@authhero/proxy 0.10.4 → 0.10.5

package/dist/proxy.mjs

@@ -2584,21 +2584,32 @@ e.object({
 	cohorts: e.array(Kn)
 });
 var qn = e.object({
+	cohort: e.string(),
+	tokens: e.number(),
+	active: e.array(e.number())
+});
+e.object({
+	interval: e.literal("week"),
+	from: e.string(),
+	to: e.string(),
+	cohorts: e.array(qn)
+});
+var Jn = e.object({
 	name: e.string(),
 	type: e.string()
-}), Jn = e.object({
+}), Yn = e.object({
 	elapsed: e.number(),
 	rows_read: e.number().optional(),
 	bytes_read: e.number().optional()
 });
 e.object({
-	meta: e.array(qn),
+	meta: e.array(Jn),
 	data: e.array(e.record(e.string(), e.any())),
 	rows: e.number(),
 	rows_before_limit_at_least: e.number().optional(),
-	statistics: Jn.optional()
+	statistics: Yn.optional()
 });
-var Yn = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Xn = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+var Xn = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Zn = e.record(e.string(), e.record(e.string(), e.string())).openapi({
 	type: "object",
 	additionalProperties: {
 		type: "object",
@@ -2606,11 +2617,11 @@ var Yn = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.
 	}
 });
 e.object({
-	prompt: Yn,
+	prompt: Xn,
 	language: e.string(),
-	custom_text: Xn
+	custom_text: Zn
 });
-var Zn = e.enum([
+var Qn = e.enum([
 	"phone",
 	"totp",
 	"email",
@@ -2618,9 +2629,9 @@ var Zn = e.enum([
 	"webauthn-roaming",
 	"webauthn-platform",
 	"passkey"
-]), Qn = e.object({
+]), $n = e.object({
 	user_id: e.string(),
-	type: Zn,
+	type: Qn,
 	phone_number: e.string().optional(),
 	totp_secret: e.string().optional(),
 	credential_id: e.string().optional(),
@@ -2654,7 +2665,7 @@ function F(t, n) {
 		path: ["public_key"]
 	}));
 }
-Qn.superRefine(F), Qn.extend({
+$n.superRefine(F), $n.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
@@ -2665,12 +2676,12 @@ Qn.superRefine(F), Qn.extend({
 });
 //#endregion
 //#region src/data-plane/cache.ts
-var $n = 1e4;
+var er = 1e4;
 function I(e, t, n) {
 	let r = typeof t == "number" ? {
 		freshTtlMs: t,
 		maxEntries: n
-	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? $n, l = r.waitUntil, u = /* @__PURE__ */ new Map();
+	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? er, l = r.waitUntil, u = /* @__PURE__ */ new Map();
 	function d(e) {
 		for (let [t, n] of u) n.stale_if_error_until <= e && n.stale_until <= e && !n.refreshing && u.delete(t);
 		for (; u.size >= c;) {
@@ -2753,27 +2764,27 @@ function R(e) {
 //#endregion
 //#region src/data-plane/handlers/util.ts
 var z = "__authhero_proxy_request__", B = "__authhero_proxy_tenant_id__", V = "__authhero_proxy_custom_domain_id__", H = "__authhero_proxy_domain__", U = "x-authhero-proxy-mutability-probe";
-function er(e, t) {
+function tr(e, t) {
 	e.set(z, t);
 }
 function W(e) {
 	return e.get(z) ?? e.req.raw;
 }
-function tr(e, t) {
+function nr(e, t) {
 	e.set(B, t.tenant_id), e.set(V, t.custom_domain_id), e.set(H, t.domain);
 }
-function nr(e) {
+function rr(e) {
 	return e.get(B);
 }
-function rr(e) {
+function ir(e) {
 	return e.get(V);
 }
-function ir(e) {
+function ar(e) {
 	return e.get(H);
 }
-function ar(e, t) {
+function or(e, t) {
 	let n = W(e), r = new Headers(n.headers);
-	t(r), er(e, new Request(n, { headers: r }));
+	t(r), tr(e, new Request(n, { headers: r }));
 }
 function G(e) {
 	let t = e.res;
@@ -2790,7 +2801,7 @@ function G(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var or = e.object({
+var sr = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2798,44 +2809,44 @@ var or = e.object({
 	expose_headers: e.array(e.string()).optional(),
