@authhero/proxy 0.3.3 → 0.4.1

package/dist/proxy.mjs

@@ -362,7 +362,7 @@ var _e = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", ve
 		"oag"
 	]).default("regular_web").optional().openapi({ description: "The type of application this client represents" }),
 	logo_uri: e.string().url().optional().openapi({ description: "URL of the logo to display for this client. Recommended size is 150x150 pixels." }),
-	is_first_party: e.boolean().default(!1).openapi({ description: "Whether this client a first party client (true) or not (false)." }),
+	is_first_party: e.boolean().default(!0).openapi({ description: "Whether this client is a first party client (true) or not (false). First-party clients skip the consent screen; third-party clients require explicit user consent for non-basic scopes." }),
 	oidc_conformant: e.boolean().default(!0).openapi({ description: "Whether this client conforms to strict OIDC specifications (true) or uses legacy features (false)." }),
 	auth0_conformant: e.boolean().default(!0).openapi({ description: "Whether this client follows Auth0-compatible behavior (true) or strict OIDC behavior (false). When true, profile/email claims are included in the ID token when scopes are requested. When false, these claims are only available from the userinfo endpoint (strict OIDC 5.4 compliance)." }),
 	callbacks: e.array(e.string()).default([]).optional().openapi({ description: "Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication." }),
@@ -1419,7 +1419,7 @@ e.object({ keys: e.array(Wt) }), e.object({
 	client_id_metadata_document_supported: e.boolean().optional()
 });
 var Gt = /* @__PURE__ */ function(e) {
-	return e.PENDING = "pending", e.AUTHENTICATED = "authenticated", e.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", e.AWAITING_MFA = "awaiting_mfa", e.AWAITING_HOOK = "awaiting_hook", e.AWAITING_CONTINUATION = "awaiting_continuation", e.COMPLETED = "completed", e.FAILED = "failed", e.EXPIRED = "expired", e;
+	return e.PENDING = "pending", e.AUTHENTICATED = "authenticated", e.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", e.AWAITING_MFA = "awaiting_mfa", e.AWAITING_HOOK = "awaiting_hook", e.AWAITING_CONTINUATION = "awaiting_continuation", e.AWAITING_CONSENT = "awaiting_consent", e.COMPLETED = "completed", e.FAILED = "failed", e.EXPIRED = "expired", e;
 }({}), Kt = e.nativeEnum(Gt), qt = e.object({
 	strategy: e.string(),
 	strategy_type: e.string()
@@ -2035,6 +2035,7 @@ var N = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
 }), F = e.object({
+	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
 	match: N,
@@ -2044,7 +2045,10 @@ var N = e.object({
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), hn = F.partial().omit({ custom_domain_id: !0 });
+}), hn = F.partial().omit({
+	id: !0,
+	custom_domain_id: !0
+});
 e.object({
 	name: e.string(),
 	enabled: e.boolean().optional().default(!0),
@@ -2141,7 +2145,12 @@ var bn = e.object({
 	resource_server_identifier: e.string(),
 	permission_name: e.string()
 }).extend({ created_at: e.string() });
-e.array(bn);
+e.array(bn), e.object({
+	user_id: e.string().openapi({ description: "The id of the user that granted the consent" }),
+	clientID: e.string().openapi({ description: "The id of the client the grant was issued to" }),
+	audience: e.string().optional().openapi({ description: "The audience the grant applies to" }),
+	scope: e.array(e.string()).default([]).openapi({ description: "The list of OAuth scopes the user has consented to" })
+}).extend({ id: e.string() });
 var xn = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
@@ -2517,21 +2526,33 @@ function B(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/util.ts
-var V = "__authhero_proxy_request__", Fn = "x-authhero-proxy-mutability-probe";
-function In(e, t) {
+var V = "__authhero_proxy_request__", H = "__authhero_proxy_tenant_id__", U = "__authhero_proxy_custom_domain_id__", W = "__authhero_proxy_domain__", G = "x-authhero-proxy-mutability-probe";
