@authhero/proxy 0.10.5 → 0.10.7

package/dist/proxy.mjs

@@ -617,22 +617,22 @@ e.object({
 });
 var Ie = /* @__PURE__ */ function(e) {
 	return e.TOKEN = "token", e.ID_TOKEN = "id_token", e.TOKEN_ID_TOKEN = "id_token token", e.CODE = "code", e.CODE_ID_TOKEN = "code id_token", e.CODE_TOKEN = "code token", e.CODE_ID_TOKEN_TOKEN = "code id_token token", e;
-}({}), Le = /* @__PURE__ */ function(e) {
+}({}), v = /* @__PURE__ */ function(e) {
 	return e.QUERY = "query", e.FRAGMENT = "fragment", e.FORM_POST = "form_post", e.WEB_MESSAGE = "web_message", e.SAML_POST = "saml_post", e;
-}({}), Re = /* @__PURE__ */ function(e) {
+}({}), Le = /* @__PURE__ */ function(e) {
 	return e.S256 = "S256", e.Plain = "plain", e;
-}({}), ze = e.union([e.null(), e.object({
+}({}), y = e.union([e.null(), e.object({
 	essential: e.boolean().optional(),
 	value: e.unknown().optional(),
 	values: e.array(e.unknown()).optional()
-})]).nullable(), Be = e.object({
-	userinfo: e.record(e.string(), ze).optional(),
-	id_token: e.record(e.string(), ze).optional()
-}), Ve = e.object({
+})]).nullable(), Re = e.object({
+	userinfo: e.record(e.string(), y).optional(),
+	id_token: e.record(e.string(), y).optional()
+}), ze = e.object({
 	client_id: e.string(),
 	act_as: e.string().optional(),
 	response_type: e.nativeEnum(Ie).optional(),
-	response_mode: e.nativeEnum(Le).optional(),
+	response_mode: e.nativeEnum(v).optional(),
 	redirect_uri: e.string().optional(),
 	audience: e.string().optional(),
 	organization: e.string().optional(),
@@ -640,13 +640,13 @@ var Ie = /* @__PURE__ */ function(e) {
 	nonce: e.string().optional(),
 	scope: e.string().optional(),
 	prompt: e.string().optional(),
-	code_challenge_method: e.nativeEnum(Re).optional(),
+	code_challenge_method: e.nativeEnum(Le).optional(),
 	code_challenge: e.string().optional(),
 	username: e.string().optional(),
 	ui_locales: e.string().optional(),
 	max_age: e.number().optional(),
 	acr_values: e.string().optional(),
-	claims: Be.optional(),
+	claims: Re.optional(),
 	vendor_id: e.string().optional()
 });
 e.object({
@@ -669,7 +669,7 @@ e.object({
 		"auto"
 	]).optional()
 });
-var He = e.enum([
+var Be = e.enum([
 	"password_reset",
 	"email_verification",
 	"otp",
@@ -682,7 +682,7 @@ e.object({
 	code_id: e.string().openapi({ description: "The code that will be used in for instance an email verification flow" }),
 	login_id: e.string().openapi({ description: "The id of the login session that the code is connected to" }),
 	connection_id: e.string().optional().openapi({ description: "The connection that the code is connected to" }),
-	code_type: He,
+	code_type: Be,
 	code_verifier: e.string().optional().openapi({ description: "The code verifier used in PKCE in outbound flows" }),
 	code_challenge: e.string().optional().openapi({ description: "The code challenge used in PKCE in outbound flows" }),
 	code_challenge_method: e.enum(["plain", "S256"]).optional().openapi({ description: "The code challenge method used in PKCE in outbound flows" }),
@@ -694,7 +694,7 @@ e.object({
 	used_at: e.string().optional(),
 	user_id: e.string().optional()
 }).extend({ created_at: e.string() });
-var Ue = e.object({
+var Ve = e.object({
 	kid: e.string().optional(),
 	team_id: e.string().optional(),
 	realms: e.string().optional(),
@@ -814,26 +814,26 @@ var Ue = e.object({
 		"never_on_login"
 	]).optional()
 });
-function v(e) {
+function b(e) {
 	if (e !== null) {
-		if (Array.isArray(e)) return e.filter((e) => e !== null).map(v);
+		if (Array.isArray(e)) return e.filter((e) => e !== null).map(b);
 		if (e && typeof e == "object") {
 			let t = {};
-			for (let [n, r] of Object.entries(e)) r !== null && (t[n] = v(r));
+			for (let [n, r] of Object.entries(e)) r !== null && (t[n] = b(r));
 			return t;
 		}
 		return e;
 	}
 }
-var We = e.object({
+var He = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	display_name: e.string().optional(),
 	strategy: e.string(),
-	options: e.preprocess((e) => e === null ? {} : v(e), Ue).default({}),
+	options: e.preprocess((e) => e === null ? {} : b(e), Ve).default({}),
 	enabled_clients: e.array(e.string()).default([]).optional(),
 	response_type: e.nativeEnum(Ie).optional(),
-	response_mode: e.nativeEnum(Le).optional(),
+	response_mode: e.nativeEnum(v).optional(),
 	is_domain_connection: e.boolean().optional(),
 	show_as_button: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional(),
@@ -843,8 +843,8 @@ e.object({
 	id: e.string(),
 	created_at: e.string().transform((e) => e === null ? "" : e),
 	updated_at: e.string().transform((e) => e === null ? "" : e)
-}).extend(We.shape);
-var Ge = e.object({
+}).extend(He.shape);
+var Ue = e.object({
 	domain: e.string(),
 	custom_domain_id: e.string().optional(),
 	type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -858,7 +858,7 @@ var Ge = e.object({
 		"null"
 	]).optional(),
 	domain_metadata: e.record(e.string(), e.string().max(255)).optional()
-}), Ke = e.discriminatedUnion("name", [e.object({
+}), We = e.discriminatedUnion("name", [e.object({
 	name: e.literal("txt"),
 	record: e.string(),
 	domain: e.string()
@@ -866,7 +866,7 @@ var Ge = e.object({
 	name: e.literal("http"),
 	http_body: e.string(),
 	http_url: e.string()
-})]), qe = Ge.extend({
+})]), Ge = Ue.extend({
 	custom_domain_id: e.string(),
 	primary: e.boolean(),
 	status: e.enum([
@@ -876,28 +876,28 @@ var Ge = e.object({
 		"ready"
 	]),
 	origin_domain_name: e.string().optional(),
-	verification: e.object({ methods: e.array(Ke) }).optional(),
+	verification: e.object({ methods: e.array(We) }).optional(),
 	tls_policy: e.string().optional()
 });
-Ge.pick({
+Ue.pick({
 	tls_policy: !0,
 	custom_client_ip_header: !0,
 	domain_metadata: !0
-}).strict(), qe.extend({ tenant_id: e.string() }), e.object({
+}).strict(), Ge.extend({ tenant_id: e.string() }), e.object({
 	certificate: e.string().regex(/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/, "must be PEM-encoded; include the full certificate chain in leaf-first order"),
