throw Error(`Invalid stats date range: from='${c}' to='${l}'`);
-			return (await j(e, `
+			return (await A(e, `
         SELECT
           toDate(toDateTime(double2 / 1000)) AS date,
-          SUM(CASE WHEN blob3 IN (${L.map((e) => M(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
+          SUM(CASE WHEN blob3 IN (${I.map((e) => j(e)).join(", ")}) THEN 1 ELSE 0 END) AS logins,
           SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
-          SUM(CASE WHEN blob3 IN (${Te.map((e) => M(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
+          SUM(CASE WHEN blob3 IN (${Ee.map((e) => j(e)).join(", ")}) THEN 1 ELSE 0 END) AS leaked_passwords,
           MIN(double2) AS first_event,
           MAX(double2) AS last_event
         FROM "${t}"
-        WHERE index1 = ${M(n)}
+        WHERE index1 = ${j(n)}
           AND double2 >= ${u}
           AND double2 <= ${d}
         GROUP BY date
@@ -897,10 +897,10 @@ function V(e) {
 		async getActiveUsers(n) {
 			let r = /* @__PURE__ */ new Date();
 			r.setDate(r.getDate() - 30);
-			let i = r.getTime(), a = L.map((e) => M(e)).join(", "), o = (await j(e, `
+			let i = r.getTime(), a = I.map((e) => j(e)).join(", "), o = (await A(e, `
         SELECT COUNT(DISTINCT blob7) AS count
         FROM "${t}"
-        WHERE index1 = ${M(n)}
+        WHERE index1 = ${j(n)}
           AND double2 >= ${i}
           AND blob3 IN (${a})
           AND blob7 IS NOT NULL
@@ -912,7 +912,7 @@ function V(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/analytics.ts
-var Ee = {
+var De = {
 	"active-users": ["s", "seacft"],
 	logins: [
 		"s",
@@ -942,17 +942,17 @@ var Ee = {
 		"fvr"
 	],
 	"codes-sent": ["cls", "cs"]
-}, De = {
+}, Oe = {
 	connection: "blob9",
 	client_id: "blob11",
 	user_type: "blob16",
 	event: "blob3"
-}, Oe = {
+}, ke = {
 	connection: "blob9",
 	client_id: "blob11",
 	user_type: "blob16",
 	user_id: "blob7"
-}, ke = {
+}, Ae = {
 	"active-users": {
 		expr: "count(DISTINCT blob7)",
 		alias: "active_users",
@@ -1009,8 +1009,8 @@ var Ee = {
 		type: "UInt64"
 	}
 };
-function Ae(e, t) {
-	let n = `toDateTime(intDiv(double2, 1000), ${M(t)})`;
+function je(e, t) {
+	let n = `toDateTime(intDiv(double2, 1000), ${j(t)})`;
 	switch (e) {
 		case "hour": return `toStartOfHour(${n})`;
 		case "week": return `toStartOfWeek(${n})`;
@@ -1018,45 +1018,45 @@ function Ae(e, t) {
 		default: return `toStartOfDay(${n})`;
 	}
 }
-function je(e) {
+function Me(e) {
 	return e === "hour" ? "DateTime" : "Date";
 }
-function Me(e, t, n) {
-	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => M(e)).join(", "), o = [
-		`index1 = ${M(t)}`,
+function Ne(e, t, n) {
+	let r = new Date(e.from).getTime(), i = new Date(e.to).getTime(), a = n.map((e) => j(e)).join(", "), o = [
+		`index1 = ${j(t)}`,
 		`double2 >= ${r}`,
 		`double2 < ${i}`,
 		`blob3 IN (${a})`
 	];
-	for (let [t, n] of Object.entries(Oe)) {
+	for (let [t, n] of Object.entries(ke)) {
 		let r = e.filters[t];
 		if (r && r.length > 0) {
-			let e = r.map((e) => M(e)).join(", ");
+			let e = r.map((e) => j(e)).join(", ");
 			o.push(`${n} IN (${e})`);
 		}
 	}
 	return o.join(" AND ");
 }
-function Ne(e, t, n) {
+function Pe(e, t, n) {
 	if (e.order_by) {
 		let t = e.order_by.startsWith("-");
-		return `${N(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
+		return `${M(t ? e.order_by.slice(1) : e.order_by)} ${t ? "DESC" : "ASC"}`;
 	}
-	return t.length > 0 && t[0] === "time" ? `${N("time")} ASC` : `${N(n)} DESC`;