+function Fn(e, t) {
 	e.set(V, t);
 }
-function H(e) {
+function K(e) {
 	return e.get(V) ?? e.req.raw;
 }
-function U(e, t) {
-	let n = H(e), r = new Headers(n.headers);
-	t(r), In(e, new Request(n, { headers: r }));
+function In(e, t) {
+	e.set(H, t.tenant_id), e.set(U, t.custom_domain_id), e.set(W, t.domain);
+}
+function Ln(e) {
+	return e.get(H);
+}
+function Rn(e) {
+	return e.get(U);
+}
+function zn(e) {
+	return e.get(W);
+}
+function q(e, t) {
+	let n = K(e), r = new Headers(n.headers);
+	t(r), Fn(e, new Request(n, { headers: r }));
 }
-function W(e) {
+function J(e) {
 	let t = e.res;
 	try {
-		t.headers.append(Fn, "1"), t.headers.delete(Fn);
+		t.headers.append(G, "1"), t.headers.delete(G);
 		return;
 	} catch {
 		e.res = new Response(t.body, {
@@ -2543,7 +2564,7 @@ function W(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var Ln = e.object({
+var Bn = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2551,44 +2572,44 @@ var Ln = e.object({
 	expose_headers: e.array(e.string()).optional(),
 	max_age: e.number().int().optional()
 }).refine((e) => !(e.allow_credentials && e.origins?.includes("*")), { message: "Cannot use wildcard origin (*) with allow_credentials" });
-function G(e, t) {
+function Y(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var K = B({
+var Vn = B({
 	type: "cors",
-	optionsSchema: Ln,
+	optionsSchema: Bn,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
 			if (t.req.method === "OPTIONS" && r !== null && t.req.header("access-control-request-method") !== void 0) {
-				let t = G(e, r);
+				let t = Y(e, r);
 				return new Response(null, {
 					status: 204,
 					headers: t
 				});
 			}
 			await n();
-			let i = G(e, r);
-			W(t), i.forEach((e, n) => {
+			let i = Y(e, r);
+			J(t), i.forEach((e, n) => {
 				n.toLowerCase() === "vary" ? t.res.headers.append(n, e) : t.res.headers.set(n, e);
 			});
 		};
 	}
-}), Rn = e.object({
+}), Hn = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function zn(e, t) {
+function Un(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var q = B({
+var Wn = B({
 	type: "basic_auth",
-	optionsSchema: Rn,
+	optionsSchema: Hn,
 	build(e) {
-		let t = zn(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = Un(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2604,7 +2625,7 @@ var q = B({
 			});
 		};
 	}
-}), J = B({
+}), Gn = B({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2614,23 +2635,23 @@ var q = B({
 	}),
 	build(e) {
 		return async (t, n) => {
-			if ((e.request || e.remove_request) && U(t, (t) => {
+			if ((e.request || e.remove_request) && q(t, (t) => {
 				if (e.remove_request?.forEach((e) => t.delete(e)), e.request) for (let [n, r] of Object.entries(e.request)) t.set(n, r);
-			}), await n(), (e.response || e.remove_response) && (W(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
+			}), await n(), (e.response || e.remove_response) && (J(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), Y = B({
+}), Kn = B({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
 		return async (t, n) => {
 			if (await n(), !t.res.headers.has("Cache-Control")) {
 				let n = t.res.headers.has("set-cookie") ? "private" : "public";
-				W(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
+				J(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
 			}
 		};
 	}
-}), Bn = B({
+}), qn = B({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
@@ -2640,40 +2661,40 @@ var q = B({
 	build(e) {
 		return async (t, n) => {
 			let r = new URL(t.req.url);
-			U(t, (n) => {
+			q(t, (n) => {
 				n.set("x-forwarded-host", r.host), n.set("x-forwarded-proto", r.protocol.replace(":", "")), e.set_x_original_url && n.set("x-original-url", t.req.url);
 				let i = n.get(e.client_ip_header), a = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), o = i ?? a[a.length - 1] ?? "127.0.0.1", s = a.length === 0 || a[a.length - 1] !== o, c = a.length ? s ? `${a.join(", ")}, ${o}` : a.join(", ") : o;