 	max_age: e.number().int().optional()
 }).refine((e) => !(e.allow_credentials && e.origins?.includes("*")), { message: "Cannot use wildcard origin (*) with allow_credentials" });
-function sr(e, t) {
+function cr(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var cr = R({
+var lr = R({
 	type: "cors",
-	optionsSchema: or,
+	optionsSchema: sr,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
 			if (t.req.method === "OPTIONS" && r !== null && t.req.header("access-control-request-method") !== void 0) {
-				let t = sr(e, r);
+				let t = cr(e, r);
 				return new Response(null, {
 					status: 204,
 					headers: t
 				});
 			}
 			await n();
-			let i = sr(e, r);
+			let i = cr(e, r);
 			G(t), i.forEach((e, n) => {
 				n.toLowerCase() === "vary" ? t.res.headers.append(n, e) : t.res.headers.set(n, e);
 			});
 		};
 	}
-}), lr = e.object({
+}), ur = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function ur(e, t) {
+function dr(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var dr = R({
+var fr = R({
 	type: "basic_auth",
-	optionsSchema: lr,
+	optionsSchema: ur,
 	build(e) {
-		let t = ur(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = dr(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2851,7 +2862,7 @@ var dr = R({
 			});
 		};
 	}
-}), fr = R({
+}), pr = R({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2861,12 +2872,12 @@ var dr = R({
 	}),
 	build(e) {
 		return async (t, n) => {
-			if ((e.request || e.remove_request) && ar(t, (t) => {
+			if ((e.request || e.remove_request) && or(t, (t) => {
 				if (e.remove_request?.forEach((e) => t.delete(e)), e.request) for (let [n, r] of Object.entries(e.request)) t.set(n, r);
 			}), await n(), (e.response || e.remove_response) && (G(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), pr = R({
+}), mr = R({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
@@ -2877,7 +2888,7 @@ var dr = R({
 			}
 		};
 	}
-}), mr = R({
+}), hr = R({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
@@ -2887,40 +2898,40 @@ var dr = R({
 	build(e) {
 		return async (t, n) => {
 			let r = new URL(t.req.url);
-			ar(t, (n) => {
+			or(t, (n) => {
 				n.set("x-forwarded-host", r.host), n.set("x-forwarded-proto", r.protocol.replace(":", "")), e.set_x_original_url && n.set("x-original-url", t.req.url);
 				let i = n.get(e.client_ip_header), a = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), o = i ?? a[a.length - 1] ?? "127.0.0.1", s = a.length === 0 || a[a.length - 1] !== o, c = a.length ? s ? `${a.join(", ")}, ${o}` : a.join(", ") : o;
 				n.set("x-forwarded-for", c), e.set_x_real_ip && n.set("x-real-ip", o);
 			}), await n();
 		};
 	}
-}), hr = e.object({ upstream_host: e.string().optional() });
-function gr(e) {
+}), gr = e.object({ upstream_host: e.string().optional() });
+function _r(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function _r(e) {
+function vr(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var vr = R({
+var yr = R({
 	type: "rewrite_cookies",
-	optionsSchema: hr,
+	optionsSchema: gr,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = _r(t.res.headers);
+			let a = vr(t.res.headers);
 			if (a.length === 0) return;
-			let o = gr(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			let o = _r(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
 			G(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), yr = R({
+}), br = R({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
@@ -2943,14 +2954,14 @@ var vr = R({
 			G(t), t.res.headers.set("location", c);
 		};
 	}
-}), br = class extends Error {
+}), xr = class extends Error {