+	return t.length > 0 && t[0] === "time" ? `${M("time")} ASC` : `${M(n)} DESC`;
 }
-function H(e) {
+function V(e) {
 	let t = e.dataset || "authhero_logs";
 	return { async query(n, r, i) {
-		let a = Ee[r], o = ke[r], s = [], c = [];
+		let a = De[r], o = Ae[r], s = [], c = [];
 		for (let e of i.group_by) if (e === "time") {
-			let e = Ae(i.interval, i.tz);
-			s.push(`${e} AS ${N("time")}`), c.push({
+			let e = je(i.interval, i.tz);
+			s.push(`${e} AS ${M("time")}`), c.push({
 				name: "time",
-				type: je(i.interval)
+				type: Me(i.interval)
 			});
 		} else {
-			let t = De[e];
-			s.push(`${t} AS ${N(e)}`), c.push({
+			let t = Oe[e];
+			s.push(`${t} AS ${M(e)}`), c.push({
 				name: e,
 				type: "String"
 			});
@@ -1065,10 +1065,10 @@ function H(e) {
 			name: o.alias,
 			type: o.type
 		});
-		let l = [...s, `${o.expr} AS ${N(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => N(e === "time" ? "time" : e)).join(", ")}` : "", d = Ne(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
+		let l = [...s, `${o.expr} AS ${M(o.alias)}`], u = i.group_by.length ? `GROUP BY ${i.group_by.map((e) => M(e === "time" ? "time" : e)).join(", ")}` : "", d = Pe(i, i.group_by.map((e) => e === "time" ? "time" : e), o.alias), f = `
         SELECT ${l.join(", ")}
-        FROM ${N(t)}
-        WHERE ${Me(i, n, a)}
+        FROM ${M(t)}
+        WHERE ${Ne(i, n, a)}
         ${u}
         ORDER BY ${d}
         LIMIT ${Math.max(0, i.limit)} OFFSET ${Math.max(0, i.offset)}
@@ -1105,47 +1105,47 @@ function H(e) {
 }
 //#endregion
 //#region src/analytics-engine-logs/index.ts
-function U(e) {
+function H(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No binding configured. Logs will not be written to Analytics Engine."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required for querying logs via SQL API."), {
-		create: _e(e),
-		list: we(e),
-		get: ye(e)
+		create: ve(e),
+		list: Te(e),
+		get: be(e)
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/actionExecutions.ts
-var Pe = "authhero_action_executions", Fe = 1024, Ie = "[truncated]";
-function W(e) {
+var Fe = "authhero_action_executions", Ie = 1024, Le = "[truncated]";
+function U(e) {
 	if (!(typeof e != "string" || e.length === 0)) try {
 		return JSON.parse(e);
 	} catch {
 		return;
 	}
 }
-function Le(e) {
+function Re(e) {
 	let t = o.safeParse(e);
 	return t.success ? t.data : "unspecified";
 }
-function G(e, t = Fe) {
-	return e.length <= t ? e : `${e.substring(0, t - 11)}${Ie}`;
+function W(e, t = Ie) {
+	return e.length <= t ? e : `${e.substring(0, t - 11)}${Le}`;
 }
-function K(e) {
+function G(e) {
 	return e == null ? "" : JSON.stringify(e);
 }
-function Re(e) {
+function ze(e) {
 	let t = typeof e.blob6 == "string" && e.blob6.length > 0 ? e.blob6 : typeof e.double1 == "number" ? new Date(e.double1).toISOString() : "", n = typeof e.blob7 == "string" && e.blob7.length > 0 ? e.blob7 : t;
 	return {
 		id: typeof e.blob1 == "string" ? e.blob1 : "",
 		tenant_id: typeof e.index1 == "string" ? e.index1 : "",
 		trigger_id: typeof e.blob2 == "string" ? e.blob2 : "",
-		status: Le(e.blob3),
-		results: W(e.blob4) ?? [],
-		logs: W(e.blob5),
+		status: Re(e.blob3),
+		results: U(e.blob4) ?? [],
+		logs: U(e.blob5),
 		created_at: t,
 		updated_at: n
 	};
 }
-function ze(e) {
+function Be(e) {
 	return async (t, n) => {
 		let r = Date.now(), i = new Date(r).toISOString(), a = {
 			id: n.id,
@@ -1157,10 +1157,10 @@ function ze(e) {
 			created_at: i,
 			updated_at: i
 		};
-		return Be(e, t, a, r), a;
