@authhero/proxy 0.4.5 → 0.5.1

package/dist/proxy.mjs

@@ -829,7 +829,7 @@ e.object({
 	created_at: e.string().transform((e) => e === null ? "" : e),
 	updated_at: e.string().transform((e) => e === null ? "" : e)
 }).extend(Ke.shape);
-var qe = e.object({
+var _ = e.object({
 	domain: e.string(),
 	custom_domain_id: e.string().optional(),
 	type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -843,7 +843,7 @@ var qe = e.object({
 		"null"
 	]).optional(),
 	domain_metadata: e.record(e.string(), e.string().max(255)).optional()
-}), Je = e.discriminatedUnion("name", [e.object({
+}), qe = e.discriminatedUnion("name", [e.object({
 	name: e.literal("txt"),
 	record: e.string(),
 	domain: e.string()
@@ -851,8 +851,7 @@ var qe = e.object({
 	name: e.literal("http"),
 	http_body: e.string(),
 	http_url: e.string()
-})]);
-qe.extend({
+})]), Je = _.extend({
 	custom_domain_id: e.string(),
 	primary: e.boolean(),
 	status: e.enum([
@@ -862,23 +861,28 @@ qe.extend({
 		"ready"
 	]),
 	origin_domain_name: e.string().optional(),
-	verification: e.object({ methods: e.array(Je) }).optional(),
+	verification: e.object({ methods: e.array(qe) }).optional(),
 	tls_policy: e.string().optional()
-}).extend({ tenant_id: e.string() }), e.object({
+});
+_.pick({
+	tls_policy: !0,
+	custom_client_ip_header: !0,
+	domain_metadata: !0
+}).strict(), Je.extend({ tenant_id: e.string() }), e.object({
 	certificate: e.string().regex(/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/, "must be PEM-encoded; include the full certificate chain in leaf-first order"),
 	private_key: e.string().regex(/-----BEGIN (RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+-----END \1PRIVATE KEY-----\s*$/, "must be a PEM-encoded private key")
 });
-var _ = e.object({
+var v = e.object({
 	id: e.string(),
 	order: e.number().optional(),
 	visible: e.boolean().optional().default(!0)
-}), v = _.extend({ category: e.literal("BLOCK").optional() }), Ye = v.extend({
+}), y = v.extend({ category: e.literal("BLOCK").optional() }), Ye = y.extend({
 	type: e.literal("DIVIDER"),
 	config: e.object({ text: e.string().optional() }).optional()
-}), Xe = v.extend({
+}), Xe = y.extend({
 	type: e.literal("HTML"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), Ze = v.extend({
+}), Ze = y.extend({
 	type: e.literal("IMAGE"),
 	config: e.object({
 		src: e.string().optional(),
@@ -886,43 +890,43 @@ var _ = e.object({
 		width: e.number().optional(),
 		height: e.number().optional()
 	}).optional()
-}), Qe = v.extend({
+}), Qe = y.extend({
 	type: e.literal("JUMP_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		target_step: e.string().optional()
 	})
-}), $e = v.extend({
+}), $e = y.extend({
 	type: e.literal("RESEND_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		resend_action: e.string().optional()
 	})
-}), et = v.extend({
+}), et = y.extend({
 	type: e.literal("NEXT_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), tt = v.extend({
+}), tt = y.extend({
 	type: e.literal("PREVIOUS_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), nt = v.extend({
+}), nt = y.extend({
 	type: e.literal("RICH_TEXT"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), y = _.extend({
+}), b = v.extend({
 	category: e.literal("WIDGET").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), rt = y.extend({
+}), rt = b.extend({
 	type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
 	config: e.object({ credential_type: e.string().optional() })
-}), it = y.extend({
+}), it = b.extend({
 	type: e.literal("GMAPS_ADDRESS"),
 	config: e.object({ api_key: e.string().optional() })
-}), at = y.extend({
+}), at = b.extend({
 	type: e.literal("RECAPTCHA"),
 	config: e.object({ site_key: e.string().optional() })
-}), b = _.extend({
+}), x = v.extend({
 	category: e.literal("FIELD").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
@@ -938,10 +942,10 @@ var _ = e.object({
 	})).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), ot = b.extend({
+}), ot = x.extend({
 	type: e.literal("BOOLEAN"),
 	config: e.object({ default_value: e.boolean().optional() }).optional()
-}), st = b.extend({
+}), st = x.extend({
 	type: e.literal("CARDS"),
 	config: e.object({
 		options: e.array(e.object({
@@ -952,7 +956,7 @@ var _ = e.object({
 		})).optional(),
 		multi_select: e.boolean().optional()
 	}).optional()
-}), ct = b.extend({
+}), ct = x.extend({
 	type: e.literal("CHOICE"),
 	config: e.object({
 		options: e.array(e.object({
@@ -963,7 +967,7 @@ var _ = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), lt = b.extend({
+}), lt = x.extend({
 	type: e.literal("CUSTOM"),
 	config: e.object({
 		component: e.string().optional(),
@@ -971,7 +975,7 @@ var _ = e.object({
 		schema: e.record(e.string(), e.any()).optional(),
 		code: e.string().optional()
 	})
-}), ut = b.extend({
+}), ut = x.extend({
 	type: e.literal("DATE"),
 	config: e.object({
 		format: e.string().optional(),
@@ -979,7 +983,7 @@ var _ = e.object({
 		max: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), dt = b.extend({
+}), dt = x.extend({
 	type: e.literal("DROPDOWN"),
 	config: e.object({
 		options: e.array(e.object({
@@ -991,26 +995,26 @@ var _ = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), ft = b.extend({