 	ms;
 	constructor(e, t) {
 		super(`${t ?? "Operation"} timed out after ${e}ms`), this.name = "TimeoutError", this.ms = e;
 	}
 };
 function K(e) {
-	return e instanceof br ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
+	return e instanceof xr ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
 }
 function q(e, t) {
 	let n = new AbortController(), r = setTimeout(() => n.abort(), e);
@@ -2958,7 +2969,7 @@ function q(e, t) {
 }
 function J(e, t, n) {
 	let r, i = new Promise((e, i) => {
-		r = setTimeout(() => i(new br(t, n)), t);
+		r = setTimeout(() => i(new xr(t, n)), t);
 	});
 	return Promise.race([e, i]).finally(() => {
 		r && clearTimeout(r);
@@ -2966,7 +2977,7 @@ function J(e, t, n) {
 }
 //#endregion
 //#region src/data-plane/handlers/http.ts
-var xr = new Set([
+var Sr = new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -2975,24 +2986,24 @@ var xr = new Set([
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), Sr = 3e4, Cr = e.object({
+]), Cr = 3e4, wr = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function wr(e, t) {
+function Tr(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function Tr(e) {
+function Er(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function Er(e, t) {
+function Dr(e, t) {
 	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = wr(r.pathname, n.pathname), r.search = n.search;
+	r.pathname = Tr(r.pathname, n.pathname), r.search = n.search;
 	let i = new Headers(t.headers);
-	for (let e of xr) i.delete(e);
+	for (let e of Sr) i.delete(e);
 	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = Tr(t.method) ? t.body : void 0, o = {
+	let a = Er(t.method) ? t.body : void 0, o = {
 		method: t.method,
 		headers: i,
 		body: a,
@@ -3003,13 +3014,13 @@ function Er(e, t) {
 		init: o
 	};
 }
-var Dr = R({
+var Or = R({
 	type: "http",
-	optionsSchema: Cr,
+	optionsSchema: wr,
 	build(e) {
-		let t = e.timeout_ms ?? Sr;
+		let t = e.timeout_ms ?? Cr;
 		return async (n) => {
-			let { target: r, init: i } = Er(e, W(n));
+			let { target: r, init: i } = Dr(e, W(n));
 			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
 			try {
 				return await q(t, (e) => fetch(r.toString(), {
@@ -3021,24 +3032,24 @@ var Dr = R({
 			}
 		};
 	}
-}), Or = 3e4, kr = e.object({
+}), kr = 3e4, Ar = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
 	preserve_host: e.boolean().default(!0),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Ar(e) {
+function jr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var jr = R({
+var Mr = R({
 	type: "service_binding",
-	optionsSchema: kr,
+	optionsSchema: Ar,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!Ar(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
-		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? Or;
+		if (!jr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? kr;
 		return async (t) => {
-			let a = W(t), { target: o, init: s } = Er({
+			let a = W(t), { target: o, init: s } = Dr({
 				upstream_url: r,
 				preserve_host: e.preserve_host
 			}, a);
@@ -3053,34 +3064,34 @@ var jr = R({
 			}
 		};
 	}
-}), Mr = 3e4, Nr = e.object({
+}), Nr = 3e4, Pr = e.object({
 	binding: e.string(),
 	script_name: e.string(),
 	cpu_ms: e.number().int().positive().optional(),
 	subrequests: e.number().int().positive().optional(),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Pr(e) {
+function Fr(e) {
 	return typeof e == "object" && !!e && typeof e.get == "function";
 }
 var Y = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
-function Fr(e) {
+function Ir(e) {
 	return Y.lastIndex = 0, Y.test(e);
 }
-var Ir = R({