+		return Ve(e, t, a, r), a;
 	};
 }
-function Be(e, t, n, r) {
+function Ve(e, t, n, r) {
 	if (!e.analyticsEngineBinding) {
 		console.error("Analytics Engine action_executions binding not configured; skipping write");
 		return;
@@ -1168,13 +1168,13 @@ function Be(e, t, n, r) {
 	try {
 		e.analyticsEngineBinding.writeDataPoint({
 			blobs: [
-				G(n.id),
-				G(n.trigger_id),
-				G(n.status),
-				G(K(n.results)),
-				G(K(n.logs)),
-				G(n.created_at),
-				G(n.updated_at)
+				W(n.id),
+				W(n.trigger_id),
+				W(n.status),
+				W(G(n.results)),
+				W(G(n.logs)),
+				W(n.created_at),
+				W(n.updated_at)
 			],
 			doubles: [r],
 			indexes: [t.substring(0, 96)]
@@ -1183,29 +1183,29 @@ function Be(e, t, n, r) {
 		console.error("Failed to write action_execution to Analytics Engine:", e);
 	}
 }
-function Ve(e) {
+function He(e) {
 	return async (t, n) => {
-		let r = await j(e, `
+		let r = await A(e, `
       SELECT *
-      FROM ${N(e.dataset || Pe)}
-      WHERE index1 = ${M(t)}
-        AND blob1 = ${M(n)}
+      FROM ${M(e.dataset || Fe)}
+      WHERE index1 = ${j(t)}
+        AND blob1 = ${j(n)}
       LIMIT 1
     `);
-		return r.length === 0 || !r[0] ? null : Re(r[0]);
+		return r.length === 0 || !r[0] ? null : ze(r[0]);
 	};
 }
 //#endregion
 //#region src/analytics-engine-action-executions/index.ts
-function q(e) {
+function K(e) {
 	return e.analyticsEngineBinding || console.warn("Analytics Engine: No action_executions binding configured. Executions will not be written."), (!e.accountId || !e.apiToken) && console.warn("Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API."), {
-		create: ze(e),
-		get: Ve(e)
+		create: Be(e),
+		get: He(e)
 	};
 }
 //#endregion
 //#region src/geo/index.ts
-function He() {
+function Ue() {
 	return { async getGeoInfo(e) {
 		try {
 			let t = e["cf-ipcountry"], n = e["cf-ipcity"], r = e["cf-iplatitude"], i = e["cf-iplongitude"], a = e["cf-timezone"], o = e["cf-ipcontinent"];
@@ -1224,7 +1224,7 @@ function He() {
 }
 //#endregion
 //#region src/rate-limit/index.ts
-var Ue = class {
+var We = class {
 	bindings;
 	constructor(e) {
 		this.bindings = e;
@@ -1240,14 +1240,72 @@ var Ue = class {
 		}
 	}
 };
-function J(e) {
-	if (e && Object.keys(e).some((t) => e[t])) return new Ue(e);
+function q(e) {
+	if (e && Object.keys(e).some((t) => e[t])) return new We(e);
 }
 //#endregion
-//#region src/customDomains/sync.ts
-var We = 5, Ge = 1e3, Y = 50;
-async function Ke(e, t = {}) {
-	let n = Math.trunc(t.perPage ?? Y), r = Number.isFinite(n) ? Math.min(Ge, Math.max(We, n)) : Y, i = t.maxPages ?? 200, a = {
+//#region src/action-code-generator.ts
+var Ge = class {
+	config;
+	models = [
+		"glm",
+		"deepseek",
+		"qwen"
+	];
+	constructor(e) {
+		this.config = e;
+	}
+	async generate(e) {
+		let t = e.triggerId === "post-login" ? "post-user-login" : e.triggerId, n = Object.hasOwn(a, t) ? a[t] : void 0;
+		if (!n) throw Error("Unsupported action trigger");
+		let r = {
+			glm: "@cf/zai-org/glm-4.7-flash",
+			deepseek: "@cf/deepseek-ai/deepseek-v4-flash-0731",
+			qwen: "@cf/qwen/qwen3.8-27b",
+			...this.config.models
+		}, o = await (this.config.fetch ?? globalThis.fetch)(`https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(this.config.accountId)}/ai/v1/chat/completions`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${this.config.apiToken}`,
+				"content-type": "application/json",
+				"cf-aig-gateway-id": this.config.gatewayId,
+				"cf-aig-collect-log": "false",
+				"cf-aig-skip-cache": "true"
