@authhero/proxy 0.10.14 → 0.11.0

package/dist/proxy.mjs

@@ -121,7 +121,7 @@ var h = e.enum([
 		old: e.unknown(),
 		new: e.unknown()
 	})).optional()
-}), ee = e.object({
+}), v = e.object({
 	method: e.string(),
 	path: e.string(),
 	query: e.record(e.string(), e.string()).optional(),
@@ -130,17 +130,17 @@ var h = e.enum([
 	user_agent: e.string().optional(),
 	correlation_id: e.string().optional(),
 	redirect_uri: e.string().optional()
-}), v = e.object({
+}), y = e.object({
 	status_code: e.number(),
 	body: e.unknown().optional()
-}), te = e.object({
+}), ee = e.object({
 	country_code: e.string(),
 	city_name: e.string(),
 	latitude: e.string(),
 	longitude: e.string(),
 	time_zone: e.string(),
 	continent_code: e.string()
-}), ne = e.object({
+}), te = e.object({
 	name: e.string(),
 	version: e.string(),
 	env: e.record(e.string(), e.string()).optional()
@@ -153,8 +153,8 @@ e.object({
 	category: h,
 	actor: g,
 	target: _,
-	request: ee,
-	response: v.optional(),
+	request: v,
+	response: y.optional(),
 	connection: e.string().optional(),
 	connection_id: e.string().optional(),
 	client_name: e.string().optional(),
@@ -162,8 +162,8 @@ e.object({
 	strategy_type: e.string().optional(),
 	audience: e.string().optional(),
 	scope: e.string().optional(),
-	location: te.optional(),
-	auth0_client: ne.optional(),
+	location: ee.optional(),
+	auth0_client: te.optional(),
 	hostname: e.string(),
 	is_mobile: e.boolean().optional(),
 	timestamp: e.string()
@@ -178,14 +178,14 @@ e.object({
 	"SEND_REQUEST",
 	"SEND_EMAIL"
 ]), e.enum(["VERIFY_EMAIL"]);
-var re = e.object({
+var ne = e.object({
 	require_mx_record: e.boolean().optional(),
 	block_aliases: e.boolean().optional(),
 	block_free_emails: e.boolean().optional(),
 	block_disposable_emails: e.boolean().optional(),
 	blocklist: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional()
-}), ie = e.object({
+}), re = e.object({
 	id: e.string(),
 	alias: e.string().max(100).optional(),
 	type: e.literal("AUTH0"),
@@ -197,7 +197,7 @@ var re = e.object({
 		user_id: e.string(),
 		changes: e.record(e.string(), e.any())
 	})
-}), ae = e.object({
+}), ie = e.object({
 	id: e.string(),
 	alias: e.string().max(100).optional(),
 	type: e.literal("EMAIL"),
@@ -206,13 +206,13 @@ var re = e.object({
 	mask_output: e.boolean().optional(),
 	params: e.object({
 		email: e.string(),
-		rules: re.optional()
+		rules: ne.optional()
 	})
-}), oe = e.enum([
+}), ae = e.enum([
 	"change-email",
 	"account",
 	"custom"
-]), se = e.object({
+]), oe = e.object({
 	id: e.string(),
 	alias: e.string().max(100).optional(),
 	type: e.literal("REDIRECT"),
@@ -220,17 +220,17 @@ var re = e.object({
 	allow_failure: e.boolean().optional(),
 	mask_output: e.boolean().optional(),
 	params: e.object({
-		target: oe.openapi({ description: "The predefined target to redirect to, or 'custom' for a custom URL" }),
+		target: ae.openapi({ description: "The predefined target to redirect to, or 'custom' for a custom URL" }),
 		custom_url: e.string().optional().openapi({ description: "Custom URL to redirect to when target is 'custom'" })
 	})
-}), ce = e.union([
+}), se = e.union([
+	re,
 	ie,
-	ae,
-	se
+	oe
 ]);
 e.object({
 	name: e.string().min(1).max(150).openapi({ description: "The name of the flow" }),
-	actions: e.array(ce).optional().default([]).openapi({ description: "The list of actions to execute in sequence" })
+	actions: e.array(se).optional().default([]).openapi({ description: "The list of actions to execute in sequence" })
 }).extend(n.shape).extend({ id: e.string().openapi({
 	description: "Unique identifier for the flow",
 	example: "af_12tMpdJ3iek7svMyZkSh5M"
@@ -247,7 +247,7 @@ e.object({
 	total: e.number().optional(),
 	next: e.string().optional()
 });
-var le = e.object({
+var ce = e.object({
 	email: e.string().optional(),
 	email_verified: e.boolean().optional(),
 	name: e.string().optional(),
@@ -256,7 +256,7 @@ var le = e.object({
 	phone_number: e.string().optional(),
 	phone_verified: e.boolean().optional(),
 	family_name: e.string().optional()
-}).catchall(e.any()), ue = e.object({
+}).catchall(e.any()), le = e.object({
 	connection: e.string(),
 	user_id: e.string(),
 	provider: e.string(),
@@ -269,15 +269,15 @@ var le = e.object({
 	access_token: e.string().optional(),
 	access_token_secret: e.string().optional(),
 	refresh_token: e.string().optional(),
-	profileData: le.optional()
-}), de = e.object({
+	profileData: ce.optional()
+}), ue = e.object({
 	formatted: e.string().optional(),
 	street_address: e.string().optional(),
 	locality: e.string().optional(),
 	region: e.string().optional(),
 	postal_code: e.string().optional(),
 	country: e.string().optional()
-}).optional(), fe = e.object({
+}).optional(), de = e.object({
 	email: e.string().transform((e) => e.toLowerCase()).optional(),
 	username: e.string().refine((e) => !e.includes("@"), { message: "Usernames must not contain \"@\". Use the email field for email addresses." }).optional(),
 	phone_number: e.string().optional(),
@@ -300,9 +300,9 @@ var le = e.object({
 	gender: e.string().optional(),
 	birthdate: e.string().optional(),
 	zoneinfo: e.string().optional(),
-	address: de
+	address: ue
 });
-fe.extend({
+de.extend({
 	email_verified: e.boolean().default(!1),
 	verify_email: e.boolean().optional(),
 	last_ip: e.string().optional(),
@@ -323,24 +323,24 @@ fe.extend({
 	is_social: e.boolean(),
 	email: e.string().optional(),
 	login_count: e.number().default(0),
-	identities: e.array(ue).optional()
-}).omit({ registration_completed_at: !0 }), fe.extend({
+	identities: e.array(le).optional()
+}).omit({ registration_completed_at: !0 }), de.extend({
 	login_count: e.number(),
 	multifactor: e.array(e.string()).optional(),
 	last_ip: e.string().optional(),
 	last_login: e.string().optional(),
 	user_id: e.string()
 }).catchall(e.any());
-var pe = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", me = (e = 21) => {
+var fe = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", pe = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += pe[n[e] & 63];
+	for (; e--;) t += fe[n[e] & 63];
 	return t;
-}, he = e.object({
+}, me = e.object({
 	client_id: e.string().optional().openapi({ description: "ID of this client. Generated server-side if omitted (Auth0 behavior)." }),
 	name: e.string().min(1).openapi({ description: "Name of this client (min length: 1 character, does not allow < or >)." }),
 	description: e.string().max(140).optional().openapi({ description: "Free text description of this client (max length: 140 characters)." }),
 	global: e.boolean().default(!1).openapi({ description: "Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false)." }),
-	client_secret: e.string().default(() => me()).optional().openapi({ description: "Client secret (which you must not make public)." }),
+	client_secret: e.string().default(() => pe()).optional().openapi({ description: "Client secret (which you must not make public)." }),
 	app_type: e.enum([
 		"native",
 		"spa",
@@ -457,8 +457,8 @@ var pe = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", me
 e.object({
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(he.shape).extend({ client_id: e.string() });
-var ge = e.object({
+}).extend(me.shape).extend({ client_id: e.string() });
+var he = e.object({
 	client_id: e.string().min(1).openapi({ description: "ID of the client." }),
 	audience: e.string().min(1).openapi({ description: "The audience (API identifier) of this client grant." }),
 	scope: e.array(e.string()).optional().openapi({ description: "Scopes allowed for this client grant." }),
@@ -471,15 +471,15 @@ var ge = e.object({
 	is_system: e.boolean().optional().openapi({ description: "If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly." }),