 	private_key: e.string().regex(/-----BEGIN (RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+-----END \1PRIVATE KEY-----\s*$/, "must be a PEM-encoded private key")
 });
-var y = e.object({
+var x = e.object({
 	id: e.string(),
 	order: e.number().optional(),
 	visible: e.boolean().optional().default(!0)
-}), b = y.extend({ category: e.literal("BLOCK").optional() }), Je = b.extend({
+}), S = x.extend({ category: e.literal("BLOCK").optional() }), Ke = S.extend({
 	type: e.literal("DIVIDER"),
 	config: e.object({ text: e.string().optional() }).optional()
-}), Ye = b.extend({
+}), qe = S.extend({
 	type: e.literal("HTML"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), Xe = b.extend({
+}), Je = S.extend({
 	type: e.literal("IMAGE"),
 	config: e.object({
 		src: e.string().optional(),
@@ -905,43 +905,43 @@ var y = e.object({
 		width: e.number().optional(),
 		height: e.number().optional()
 	}).optional()
-}), Ze = b.extend({
+}), Ye = S.extend({
 	type: e.literal("JUMP_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		target_step: e.string().optional()
 	})
-}), Qe = b.extend({
+}), Xe = S.extend({
 	type: e.literal("RESEND_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		resend_action: e.string().optional()
 	})
-}), $e = b.extend({
+}), Ze = S.extend({
 	type: e.literal("NEXT_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), et = b.extend({
+}), Qe = S.extend({
 	type: e.literal("PREVIOUS_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), tt = b.extend({
+}), $e = S.extend({
 	type: e.literal("RICH_TEXT"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), x = y.extend({
+}), C = x.extend({
 	category: e.literal("WIDGET").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), nt = x.extend({
+}), et = C.extend({
 	type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
 	config: e.object({ credential_type: e.string().optional() })
-}), rt = x.extend({
+}), tt = C.extend({
 	type: e.literal("GMAPS_ADDRESS"),
 	config: e.object({ api_key: e.string().optional() })
-}), it = x.extend({
+}), nt = C.extend({
 	type: e.literal("RECAPTCHA"),
 	config: e.object({ site_key: e.string().optional() })
-}), S = y.extend({
+}), w = x.extend({
 	category: e.literal("FIELD").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
@@ -957,10 +957,10 @@ var y = e.object({
 	})).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), at = S.extend({
+}), rt = w.extend({
 	type: e.literal("BOOLEAN"),
 	config: e.object({ default_value: e.boolean().optional() }).optional()
-}), ot = S.extend({
+}), it = w.extend({
 	type: e.literal("CARDS"),
 	config: e.object({
 		options: e.array(e.object({
@@ -971,7 +971,7 @@ var y = e.object({
 		})).optional(),
 		multi_select: e.boolean().optional()
 	}).optional()
-}), st = S.extend({
+}), at = w.extend({
 	type: e.literal("CHOICE"),
 	config: e.object({
 		options: e.array(e.object({
@@ -982,7 +982,7 @@ var y = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), ct = S.extend({
+}), ot = w.extend({
 	type: e.literal("CODE"),
 	config: e.object({
 		length: e.number().int().positive().max(100).optional(),
@@ -999,7 +999,7 @@ var y = e.object({
 		message: "default_value is longer than the configured length",
 		path: ["default_value"]
 	}).optional()
-}), lt = S.extend({
+}), st = w.extend({
 	type: e.literal("CUSTOM"),
 	config: e.object({
 		component: e.string().optional(),
@@ -1007,7 +1007,7 @@ var y = e.object({
 		schema: e.record(e.string(), e.any()).optional(),
 		code: e.string().optional()
 	})
-}), ut = S.extend({
+}), ct = w.extend({
 	type: e.literal("DATE"),
 	config: e.object({
 		format: e.string().optional(),
@@ -1015,7 +1015,7 @@ var y = e.object({
 		max: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), dt = S.extend({
+}), lt = w.extend({
 	type: e.literal("DROPDOWN"),
 	config: e.object({
 		options: e.array(e.object({
@@ -1027,7 +1027,7 @@ var y = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), ft = S.extend({
+}), ut = w.extend({
 	type: e.literal("EMAIL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1035,20 +1035,20 @@ var y = e.object({
 		last_used: e.boolean().optional(),
 		last_used_label: e.string().optional()
 	}).optional()
-}), pt = S.extend({
+}), dt = w.extend({
 	type: e.literal("FILE"),
 	config: e.object({
 		accept: e.string().optional(),
 		max_size: e.number().optional(),
 		multiple: e.boolean().optional()
 	}).optional()
-}), mt = S.extend({
+}), ft = w.extend({
 	type: e.literal("LEGAL"),
 	config: e.object({
 		text: e.string(),
 		html: e.boolean().optional()
 	}).optional()
-}), ht = S.extend({
+}), pt = w.extend({
 	type: e.literal("NUMBER"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1057,7 +1057,7 @@ var y = e.object({
 		step: e.number().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), gt = S.extend({
+}), mt = w.extend({
 	type: e.literal("PASSWORD"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1066,13 +1066,13 @@ var y = e.object({
 		forgot_password_link: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), _t = S.extend({
+}), ht = w.extend({
 	type: e.literal("PAYMENT"),
 	config: e.object({
 		provider: e.string().optional(),
 		currency: e.string().optional()
 	}).optional()
-}), vt = S.extend({
+}), gt = w.extend({
 	type: e.literal("SOCIAL"),
 	config: e.object({
 		providers: e.array(e.string()).optional(),
@@ -1086,7 +1086,7 @@ var y = e.object({
 			last_used_label: e.string().optional()
 		})).optional()
 	}).optional()
-}), yt = S.extend({
+}), _t = w.extend({
 	type: e.literal("TEL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1094,7 +1094,7 @@ var y = e.object({
 		default_value: e.string().optional(),
 		allow_email: e.boolean().optional()
 	}).optional()
-}), bt = S.extend({
+}), vt = w.extend({
 	type: e.literal("TEXT"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1104,37 +1104,39 @@ var y = e.object({
 		last_used: e.boolean().optional(),
 		last_used_label: e.string().optional()
 	}).optional()
-}), xt = S.extend({
+}), yt = w.extend({
 	type: e.literal("COUNTRY"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), St = S.extend({