+			},
+			signal: AbortSignal.timeout(this.config.timeoutMs ?? 6e4),
+			body: JSON.stringify({
+				model: r[e.model],
+				max_tokens: 8192,
+				stream: !1,
+				messages: [{
+					role: "system",
+					content: [
+						"Generate an AuthHero Action as plain JavaScript source only. No Markdown, prose, or reasoning.",
+						`Define exports.${n} = async (event, api) => { ... }; at the top level.`,
+						`The only available api namespaces and methods are: ${JSON.stringify(i[t])}. Do not invent APIs.`,
+						"Use the following TypeScript API declarations as reference for parameter types, optional arguments, and return values. The handler's api parameter has type ActionAPI. Output JavaScript only; do not copy type declarations or type annotations into the action.",
+						e.apiTypes,
+						"This runs in a Web Worker. Use fetch and Web Crypto; no require, imports, npm modules, process, filesystem, or Node APIs.",
+						"Read credentials and configurable endpoint URLs from event.secrets. Never embed credentials. Comment with the secret names needed.",
+						"Treat event data as untrusted. Validate tokens before using their claims. Handle fetch failures and use bounded timeouts.",
+						t === "custom-token-exchange" ? "Validate event.transaction.subject_token before calling exactly one api.authentication.setUserById or setUserByConnection, or reject with api.access.rejectInvalidSubjectToken." : ""
+					].filter(Boolean).join("\n")
+				}, {
+					role: "user",
+					content: e.prompt
+				}]
+			})
+		});
+		if (!o.ok) throw Error(`AI Gateway request failed (${o.status})`);
+		let s = (await o.json()).choices?.[0];
+		if (s?.finish_reason !== "stop" || typeof s.message?.content != "string") throw Error("AI Gateway did not return a complete action");
+		let c = s.message.content.trim().replace(/^```(?:javascript|js)?\s*\n([\s\S]*?)\n```$/, "$1").trim();
+		if (!c || c.length > 1e5) throw Error("AI Gateway returned invalid action source");
+		return { code: c };
+	}
+}, Ke = 5, qe = 1e3, J = 50;
+async function Je(e, t = {}) {
+	let n = Math.trunc(t.perPage ?? J), r = Number.isFinite(n) ? Math.min(qe, Math.max(Ke, n)) : J, i = t.maxPages ?? 200, a = {
 		scanned: 0,
 		matched: 0,
 		updated: 0,
@@ -1282,7 +1340,7 @@ async function Ke(e, t = {}) {
 					continue;
 				}
 				a.matched++;
-				let { outcome: r } = await w(e, n.tenant_id, n, t);
+				let { outcome: r } = await oe(e, n.tenant_id, n, t);
 				r === "updated" ? a.updated++ : r === "failed" && a.errors++;
 			} catch (e) {
 				console.warn(`[custom-domains] sync failed for ${t.hostname}:`, e instanceof Error ? e.message : e), a.errors++;
@@ -1294,7 +1352,7 @@ async function Ke(e, t = {}) {
 }
 //#endregion
 //#region src/code-executor/worker-template.ts
-function X(e) {
+function Y(e) {
 	return `// Auto-generated AuthHero code hook worker
 
 const fnNames = ${JSON.stringify(a)};
@@ -1381,7 +1439,7 @@ export default {
 }
 //#endregion
 //#region src/code-executor/index.ts
-var qe = class {
+var X = class {
 	config;
 	constructor(e) {
 		this.config = e;
@@ -1442,7 +1500,7 @@ var qe = class {
 		}
 	}
 	async deploy(e, t) {
-		let n = `hook-${e}`, r = X(t), i = `https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`, a = JSON.stringify({
+		let n = `hook-${e}`, r = Y(t), i = `https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`, a = JSON.stringify({
 			main_module: "index.js",
 			compatibility_date: this.config.compatibilityDate ?? "2024-11-20"
 		}), o = new FormData();