 	subject_type: e.enum(["client", "user"]).optional().openapi({ description: "The type of application access the client grant allows. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement." }),
 	authorization_details_types: e.array(e.string()).optional().openapi({ description: "Types of authorization_details allowed for this client grant. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement." })
-}), _e = e.object({ id: e.string().openapi({ description: "ID of the client grant." }) }).extend(ge.shape).extend({
+}), ge = e.object({ id: e.string().openapi({ description: "ID of the client grant." }) }).extend(he.shape).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(_e);
-var ve = e.enum(["iat", "rat"]), ye = e.object({
+e.array(ge);
+var _e = e.enum(["iat", "rat"]), ve = e.object({
 	id: e.string(),
 	token_hash: e.string(),
-	type: ve,
+	type: _e,
 	client_id: e.string().optional(),
 	sub: e.string().optional(),
 	constraints: e.record(e.string(), e.unknown()).optional(),
@@ -490,23 +490,23 @@ e.object({
 	created_at: e.string(),
 	used_at: e.string().optional(),
 	revoked_at: e.string().optional()
-}).extend(ye.shape);
-var y = e.object({
+}).extend(ve.shape);
+var b = e.object({
 	x: e.number(),
 	y: e.number()
-}), be = /* @__PURE__ */ function(e) {
+}), ye = /* @__PURE__ */ function(e) {
 	return e.RICH_TEXT = "RICH_TEXT", e.NEXT_BUTTON = "NEXT_BUTTON", e.BACK_BUTTON = "BACK_BUTTON", e.SUBMIT_BUTTON = "SUBMIT_BUTTON", e.DIVIDER = "DIVIDER", e.TEXT = "TEXT", e.EMAIL = "EMAIL", e.PASSWORD = "PASSWORD", e.NUMBER = "NUMBER", e.PHONE = "PHONE", e.DATE = "DATE", e.CHECKBOX = "CHECKBOX", e.RADIO = "RADIO", e.SELECT = "SELECT", e.HIDDEN = "HIDDEN", e.LEGAL = "LEGAL", e;
-}({}), xe = /* @__PURE__ */ function(e) {
+}({}), be = /* @__PURE__ */ function(e) {
 	return e.BLOCK = "BLOCK", e.FIELD = "FIELD", e;
-}({}), b = e.object({
+}({}), x = e.object({
 	id: e.string(),
-	category: e.nativeEnum(xe),
-	type: e.nativeEnum(be)
-}), Se = b.extend({
+	category: e.nativeEnum(be),
+	type: e.nativeEnum(ye)
+}), xe = x.extend({
 	category: e.literal("BLOCK"),
 	type: e.literal("RICH_TEXT"),
 	config: e.object({ content: e.string() }).passthrough()
-}), Ce = b.extend({
+}), Se = x.extend({
 	category: e.literal("BLOCK"),
 	type: e.union([
 		e.literal("NEXT_BUTTON"),
@@ -514,13 +514,13 @@ var y = e.object({
 		e.literal("SUBMIT_BUTTON")
 	]),
 	config: e.object({ text: e.string() }).passthrough()
-}), we = b.extend({
+}), Ce = x.extend({
 	category: e.literal("FIELD"),
 	type: e.literal("LEGAL"),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional(),
 	config: e.object({ text: e.string() }).passthrough()
-}), Te = b.extend({
+}), we = x.extend({
 	category: e.literal("FIELD"),
 	type: e.union([
 		e.literal("TEXT"),
@@ -540,38 +540,38 @@ var y = e.object({
 		label: e.string().optional(),
 		placeholder: e.string().optional()
 	}).passthrough()
-}), Ee = e.object({
+}), Te = e.object({
 	id: e.string(),
 	category: e.string(),
 	type: e.string()
-}).passthrough(), De = e.union([
+}).passthrough(), Ee = e.union([
+	xe,
 	Se,
 	Ce,
 	we,
-	Te,
-	Ee
-]), Oe = e.object({
+	Te
+]), De = e.object({
 	id: e.string(),
 	type: e.literal("STEP"),
-	coordinates: y,
+	coordinates: b,
 	alias: e.string().optional(),
 	config: e.object({
-		components: e.array(De),
+		components: e.array(Ee),
 		next_node: e.string()
 	}).passthrough()
-}), ke = e.object({
+}), Oe = e.object({
 	id: e.string(),
 	type: e.literal("FLOW"),
-	coordinates: y,
+	coordinates: b,
 	alias: e.string().optional(),
 	config: e.object({
 		flow_id: e.string(),
 		next_node: e.string()
 	})
-}), Ae = e.object({
+}), ke = e.object({
 	id: e.string(),
 	type: e.literal("ACTION"),
-	coordinates: y,
+	coordinates: b,
 	alias: e.string().optional(),
 	config: e.object({
 		action_type: e.enum(["REDIRECT"]).openapi({ description: "The type of action to perform" }),
@@ -583,29 +583,29 @@ var y = e.object({
 		custom_url: e.string().optional().openapi({ description: "Custom URL when target is 'custom'" }),
 		next_node: e.string().openapi({ description: "The next node to navigate to after action (for non-redirect actions)" })
 	}).passthrough()
-}), je = e.object({
+}), Ae = e.object({
 	id: e.string(),
 	type: e.string(),
-	coordinates: y
-}).passthrough(), Me = e.union([
+	coordinates: b
+}).passthrough(), je = e.union([
+	De,
 	Oe,
 	ke,
-	Ae,
-	je
-]), Ne = e.object({
+	Ae
+]), Me = e.object({
 	next_node: e.string(),
-	coordinates: y
-}).passthrough(), Pe = e.object({
+	coordinates: b
+}).passthrough(), Ne = e.object({
 	resume_flow: e.boolean().optional(),
-	coordinates: y
+	coordinates: b
 }).passthrough();
 e.object({
 	id: e.string(),
 	name: e.string(),
 	languages: e.object({ primary: e.string() }).passthrough(),
-	nodes: e.array(Me),
-	start: Ne,
-	ending: Pe,
+	nodes: e.array(je),
+	start: Me,
+	ending: Ne,
 	created_at: e.string(),
 	updated_at: e.string(),
 	links: e.object({
@@ -617,24 +617,24 @@ e.object({
 	created_at: !0,
 	updated_at: !0
 });
-var Fe = /* @__PURE__ */ function(e) {
+var Pe = /* @__PURE__ */ function(e) {
 	return e.TOKEN = "token", e.ID_TOKEN = "id_token", e.TOKEN_ID_TOKEN = "id_token token", e.CODE = "code", e.CODE_ID_TOKEN = "code id_token", e.CODE_TOKEN = "code token", e.CODE_ID_TOKEN_TOKEN = "code id_token token", e;
-}({}), x = /* @__PURE__ */ function(e) {
+}({}), Fe = /* @__PURE__ */ function(e) {
 	return e.QUERY = "query", e.FRAGMENT = "fragment", e.FORM_POST = "form_post", e.WEB_MESSAGE = "web_message", e.SAML_POST = "saml_post", e;
 }({}), Ie = /* @__PURE__ */ function(e) {
 	return e.S256 = "S256", e.Plain = "plain", e;
-}({}), S = e.union([e.null(), e.object({
+}({}), Le = e.union([e.null(), e.object({
 	essential: e.boolean().optional(),
 	value: e.unknown().optional(),
 	values: e.array(e.unknown()).optional()
-})]).nullable(), Le = e.object({
-	userinfo: e.record(e.string(), S).optional(),
-	id_token: e.record(e.string(), S).optional()
-}), Re = e.object({
+})]).nullable(), Re = e.object({
+	userinfo: e.record(e.string(), Le).optional(),
+	id_token: e.record(e.string(), Le).optional()
+}), ze = e.object({
 	client_id: e.string(),
 	act_as: e.string().optional(),
-	response_type: e.nativeEnum(Fe).optional(),
-	response_mode: e.nativeEnum(x).optional(),
+	response_type: e.nativeEnum(Pe).optional(),
+	response_mode: e.nativeEnum(Fe).optional(),
 	redirect_uri: e.string().optional(),
 	audience: e.string().optional(),
 	organization: e.string().optional(),
@@ -648,7 +648,7 @@ var Fe = /* @__PURE__ */ function(e) {
 	ui_locales: e.string().optional(),
 	max_age: e.number().optional(),
 	acr_values: e.string().optional(),
-	claims: Le.optional(),
+	claims: Re.optional(),
 	vendor_id: e.string().optional()
 });
 e.object({
@@ -671,7 +671,7 @@ e.object({
 		"auto"
 	]).optional()
 });
-var ze = e.enum([
+var Be = e.enum([
 	"password_reset",
 	"email_verification",
 	"otp",
@@ -685,7 +685,7 @@ e.object({
 	code_id: e.string().openapi({ description: "The code that will be used in for instance an email verification flow" }),
 	login_id: e.string().optional().openapi({ description: "The id of the login session that the code is connected to" }),
 	connection_id: e.string().optional().openapi({ description: "The connection that the code is connected to" }),
-	code_type: ze,
+	code_type: Be,
 	code_verifier: e.string().optional().openapi({ description: "The code verifier used in PKCE in outbound flows" }),
 	code_challenge: e.string().optional().openapi({ description: "The code challenge used in PKCE in outbound flows" }),
 	code_challenge_method: e.enum(["plain", "S256"]).optional().openapi({ description: "The code challenge method used in PKCE in outbound flows" }),
@@ -697,7 +697,7 @@ e.object({
 	used_at: e.string().optional(),