 				n.set("x-forwarded-for", c), e.set_x_real_ip && n.set("x-real-ip", o);
 			}), await n();
 		};
 	}
-}), Vn = e.object({ upstream_host: e.string().optional() });
-function Hn(e) {
+}), Jn = e.object({ upstream_host: e.string().optional() });
+function Yn(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function Un(e) {
+function Xn(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var Wn = B({
+var Zn = B({
 	type: "rewrite_cookies",
-	optionsSchema: Vn,
+	optionsSchema: Jn,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = Un(t.res.headers);
+			let a = Xn(t.res.headers);
 			if (a.length === 0) return;
-			let o = Hn(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
-			W(t), t.res.headers.delete("set-cookie");
+			let o = Yn(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			J(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), Gn = B({
+}), Qn = B({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
@@ -2693,10 +2714,10 @@ var Wn = B({
 			}
 			if (o.origin !== a) return;
 			let s = new URL(t.req.url), c = `${`${s.protocol}//${s.host}`}${o.pathname}${o.search}${o.hash}`;
-			W(t), t.res.headers.set("location", c);
+			J(t), t.res.headers.set("location", c);
 		};
 	}
-}), Kn = new Set([
+}), $n = new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -2705,24 +2726,24 @@ var Wn = B({
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), qn = 3e4, Jn = e.object({
+]), er = 3e4, tr = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function Yn(e, t) {
+function nr(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function Xn(e) {
+function rr(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function Zn(e, t) {
+function ir(e, t) {
 	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = Yn(r.pathname, n.pathname), r.search = n.search;
+	r.pathname = nr(r.pathname, n.pathname), r.search = n.search;
 	let i = new Headers(t.headers);
-	for (let e of Kn) i.delete(e);
+	for (let e of $n) i.delete(e);
 	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = Xn(t.method) ? t.body : void 0, o = {
+	let a = rr(t.method) ? t.body : void 0, o = {
 		method: t.method,
 		headers: i,
 		body: a,
@@ -2733,13 +2754,13 @@ function Zn(e, t) {
 		init: o
 	};
 }
-var Qn = B({
+var ar = B({
 	type: "http",
-	optionsSchema: Jn,
+	optionsSchema: tr,
 	build(e) {
-		let t = e.timeout_ms ?? qn;
+		let t = e.timeout_ms ?? er;
 		return async (n) => {
-			let { target: r, init: i } = Zn(e, H(n));
+			let { target: r, init: i } = ir(e, K(n));
 			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
 			let a = new AbortController(), o = setTimeout(() => a.abort(), t);
 			try {
@@ -2755,30 +2776,71 @@ var Qn = B({
 			}
 		};
 	}
-}), $n = e.object({
+}), or = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
 	preserve_host: e.boolean().default(!0)
 });
-function er(e) {
+function sr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var tr = B({
+var cr = B({
 	type: "service_binding",
-	optionsSchema: $n,
+	optionsSchema: or,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!er(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		if (!sr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
 		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`;
 		return async (t) => {
-			let i = H(t), { target: a, init: o } = Zn({
+			let i = K(t), { target: a, init: o } = ir({
 				upstream_url: r,
 				preserve_host: e.preserve_host
 			}, i);
 			return t.set("__proxy_upstream_host__", a.hostname), t.set("__proxy_upstream_origin__", `${a.protocol}//${a.host}`), n.fetch(new Request(a.toString(), o));
 		};
 	}
-}), nr = B({
+}), lr = e.object({
+	binding: e.string(),
+	script_name: e.string(),
+	cpu_ms: e.number().int().positive().optional(),
+	subrequests: e.number().int().positive().optional()
+});
+function ur(e) {
+	return typeof e == "object" && !!e && typeof e.get == "function";
+}
+var X = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
+function dr(e) {
+	return X.lastIndex = 0, X.test(e);
+}
+var fr = B({