@@ -1467,16 +1525,16 @@ var qe = class {
 			throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`);
 		}
 	}
-}, Je = qe, Ye = a, Xe = i;
-async function Ze(e) {
+}, Ye = X, Xe = a, Ze = i;
+async function Qe(e) {
 	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t), r = new Uint8Array(n), i = "";
 	for (let e of r) i += e.toString(16).padStart(2, "0");
 	return i;
 }
-function Qe(e) {
+function $e(e) {
 	return `
-const TRIGGER_FN_NAMES = ${JSON.stringify(Ye)};
-const API_SHAPES = ${JSON.stringify(Xe)};
+const TRIGGER_FN_NAMES = ${JSON.stringify(Xe)};
+const API_SHAPES = ${JSON.stringify(Ze)};
 const MAX_LOG_ENTRIES = 50;
 const MAX_LOG_LENGTH = 500;
 
@@ -1576,7 +1634,7 @@ export default {
 };
 `;
 }
-var $e = class {
+var et = class {
 	loader;
 	compatibilityDate;
 	constructor(e) {
@@ -1585,11 +1643,11 @@ var $e = class {
 	async execute(e) {
 		let t = Date.now();
 		try {
-			let t = Qe(e.code), n = {
+			let t = $e(e.code), n = {
 				compatibilityDate: this.compatibilityDate,
 				mainModule: "hook.js",
 				modules: { "hook.js": t }
-			}, r = e.hookCodeId ? `${e.hookCodeId}-${await Ze(e.code)}` : null;
+			}, r = e.hookCodeId ? `${e.hookCodeId}-${await Qe(e.code)}` : null;
 			return await (await (r ? this.loader.get(r, async () => n) : this.loader.load(n)).getEntrypoint().fetch(new Request("https://hook/execute", {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
@@ -1607,37 +1665,37 @@ var $e = class {
 			};
 		}
 	}
-}, Z = new TextEncoder();
-function et(e, t) {
-	if (Z.encode(e).length <= t) return e;
+}, tt = new TextEncoder();
+function nt(e, t) {
+	if (tt.encode(e).length <= t) return e;
 	let n = 0, r = "";
 	for (let i of e) {
-		let e = Z.encode(i).length;
+		let e = tt.encode(i).length;
 		if (n + e > t) break;
 		n += e, r += i;
 	}
 	return r;
 }
-var Q = (e, t = 1024) => et(e, t);
-function tt(e) {
+var Z = (e, t = 1024) => nt(e, t);
+function rt(e) {
 	let t = e.analyticsEngineBinding;
 	return (e) => {
 		if (t) try {
 			t.writeDataPoint({
 				blobs: [
-					Q(e.name),
-					Q(e.tenantId),
-					Q(e.eventType),
-					Q(e.source),
-					Q(e.destination ?? ""),
-					Q(e.error ?? "")
+					Z(e.name),
+					Z(e.tenantId),
+					Z(e.eventType),
+					Z(e.source),
+					Z(e.destination ?? ""),
+					Z(e.error ?? "")
 				],
 				doubles: [
 					e.value,
 					e.retryCount ?? 0,
 					Date.now()
 				],
-				indexes: [et(e.tenantId, 96)]
+				indexes: [nt(e.tenantId, 96)]
 			});
 		} catch (e) {
 			console.error("Failed to write outbox metric to Analytics Engine:", e);
@@ -1646,7 +1704,7 @@ function tt(e) {
 }
 //#endregion
 //#region src/wfp-provisioner/provisioner.ts
-function nt(e) {
+function it(e) {
 	let t = n(e);
 	return {
 		async onProvision(e) {
@@ -1667,11 +1725,11 @@ function nt(e) {
 }
 //#endregion
 //#region src/wfp-provisioner/tenant-hook.ts
-function rt(e) {
+function at(e) {
 	return e.deployment_type === "wfp";
 }
-var it = 2048;
-function $(e) {
+var ot = 2048;
+function Q(e) {
 	let t;
 	if (e instanceof Error) t = e.message;
 	else try {
@@ -1679,15 +1737,15 @@ function $(e) {
 	} catch {
 		t = Object.prototype.toString.call(e);
 	}
-	return t.slice(0, it);
+	return t.slice(0, ot);
 }
-function at(e) {
-	let { provisioner: t, tenants: n, syncDefaults: i } = e, a = e.shouldProvision ?? rt, o = e.logger;
+function st(e) {
+	let { provisioner: t, tenants: n, syncDefaults: i } = e, a = e.shouldProvision ?? at, o = e.logger;
 	async function s(e, t) {
 		try {
 			await n.update(e, {