 	user_id: e.string().optional()
 }).extend({ created_at: e.string() });
-var Be = e.object({
+var Ve = e.object({
 	kid: e.string().optional(),
 	team_id: e.string().optional(),
 	realms: e.string().optional(),
@@ -817,26 +817,26 @@ var Be = e.object({
 		"never_on_login"
 	]).optional()
 });
-function C(e) {
+function S(e) {
 	if (e !== null) {
-		if (Array.isArray(e)) return e.filter((e) => e !== null).map(C);
+		if (Array.isArray(e)) return e.filter((e) => e !== null).map(S);
 		if (e && typeof e == "object") {
 			let t = {};
-			for (let [n, r] of Object.entries(e)) r !== null && (t[n] = C(r));
+			for (let [n, r] of Object.entries(e)) r !== null && (t[n] = S(r));
 			return t;
 		}
 		return e;
 	}
 }
-var Ve = e.object({
+var He = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	display_name: e.string().optional(),
 	strategy: e.string(),
-	options: e.preprocess((e) => e === null ? {} : C(e), Be).default({}),
+	options: e.preprocess((e) => e === null ? {} : S(e), Ve).default({}),
 	enabled_clients: e.array(e.string()).default([]).optional(),
-	response_type: e.nativeEnum(Fe).optional(),
-	response_mode: e.nativeEnum(x).optional(),
+	response_type: e.nativeEnum(Pe).optional(),
+	response_mode: e.nativeEnum(Fe).optional(),
 	is_domain_connection: e.boolean().optional(),
 	show_as_button: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional(),
@@ -846,8 +846,8 @@ e.object({
 	id: e.string(),
 	created_at: e.string().transform((e) => e === null ? "" : e),
 	updated_at: e.string().transform((e) => e === null ? "" : e)
-}).extend(Ve.shape);
-var He = e.object({
+}).extend(He.shape);
+var Ue = e.object({
 	domain: e.string(),
 	custom_domain_id: e.string().optional(),
 	type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -861,7 +861,7 @@ var He = e.object({
 		"null"
 	]).optional(),
 	domain_metadata: e.record(e.string(), e.string().max(255)).optional()
-}), Ue = e.discriminatedUnion("name", [e.object({
+}), We = e.discriminatedUnion("name", [e.object({
 	name: e.literal("txt"),
 	record: e.string(),
 	domain: e.string()
@@ -869,7 +869,7 @@ var He = e.object({
 	name: e.literal("http"),
 	http_body: e.string(),
 	http_url: e.string()
-})]), We = He.extend({
+})]), Ge = Ue.extend({
 	custom_domain_id: e.string(),
 	primary: e.boolean(),
 	status: e.enum([
@@ -879,28 +879,28 @@ var He = e.object({
 		"ready"
 	]),
 	origin_domain_name: e.string().optional(),
-	verification: e.object({ methods: e.array(Ue) }).optional(),
+	verification: e.object({ methods: e.array(We) }).optional(),
 	tls_policy: e.string().optional()
 });
-He.pick({
+Ue.pick({
 	tls_policy: !0,
 	custom_client_ip_header: !0,
 	domain_metadata: !0
-}).strict(), We.extend({ tenant_id: e.string() }), e.object({
+}).strict(), Ge.extend({ tenant_id: e.string() }), e.object({
 	certificate: e.string().regex(/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/, "must be PEM-encoded; include the full certificate chain in leaf-first order"),
 	private_key: e.string().regex(/-----BEGIN (RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+-----END \1PRIVATE KEY-----\s*$/, "must be a PEM-encoded private key")
 });
-var w = e.object({
+var C = e.object({
 	id: e.string(),
 	order: e.number().optional(),
 	visible: e.boolean().optional().default(!0)
-}), T = w.extend({ category: e.literal("BLOCK").optional() }), Ge = T.extend({
+}), w = C.extend({ category: e.literal("BLOCK").optional() }), Ke = w.extend({
 	type: e.literal("DIVIDER"),
 	config: e.object({ text: e.string().optional() }).optional()
-}), Ke = T.extend({
+}), qe = w.extend({
 	type: e.literal("HTML"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), qe = T.extend({
+}), Je = w.extend({
 	type: e.literal("IMAGE"),
 	config: e.object({
 		src: e.string().optional(),
@@ -908,43 +908,43 @@ var w = e.object({
 		width: e.number().optional(),
 		height: e.number().optional()
 	}).optional()
-}), Je = T.extend({
+}), Ye = w.extend({
 	type: e.literal("JUMP_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		target_step: e.string().optional()
 	})
-}), Ye = T.extend({
+}), Xe = w.extend({
 	type: e.literal("RESEND_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		resend_action: e.string().optional()
 	})
-}), Xe = T.extend({
+}), Ze = w.extend({
 	type: e.literal("NEXT_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), Ze = T.extend({
+}), Qe = w.extend({
 	type: e.literal("PREVIOUS_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), Qe = T.extend({
+}), $e = w.extend({
 	type: e.literal("RICH_TEXT"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), E = w.extend({
+}), T = C.extend({
 	category: e.literal("WIDGET").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), $e = E.extend({
+}), et = T.extend({
 	type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
 	config: e.object({ credential_type: e.string().optional() })
-}), et = E.extend({
+}), tt = T.extend({
 	type: e.literal("GMAPS_ADDRESS"),
 	config: e.object({ api_key: e.string().optional() })
-}), tt = E.extend({
+}), nt = T.extend({
 	type: e.literal("RECAPTCHA"),
 	config: e.object({ site_key: e.string().optional() })
-}), D = w.extend({
+}), E = C.extend({
 	category: e.literal("FIELD").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
@@ -960,10 +960,10 @@ var w = e.object({
 	})).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), nt = D.extend({
+}), rt = E.extend({
 	type: e.literal("BOOLEAN"),
 	config: e.object({ default_value: e.boolean().optional() }).optional()
-}), rt = D.extend({
+}), it = E.extend({
 	type: e.literal("CARDS"),
 	config: e.object({
 		options: e.array(e.object({
@@ -974,7 +974,7 @@ var w = e.object({
 		})).optional(),
 		multi_select: e.boolean().optional()
 	}).optional()
-}), it = D.extend({
+}), at = E.extend({
 	type: e.literal("CHOICE"),
 	config: e.object({
 		options: e.array(e.object({
@@ -985,7 +985,7 @@ var w = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), at = D.extend({
+}), ot = E.extend({
 	type: e.literal("CODE"),
 	config: e.object({
 		length: e.number().int().positive().max(100).optional(),
@@ -1002,7 +1002,7 @@ var w = e.object({
 		message: "default_value is longer than the configured length",
 		path: ["default_value"]
 	}).optional()
-}), ot = D.extend({
+}), st = E.extend({
 	type: e.literal("CUSTOM"),
 	config: e.object({
 		component: e.string().optional(),
@@ -1010,7 +1010,7 @@ var w = e.object({
 		schema: e.record(e.string(), e.any()).optional(),
 		code: e.string().optional()
 	})
-}), st = D.extend({
+}), ct = E.extend({
 	type: e.literal("DATE"),
 	config: e.object({
 		format: e.string().optional(),
@@ -1018,7 +1018,7 @@ var w = e.object({
 		max: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), ct = D.extend({
+}), lt = E.extend({
 	type: e.literal("DROPDOWN"),
 	config: e.object({
 		options: e.array(e.object({
@@ -1030,7 +1030,7 @@ var w = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), lt = D.extend({
+}), ut = E.extend({
 	type: e.literal("EMAIL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1038,20 +1038,20 @@ var w = e.object({
 		last_used: e.boolean().optional(),
 		last_used_label: e.string().optional()
 	}).optional()
-}), ut = D.extend({
+}), dt = E.extend({
 	type: e.literal("FILE"),
 	config: e.object({
 		accept: e.string().optional(),
 		max_size: e.number().optional(),
 		multiple: e.boolean().optional()
 	}).optional()
-}), dt = D.extend({
+}), ft = E.extend({
 	type: e.literal("LEGAL"),
 	config: e.object({
 		text: e.string(),
 		html: e.boolean().optional()
 	}).optional()
-}), ft = D.extend({
+}), pt = E.extend({
 	type: e.literal("NUMBER"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1060,7 +1060,7 @@ var w = e.object({
 		step: e.number().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), pt = D.extend({