+}), bt = w.extend({
 	type: e.literal("URL"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), Ct = e.discriminatedUnion("type", [
+}), xt = e.discriminatedUnion("type", [
+	Ke,
+	qe,
 	Je,
 	Ye,
 	Xe,
 	Ze,
 	Qe,
-	$e,
+	$e
+]), St = e.discriminatedUnion("type", [
 	et,
-	tt
-]), wt = e.discriminatedUnion("type", [
-	nt,
+	tt,
+	nt
+]), Ct = e.discriminatedUnion("type", [
 	rt,
-	it
-]), Tt = e.discriminatedUnion("type", [
+	it,
 	at,
 	ot,
+	yt,
 	st,
 	ct,
-	xt,
 	lt,
 	ut,
 	dt,
@@ -1145,13 +1147,11 @@ var y = e.object({
 	gt,
 	_t,
 	vt,
-	yt,
-	bt,
-	St
-]), C = e.union([
-	Ct,
-	wt,
-	Tt
+	bt
+]), wt = e.union([
+	xt,
+	St,
+	Ct
 ]);
 new Set([
 	"BOOLEAN",
@@ -1178,22 +1178,22 @@ new Set([
 	visible: e.boolean().optional().default(!0),
 	customizations: e.record(e.string(), e.any()).optional()
 });
-var w = e.object({
+var T = e.object({
 	x: e.number(),
 	y: e.number()
-}), Et = e.object({
+}), Tt = e.object({
 	id: e.string(),
 	type: e.literal("FLOW"),
-	coordinates: w,
+	coordinates: T,
 	alias: e.string().min(1).max(150).optional(),
 	config: e.object({
 		flow_id: e.string().max(30),
 		next_node: e.string().optional()
 	})
-}), Dt = e.object({
+}), Et = e.object({
 	id: e.string(),
 	type: e.literal("ROUTER"),
-	coordinates: w,
+	coordinates: T,
 	alias: e.string().min(1).max(150),
 	config: e.object({
 		rules: e.array(e.object({
@@ -1204,20 +1204,20 @@ var w = e.object({
 		})),
 		fallback: e.string()
 	})
-}), Ot = e.object({
+}), Dt = e.object({
 	id: e.string(),
 	type: e.literal("STEP"),
-	coordinates: w,
+	coordinates: T,
 	alias: e.string().min(1).max(150).optional(),
 	config: e.object({
-		components: e.array(C),
+		components: e.array(wt),
 		next_node: e.string().optional()
 	})
-}), kt = e.discriminatedUnion("type", [
+}), Ot = e.discriminatedUnion("type", [
+	Tt,
 	Et,
-	Dt,
-	Ot
-]), At = e.object({
+	Dt
+]), kt = e.object({
 	name: e.string().openapi({ description: "The name of the form" }),
 	messages: e.object({
 		errors: e.record(e.string(), e.any()).optional(),
@@ -1228,14 +1228,14 @@ var w = e.object({
 		default: e.string().optional()
 	}).optional(),
 	translations: e.record(e.string(), e.any()).optional(),
-	nodes: e.array(kt).optional(),
+	nodes: e.array(Ot).optional(),
 	start: e.object({
 		hidden_fields: e.array(e.object({
 			key: e.string(),
 			value: e.string()
 		})).optional(),
 		next_node: e.string().optional(),
-		coordinates: w.optional()
+		coordinates: T.optional()
 	}).optional(),
 	ending: e.object({
 		redirection: e.object({
@@ -1243,7 +1243,7 @@ var w = e.object({
 			target: e.string().optional()
 		}).optional(),
 		after_submit: e.object({ flow_id: e.string().optional() }).optional(),
-		coordinates: w.optional(),
+		coordinates: T.optional(),
 		resume_flow: e.boolean().optional()
 	}).optional(),
 	style: e.object({ css: e.string().optional() }).optional(),
@@ -1252,8 +1252,8 @@ var w = e.object({
 		sdk_src: e.string().optional()
 	}).optional()
 }).openapi({ description: "Schema for flow-based forms (matches Auth0 Forms structure)" });
-n.extend(At.shape).extend({ id: e.string() });
-var jt = e.object({
+n.extend(kt.shape).extend({ id: e.string() });
+var At = e.object({
 	id: e.number().optional(),
 	text: e.string(),
 	type: e.enum([
@@ -1262,7 +1262,7 @@ var jt = e.object({
 		"success",
 		"warning"
 	])
-}), Mt = e.object({
+}), jt = e.object({
 	id: e.string().optional(),
 	text: e.string(),
 	href: e.string(),
@@ -1274,12 +1274,12 @@ e.object({
 	method: e.enum(["POST", "GET"]),
 	title: e.string().optional(),
 	description: e.string().optional(),
-	components: e.array(C),
-	messages: e.array(jt).optional(),
-	links: e.array(Mt).optional(),
+	components: e.array(wt),
+	messages: e.array(At).optional(),
+	links: e.array(jt).optional(),
 	footer: e.string().optional()
 });
-var T = e.enum([
+var E = e.enum([
 	"pre-user-registration",
 	"post-user-registration",
 	"post-user-login",
@@ -1287,19 +1287,19 @@ var T = e.enum([
 	"validate-registration-username",
 	"pre-user-deletion",
 	"post-user-deletion"
-]), E = e.enum(["post-user-login"]), D = e.enum([
+]), D = e.enum(["post-user-login"]), O = e.enum([
 	"post-user-login",
 	"post-user-registration",
 	"post-user-update",
 	"credentials-exchange"
-]), O = e.enum([
+]), k = e.enum([
 	"post-user-login",
 	"credentials-exchange",
 	"pre-user-registration",
 	"post-user-registration"
-]), k = e.enum(["post-user-login"]);
-T.options, E.options, D.options, O.options, k.options;
-var A = e.enum(["impersonate"]), Nt = e.enum([
+]), A = e.enum(["post-user-login"]);
+E.options, D.options, O.options, k.options, A.options;
+var Mt = e.enum(["impersonate"]), Nt = e.enum([
 	"ensure-username",
 	"set-preferred-username",
 	"account-linking"
@@ -1311,24 +1311,24 @@ var A = e.enum(["impersonate"]), Nt = e.enum([
 	metadata: e.record(e.string(), e.unknown()).optional()
 }, Pt = e.object({
 	...j,
-	trigger_id: T,
+	trigger_id: E,
 	url: e.string()
 }), Ft = e.object({
 	...j,
-	trigger_id: E,
+	trigger_id: D,
 	form_id: e.string()
 }), It = e.object({
 	...j,
-	trigger_id: D,
+	trigger_id: O,
 	template_id: Nt
 }), Lt = e.object({
 	...j,
-	trigger_id: O,
+	trigger_id: k,
 	code_id: e.string()
 }), Rt = e.object({
 	...j,
-	trigger_id: k,
-	page_id: A,
+	trigger_id: A,
+	page_id: Mt,
 	permission_required: e.string().optional()
 });
 e.union([
@@ -1340,34 +1340,34 @@ e.union([
 ]);
 var zt = e.object({
 	...j,
-	trigger_id: T
+	trigger_id: E
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	url: e.string()
 }), Bt = e.object({
 	...j,
-	trigger_id: E
+	trigger_id: D
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	form_id: e.string()
 }), Vt = e.object({
 	...j,
-	trigger_id: D
+	trigger_id: O
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	template_id: Nt
 }), Ht = e.object({
 	...j,
-	trigger_id: O
+	trigger_id: k
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	code_id: e.string()
 }), Ut = e.object({
 	...j,
-	trigger_id: k
+	trigger_id: A
 }).extend(n.shape).extend({
 	hook_id: e.string(),
-	page_id: A,