+var Lr = R({
 	type: "dispatch_namespace",
-	optionsSchema: Nr,
+	optionsSchema: Pr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!Pr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
-		let r = Fr(e.script_name), i = e.timeout_ms ?? Mr, a = e.cpu_ms || e.subrequests ? { limits: {
+		if (!Fr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = Ir(e.script_name), i = e.timeout_ms ?? Nr, a = e.cpu_ms || e.subrequests ? { limits: {
 			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
 			...e.subrequests ? { subrequests: e.subrequests } : {}
 		} } : void 0;
 		return async (t) => {
 			let o = e.script_name;
 			if (r) {
-				let n = nr(t), r = rr(t), i = ir(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				let n = rr(t), r = ir(t), i = ar(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
 				if (o = o.replace(Y, (e, t) => {
 					switch (t) {
 						case "tenant_id": return n ?? "";
@@ -3103,7 +3114,7 @@ var Ir = R({
 			}
 		};
 	}
-}), Lr = R({
+}), Rr = R({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -3132,7 +3143,7 @@ var Ir = R({
 			});
 		};
 	}
-}), Rr = R({
+}), zr = R({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -3152,15 +3163,15 @@ var Ir = R({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function zr(e) {
-	e.add(cr).add(dr).add(fr).add(pr).add(mr).add(vr).add(yr).add(Dr).add(jr).add(Ir).add(Lr).add(Rr);
+function Br(e) {
+	e.add(lr).add(fr).add(pr).add(mr).add(hr).add(yr).add(br).add(Or).add(Mr).add(Lr).add(Rr).add(zr);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
-function Br(e) {
+function Vr(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function Vr(e, t) {
+function Hr(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -3169,13 +3180,13 @@ function Vr(e, t) {
 	}
 	return !1;
 }
-function Hr(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => Vr(e, t));
+function Ur(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => Hr(e, t));
 }
 function X(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !Hr(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r && !Ur(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -3192,7 +3203,7 @@ function X(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var Ur = [
+var Wr = [
 	"GET",
 	"POST",
 	"PUT",
@@ -3204,34 +3215,34 @@ var Ur = [
 function Z(e, n, r, i) {
 	let a = new t();
 	r && a.use("*", async (e, t) => {
-		tr(e, r), await t();
+		nr(e, r), await t();
 	});
-	let o = Br(e);
+	let o = Vr(e);
 	for (let e of o) {
 		let t = [];
 		t.push(X(e.match));
 		for (let r of e.handlers) t.push(n.build(r.type, r.options));
-		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : Ur, i = e.match.path || "/*";
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : Wr, i = e.match.path || "/*";
 		a.on(r, [i], ...t);
 	}
-	return i && i.length > 0 ? a.on(Ur, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
+	return i && i.length > 0 ? a.on(Wr, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
 		let n = K(e);
 		return t.text(n ? "Upstream timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "handler_timeout" : "handler_failed" });
 	}), a;
 }
 //#endregion
 //#region src/data-plane/router.ts
-var Wr = 1e4;
-function Gr(e) {
+var Gr = 1e4;
+function Kr(e) {
 	return e.resolver ? e.resolver : e.cache ? I(e.data, e.cache) : I(e.data, e.cacheTtlMs ?? 3e4);
 }
-function Kr(e) {
+function qr(e) {
 	if (e.registry) return e.registry;
 	let t = new L(e.bindings ?? {});
-	return zr(t), t;
+	return Br(t), t;
 }
 function Q(e) {