+}), mt = E.extend({
 	type: e.literal("PASSWORD"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1069,13 +1069,13 @@ var w = e.object({
 		forgot_password_link: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), mt = D.extend({
+}), ht = E.extend({
 	type: e.literal("PAYMENT"),
 	config: e.object({
 		provider: e.string().optional(),
 		currency: e.string().optional()
 	}).optional()
-}), ht = D.extend({
+}), gt = E.extend({
 	type: e.literal("SOCIAL"),
 	config: e.object({
 		providers: e.array(e.string()).optional(),
@@ -1089,7 +1089,7 @@ var w = e.object({
 			last_used_label: e.string().optional()
 		})).optional()
 	}).optional()
-}), gt = D.extend({
+}), _t = E.extend({
 	type: e.literal("TEL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1097,7 +1097,7 @@ var w = e.object({
 		default_value: e.string().optional(),
 		allow_email: e.boolean().optional()
 	}).optional()
-}), _t = D.extend({
+}), vt = E.extend({
 	type: e.literal("TEXT"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1107,38 +1107,37 @@ var w = e.object({
 		last_used: e.boolean().optional(),
 		last_used_label: e.string().optional()
 	}).optional()
-}), vt = D.extend({
+}), yt = E.extend({
 	type: e.literal("COUNTRY"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), yt = D.extend({
+}), bt = E.extend({
 	type: e.literal("URL"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), bt = e.discriminatedUnion("type", [
-	Ge,
+}), xt = e.discriminatedUnion("type", [
 	Ke,
 	qe,
 	Je,
 	Ye,
 	Xe,
 	Ze,
-	Qe
-]), xt = e.discriminatedUnion("type", [
-	$e,
-	et,
-	tt
+	Qe,
+	$e
 ]), St = e.discriminatedUnion("type", [
-	nt,
+	et,
+	tt,
+	nt
+]), Ct = e.discriminatedUnion("type", [
 	rt,
 	it,
 	at,
-	vt,
 	ot,
+	yt,
 	st,
 	ct,
 	lt,
@@ -1150,11 +1149,12 @@ var w = e.object({
 	ht,
 	gt,
 	_t,
-	yt
-]), Ct = e.union([
-	bt,
+	vt,
+	bt
+]), D = e.union([
 	xt,
-	St
+	St,
+	Ct
 ]);
 new Set([
 	"BOOLEAN",
@@ -1213,7 +1213,7 @@ var O = e.object({
 	coordinates: O,
 	alias: e.string().min(1).max(150).optional(),
 	config: e.object({
-		components: e.array(Ct),
+		components: e.array(D),
 		next_node: e.string().optional()
 	})
 }), Dt = e.discriminatedUnion("type", [
@@ -1277,7 +1277,7 @@ e.object({
 	method: e.enum(["POST", "GET"]),
 	title: e.string().optional(),
 	description: e.string().optional(),
-	components: e.array(Ct),
+	components: e.array(D),
 	messages: e.array(kt).optional(),
 	links: e.array(At).optional(),
 	footer: e.string().optional()
@@ -1485,7 +1485,7 @@ var qt = /* @__PURE__ */ function(e) {
 e.object({
 	csrf_token: e.string(),
 	auth0Client: e.string().optional(),
-	authParams: Re,
+	authParams: ze,
 	expires_at: e.string(),
 	deleted_at: e.string().optional(),
 	ip: e.string().optional(),
@@ -2730,7 +2730,29 @@ function H(e, t) {
 	let n = new AbortController(), r = setTimeout(() => n.abort(), e);
 	return t(n.signal).finally(() => clearTimeout(r));
 }
-function U(e, t, n) {
+function er(e) {
+	let t = e.filter((e) => e !== void 0);
+	if (t.length <= 1) return t[0];
+	if (typeof AbortSignal.any == "function") return AbortSignal.any(t);
+	let n = new AbortController(), r = t.find((e) => e.aborted);
+	if (r) return n.abort(r.reason), n.signal;
+	let i = () => {
+		for (let e of t) e.removeEventListener("abort", i);
+		n.abort(t.find((e) => e.aborted)?.reason);
+	};
+	for (let e of t) e.addEventListener("abort", i);
+	return n.signal;
+}
+function U(e, t, n, r) {
+	let i = new AbortController(), a = er([n, i.signal]) ?? i.signal, o, s = new Promise((n, r) => {
+		o = setTimeout(() => {
+			let n = new B(e, t);
+			i.abort(n), r(n);
+		}, e);
+	});
+	return Promise.race([Promise.resolve().then(() => r(a)), s]).finally(() => clearTimeout(o));
+}
+function W(e, t, n) {
 	let r, i = new Promise((e, i) => {
 		r = setTimeout(() => i(new B(t, n)), t);
 	});
@@ -2740,12 +2762,12 @@ function U(e, t, n) {
 }
 //#endregion
 //#region src/data-plane/cache.ts
-var er = 1e4, tr = 8e3;
-function W(e, t, n) {
+var tr = 1e4, nr = 8e3;
+function G(e, t, n) {
 	let r = typeof t == "number" ? {
 		freshTtlMs: t,
 		maxEntries: n
-	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? er, l = r.waitUntil, u = r.upstreamTimeoutMs ?? tr, d = u > 0 ? u : 1e4, f = /* @__PURE__ */ new Map();
+	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? tr, l = r.waitUntil, u = r.upstreamTimeoutMs ?? nr, d = u > 0 ? u : 1e4, f = /* @__PURE__ */ new Map();
 	function p(e) {
 		for (let [t, n] of f) n.stale_if_error_until <= e && n.stale_until <= e && f.delete(t);
 		for (; f.size >= c;) {
@@ -2766,42 +2788,41 @@ function W(e, t, n) {
 	function h(e, t) {
 		return e.refresh_started_at === void 0 ? !1 : t - e.refresh_started_at < d ? !0 : (e.refresh_started_at = void 0, !1);
 	}
-	function g(t) {
-		let n = e.resolveHost(t);
-		return u > 0 ? U(n, u, "resolveHost") : n;
+	function g(t, n) {
+		return u > 0 ? U(u, "resolveHost", n, (n) => e.resolveHost(t, { signal: n })) : e.resolveHost(t, { signal: n });
 	}
-	async function _(e) {
-		let t = f.get(e);
-		t && (t.refresh_started_at = Date.now());
+	async function _(e, t) {
+		let n = f.get(e);
+		n && (n.refresh_started_at = Date.now());
 		try {
-			let t = await g(e);
-			return m(e, t, Date.now()), t;
+			let n = await g(e, t);
+			return m(e, n, Date.now()), n;
 		} catch (t) {
 			let n = f.get(e);
 			throw n && (n.refresh_started_at = void 0, n.stale_if_error_until <= Date.now() && f.delete(e)), t;
 		}
 	}
-	return { async resolveHost(e) {
-		let t = Date.now(), n = f.get(e);
-		if (n && n.fresh_until > t) return f.delete(e), f.set(e, n), n.value;
-		if (n && n.stale_until > t) {
-			if (f.delete(e), f.set(e, n), !h(n, t)) {
+	return { async resolveHost(e, t) {
+		let n = Date.now(), r = f.get(e);
+		if (r && r.fresh_until > n) return f.delete(e), f.set(e, r), r.value;
+		if (r && r.stale_until > n) {
+			if (f.delete(e), f.set(e, r), !h(r, n)) {
 				let t = _(e).catch(() => void 0);
 				l && l(t);
 			}
-			return n.value;
+			return r.value;
 		}
 		try {
-			return await _(e);
+			return await _(e, t?.signal);
 		} catch (e) {
-			if (n && n.stale_if_error_until > t) return n.value;
+			if (r && r.stale_if_error_until > n) return r.value;
 			throw e;
 		}
 	} };
 }
 //#endregion
 //#region src/data-plane/registry.ts
-var nr = class {
+var rr = class {
 	definitions = /* @__PURE__ */ new Map();
 	bindings;
 	constructor(e = {}) {
@@ -2821,23 +2842,20 @@ var nr = class {
 		return n.build(r.data, { bindings: this.bindings });
 	}
 };
-function G(e) {
+function K(e) {
 	return e;
 }
 //#endregion
 //#region src/data-plane/handlers/util.ts
-var rr = "__authhero_proxy_request__", ir = "__authhero_proxy_tenant_id__", ar = "__authhero_proxy_custom_domain_id__", or = "__authhero_proxy_domain__", sr = "x-authhero-proxy-mutability-probe";
-function cr(e, t) {
-	e.set(rr, t);
-}
-function K(e) {
-	return e.get(rr) ?? e.req.raw;
-}
+var ir = "__authhero_proxy_request__", ar = "__authhero_proxy_tenant_id__", or = "__authhero_proxy_custom_domain_id__", sr = "__authhero_proxy_domain__", cr = "x-authhero-proxy-mutability-probe";
 function lr(e, t) {
-	e.set(ir, t.tenant_id), e.set(ar, t.custom_domain_id), e.set(or, t.domain);
+	e.set(ir, t);
+}
+function q(e) {
+	return e.get(ir) ?? e.req.raw;
 }
-function ur(e) {
-	return e.get(ir);
+function ur(e, t) {
+	e.set(ar, t.tenant_id), e.set(or, t.custom_domain_id), e.set(sr, t.domain);
 }
 function dr(e) {
 	return e.get(ar);
@@ -2845,14 +2863,17 @@ function dr(e) {
 function fr(e) {
 	return e.get(or);
 }
-function pr(e, t) {
-	let n = K(e), r = new Headers(n.headers);
-	t(r), cr(e, new Request(n, { headers: r }));
+function pr(e) {
+	return e.get(sr);
 }
-function q(e) {
+function mr(e, t) {