+	page_id: Mt,
 	permission_required: e.string().optional()
 });
 e.union([
@@ -1482,7 +1482,7 @@ var Jt = /* @__PURE__ */ function(e) {
 e.object({
 	csrf_token: e.string(),
 	auth0Client: e.string().optional(),
-	authParams: Ve,
+	authParams: ze,
 	expires_at: e.string(),
 	deleted_at: e.string().optional(),
 	ip: e.string().optional(),
@@ -2642,7 +2642,7 @@ var Qn = e.enum([
 	friendly_name: e.string().optional(),
 	confirmed: e.boolean().default(!1)
 });
-function F(t, n) {
+function er(t, n) {
 	t.type === "phone" && !t.phone_number && n.addIssue({
 		code: e.ZodIssueCode.custom,
 		message: "phone_number is required when type is 'phone'",
@@ -2665,23 +2665,23 @@ function F(t, n) {
 		path: ["public_key"]
 	}));
 }
-$n.superRefine(F), $n.extend({
+$n.superRefine(er), $n.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).superRefine(F), e.object({
+}).superRefine(er), e.object({
 	id: e.string().optional(),
 	created_at: e.string().datetime({ offset: !0 }).optional(),
 	updated_at: e.string().datetime({ offset: !0 }).optional()
 });
 //#endregion
 //#region src/data-plane/cache.ts
-var er = 1e4;
-function I(e, t, n) {
+var tr = 1e4;
+function F(e, t, n) {
 	let r = typeof t == "number" ? {
 		freshTtlMs: t,
 		maxEntries: n
-	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? er, l = r.waitUntil, u = /* @__PURE__ */ new Map();
+	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? tr, l = r.waitUntil, u = /* @__PURE__ */ new Map();
 	function d(e) {
 		for (let [t, n] of u) n.stale_if_error_until <= e && n.stale_until <= e && !n.refreshing && u.delete(t);
 		for (; u.size >= c;) {
@@ -2738,7 +2738,7 @@ function I(e, t, n) {
 }
 //#endregion
 //#region src/data-plane/registry.ts
-var L = class {
+var I = class {
 	definitions = /* @__PURE__ */ new Map();
 	bindings;
 	constructor(e = {}) {
@@ -2758,38 +2758,38 @@ var L = class {
 		return n.build(r.data, { bindings: this.bindings });
 	}
 };
-function R(e) {
+function L(e) {
 	return e;
 }
 //#endregion
 //#region src/data-plane/handlers/util.ts
-var z = "__authhero_proxy_request__", B = "__authhero_proxy_tenant_id__", V = "__authhero_proxy_custom_domain_id__", H = "__authhero_proxy_domain__", U = "x-authhero-proxy-mutability-probe";
-function tr(e, t) {
-	e.set(z, t);
-}
-function W(e) {
-	return e.get(z) ?? e.req.raw;
-}
+var R = "__authhero_proxy_request__", z = "__authhero_proxy_tenant_id__", B = "__authhero_proxy_custom_domain_id__", V = "__authhero_proxy_domain__", H = "x-authhero-proxy-mutability-probe";
 function nr(e, t) {
-	e.set(B, t.tenant_id), e.set(V, t.custom_domain_id), e.set(H, t.domain);
+	e.set(R, t);
 }
-function rr(e) {
-	return e.get(B);
+function U(e) {
+	return e.get(R) ?? e.req.raw;
+}
+function rr(e, t) {
+	e.set(z, t.tenant_id), e.set(B, t.custom_domain_id), e.set(V, t.domain);
 }
 function ir(e) {
-	return e.get(V);
+	return e.get(z);
 }
 function ar(e) {
-	return e.get(H);
+	return e.get(B);
 }
-function or(e, t) {
-	let n = W(e), r = new Headers(n.headers);
-	t(r), tr(e, new Request(n, { headers: r }));
+function or(e) {
+	return e.get(V);
 }
-function G(e) {
+function sr(e, t) {
+	let n = U(e), r = new Headers(n.headers);
+	t(r), nr(e, new Request(n, { headers: r }));
+}
+function W(e) {
 	let t = e.res;
 	try {
-		t.headers.append(U, "1"), t.headers.delete(U);
+		t.headers.append(H, "1"), t.headers.delete(H);
 		return;
 	} catch {
 		e.res = new Response(t.body, {
@@ -2801,7 +2801,7 @@ function G(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var sr = e.object({
+var cr = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2809,44 +2809,44 @@ var sr = e.object({
 	expose_headers: e.array(e.string()).optional(),
 	max_age: e.number().int().optional()
 }).refine((e) => !(e.allow_credentials && e.origins?.includes("*")), { message: "Cannot use wildcard origin (*) with allow_credentials" });
-function cr(e, t) {
+function lr(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var lr = R({
+var ur = L({
 	type: "cors",
-	optionsSchema: sr,
+	optionsSchema: cr,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
 			if (t.req.method === "OPTIONS" && r !== null && t.req.header("access-control-request-method") !== void 0) {
-				let t = cr(e, r);
+				let t = lr(e, r);
 				return new Response(null, {
 					status: 204,
 					headers: t
 				});
 			}
 			await n();
-			let i = cr(e, r);
-			G(t), i.forEach((e, n) => {
+			let i = lr(e, r);
+			W(t), i.forEach((e, n) => {
 				n.toLowerCase() === "vary" ? t.res.headers.append(n, e) : t.res.headers.set(n, e);
 			});
 		};
 	}
-}), ur = e.object({
+}), dr = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function dr(e, t) {
+function fr(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var fr = R({
+var pr = L({
 	type: "basic_auth",
-	optionsSchema: ur,
+	optionsSchema: dr,
 	build(e) {
-		let t = dr(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = fr(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2862,7 +2862,7 @@ var fr = R({
 			});
 		};
 	}
-}), pr = R({
+}), mr = L({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2872,66 +2872,173 @@ var fr = R({
 	}),
 	build(e) {
 		return async (t, n) => {
-			if ((e.request || e.remove_request) && or(t, (t) => {
+			if ((e.request || e.remove_request) && sr(t, (t) => {
 				if (e.remove_request?.forEach((e) => t.delete(e)), e.request) for (let [n, r] of Object.entries(e.request)) t.set(n, r);
-			}), await n(), (e.response || e.remove_response) && (G(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
+			}), await n(), (e.response || e.remove_response) && (W(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), mr = R({
+}), hr = L({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
 		return async (t, n) => {
 			if (await n(), !t.res.headers.has("Cache-Control")) {
 				let n = t.res.headers.has("set-cookie") ? "private" : "public";
-				G(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
+				W(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
 			}
 		};
 	}
-}), hr = R({
+}), gr = [
+	"173.245.48.0/20",