+	type: "dispatch_namespace",
+	optionsSchema: lr,
+	build(e, t) {
+		let n = t.bindings[e.binding];
+		if (!ur(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = dr(e.script_name), i = e.cpu_ms || e.subrequests ? { limits: {
+			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
+			...e.subrequests ? { subrequests: e.subrequests } : {}
+		} } : void 0;
+		return async (t) => {
+			let a = e.script_name;
+			if (r) {
+				let n = Ln(t), r = Rn(t), i = zn(t), o = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				if (a = a.replace(X, (e, t) => {
+					switch (t) {
+						case "tenant_id": return n ?? "";
+						case "custom_domain_id": return r ?? "";
+						case "domain": return i ?? "";
+						case "host": return o;
+						default: return "";
+					}
+				}), a.includes("{") || a === "") return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`, 500);
+			}
+			let o = n.get(a, void 0, i), s = K(t);
+			return o.fetch(s);
+		};
+	}
+}), pr = B({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -2807,7 +2869,7 @@ var tr = B({
 			});
 		};
 	}
-}), rr = B({
+}), mr = B({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -2827,15 +2889,15 @@ var tr = B({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function X(e) {
-	e.add(K).add(q).add(J).add(Y).add(Bn).add(Wn).add(Gn).add(Qn).add(tr).add(nr).add(rr);
+function hr(e) {
+	e.add(Vn).add(Wn).add(Gn).add(Kn).add(qn).add(Zn).add(Qn).add(ar).add(cr).add(fr).add(pr).add(mr);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
-function ir(e) {
+function gr(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function ar(e, t) {
+function _r(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -2844,13 +2906,13 @@ function ar(e, t) {
 	}
 	return !1;
 }
-function or(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => ar(e, t));
+function vr(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => _r(e, t));
 }
-function sr(e) {
+function yr(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !or(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r && !vr(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -2867,7 +2929,7 @@ function sr(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var cr = [
+var br = [
 	"GET",
 	"POST",
 	"PUT",
@@ -2876,45 +2938,53 @@ var cr = [
 	"OPTIONS",
 	"HEAD"
 ];
-function lr(e, n) {
-	let r = new t(), i = ir(e);
-	for (let e of i) {
+function xr(e, n, r) {
+	let i = new t();
+	r && i.use("*", async (e, t) => {
+		In(e, r), await t();
+	});
+	let a = gr(e);
+	for (let e of a) {
 		let t = [];
-		t.push(sr(e.match));
+		t.push(yr(e.match));
 		for (let r of e.handlers) t.push(n.build(r.type, r.options));
-		let i = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : cr, a = e.match.path || "/*";
-		r.on(i, [a], ...t);
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : br, a = e.match.path || "/*";
+		i.on(r, [a], ...t);
 	}
-	return r.all("*", (e) => e.text("No matching route", 404)), r;
+	return i.all("*", (e) => e.text("No matching route", 404)), i;
 }
 //#endregion
 //#region src/data-plane/router.ts
-function ur(e) {
+function Sr(e) {
 	return e.resolver ? e.resolver : e.cache ? R(e.data, e.cache) : R(e.data, e.cacheTtlMs ?? 3e4);
 }
-function dr(e) {
+function Cr(e) {
 	if (e.registry) return e.registry;
 	let t = new z(e.bindings ?? {});
-	return X(t), t;
+	return hr(t), t;
 }
 function Z(e) {
-	let t = ur(e), n = dr(e), r = /* @__PURE__ */ new WeakMap();
+	let t = Sr(e), n = Cr(e), r = /* @__PURE__ */ new WeakMap();
 	return async (e) => {
 		let i = e.req.header("host") ?? e.req.header("x-forwarded-host");
 		if (!i) return e.text("Missing host", 400);
 		let a = await t.resolveHost(i);
 		if (!a) return e.text("Unknown host", 404);
 		let o = r.get(a);
-		return o || (o = lr(a.routes, n), r.set(a, o)), o.fetch(e.req.raw);
+		return o || (o = xr(a.routes, n, {
+			tenant_id: a.tenant_id,
+			custom_domain_id: a.custom_domain_id,
+			domain: a.domain
+		}), r.set(a, o)), o.fetch(e.req.raw);
 	};
 }