+	let n = q(e), r = new Headers(n.headers);
+	t(r), lr(e, new Request(n, { headers: r }));
+}
+function J(e) {
 	let t = e.res;
 	try {
-		t.headers.append(sr, "1"), t.headers.delete(sr);
+		t.headers.append(cr, "1"), t.headers.delete(cr);
 		return;
 	} catch {
 		e.res = new Response(t.body, {
@@ -2864,7 +2885,7 @@ function q(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var mr = e.object({
+var hr = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2872,44 +2893,44 @@ var mr = e.object({
 	expose_headers: e.array(e.string()).optional(),
 	max_age: e.number().int().optional()
 }).refine((e) => !(e.allow_credentials && e.origins?.includes("*")), { message: "Cannot use wildcard origin (*) with allow_credentials" });
-function hr(e, t) {
+function gr(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var gr = G({
+var _r = K({
 	type: "cors",
-	optionsSchema: mr,
+	optionsSchema: hr,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
 			if (t.req.method === "OPTIONS" && r !== null && t.req.header("access-control-request-method") !== void 0) {
-				let t = hr(e, r);
+				let t = gr(e, r);
 				return new Response(null, {
 					status: 204,
 					headers: t
 				});
 			}
 			await n();
-			let i = hr(e, r);
-			q(t), i.forEach((e, n) => {
+			let i = gr(e, r);
+			J(t), i.forEach((e, n) => {
 				n.toLowerCase() === "vary" ? t.res.headers.append(n, e) : t.res.headers.set(n, e);
 			});
 		};
 	}
-}), _r = e.object({
+}), vr = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function vr(e, t) {
+function yr(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var yr = G({
+var br = K({
 	type: "basic_auth",
-	optionsSchema: _r,
+	optionsSchema: vr,
 	build(e) {
-		let t = vr(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = yr(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2925,7 +2946,7 @@ var yr = G({
 			});
 		};
 	}
-}), br = G({
+}), xr = K({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2935,23 +2956,23 @@ var yr = G({
 	}),
 	build(e) {
 		return async (t, n) => {
-			if ((e.request || e.remove_request) && pr(t, (t) => {
+			if ((e.request || e.remove_request) && mr(t, (t) => {
 				if (e.remove_request?.forEach((e) => t.delete(e)), e.request) for (let [n, r] of Object.entries(e.request)) t.set(n, r);
-			}), await n(), (e.response || e.remove_response) && (q(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
+			}), await n(), (e.response || e.remove_response) && (J(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), xr = G({
+}), Sr = K({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
 		return async (t, n) => {
 			if (await n(), !t.res.headers.has("Cache-Control")) {
 				let n = t.res.headers.has("set-cookie") ? "private" : "public";
-				q(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
+				J(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
 			}
 		};
 	}
-}), Sr = [
+}), Cr = [
 	"173.245.48.0/20",
 	"103.21.244.0/22",
 	"103.22.200.0/22",
@@ -2975,7 +2996,7 @@ var yr = G({
 	"2a06:98c0::/29",
 	"2c0f:f248::/32"
 ];
-function Cr(e) {
+function wr(e) {
 	let t = e.split(".");
 	if (t.length !== 4) return null;
 	let n = [];
@@ -2987,14 +3008,14 @@ function Cr(e) {
 	}
 	return n;
 }
-function wr(e) {
+function Tr(e) {
 	if (e === "") return [];
 	let t = e.split(":"), n = [];
 	for (let e = 0; e < t.length; e++) {
 		let r = t[e];
 		if (r.includes(".")) {
 			if (e !== t.length - 1) return null;
-			let i = Cr(r);
+			let i = wr(r);
 			if (!i) return null;
 			n.push(i[0] << 8 | i[1], i[2] << 8 | i[3]);
 			continue;
@@ -3004,14 +3025,14 @@ function wr(e) {
 	}
 	return n;
 }
-function Tr(e) {
+function Er(e) {
 	let t = e.split("::");
 	if (t.length > 2) return null;
-	let n = wr(t[0] ?? "");
+	let n = Tr(t[0] ?? "");
 	if (!n) return null;
 	let r;
 	if (t.length === 2) {
-		let e = wr(t[1] ?? "");
+		let e = Tr(t[1] ?? "");
 		if (!e) return null;
 		let i = 8 - n.length - e.length;
 		if (i < 1) return null;
@@ -3026,25 +3047,25 @@ function Tr(e) {
 	for (let e of r) i.push(e >> 8 & 255, e & 255);
 	return i;
 }
-function Er(e) {
+function Dr(e) {
 	let t = e.trim();
 	t.startsWith("[") && t.endsWith("]") && (t = t.slice(1, -1));
 	let n = t.indexOf("%");
 	if (n !== -1 && (t = t.slice(0, n)), t === "") return null;
-	if (!t.includes(":")) return Cr(t);
-	let r = Tr(t);
+	if (!t.includes(":")) return wr(t);
+	let r = Er(t);
 	return r ? r.slice(0, 10).every((e) => e === 0) && r[10] === 255 && r[11] === 255 ? r.slice(12) : r : null;
 }
-function Dr(e) {
-	let [t, n] = e.split("/"), r = Er(t ?? ""), i = Number(n);
+function Or(e) {
+	let [t, n] = e.split("/"), r = Dr(t ?? ""), i = Number(n);
 	if (!r || !Number.isInteger(i)) throw Error(`Invalid Cloudflare CIDR: ${e}`);
 	return {
 		bytes: r,
 		prefixBits: i
 	};
 }
-var Or = Sr.map(Dr);
-function kr(e, t) {
+var kr = Cr.map(Or);
+function Ar(e, t) {
 	if (e.length !== t.bytes.length) return !1;
 	let n = t.prefixBits >> 3;
 	for (let r = 0; r < n; r++) if (e[r] !== t.bytes[r]) return !1;
@@ -3053,11 +3074,11 @@ function kr(e, t) {
 	let i = 255 << 8 - r & 255;
 	return (e[n] & i) === (t.bytes[n] & i);
 }
-function Ar(e) {
-	let t = Er(e);
-	return t ? Or.some((e) => kr(t, e)) : !1;
+function jr(e) {
+	let t = Dr(e);
+	return t ? kr.some((e) => Ar(t, e)) : !1;
 }
-var jr = G({
+var Mr = K({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
@@ -3068,46 +3089,46 @@ var jr = G({
 	build(e) {
 		return async (t, n) => {
 			let r = new URL(t.req.url);
-			pr(t, (n) => {
+			mr(t, (n) => {
 				n.set("x-forwarded-host", r.host), n.set("x-forwarded-proto", r.protocol.replace(":", "")), e.set_x_original_url && n.set("x-original-url", t.req.url);
-				let i = n.get(e.client_ip_header), a = i && e.skip_cloudflare_client_ip && Ar(i) ? null : i, o = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), s = a ?? o[o.length - 1] ?? "127.0.0.1", c = o.length === 0 || o[o.length - 1] !== s, l = o.length ? c ? `${o.join(", ")}, ${s}` : o.join(", ") : s;
+				let i = n.get(e.client_ip_header), a = i && e.skip_cloudflare_client_ip && jr(i) ? null : i, o = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), s = a ?? o[o.length - 1] ?? "127.0.0.1", c = o.length === 0 || o[o.length - 1] !== s, l = o.length ? c ? `${o.join(", ")}, ${s}` : o.join(", ") : s;
 				n.set("x-forwarded-for", l), e.set_x_real_ip && n.set("x-real-ip", s);
 			}), await n();
 		};
 	}
-}), Mr = e.object({ upstream_host: e.string().optional() });
-function Nr(e) {
+}), Nr = e.object({ upstream_host: e.string().optional() });
+function Pr(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function Pr(e) {
+function Fr(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var Fr = G({
+var Ir = K({
 	type: "rewrite_cookies",
-	optionsSchema: Mr,
+	optionsSchema: Nr,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = Pr(t.res.headers);
+			let a = Fr(t.res.headers);
 			if (a.length === 0) return;
-			let o = Nr(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
-			q(t), t.res.headers.delete("set-cookie");
+			let o = Pr(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			J(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), Ir = G({
+}), Lr = K({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
 		return async (t, n) => {
 			if (await n(), t.res.headers.has("x-authhero-preserve-location")) {
-				q(t), t.res.headers.delete($n);
+				J(t), t.res.headers.delete($n);
 				return;
 			}
 			let r = t.res.status;
@@ -3124,10 +3145,10 @@ var Fr = G({
 			}
 			if (o.origin !== a) return;
 			let s = new URL(t.req.url), c = `${`${s.protocol}//${s.host}`}${o.pathname}${o.search}${o.hash}`;
-			q(t), t.res.headers.set("location", c);
+			J(t), t.res.headers.set("location", c);
 		};
 	}
-}), Lr = new Set([