+	"103.21.244.0/22",
+	"103.22.200.0/22",
+	"103.31.4.0/22",
+	"141.101.64.0/18",
+	"108.162.192.0/18",
+	"190.93.240.0/20",
+	"188.114.96.0/20",
+	"197.234.240.0/22",
+	"198.41.128.0/17",
+	"162.158.0.0/15",
+	"104.16.0.0/13",
+	"104.24.0.0/14",
+	"172.64.0.0/13",
+	"131.0.72.0/22",
+	"2400:cb00::/32",
+	"2606:4700::/32",
+	"2803:f800::/32",
+	"2405:b500::/32",
+	"2405:8100::/32",
+	"2a06:98c0::/29",
+	"2c0f:f248::/32"
+];
+function _r(e) {
+	let t = e.split(".");
+	if (t.length !== 4) return null;
+	let n = [];
+	for (let e of t) {
+		if (!/^\d{1,3}$/.test(e)) return null;
+		let t = Number(e);
+		if (t > 255) return null;
+		n.push(t);
+	}
+	return n;
+}
+function vr(e) {
+	if (e === "") return [];
+	let t = e.split(":"), n = [];
+	for (let e = 0; e < t.length; e++) {
+		let r = t[e];
+		if (r.includes(".")) {
+			if (e !== t.length - 1) return null;
+			let i = _r(r);
+			if (!i) return null;
+			n.push(i[0] << 8 | i[1], i[2] << 8 | i[3]);
+			continue;
+		}
+		if (!/^[0-9a-f]{1,4}$/i.test(r)) return null;
+		n.push(parseInt(r, 16));
+	}
+	return n;
+}
+function yr(e) {
+	let t = e.split("::");
+	if (t.length > 2) return null;
+	let n = vr(t[0] ?? "");
+	if (!n) return null;
+	let r;
+	if (t.length === 2) {
+		let e = vr(t[1] ?? "");
+		if (!e) return null;
+		let i = 8 - n.length - e.length;
+		if (i < 1) return null;
+		r = [
+			...n,
+			...Array(i).fill(0),
+			...e
+		];
+	} else r = n;
+	if (r.length !== 8) return null;
+	let i = [];
+	for (let e of r) i.push(e >> 8 & 255, e & 255);
+	return i;
+}
+function br(e) {
+	let t = e.trim();
+	t.startsWith("[") && t.endsWith("]") && (t = t.slice(1, -1));
+	let n = t.indexOf("%");
+	if (n !== -1 && (t = t.slice(0, n)), t === "") return null;
+	if (!t.includes(":")) return _r(t);
+	let r = yr(t);
+	return r ? r.slice(0, 10).every((e) => e === 0) && r[10] === 255 && r[11] === 255 ? r.slice(12) : r : null;
+}
+function xr(e) {
+	let [t, n] = e.split("/"), r = br(t ?? ""), i = Number(n);
+	if (!r || !Number.isInteger(i)) throw Error(`Invalid Cloudflare CIDR: ${e}`);
+	return {
+		bytes: r,
+		prefixBits: i
+	};
+}
+var Sr = gr.map(xr);
+function Cr(e, t) {
+	if (e.length !== t.bytes.length) return !1;
+	let n = t.prefixBits >> 3;
+	for (let r = 0; r < n; r++) if (e[r] !== t.bytes[r]) return !1;
+	let r = t.prefixBits & 7;
+	if (r === 0) return !0;
+	let i = 255 << 8 - r & 255;
+	return (e[n] & i) === (t.bytes[n] & i);
+}
+function wr(e) {
+	let t = br(e);
+	return t ? Sr.some((e) => Cr(t, e)) : !1;
+}
+var Tr = L({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
 		set_x_real_ip: e.boolean().default(!0),
-		set_x_original_url: e.boolean().default(!0)
+		set_x_original_url: e.boolean().default(!0),
+		skip_cloudflare_client_ip: e.boolean().default(!0)
 	}),
 	build(e) {
 		return async (t, n) => {
 			let r = new URL(t.req.url);
-			or(t, (n) => {
+			sr(t, (n) => {
 				n.set("x-forwarded-host", r.host), n.set("x-forwarded-proto", r.protocol.replace(":", "")), e.set_x_original_url && n.set("x-original-url", t.req.url);
-				let i = n.get(e.client_ip_header), a = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), o = i ?? a[a.length - 1] ?? "127.0.0.1", s = a.length === 0 || a[a.length - 1] !== o, c = a.length ? s ? `${a.join(", ")}, ${o}` : a.join(", ") : o;
-				n.set("x-forwarded-for", c), e.set_x_real_ip && n.set("x-real-ip", o);
+				let i = n.get(e.client_ip_header), a = i && e.skip_cloudflare_client_ip && wr(i) ? null : i, o = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), s = a ?? o[o.length - 1] ?? "127.0.0.1", c = o.length === 0 || o[o.length - 1] !== s, l = o.length ? c ? `${o.join(", ")}, ${s}` : o.join(", ") : s;
+				n.set("x-forwarded-for", l), e.set_x_real_ip && n.set("x-real-ip", s);
 			}), await n();
 		};
 	}
-}), gr = e.object({ upstream_host: e.string().optional() });
-function _r(e) {
+}), Er = e.object({ upstream_host: e.string().optional() });
+function Dr(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function vr(e) {
+function Or(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var yr = R({
+var kr = L({
 	type: "rewrite_cookies",
-	optionsSchema: gr,
+	optionsSchema: Er,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = vr(t.res.headers);
+			let a = Or(t.res.headers);
 			if (a.length === 0) return;
-			let o = _r(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
-			G(t), t.res.headers.delete("set-cookie");
+			let o = Dr(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			W(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), br = R({
+}), Ar = L({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
@@ -2951,25 +3058,25 @@ var yr = R({
 			}
 			if (o.origin !== a) return;
 			let s = new URL(t.req.url), c = `${`${s.protocol}//${s.host}`}${o.pathname}${o.search}${o.hash}`;
-			G(t), t.res.headers.set("location", c);
+			W(t), t.res.headers.set("location", c);
 		};
 	}
-}), xr = class extends Error {
+}), jr = class extends Error {
 	ms;
 	constructor(e, t) {
 		super(`${t ?? "Operation"} timed out after ${e}ms`), this.name = "TimeoutError", this.ms = e;
 	}
 };
-function K(e) {
-	return e instanceof xr ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
+function G(e) {
+	return e instanceof jr ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
 }
-function q(e, t) {
+function K(e, t) {
 	let n = new AbortController(), r = setTimeout(() => n.abort(), e);
 	return t(n.signal).finally(() => clearTimeout(r));
 }
-function J(e, t, n) {
+function q(e, t, n) {
 	let r, i = new Promise((e, i) => {
-		r = setTimeout(() => i(new xr(t, n)), t);
+		r = setTimeout(() => i(new jr(t, n)), t);
 	});
 	return Promise.race([e, i]).finally(() => {
 		r && clearTimeout(r);
@@ -2977,7 +3084,7 @@ function J(e, t, n) {
 }
 //#endregion
 //#region src/data-plane/handlers/http.ts
-var Sr = new Set([
+var Mr = new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -2986,24 +3093,24 @@ var Sr = new Set([
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), Cr = 3e4, wr = e.object({
+]), Nr = 3e4, Pr = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Tr(e, t) {