-	let t = Gr(e), n = Kr(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? Wr, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? e.defaultHandlers.map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
+	let t = Kr(e), n = qr(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? Gr, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? e.defaultHandlers.map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
 	return async (e) => {
 		let s = e.req.header("host") ?? e.req.header("x-forwarded-host");
 		if (!s) return e.text("Missing host", 400);
@@ -3249,13 +3260,13 @@ function Q(e) {
 		}
 	};
 }
-function qr(e) {
+function Jr(e) {
 	let n = new t();
 	return n.all("*", Q(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function Jr(e) {
+function Yr(e) {
 	let n = new t();
 	return n.all("*", Q({
 		data: e.data,
@@ -3273,17 +3284,17 @@ function Jr(e) {
 }
 //#endregion
 //#region src/data-plane/cache-api-cache.ts
-var Yr = 1e3, Xr = 1e3;
-function Zr(e, t) {
+var Xr = 1e3, Zr = 1e3;
+function Qr(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function Qr() {
+function $r() {
 	return globalThis.caches?.default;
 }
-function $r(e) {
-	let t = e.cache ?? Qr();
+function ei(e) {
+	let t = e.cache ?? $r();
 	if (!t) return e.upstream;
-	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? Yr, c = e.cacheWriteTimeoutMs ?? Xr;
+	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? Xr, c = e.cacheWriteTimeoutMs ?? Zr;
 	async function l(e) {
 		try {
 			return await J(Promise.resolve(n.match(e)), s, "cache.match");
@@ -3292,7 +3303,7 @@ function $r(e) {
 		}
 	}
 	return { async resolveHost(t) {
-		let s = Zr(r, t), u = await l(s);
+		let s = Qr(r, t), u = await l(s);
 		if (u) try {
 			return (await u.json()).value;
 		} catch {}
@@ -3303,14 +3314,14 @@ function $r(e) {
 		return o ? o(m) : await m, d;
 	} };
 }
-function ei(e, t) {
-	return Zr(e, t);
+function ti(e, t) {
+	return Qr(e, t);
 }
 //#endregion
 //#region src/data-plane/cache-adapter-cache.ts
-var ti = 1e3, ni = 1e3;
-function ri(e) {
-	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = ti, cacheWriteTimeoutMs: u = ni } = e, d = /* @__PURE__ */ new Map();
+var ni = 1e3, ri = 1e3;
+function ii(e) {
+	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = ni, cacheWriteTimeoutMs: u = ri } = e, d = /* @__PURE__ */ new Map();
 	function f(e) {
 		return `${s}:${e.toLowerCase()}`;
 	}
@@ -3363,7 +3374,7 @@ function ri(e) {
 		}
 	} };
 }
-function ii(e, t) {
+function ai(e, t) {
 	return `${e}:${t.toLowerCase()}`;
 }
 //#endregion
@@ -3371,7 +3382,7 @@ function ii(e, t) {
 function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function ai(e, t, n, r, i, a) {
+function oi(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -3386,10 +3397,10 @@ function ai(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function oi(e) {
+function si(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => ai(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => oi(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3433,7 +3444,7 @@ function oi(e) {
 		}
 	};
 }
-function si(e, t = {}) {
+function ci(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3448,10 +3459,10 @@ function si(e, t = {}) {
 }
 //#endregion
 //#region src/constants.ts
-var ci = "proxy:resolve_host";
+var li = "proxy:resolve_host";
 //#endregion
 //#region src/http-adapter/index.ts
-function li() {
+function ui() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3473,7 +3484,7 @@ function li() {
 		}
 	};
 }
-function ui(e) {
+function di(e) {
 	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.scope ?? "proxy:resolve_host", o = e.tokenRefreshSkewSeconds ?? 60, s = e.timeoutMs ?? 2500;