+}), Rr = new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -3136,45 +3157,92 @@ var Fr = G({
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), Rr = 3e4, zr = e.object({
+]), zr = 3e4, Br = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Br(e, t) {
+function Vr(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function Vr(e) {
+function Hr(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function Hr(e, t) {
-	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = Br(r.pathname, n.pathname), r.search = n.search;
-	let i = new Headers(t.headers);
-	for (let e of Lr) i.delete(e);
-	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = Vr(t.method) ? t.body : void 0, o = {
+var Ur = 128 * 1024;
+function Wr(e) {
+	let t = e.headers.get("content-length");
+	if (t === null) return null;
+	let n = Number(t);
+	return Number.isInteger(n) && n >= 0 ? n : null;
+}
+async function Gr(e, t) {
+	let n = e.getReader(), r = !1, i = setTimeout(() => {
+		r = !0, n.cancel().catch(() => {});
+	}, t), a = [], o = 0;
+	try {
+		for (;;) {
+			let { done: e, value: i } = await n.read();
+			if (r) throw new B(t, "Request body read");
+			if (e) break;
+			a.push(i), o += i.byteLength;
+		}
+	} finally {
+		clearTimeout(i);
+	}
+	let s = new Uint8Array(o), c = 0;
+	for (let e of a) s.set(e, c), c += e.byteLength;
+	return s.buffer;
+}
+function Kr(e) {
+	return V(e) ? new Response("Request body timeout", {
+		status: 408,
+		headers: { "x-authhero-proxy-error": "request_body_timeout" }
+	}) : new Response("Bad request", {
+		status: 400,
+		headers: { "x-authhero-proxy-error": "request_body_failed" }
+	});
+}
+async function qr(e, t, n) {
+	if (!Hr(e.method) || !e.body) return;
+	let r = Wr(e);
+	if (r === null || r > Ur) return e.body;
+	let i = await Gr(e.body, n);
+	return t.set("content-length", String(i.byteLength)), i;
+}
+async function Jr(e, t, n) {
+	let r = new URL(t.url), i = new URL(e.upstream_url);
+	i.pathname = Vr(i.pathname, r.pathname), i.search = r.search;
+	let a = new Headers(t.headers);
+	for (let e of Rr) a.delete(e);
+	e.preserve_host || a.set("host", i.host), a.has("x-forwarded-host") || a.set("x-forwarded-host", r.host), a.has("x-forwarded-proto") || a.set("x-forwarded-proto", r.protocol.replace(":", ""));
+	let o = await qr(t, a, n), s = {
 		method: t.method,
-		headers: i,
-		body: a,
+		headers: a,
+		body: o,
 		redirect: "manual"
 	};
-	return a instanceof ReadableStream && (o.duplex = "half"), {
-		target: r,
-		init: o
+	return o instanceof ReadableStream && (s.duplex = "half"), {
+		target: i,
+		init: s
 	};
 }
-var Ur = G({
+var Yr = K({
 	type: "http",
-	optionsSchema: zr,
+	optionsSchema: Br,
 	build(e) {
-		let t = e.timeout_ms ?? Rr;
+		let t = e.timeout_ms ?? zr;
 		return async (n) => {
-			let { target: r, init: i } = Hr(e, K(n));
-			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
+			let r = q(n), i;
 			try {
-				return await H(t, (e) => fetch(r.toString(), {
-					...i,
+				i = await Jr(e, r, t);
+			} catch (e) {
+				return Kr(e);
+			}
+			let { target: a, init: o } = i;
+			n.set("__proxy_upstream_host__", a.hostname), n.set("__proxy_upstream_origin__", `${a.protocol}//${a.host}`);
+			try {
+				return await H(t, (e) => fetch(a.toString(), {
+					...o,
 					signal: e
 				}));
 			} catch (e) {
@@ -3182,31 +3250,37 @@ var Ur = G({
 			}
 		};
 	}
-}), Wr = 3e4, Gr = e.object({
+}), Xr = 3e4, Zr = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
 	preserve_host: e.boolean().default(!0),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Kr(e) {
+function Qr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var qr = G({
+var $r = K({
 	type: "service_binding",
-	optionsSchema: Gr,
+	optionsSchema: Zr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!Kr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
-		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? Wr;
+		if (!Qr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? Xr;
 		return async (t) => {
-			let a = K(t), { target: o, init: s } = Hr({
-				upstream_url: r,
-				preserve_host: e.preserve_host
-			}, a);
-			t.set("__proxy_upstream_host__", o.hostname), t.set("__proxy_upstream_origin__", `${o.protocol}//${o.host}`);
+			let a = q(t), o;
 			try {
-				return await H(i, async (e) => n.fetch(new Request(o.toString(), {
-					...s,
+				o = await Jr({
+					upstream_url: r,
+					preserve_host: e.preserve_host
+				}, a, i);
+			} catch (e) {
+				return Kr(e);
+			}
+			let { target: s, init: c } = o;
+			t.set("__proxy_upstream_host__", s.hostname), t.set("__proxy_upstream_origin__", `${s.protocol}//${s.host}`);
+			try {
+				return await H(i, async (e) => n.fetch(new Request(s.toString(), {
+					...c,
 					signal: e
 				})));
 			} catch (e) {
@@ -3214,35 +3288,35 @@ var qr = G({
 			}
 		};
 	}
-}), Jr = 3e4, Yr = e.object({
+}), ei = 3e4, ti = e.object({
 	binding: e.string(),
 	script_name: e.string(),
 	cpu_ms: e.number().int().positive().optional(),
 	subrequests: e.number().int().positive().optional(),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Xr(e) {
+function ni(e) {
 	return typeof e == "object" && !!e && typeof e.get == "function";
 }
-var J = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
-function Zr(e) {
-	return J.lastIndex = 0, J.test(e);
+var Y = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
+function ri(e) {
+	return Y.lastIndex = 0, Y.test(e);
 }
-var Qr = G({
+var ii = K({
 	type: "dispatch_namespace",
-	optionsSchema: Yr,
+	optionsSchema: ti,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!Xr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
-		let r = Zr(e.script_name), i = e.timeout_ms ?? Jr, a = e.cpu_ms || e.subrequests ? { limits: {
+		if (!ni(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = ri(e.script_name), i = e.timeout_ms ?? ei, a = e.cpu_ms || e.subrequests ? { limits: {
 			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
 			...e.subrequests ? { subrequests: e.subrequests } : {}
 		} } : void 0;
 		return async (t) => {
 			let o = e.script_name;
 			if (r) {
-				let n = ur(t), r = dr(t), i = fr(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
-				if (o = o.replace(J, (e, t) => {
+				let n = dr(t), r = fr(t), i = pr(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				if (o = o.replace(Y, (e, t) => {
 					switch (t) {
 						case "tenant_id": return n ?? "";
 						case "custom_domain_id": return r ?? "";
@@ -3252,7 +3326,7 @@ var Qr = G({
 					}
 				}), o.includes("{") || o === "") return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`, 500);
 			}
-			let s = K(t);
+			let s = q(t);
 			try {
 				let e = n.get(o, void 0, a);
 				return await H(i, async (t) => {
@@ -3264,7 +3338,7 @@ var Qr = G({
 			}
 		};
 	}
-}), $r = G({
+}), ai = K({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -3293,7 +3367,7 @@ var Qr = G({
 			});
 		};
 	}
-}), ei = G({
+}), oi = K({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -3313,15 +3387,15 @@ var Qr = G({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function ti(e) {
-	e.add(gr).add(yr).add(br).add(xr).add(jr).add(Fr).add(Ir).add(Ur).add(qr).add(Qr).add($r).add(ei);
+function si(e) {
+	e.add(_r).add(br).add(xr).add(Sr).add(Mr).add(Ir).add(Lr).add(Yr).add($r).add(ii).add(ai).add(oi);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
-function ni(e) {
+function ci(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function ri(e, t) {
+function li(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -3330,13 +3404,13 @@ function ri(e, t) {
 	}
 	return !1;
 }
-function ii(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => ri(e, t));
+function ui(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => li(e, t));
 }
-function ai(e) {