+function Fr(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function Er(e) {
+function Ir(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function Dr(e, t) {
+function Lr(e, t) {
 	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = Tr(r.pathname, n.pathname), r.search = n.search;
+	r.pathname = Fr(r.pathname, n.pathname), r.search = n.search;
 	let i = new Headers(t.headers);
-	for (let e of Sr) i.delete(e);
+	for (let e of Mr) i.delete(e);
 	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = Er(t.method) ? t.body : void 0, o = {
+	let a = Ir(t.method) ? t.body : void 0, o = {
 		method: t.method,
 		headers: i,
 		body: a,
@@ -3014,85 +3121,85 @@ function Dr(e, t) {
 		init: o
 	};
 }
-var Or = R({
+var Rr = L({
 	type: "http",
-	optionsSchema: wr,
+	optionsSchema: Pr,
 	build(e) {
-		let t = e.timeout_ms ?? Cr;
+		let t = e.timeout_ms ?? Nr;
 		return async (n) => {
-			let { target: r, init: i } = Dr(e, W(n));
+			let { target: r, init: i } = Lr(e, U(n));
 			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
 			try {
-				return await q(t, (e) => fetch(r.toString(), {
+				return await K(t, (e) => fetch(r.toString(), {
 					...i,
 					signal: e
 				}));
 			} catch (e) {
-				return K(e) ? n.text("Upstream timeout", 504, { "x-authhero-proxy-error": "http_timeout" }) : n.text("Bad gateway", 502, { "x-authhero-proxy-error": "http_failed" });
+				return G(e) ? n.text("Upstream timeout", 504, { "x-authhero-proxy-error": "http_timeout" }) : n.text("Bad gateway", 502, { "x-authhero-proxy-error": "http_failed" });
 			}
 		};
 	}
-}), kr = 3e4, Ar = e.object({
+}), zr = 3e4, Br = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
 	preserve_host: e.boolean().default(!0),
 	timeout_ms: e.number().int().positive().optional()
 });
-function jr(e) {
+function Vr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var Mr = R({
+var Hr = L({
 	type: "service_binding",
-	optionsSchema: Ar,
+	optionsSchema: Br,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!jr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
-		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? kr;
+		if (!Vr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? zr;
 		return async (t) => {
-			let a = W(t), { target: o, init: s } = Dr({
+			let a = U(t), { target: o, init: s } = Lr({
 				upstream_url: r,
 				preserve_host: e.preserve_host
 			}, a);
 			t.set("__proxy_upstream_host__", o.hostname), t.set("__proxy_upstream_origin__", `${o.protocol}//${o.host}`);
 			try {
-				return await q(i, async (e) => n.fetch(new Request(o.toString(), {
+				return await K(i, async (e) => n.fetch(new Request(o.toString(), {
 					...s,
 					signal: e
 				})));
 			} catch (e) {
-				return K(e) ? t.text(`service_binding timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "service_binding_timeout" }) : t.text("Bad gateway", 502, { "x-authhero-proxy-error": "service_binding_failed" });
+				return G(e) ? t.text(`service_binding timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "service_binding_timeout" }) : t.text("Bad gateway", 502, { "x-authhero-proxy-error": "service_binding_failed" });
 			}
 		};
 	}
-}), Nr = 3e4, Pr = e.object({
+}), Ur = 3e4, Wr = e.object({
 	binding: e.string(),
 	script_name: e.string(),
 	cpu_ms: e.number().int().positive().optional(),
 	subrequests: e.number().int().positive().optional(),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Fr(e) {
+function Gr(e) {
 	return typeof e == "object" && !!e && typeof e.get == "function";
 }
-var Y = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
-function Ir(e) {
-	return Y.lastIndex = 0, Y.test(e);
+var J = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
+function Kr(e) {
+	return J.lastIndex = 0, J.test(e);
 }
-var Lr = R({
+var qr = L({
 	type: "dispatch_namespace",
-	optionsSchema: Pr,
+	optionsSchema: Wr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!Fr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
-		let r = Ir(e.script_name), i = e.timeout_ms ?? Nr, a = e.cpu_ms || e.subrequests ? { limits: {
+		if (!Gr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = Kr(e.script_name), i = e.timeout_ms ?? Ur, a = e.cpu_ms || e.subrequests ? { limits: {
 			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
 			...e.subrequests ? { subrequests: e.subrequests } : {}
 		} } : void 0;
 		return async (t) => {
 			let o = e.script_name;
 			if (r) {
-				let n = rr(t), r = ir(t), i = ar(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
-				if (o = o.replace(Y, (e, t) => {
+				let n = ir(t), r = ar(t), i = or(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				if (o = o.replace(J, (e, t) => {
 					switch (t) {
 						case "tenant_id": return n ?? "";
 						case "custom_domain_id": return r ?? "";
@@ -3102,19 +3209,19 @@ var Lr = R({
 					}
 				}), o.includes("{") || o === "") return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`, 500);
 			}
-			let s = W(t);
+			let s = U(t);
 			try {
 				let e = n.get(o, void 0, a);
-				return await q(i, async (t) => {
+				return await K(i, async (t) => {
 					let n = new Request(s, { signal: t });
 					return e.fetch(n);
 				});
 			} catch (e) {
-				return K(e) ? t.text(`dispatch_namespace timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "dispatch_namespace_timeout" }) : t.text("Bad gateway", 502, { "x-authhero-proxy-error": "dispatch_namespace_failed" });
+				return G(e) ? t.text(`dispatch_namespace timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "dispatch_namespace_timeout" }) : t.text("Bad gateway", 502, { "x-authhero-proxy-error": "dispatch_namespace_failed" });
 			}
 		};
 	}
-}), Rr = R({
+}), Jr = L({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -3143,7 +3250,7 @@ var Lr = R({
 			});
 		};
 	}
-}), zr = R({
+}), Yr = L({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -3163,15 +3270,15 @@ var Lr = R({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function Br(e) {
-	e.add(lr).add(fr).add(pr).add(mr).add(hr).add(yr).add(br).add(Or).add(Mr).add(Lr).add(Rr).add(zr);