-function fr(e) {
+function wr(e) {
 	let n = new t();
 	return n.all("*", Z(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function pr(e) {
+function Tr(e) {
 	let n = new t();
 	return n.all("*", Z({
 		data: e.data,
@@ -2929,11 +2999,11 @@ function pr(e) {
 function Q(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function mr() {
+function Er() {
 	return globalThis.caches?.default;
 }
-function hr(e) {
-	let t = e.cache ?? mr();
+function Dr(e) {
+	let t = e.cache ?? Er();
 	if (!t) return e.upstream;
 	let n = e.namespace ?? "authhero-proxy", r = e.cacheTtlSeconds ?? 60, i = e.negativeCacheTtlSeconds ?? 10, a = e.waitUntil;
 	return { async resolveHost(o) {
@@ -2948,7 +3018,7 @@ function hr(e) {
 		return a ? a(f) : await f.catch(() => void 0), l;
 	} };
 }
-function gr(e, t) {
+function Or(e, t) {
 	return Q(e, t);
 }
 //#endregion
@@ -2956,7 +3026,7 @@ function gr(e, t) {
 function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function _r(e, t, n, r, i, a) {
+function kr(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -2971,10 +3041,10 @@ function _r(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function vr(e) {
+function Ar(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => _r(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => kr(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3018,7 +3088,7 @@ function vr(e) {
 		}
 	};
 }
-function yr(e, t = {}) {
+function jr(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3033,7 +3103,7 @@ function yr(e, t = {}) {
 }
 //#endregion
 //#region src/http-adapter/index.ts
-function br() {
+function Mr() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3055,7 +3125,7 @@ function br() {
 		}
 	};
 }
-function xr(e) {
+function Nr(e) {
 	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.tokenRefreshSkewSeconds ?? 60, o = e.timeoutMs ?? 5e3;
 	function s(e) {
 		let t = new AbortController(), n = setTimeout(() => t.abort(), o);
@@ -3087,7 +3157,7 @@ function xr(e) {
 		}), l);
 	}
 	return {
-		proxyRoutes: br(),
+		proxyRoutes: Mr(),
 		async resolveHost(e) {
 			let i = await d(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await s((e) => t(a, {
 				headers: { authorization: `Bearer ${i}` },
@@ -3100,4 +3170,4 @@ function xr(e) {
 	};
 }
 //#endregion
-export { z as HandlerRegistry, q as basicAuthHandler, gr as buildCacheApiKey, sr as buildMatchFilter, Y as cacheHandler, lr as compileHostApp, K as corsHandler, hr as createCacheApiHostCache, xr as createHttpProxyAdapter, R as createInMemoryHostCache, pr as createProxyApp, Z as createProxyDataPlaneHandler, fr as createProxyDataPlaneRouter, vr as createStaticProxyAdapter, B as defineHandler, Bn as forwardedHeadersHandler, P as handlerConfigSchema, J as headersHandler, Qn as httpHandler, yr as httpRoute, N as matchSchema, or as matchesAnyHost, ar as matchesHost, F as proxyRouteInsertSchema, mn as proxyRouteSchema, hn as proxyRouteUpdateSchema, nr as redirectHandler, X as registerBuiltinHandlers, Wn as rewriteCookiesHandler, Gn as rewriteLocationHandler, tr as serviceBindingHandler, ir as sortRoutes, rr as staticHandler };
+export { z as HandlerRegistry, Wn as basicAuthHandler, Or as buildCacheApiKey, yr as buildMatchFilter, Kn as cacheHandler, xr as compileHostApp, Vn as corsHandler, Dr as createCacheApiHostCache, Nr as createHttpProxyAdapter, R as createInMemoryHostCache, Tr as createProxyApp, Z as createProxyDataPlaneHandler, wr as createProxyDataPlaneRouter, Ar as createStaticProxyAdapter, B as defineHandler, fr as dispatchNamespaceHandler, qn as forwardedHeadersHandler, P as handlerConfigSchema, Gn as headersHandler, ar as httpHandler, jr as httpRoute, N as matchSchema, vr as matchesAnyHost, _r as matchesHost, F as proxyRouteInsertSchema, mn as proxyRouteSchema, hn as proxyRouteUpdateSchema, pr as redirectHandler, hr as registerBuiltinHandlers, Zn as rewriteCookiesHandler, Qn as rewriteLocationHandler, cr as serviceBindingHandler, gr as sortRoutes, mr as staticHandler };