 	function c(e) {
 		let t = new AbortController(), n = setTimeout(() => t.abort(), s);
@@ -3506,7 +3517,7 @@ function ui(e) {
 		}), u);
 	}
 	return {
-		proxyRoutes: li(),
+		proxyRoutes: ui(),
 		async resolveHost(e) {
 			let i = await f(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await c((e) => t(a, {
 				headers: { authorization: `Bearer ${i}` },
@@ -3520,7 +3531,7 @@ function ui(e) {
 }
 //#endregion
 //#region src/http-adapter/service-binding-fetch.ts
-function di(e) {
+function fi(e) {
 	return (t, n) => {
 		let r = t instanceof Request && n === void 0 ? t : new Request(t, n);
 		return e.fetch(r);
@@ -3528,11 +3539,11 @@ function di(e) {
 }
 //#endregion
 //#region src/kv-adapter/index.ts
-var fi = "authhero-proxy-host:";
-function pi(e, t) {
+var pi = "authhero-proxy-host:";
+function mi(e, t) {
 	return `${e}${t.toLowerCase()}`;
 }
-function mi() {
+function hi() {
 	let e = () => {
 		throw Error("KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3554,15 +3565,15 @@ function mi() {
 		}
 	};
 }
-function hi(e) {
-	let { kv: t, keyPrefix: n = fi, timeoutMs: r } = e;
+function gi(e) {
+	let { kv: t, keyPrefix: n = pi, timeoutMs: r } = e;
 	return {
-		proxyRoutes: mi(),
+		proxyRoutes: hi(),
 		async resolveHost(e) {
-			let i = pi(n, e), a = t.get(i, "json");
+			let i = mi(n, e), a = t.get(i, "json");
 			return (r && r > 0 ? await J(a, r, "kv.get") : await a) ?? null;
 		}
 	};
 }
 //#endregion
-export { fi as DEFAULT_KV_HOST_KEY_PREFIX, L as HandlerRegistry, ci as PROXY_RESOLVE_HOST_SCOPE, dr as basicAuthHandler, ii as buildCacheAdapterKey, ei as buildCacheApiKey, pi as buildKvHostKey, X as buildMatchFilter, pr as cacheHandler, Z as compileHostApp, cr as corsHandler, ri as createCacheAdapterHostCache, $r as createCacheApiHostCache, ui as createHttpProxyAdapter, I as createInMemoryHostCache, hi as createKvProxyAdapter, Jr as createProxyApp, Q as createProxyDataPlaneHandler, qr as createProxyDataPlaneRouter, di as createServiceBindingFetch, oi as createStaticProxyAdapter, R as defineHandler, Ir as dispatchNamespaceHandler, mr as forwardedHeadersHandler, En as handlerConfigSchema, fr as headersHandler, Dr as httpHandler, si as httpRoute, Tn as matchSchema, Hr as matchesAnyHost, Vr as matchesHost, P as proxyRouteInsertSchema, Dn as proxyRouteSchema, On as proxyRouteUpdateSchema, Lr as redirectHandler, zr as registerBuiltinHandlers, vr as rewriteCookiesHandler, yr as rewriteLocationHandler, jr as serviceBindingHandler, Br as sortRoutes, Rr as staticHandler };
+export { pi as DEFAULT_KV_HOST_KEY_PREFIX, L as HandlerRegistry, li as PROXY_RESOLVE_HOST_SCOPE, fr as basicAuthHandler, ai as buildCacheAdapterKey, ti as buildCacheApiKey, mi as buildKvHostKey, X as buildMatchFilter, mr as cacheHandler, Z as compileHostApp, lr as corsHandler, ii as createCacheAdapterHostCache, ei as createCacheApiHostCache, di as createHttpProxyAdapter, I as createInMemoryHostCache, gi as createKvProxyAdapter, Yr as createProxyApp, Q as createProxyDataPlaneHandler, Jr as createProxyDataPlaneRouter, fi as createServiceBindingFetch, si as createStaticProxyAdapter, R as defineHandler, Lr as dispatchNamespaceHandler, hr as forwardedHeadersHandler, En as handlerConfigSchema, pr as headersHandler, Or as httpHandler, ci as httpRoute, Tn as matchSchema, Ur as matchesAnyHost, Hr as matchesHost, P as proxyRouteInsertSchema, Dn as proxyRouteSchema, On as proxyRouteUpdateSchema, Rr as redirectHandler, Br as registerBuiltinHandlers, yr as rewriteCookiesHandler, br as rewriteLocationHandler, Mr as serviceBindingHandler, Vr as sortRoutes, zr as staticHandler };