+function Xr(e) {
+	e.add(ur).add(pr).add(mr).add(hr).add(Tr).add(kr).add(Ar).add(Rr).add(Hr).add(qr).add(Jr).add(Yr);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
-function Vr(e) {
+function Zr(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function Hr(e, t) {
+function Qr(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -3180,13 +3287,13 @@ function Hr(e, t) {
 	}
 	return !1;
 }
-function Ur(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => Hr(e, t));
+function $r(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => Qr(e, t));
 }
-function X(e) {
+function ei(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !Ur(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r && !$r(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -3203,7 +3310,17 @@ function X(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var Wr = [
+var ti = "forwarded_headers";
+function ni(e) {
+	return e.some((e) => e.type === "forwarded_headers") ? [...e] : [{
+		type: ti,
+		options: {}
+	}, ...e];
+}
+function Y(e, t) {
+	return e.has("forwarded_headers") ? ni(t) : [...t];
+}
+var X = [
 	"GET",
 	"POST",
 	"PUT",
@@ -3215,39 +3332,39 @@ var Wr = [
 function Z(e, n, r, i) {
 	let a = new t();
 	r && a.use("*", async (e, t) => {
-		nr(e, r), await t();
+		rr(e, r), await t();
 	});
-	let o = Vr(e);
+	let o = Zr(e);
 	for (let e of o) {
 		let t = [];
-		t.push(X(e.match));
-		for (let r of e.handlers) t.push(n.build(r.type, r.options));
-		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : Wr, i = e.match.path || "/*";
+		t.push(ei(e.match));
+		for (let r of Y(n, e.handlers)) t.push(n.build(r.type, r.options));
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : X, i = e.match.path || "/*";
 		a.on(r, [i], ...t);
 	}
-	return i && i.length > 0 ? a.on(Wr, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
-		let n = K(e);
+	return i && i.length > 0 ? a.on(X, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
+		let n = G(e);
 		return t.text(n ? "Upstream timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "handler_timeout" : "handler_failed" });
 	}), a;
 }
 //#endregion
 //#region src/data-plane/router.ts
-var Gr = 1e4;
-function Kr(e) {
-	return e.resolver ? e.resolver : e.cache ? I(e.data, e.cache) : I(e.data, e.cacheTtlMs ?? 3e4);
+var ri = 1e4;
+function ii(e) {
+	return e.resolver ? e.resolver : e.cache ? F(e.data, e.cache) : F(e.data, e.cacheTtlMs ?? 3e4);
 }
-function qr(e) {
+function ai(e) {
 	if (e.registry) return e.registry;
-	let t = new L(e.bindings ?? {});
-	return Br(t), t;
+	let t = new I(e.bindings ?? {});
+	return Xr(t), t;
 }
 function Q(e) {
-	let t = Kr(e), n = qr(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? Gr, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? e.defaultHandlers.map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
+	let t = ii(e), n = ai(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? ri, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? Y(n, e.defaultHandlers).map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
 	return async (e) => {
 		let s = e.req.header("host") ?? e.req.header("x-forwarded-host");
 		if (!s) return e.text("Missing host", 400);
 		try {
-			let c = await J(t.resolveHost(s), i, "resolveHost");
+			let c = await q(t.resolveHost(s), i, "resolveHost");
 			if (!c) return o ? await o.fetch(e.req.raw) : e.text("Unknown host", 404);
 			let l = r.get(c);
 			return l || (l = Z(c.routes, n, {
@@ -3256,17 +3373,17 @@ function Q(e) {
 				domain: c.domain
 			}, a), r.set(c, l)), await l.fetch(e.req.raw);
 		} catch (t) {
-			return o ? await o.fetch(e.req.raw) : K(t) ? e.text(`Resolve host timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "resolve_host_timeout" }) : e.text("Bad gateway", 502, { "x-authhero-proxy-error": "data_plane_error" });
+			return o ? await o.fetch(e.req.raw) : G(t) ? e.text(`Resolve host timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "resolve_host_timeout" }) : e.text("Bad gateway", 502, { "x-authhero-proxy-error": "data_plane_error" });
 		}
 	};
 }
-function Jr(e) {
+function oi(e) {
 	let n = new t();
 	return n.all("*", Q(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function Yr(e) {
+function si(e) {
 	let n = new t();
 	return n.all("*", Q({
 		data: e.data,
@@ -3278,62 +3395,62 @@ function Yr(e) {
 		resolveHostTimeoutMs: e.resolveHostTimeoutMs,
 		defaultHandlers: e.defaultHandlers
 	})), n.onError((e, t) => {
-		let n = K(e);
+		let n = G(e);
 		return t.text(n ? "Proxy timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "proxy_timeout" : "proxy_error" });
 	}), n;
 }
 //#endregion
 //#region src/data-plane/cache-api-cache.ts
-var Xr = 1e3, Zr = 1e3;
-function Qr(e, t) {
+var ci = 1e3, li = 1e3;
+function ui(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function $r() {
+function di() {
 	return globalThis.caches?.default;
 }
-function ei(e) {
-	let t = e.cache ?? $r();
+function fi(e) {
+	let t = e.cache ?? di();
 	if (!t) return e.upstream;
-	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? Xr, c = e.cacheWriteTimeoutMs ?? Zr;
+	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? ci, c = e.cacheWriteTimeoutMs ?? li;
 	async function l(e) {
 		try {
-			return await J(Promise.resolve(n.match(e)), s, "cache.match");
+			return await q(Promise.resolve(n.match(e)), s, "cache.match");
 		} catch {
 			return;
 		}
 	}
 	return { async resolveHost(t) {
-		let s = Qr(r, t), u = await l(s);
+		let s = ui(r, t), u = await l(s);
 		if (u) try {
 			return (await u.json()).value;
 		} catch {}
 		let d = await e.upstream.resolveHost(t), f = d === null ? a : i, p = new Response(JSON.stringify({ value: d }), { headers: {
 			"content-type": "application/json",
 			"cache-control": `public, max-age=${f}`
-		} }), m = J(Promise.resolve(n.put(s, p)), c, "cache.put").catch(() => void 0);
+		} }), m = q(Promise.resolve(n.put(s, p)), c, "cache.put").catch(() => void 0);
 		return o ? o(m) : await m, d;
 	} };
 }
-function ti(e, t) {
-	return Qr(e, t);