 				provisioning_state: "failed",
-				provisioning_error: $(t),
+				provisioning_error: Q(t),
 				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		} catch (t) {
@@ -1707,7 +1765,7 @@ function at(e) {
 		try {
 			l = await t.onProvision(e);
 		} catch (t) {
-			throw await c("provision-resources", "failed", { message: $(t) }), await s(e, t), t;
+			throw await c("provision-resources", "failed", { message: Q(t) }), await s(e, t), t;
 		}
 		let u = {
 			d1_database_id: l.d1DatabaseId,
@@ -1725,7 +1783,7 @@ function at(e) {
 					if (t.length > 0) throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join("; ")}`);
 					await c("seed-defaults", "succeeded");
 				} catch (e) {
-					throw await c("seed-defaults", "failed", { message: $(e) }), e;
+					throw await c("seed-defaults", "failed", { message: Q(e) }), e;
 				}
 			}
 			await n.update(e, {
@@ -1739,7 +1797,7 @@ function at(e) {
 				await n.update(e, {
 					...u,
 					provisioning_state: "failed",
-					provisioning_error: $(t),
+					provisioning_error: Q(t),
 					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 				});
 			} catch (t) {
@@ -1776,62 +1834,64 @@ function at(e) {
 }
 //#endregion
 //#region src/wfp-provisioner/wfp-forward.ts
-var ot = "DISPATCHER", st = "tenant-{tenant_id}-auth", ct = ["/u/widget/"];
-function lt(e) {
+var ct = "DISPATCHER", lt = "tenant-{tenant_id}-auth", $ = ["/u/widget/"];
+function ut(e) {
 	return typeof e == "object" && !!e && "get" in e && typeof Reflect.get(e, "get") == "function";
 }
-function ut(e, t) {
+function dt(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function dt(e) {
-	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = ot, scriptNameTemplate: i = st, resolveTenantId: a = (e) => e.req.header("tenant-id"), localPaths: o = ct } = e;
-	return async (e, s) => {
-		if (o.length > 0) {
+function ft(e) {
+	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = ct, scriptNameTemplate: i = lt, resolveTenantId: a = (e) => e.req.header("tenant-id"), localPaths: o = [], includeDefaultLocalPaths: s = !0 } = e;
+	e.localPaths?.length === 0 && e.includeDefaultLocalPaths === void 0 && console.warn("[authhero] createWfpForwardMiddleware: `localPaths: []` no longer turns off DEFAULT_LOCAL_PATHS; pass `includeDefaultLocalPaths: false` to dispatch them.");
+	let c = [...s ? $ : [], ...o];
+	return async (e, o) => {
+		if (c.length > 0) {
 			let t = e.req.path;
-			if (o.some((e) => t.startsWith(e))) return s();
+			if (c.some((e) => t.startsWith(e))) return o();
 		}
-		let c = await a(e);
-		if (!c || c === n) return s();
-		let l = await t.get(c);
-		if (!l || l.deployment_type !== "wfp" || l.provisioning_state && l.provisioning_state !== "ready") return s();
+		let s = await a(e);
+		if (!s || s === n) return o();
+		let l = await t.get(s);
+		if (!l || l.deployment_type !== "wfp" || l.provisioning_state && l.provisioning_state !== "ready") return o();
 		let u = Reflect.get(e.env ?? {}, r);
-		if (!lt(u)) return s();
-		let d = ut(i, c), f;
+		if (!ut(u)) return o();
+		let d = dt(i, s), f;
 		try {
 			f = await u.get(d).fetch(e.req.raw);
 		} catch (t) {
 			let n = t instanceof Error ? t.message : String(t), r = /not\s*found|no\s*such|does not exist/i.test(n), i = r ? "wfp_worker_not_found" : "wfp_dispatch_failed";
-			return console.error(`[wfp-forward] ${i} tenant=${c} script=${d}: ${n}`), e.header("X-Authhero-Error", i), e.header("X-Wfp-Tenant", c), e.json({