+function di(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !ii(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r && !ui(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -3353,17 +3427,17 @@ function ai(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var oi = "forwarded_headers";
-function si(e) {
+var fi = "forwarded_headers";
+function pi(e) {
 	return e.some((e) => e.type === "forwarded_headers") ? [...e] : [{
-		type: oi,
+		type: fi,
 		options: {}
 	}, ...e];
 }
-function Y(e, t) {
-	return e.has("forwarded_headers") ? si(t) : [...t];
+function X(e, t) {
+	return e.has("forwarded_headers") ? pi(t) : [...t];
 }
-var ci = [
+var mi = [
 	"GET",
 	"POST",
 	"PUT",
@@ -3372,45 +3446,45 @@ var ci = [
 	"OPTIONS",
 	"HEAD"
 ];
-function X(e, n, r, i) {
+function Z(e, n, r, i) {
 	let a = new t();
 	r && a.use("*", async (e, t) => {
-		lr(e, r), await t();
+		ur(e, r), await t();
 	});
-	let o = ni(e);
+	let o = ci(e);
 	for (let e of o) {
 		let t = [];
-		t.push(ai(e.match));
-		for (let r of Y(n, e.handlers)) t.push(n.build(r.type, r.options));
-		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : ci, i = e.match.path || "/*";
+		t.push(di(e.match));
+		for (let r of X(n, e.handlers)) t.push(n.build(r.type, r.options));
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : mi, i = e.match.path || "/*";
 		a.on(r, [i], ...t);
 	}
-	return i && i.length > 0 ? a.on(ci, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
+	return i && i.length > 0 ? a.on(mi, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
 		let n = V(e);
 		return t.text(n ? "Upstream timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "handler_timeout" : "handler_failed" });
 	}), a;
 }
 //#endregion
 //#region src/data-plane/router.ts
-var li = 1e4;
-function ui(e) {
-	return e.resolver ? e.resolver : e.cache ? W(e.data, e.cache) : W(e.data, e.cacheTtlMs ?? 3e4);
+var hi = 1e4;
+function gi(e) {
+	return e.resolver ? e.resolver : e.cache ? G(e.data, e.cache) : G(e.data, e.cacheTtlMs ?? 3e4);
 }
-function di(e) {
+function _i(e) {
 	if (e.registry) return e.registry;
-	let t = new nr(e.bindings ?? {});
-	return ti(t), t;
+	let t = new rr(e.bindings ?? {});
+	return si(t), t;
 }
-function Z(e) {
-	let t = ui(e), n = di(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? li, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? Y(n, e.defaultHandlers).map((e) => n.build(e.type, e.options)) : void 0, o = a ? X([], n, void 0, a) : void 0;
+function Q(e) {
+	let t = gi(e), n = _i(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? hi, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? X(n, e.defaultHandlers).map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
 	return async (e) => {
 		let s = e.req.header("host") ?? e.req.header("x-forwarded-host");
 		if (!s) return e.text("Missing host", 400);
 		try {
-			let c = await U(t.resolveHost(s), i, "resolveHost");
+			let c = await U(i, "resolveHost", void 0, (e) => t.resolveHost(s, { signal: e }));
 			if (!c) return o ? await o.fetch(e.req.raw) : e.text("Unknown host", 404);
 			let l = r.get(c);
-			return l || (l = X(c.routes, n, {
+			return l || (l = Z(c.routes, n, {
 				tenant_id: c.tenant_id,
 				custom_domain_id: c.custom_domain_id,
 				domain: c.domain
@@ -3420,15 +3494,15 @@ function Z(e) {
 		}
 	};
 }
-function fi(e) {
+function vi(e) {
 	let n = new t();
-	return n.all("*", Z(e)), n;
+	return n.all("*", Q(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function pi(e) {
+function yi(e) {
 	let n = new t();
-	return n.all("*", Z({
+	return n.all("*", Q({
 		data: e.data,
 		cacheTtlMs: e.cacheTtlMs,
 		cache: e.cache,
@@ -3444,110 +3518,109 @@ function pi(e) {
 }
 //#endregion
 //#region src/data-plane/cache-api-cache.ts
-var mi = 1e3, hi = 1e3;
-function gi(e, t) {
+var bi = 1e3, xi = 1e3;
+function Si(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function _i() {
+function Ci() {
 	return globalThis.caches?.default;
 }
-function vi(e) {
-	let t = e.cache ?? _i();
+function wi(e) {
+	let t = e.cache ?? Ci();
 	if (!t) return e.upstream;
-	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? mi, c = e.cacheWriteTimeoutMs ?? hi;
+	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? bi, c = e.cacheWriteTimeoutMs ?? xi;
 	async function l(e) {
 		try {
-			return await U(Promise.resolve(n.match(e)), s, "cache.match");
+			return await W(Promise.resolve(n.match(e)), s, "cache.match");
 		} catch {
 			return;
 		}
 	}
-	return { async resolveHost(t) {
-		let s = gi(r, t), u = await l(s);
-		if (u) try {
-			return (await u.json()).value;
+	return { async resolveHost(t, s) {
+		let u = Si(r, t), d = await l(u);
+		if (d) try {
+			return (await d.json()).value;
 		} catch {}
-		let d = await e.upstream.resolveHost(t), f = d === null ? a : i, p = new Response(JSON.stringify({ value: d }), { headers: {
+		let f = await e.upstream.resolveHost(t, s), p = f === null ? a : i, m = new Response(JSON.stringify({ value: f }), { headers: {
 			"content-type": "application/json",
-			"cache-control": `public, max-age=${f}`
-		} }), m = U(Promise.resolve(n.put(s, p)), c, "cache.put").catch(() => void 0);
-		return o ? o(m) : await m, d;
+			"cache-control": `public, max-age=${p}`
+		} }), h = W(Promise.resolve(n.put(u, m)), c, "cache.put").catch(() => void 0);
+		return o ? o(h) : await h, f;
 	} };
 }
-function yi(e, t) {
-	return gi(e, t);
+function Ti(e, t) {
+	return Si(e, t);
 }
 //#endregion
 //#region src/data-plane/cache-adapter-cache.ts
-var bi = 1e3, xi = 1e3, Si = 5e3;
-function Ci(e) {
-	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = bi, cacheWriteTimeoutMs: u = xi, upstreamTimeoutMs: d = Si } = e, f = d > 0 ? d : 1e4, p = /* @__PURE__ */ new Map();
+var Ei = 1e3, Di = 1e3, Oi = 5e3;
+function ki(e) {
+	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = Ei, cacheWriteTimeoutMs: u = Di, upstreamTimeoutMs: d = Oi } = e, f = d > 0 ? d : 1e4, p = /* @__PURE__ */ new Map();
 	function m(e) {
 		return `${s}:${e.toLowerCase()}`;
 	}
 	async function h(e) {
 		try {
-			return await U(n.get(e), l, "cache.get") ?? null;
+			return await W(n.get(e), l, "cache.get") ?? null;
 		} catch {
 			return null;
 		}
 	}
 	function g(e, t, r) {
-		let i = U(Promise.resolve().then(() => n.set(e, t, r)), u, "cache.set").catch(() => void 0);
+		let i = W(Promise.resolve().then(() => n.set(e, t, r)), u, "cache.set").catch(() => void 0);
 		return c ? (c(i), Promise.resolve()) : i;
 	}
 	function _(e, t) {
 		let n = p.get(e);
 		return n === void 0 ? !1 : t - n < f ? !0 : (p.delete(e), !1);
 	}
-	function ee(e) {
-		let n = t.resolveHost(e);
-		return d > 0 ? U(n, d, "resolveHost") : n;
+	function v(e, n) {
+		return d > 0 ? U(d, "resolveHost", n, (n) => t.resolveHost(e, { signal: n })) : t.resolveHost(e, { signal: n });
 	}
-	async function v(e) {
+	async function y(e, t) {
 		return p.set(e, Date.now()), (async () => {
 			try {
-				let t = await ee(e), n = Date.now(), s = t === null ? o : r, c = t === null ? 0 : i, l = t === null ? 0 : a, u = {
-					value: t,
-					freshUntilMs: n + s,
-					staleUntilMs: n + s + c,
-					staleIfErrorUntilMs: n + s + c + l
-				}, d = Math.max(1, Math.ceil((s + c + l) / 1e3));
-				return await g(m(e), u, d), t;
+				let n = await v(e, t), s = Date.now(), c = n === null ? o : r, l = n === null ? 0 : i, u = n === null ? 0 : a, d = {
+					value: n,
+					freshUntilMs: s + c,
+					staleUntilMs: s + c + l,
+					staleIfErrorUntilMs: s + c + l + u
+				}, f = Math.max(1, Math.ceil((c + l + u) / 1e3));
+				return await g(m(e), d, f), n;
 			} finally {
 				p.delete(e);
 			}
 		})();
 	}
-	return { async resolveHost(e) {
-		let t = await h(m(e)), n = Date.now();
-		if (t && typeof t.freshUntilMs == "number") {
-			if (t.freshUntilMs > n) return t.value;