+function pi(e, t) {
+	return ui(e, t);
 }
 //#endregion
 //#region src/data-plane/cache-adapter-cache.ts
-var ni = 1e3, ri = 1e3;
-function ii(e) {
-	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = ni, cacheWriteTimeoutMs: u = ri } = e, d = /* @__PURE__ */ new Map();
+var mi = 1e3, hi = 1e3;
+function gi(e) {
+	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = mi, cacheWriteTimeoutMs: u = hi } = e, d = /* @__PURE__ */ new Map();
 	function f(e) {
 		return `${s}:${e.toLowerCase()}`;
 	}
 	async function p(e) {
 		try {
-			return await J(n.get(e), l, "cache.get") ?? null;
+			return await q(n.get(e), l, "cache.get") ?? null;
 		} catch {
 			return null;
 		}
 	}
 	function m(e, t, r) {
-		let i = J(Promise.resolve().then(() => n.set(e, t, r)), u, "cache.set").catch(() => void 0);
+		let i = q(Promise.resolve().then(() => n.set(e, t, r)), u, "cache.set").catch(() => void 0);
 		return c ? (c(i), Promise.resolve()) : i;
 	}
 	async function h(e) {
@@ -3374,7 +3491,7 @@ function ii(e) {
 		}
 	} };
 }
-function ai(e, t) {
+function _i(e, t) {
 	return `${e}:${t.toLowerCase()}`;
 }
 //#endregion
@@ -3382,7 +3499,7 @@ function ai(e, t) {
 function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function oi(e, t, n, r, i, a) {
+function vi(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -3397,10 +3514,10 @@ function oi(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function si(e) {
+function yi(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => oi(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => vi(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3444,7 +3561,7 @@ function si(e) {
 		}
 	};
 }
-function ci(e, t = {}) {
+function bi(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3459,10 +3576,10 @@ function ci(e, t = {}) {
 }
 //#endregion
 //#region src/constants.ts
-var li = "proxy:resolve_host";
+var xi = "proxy:resolve_host";
 //#endregion
 //#region src/http-adapter/index.ts
-function ui() {
+function Si() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3484,7 +3601,7 @@ function ui() {
 		}
 	};
 }
-function di(e) {
+function Ci(e) {
 	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.scope ?? "proxy:resolve_host", o = e.tokenRefreshSkewSeconds ?? 60, s = e.timeoutMs ?? 2500;
 	function c(e) {
 		let t = new AbortController(), n = setTimeout(() => t.abort(), s);
@@ -3517,7 +3634,7 @@ function di(e) {
 		}), u);
 	}
 	return {
-		proxyRoutes: ui(),
+		proxyRoutes: Si(),
 		async resolveHost(e) {
 			let i = await f(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await c((e) => t(a, {
 				headers: { authorization: `Bearer ${i}` },
@@ -3531,7 +3648,7 @@ function di(e) {
 }
 //#endregion
 //#region src/http-adapter/service-binding-fetch.ts
-function fi(e) {
+function wi(e) {
 	return (t, n) => {
 		let r = t instanceof Request && n === void 0 ? t : new Request(t, n);
 		return e.fetch(r);
@@ -3539,11 +3656,11 @@ function fi(e) {
 }
 //#endregion
 //#region src/kv-adapter/index.ts
-var pi = "authhero-proxy-host:";
-function mi(e, t) {
+var Ti = "authhero-proxy-host:";
+function Ei(e, t) {
 	return `${e}${t.toLowerCase()}`;
 }
-function hi() {
+function Di() {
 	let e = () => {
 		throw Error("KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3565,15 +3682,15 @@ function hi() {
 		}
 	};
 }
-function gi(e) {
-	let { kv: t, keyPrefix: n = pi, timeoutMs: r } = e;
+function Oi(e) {
+	let { kv: t, keyPrefix: n = Ti, timeoutMs: r } = e;
 	return {
-		proxyRoutes: hi(),
+		proxyRoutes: Di(),
 		async resolveHost(e) {
-			let i = mi(n, e), a = t.get(i, "json");
-			return (r && r > 0 ? await J(a, r, "kv.get") : await a) ?? null;
+			let i = Ei(n, e), a = t.get(i, "json");
+			return (r && r > 0 ? await q(a, r, "kv.get") : await a) ?? null;
 		}
 	};
 }
 //#endregion
-export { pi as DEFAULT_KV_HOST_KEY_PREFIX, L as HandlerRegistry, li as PROXY_RESOLVE_HOST_SCOPE, fr as basicAuthHandler, ai as buildCacheAdapterKey, ti as buildCacheApiKey, mi as buildKvHostKey, X as buildMatchFilter, mr as cacheHandler, Z as compileHostApp, lr as corsHandler, ii as createCacheAdapterHostCache, ei as createCacheApiHostCache, di as createHttpProxyAdapter, I as createInMemoryHostCache, gi as createKvProxyAdapter, Yr as createProxyApp, Q as createProxyDataPlaneHandler, Jr as createProxyDataPlaneRouter, fi as createServiceBindingFetch, si as createStaticProxyAdapter, R as defineHandler, Lr as dispatchNamespaceHandler, hr as forwardedHeadersHandler, En as handlerConfigSchema, pr as headersHandler, Or as httpHandler, ci as httpRoute, Tn as matchSchema, Ur as matchesAnyHost, Hr as matchesHost, P as proxyRouteInsertSchema, Dn as proxyRouteSchema, On as proxyRouteUpdateSchema, Rr as redirectHandler, Br as registerBuiltinHandlers, yr as rewriteCookiesHandler, br as rewriteLocationHandler, Mr as serviceBindingHandler, Vr as sortRoutes, zr as staticHandler };
+export { Ti as DEFAULT_KV_HOST_KEY_PREFIX, ti as FORWARDED_HEADERS_HANDLER_TYPE, I as HandlerRegistry, xi as PROXY_RESOLVE_HOST_SCOPE, pr as basicAuthHandler, _i as buildCacheAdapterKey, pi as buildCacheApiKey, Ei as buildKvHostKey, ei as buildMatchFilter, hr as cacheHandler, Z as compileHostApp, ur as corsHandler, gi as createCacheAdapterHostCache, fi as createCacheApiHostCache, Ci as createHttpProxyAdapter, F as createInMemoryHostCache, Oi as createKvProxyAdapter, si as createProxyApp, Q as createProxyDataPlaneHandler, oi as createProxyDataPlaneRouter, wi as createServiceBindingFetch, yi as createStaticProxyAdapter, L as defineHandler, qr as dispatchNamespaceHandler, Tr as forwardedHeadersHandler, En as handlerConfigSchema, mr as headersHandler, Rr as httpHandler, bi as httpRoute, wr as isCloudflareIp, Tn as matchSchema, $r as matchesAnyHost, Qr as matchesHost, P as proxyRouteInsertSchema, Dn as proxyRouteSchema, On as proxyRouteUpdateSchema, Jr as redirectHandler, Xr as registerBuiltinHandlers, kr as rewriteCookiesHandler, Ar as rewriteLocationHandler, Hr as serviceBindingHandler, Zr as sortRoutes, Yr as staticHandler, ni as withForwardedHeaders, Y as withForwardedHeadersFor };