+			return console.error(`[wfp-forward] ${i} tenant=${s} script=${d}: ${n}`), e.header("X-Authhero-Error", i), e.header("X-Wfp-Tenant", s), e.json({
 				error: i,
-				detail: r ? `Tenant '${c}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.` : `The worker for tenant '${c}' could not be reached.`,
-				tenant_id: c
+				detail: r ? `Tenant '${s}' is marked ready but its worker '${d}' is not deployed in the dispatch namespace.` : `The worker for tenant '${s}' could not be reached.`,
+				tenant_id: s
 			}, r ? 503 : 502);
 		}
 		if (f.status >= 500) {
 			let e = f.headers.get("X-Authhero-Error");
-			console.error(`[wfp-forward] tenant worker ${f.status}${e ? ` (${e})` : ""} tenant=${c} script=${d}`);
+			console.error(`[wfp-forward] tenant worker ${f.status}${e ? ` (${e})` : ""} tenant=${s} script=${d}`);
 		}
 		let p = Reflect.get(f, "webSocket");
 		if (f.status === 101 || p != null) return f;
 		let m = new Response(f.body, f);
-		return m.headers.set("X-Wfp-Tenant", c), m;
+		return m.headers.set("X-Wfp-Tenant", s), m;
 	};
 }
 //#endregion
 //#region src/index.ts
-function ft(e) {
+function pt(e) {
 	let t = {
-		customDomains: oe(e),
-		cache: ce({
+		customDomains: se(e),
+		cache: le({
 			...e.cacheName && { cacheName: e.cacheName },
 			...e.defaultTtlSeconds !== void 0 && { defaultTtlSeconds: e.defaultTtlSeconds },
 			...e.keyPrefix && { keyPrefix: e.keyPrefix }
 		}),
-		geo: He()
+		geo: Ue()
 	};
-	e.r2SqlLogs ? t.logs = A(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = U(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = H(e.analyticsEngineLogs), t.stats = V(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = q(e.analyticsEngineActionExecutions));
-	let n = J(e.rateLimitBindings);
+	e.r2SqlLogs ? t.logs = k(e.r2SqlLogs) : e.analyticsEngineLogs && (t.logs = H(e.analyticsEngineLogs)), e.analyticsEngineLogs && (t.analytics = V(e.analyticsEngineLogs), t.stats = B(e.analyticsEngineLogs)), e.analyticsEngineActionExecutions && (t.actionExecutions = K(e.analyticsEngineActionExecutions));
+	let n = q(e.rateLimitBindings);
 	return n && (t.rateLimit = n), t;
 }
 //#endregion
-export { t as CloudflareApiClient, e as CloudflareApiError, Je as CloudflareCodeExecutor, qe as DispatchNamespaceCodeExecutor, $e as WorkerLoaderCodeExecutor, q as createAnalyticsEngineActionExecutionsAdapter, H as createAnalyticsEngineAnalyticsAdapter, U as createAnalyticsEngineLogsAdapter, tt as createAnalyticsEngineOutboxMetricsSink, V as createAnalyticsEngineStatsAdapter, J as createCloudflareRateLimitAdapter, nt as createCloudflareWfpD1Provisioner, A as createR2SQLLogsAdapter, ge as createR2SQLStatsAdapter, dt as createWfpForwardMiddleware, n as createWfpProvisionerSteps, at as createWfpTenantProvisioningHook, ft as default, X as generateWorkerScript, Ke as syncCustomDomains };
+export { Ge as CloudflareActionCodeGenerator, t as CloudflareApiClient, e as CloudflareApiError, Ye as CloudflareCodeExecutor, $ as DEFAULT_LOCAL_PATHS, X as DispatchNamespaceCodeExecutor, et as WorkerLoaderCodeExecutor, K as createAnalyticsEngineActionExecutionsAdapter, V as createAnalyticsEngineAnalyticsAdapter, H as createAnalyticsEngineLogsAdapter, rt as createAnalyticsEngineOutboxMetricsSink, B as createAnalyticsEngineStatsAdapter, q as createCloudflareRateLimitAdapter, it as createCloudflareWfpD1Provisioner, k as createR2SQLLogsAdapter, _e as createR2SQLStatsAdapter, ft as createWfpForwardMiddleware, n as createWfpProvisionerSteps, st as createWfpTenantProvisioningHook, pt as default, Y as generateWorkerScript, Je as syncCustomDomains };