-			if (t.staleUntilMs > n) {
-				if (!_(e, n)) {
-					let t = v(e).catch(() => void 0);
+	return { async resolveHost(e, t) {
+		let n = await h(m(e)), r = Date.now();
+		if (n && typeof n.freshUntilMs == "number") {
+			if (n.freshUntilMs > r) return n.value;
+			if (n.staleUntilMs > r) {
+				if (!_(e, r)) {
+					let t = y(e).catch(() => void 0);
 					c && c(t);
 				}
-				return t.value;
+				return n.value;
 			}
 		}
 		try {
-			return await v(e);
+			return await y(e, t?.signal);
 		} catch (e) {
-			if (t && (t.staleIfErrorUntilMs ?? t.staleUntilMs) > n) return t.value;
+			if (n && (n.staleIfErrorUntilMs ?? n.staleUntilMs) > r) return n.value;
 			throw e;
 		}
 	} };
 }
-function wi(e, t) {
+function Ai(e, t) {
 	return `${e}:${t.toLowerCase()}`;
 }
 //#endregion
 //#region src/static/index.ts
-function Q() {
+function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function Ti(e, t, n, r, i, a) {
+function ji(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -3562,10 +3635,10 @@ function Ti(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function Ei(e) {
+function Mi(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => Ti(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => ji(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3576,13 +3649,13 @@ function Ei(e) {
 	return {
 		proxyRoutes: {
 			async create() {
-				return Q();
+				return $();
 			},
 			async update() {
-				return Q();
+				return $();
 			},
 			async remove() {
-				return Q();
+				return $();
 			},
 			async get(e, t) {
 				for (let n of r.values()) {
@@ -3609,7 +3682,7 @@ function Ei(e) {
 		}
 	};
 }
-function Di(e, t = {}) {
+function Ni(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3624,10 +3697,10 @@ function Di(e, t = {}) {
 }
 //#endregion
 //#region src/constants.ts
-var Oi = "proxy:resolve_host";
+var Pi = "proxy:resolve_host";
 //#endregion
 //#region src/http-adapter/index.ts
-function ki() {
+function Fi() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3649,19 +3722,19 @@ function ki() {
 		}
 	};
 }
-function Ai(e) {
+function Ii(e) {
 	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.scope ?? "proxy:resolve_host", o = e.tokenRefreshSkewSeconds ?? 60, s = e.timeoutMs ?? 2500;
-	function c(e) {
-		let t = new AbortController(), n, r = new Promise((e, r) => {
-			n = setTimeout(() => {
-				t.abort(), r(new B(s, "control plane"));
+	function c(e, t) {
+		let n = new AbortController(), r = er([e, n.signal]) ?? n.signal, i, a = new Promise((e, t) => {
+			i = setTimeout(() => {
+				n.abort(), t(new B(s, "control plane"));
 			}, s);
 		});
-		return Promise.race([e(t.signal), r]).finally(() => clearTimeout(n));
+		return Promise.race([t(r), a]).finally(() => clearTimeout(i));
 	}
 	let l = null;
-	async function u() {
-		let r = await c(async (r) => {
+	async function u(r) {
+		let s = await c(r, async (r) => {
 			let o = await t(`${n}/oauth/token`, {
 				method: "POST",
 				headers: { "content-type": "application/json" },
@@ -3676,22 +3749,22 @@ function Ai(e) {
 			});
 			if (!o.ok) throw Error(`Proxy adapter token request failed: ${o.status} ${await o.text().catch(() => "")}`);
 			return await o.json();
-		}), s = r.expires_in ?? 3600;
+		}), u = s.expires_in ?? 3600;
 		return l = {
-			value: r.access_token,
-			expires_at: Date.now() + (s - o) * 1e3
-		}, r.access_token;
+			value: s.access_token,
+			expires_at: Date.now() + (u - o) * 1e3
+		}, s.access_token;
 	}
-	async function d() {
-		return l && l.expires_at > Date.now() ? l.value : u();
+	async function d(e) {
+		return l && l.expires_at > Date.now() ? l.value : u(e);
 	}
 	return {
-		proxyRoutes: ki(),
-		async resolveHost(e) {
-			let i = await d(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`;
-			return c(async (e) => {
-				let n = await t(a, {
-					headers: { authorization: `Bearer ${i}` },
+		proxyRoutes: Fi(),
+		async resolveHost(e, i) {
+			let a = i?.signal, o = await d(a), s = `${n}${r}${encodeURIComponent(e.toLowerCase())}`;
+			return c(a, async (e) => {
+				let n = await t(s, {
+					headers: { authorization: `Bearer ${o}` },
 					signal: e
 				});
 				if (n.status === 404) return null;
@@ -3703,7 +3776,7 @@ function Ai(e) {
 }
 //#endregion
 //#region src/http-adapter/service-binding-fetch.ts
-function ji(e) {
+function Li(e) {
 	return (t, n) => {
 		let r = t instanceof Request && n === void 0 ? t : new Request(t, n);
 		return e.fetch(r);
@@ -3711,11 +3784,11 @@ function ji(e) {
 }
 //#endregion
 //#region src/kv-adapter/index.ts
-var $ = "authhero-proxy-host:";
-function Mi(e, t) {
+var Ri = "authhero-proxy-host:";
+function zi(e, t) {
 	return `${e}${t.toLowerCase()}`;
 }
-function Ni() {
+function Bi() {
 	let e = () => {
 		throw Error("KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3737,15 +3810,15 @@ function Ni() {
 		}
 	};
 }
-function Pi(e) {
-	let { kv: t, keyPrefix: n = $, timeoutMs: r } = e;
+function Vi(e) {
+	let { kv: t, keyPrefix: n = Ri, timeoutMs: r } = e;
 	return {
-		proxyRoutes: Ni(),
+		proxyRoutes: Bi(),
 		async resolveHost(e) {
-			let i = Mi(n, e), a = t.get(i, "json");
-			return (r && r > 0 ? await U(a, r, "kv.get") : await a) ?? null;
+			let i = zi(n, e), a = t.get(i, "json");
+			return (r && r > 0 ? await W(a, r, "kv.get") : await a) ?? null;
 		}
 	};
 }
 //#endregion
-export { $ as DEFAULT_KV_HOST_KEY_PREFIX, oi as FORWARDED_HEADERS_HANDLER_TYPE, nr as HandlerRegistry, Oi as PROXY_RESOLVE_HOST_SCOPE, yr as basicAuthHandler, wi as buildCacheAdapterKey, yi as buildCacheApiKey, Mi as buildKvHostKey, ai as buildMatchFilter, xr as cacheHandler, X as compileHostApp, gr as corsHandler, Ci as createCacheAdapterHostCache, vi as createCacheApiHostCache, Ai as createHttpProxyAdapter, W as createInMemoryHostCache, Pi as createKvProxyAdapter, pi as createProxyApp, Z as createProxyDataPlaneHandler, fi as createProxyDataPlaneRouter, ji as createServiceBindingFetch, Ei as createStaticProxyAdapter, G as defineHandler, Qr as dispatchNamespaceHandler, jr as forwardedHeadersHandler, wn as handlerConfigSchema, br as headersHandler, Ur as httpHandler, Di as httpRoute, Ar as isCloudflareIp, Cn as matchSchema, ii as matchesAnyHost, ri as matchesHost, z as proxyRouteInsertSchema, Tn as proxyRouteSchema, En as proxyRouteUpdateSchema, $r as redirectHandler, ti as registerBuiltinHandlers, Fr as rewriteCookiesHandler, Ir as rewriteLocationHandler, qr as serviceBindingHandler, ni as sortRoutes, ei as staticHandler, si as withForwardedHeaders, Y as withForwardedHeadersFor };
+export { Ri as DEFAULT_KV_HOST_KEY_PREFIX, fi as FORWARDED_HEADERS_HANDLER_TYPE, rr as HandlerRegistry, Pi as PROXY_RESOLVE_HOST_SCOPE, br as basicAuthHandler, Ai as buildCacheAdapterKey, Ti as buildCacheApiKey, zi as buildKvHostKey, di as buildMatchFilter, Sr as cacheHandler, Z as compileHostApp, _r as corsHandler, ki as createCacheAdapterHostCache, wi as createCacheApiHostCache, Ii as createHttpProxyAdapter, G as createInMemoryHostCache, Vi as createKvProxyAdapter, yi as createProxyApp, Q as createProxyDataPlaneHandler, vi as createProxyDataPlaneRouter, Li as createServiceBindingFetch, Mi as createStaticProxyAdapter, K as defineHandler, ii as dispatchNamespaceHandler, Mr as forwardedHeadersHandler, wn as handlerConfigSchema, xr as headersHandler, Yr as httpHandler, Ni as httpRoute, jr as isCloudflareIp, Cn as matchSchema, ui as matchesAnyHost, li as matchesHost, z as proxyRouteInsertSchema, Tn as proxyRouteSchema, En as proxyRouteUpdateSchema, ai as redirectHandler, si as registerBuiltinHandlers, Ir as rewriteCookiesHandler, Lr as rewriteLocationHandler, $r as serviceBindingHandler, ci as sortRoutes, oi as staticHandler, pi as withForwardedHeaders, X as withForwardedHeadersFor };