+}), ft = x.extend({
 	type: e.literal("EMAIL"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), pt = b.extend({
+}), pt = x.extend({
 	type: e.literal("FILE"),
 	config: e.object({
 		accept: e.string().optional(),
 		max_size: e.number().optional(),
 		multiple: e.boolean().optional()
 	}).optional()
-}), mt = b.extend({
+}), mt = x.extend({
 	type: e.literal("LEGAL"),
 	config: e.object({
 		text: e.string(),
 		html: e.boolean().optional()
 	}).optional()
-}), ht = b.extend({
+}), ht = x.extend({
 	type: e.literal("NUMBER"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1019,7 +1023,7 @@ var _ = e.object({
 		step: e.number().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), gt = b.extend({
+}), gt = x.extend({
 	type: e.literal("PASSWORD"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1028,13 +1032,13 @@ var _ = e.object({
 		forgot_password_link: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), _t = b.extend({
+}), _t = x.extend({
 	type: e.literal("PAYMENT"),
 	config: e.object({
 		provider: e.string().optional(),
 		currency: e.string().optional()
 	}).optional()
-}), vt = b.extend({
+}), vt = x.extend({
 	type: e.literal("SOCIAL"),
 	config: e.object({
 		providers: e.array(e.string()).optional(),
@@ -1046,7 +1050,7 @@ var _ = e.object({
 			href: e.string().optional()
 		})).optional()
 	}).optional()
-}), yt = b.extend({
+}), yt = x.extend({
 	type: e.literal("TEL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1054,7 +1058,7 @@ var _ = e.object({
 		default_value: e.string().optional(),
 		allow_email: e.boolean().optional()
 	}).optional()
-}), bt = b.extend({
+}), bt = x.extend({
 	type: e.literal("TEXT"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1062,13 +1066,13 @@ var _ = e.object({
 		max_length: e.number().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), xt = b.extend({
+}), xt = x.extend({
 	type: e.literal("COUNTRY"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), St = b.extend({
+}), St = x.extend({
 	type: e.literal("URL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1105,7 +1109,7 @@ var _ = e.object({
 	yt,
 	bt,
 	St
-]), x = e.union([
+]), S = e.union([
 	Ct,
 	wt,
 	Tt
@@ -1134,13 +1138,13 @@ new Set([
 	visible: e.boolean().optional().default(!0),
 	customizations: e.record(e.string(), e.any()).optional()
 });
-var S = e.object({
+var C = e.object({
 	x: e.number(),
 	y: e.number()
 }), Et = e.object({
 	id: e.string(),
 	type: e.literal("FLOW"),
-	coordinates: S,
+	coordinates: C,
 	alias: e.string().min(1).max(150).optional(),
 	config: e.object({
 		flow_id: e.string().max(30),
@@ -1149,7 +1153,7 @@ var S = e.object({
 }), Dt = e.object({
 	id: e.string(),
 	type: e.literal("ROUTER"),
-	coordinates: S,
+	coordinates: C,
 	alias: e.string().min(1).max(150),
 	config: e.object({
 		rules: e.array(e.object({
@@ -1163,10 +1167,10 @@ var S = e.object({
 }), Ot = e.object({
 	id: e.string(),
 	type: e.literal("STEP"),
-	coordinates: S,
+	coordinates: C,
 	alias: e.string().min(1).max(150).optional(),
 	config: e.object({
-		components: e.array(x),
+		components: e.array(S),
 		next_node: e.string().optional()
 	})
 }), kt = e.discriminatedUnion("type", [
@@ -1191,7 +1195,7 @@ var S = e.object({
 			value: e.string()
 		})).optional(),
 		next_node: e.string().optional(),
-		coordinates: S.optional()
+		coordinates: C.optional()
 	}).optional(),
 	ending: e.object({
 		redirection: e.object({
@@ -1199,7 +1203,7 @@ var S = e.object({
 			target: e.string().optional()
 		}).optional(),
 		after_submit: e.object({ flow_id: e.string().optional() }).optional(),
-		coordinates: S.optional(),
+		coordinates: C.optional(),
 		resume_flow: e.boolean().optional()
 	}).optional(),
 	style: e.object({ css: e.string().optional() }).optional(),
@@ -1230,12 +1234,12 @@ e.object({
 	method: e.enum(["POST", "GET"]),
 	title: e.string().optional(),
 	description: e.string().optional(),
-	components: e.array(x),
+	components: e.array(S),
 	messages: e.array(jt).optional(),
 	links: e.array(Mt).optional(),
 	footer: e.string().optional()
 });
-var C = e.enum([
+var w = e.enum([
 	"pre-user-registration",
 	"post-user-registration",
 	"post-user-login",
@@ -1243,48 +1247,48 @@ var C = e.enum([
 	"validate-registration-username",
 	"pre-user-deletion",
 	"post-user-deletion"
-]), w = e.enum([
+]), T = e.enum([
 	"pre-user-registration",
 	"post-user-registration",
 	"post-user-login",
 	"validate-registration-username",
 	"pre-user-deletion",
 	"post-user-deletion"
-]), T = e.enum([
+]), E = e.enum([
 	"post-user-login",
 	"post-user-registration",
 	"post-user-update",
 	"credentials-exchange"
-]), E = e.enum([
+]), D = e.enum([
 	"post-user-login",
 	"credentials-exchange",
 	"pre-user-registration",
 	"post-user-registration"
-]), D = e.enum([
+]), O = e.enum([
 	"ensure-username",
 	"set-preferred-username",
 	"account-linking"
-]), O = {
+]), k = {
 	enabled: e.boolean().default(!1),
 	synchronous: e.boolean().default(!1),
 	priority: e.number().optional(),
 	hook_id: e.string().optional(),
 	metadata: e.record(e.string(), e.unknown()).optional()
 }, Nt = e.object({
-	...O,
-	trigger_id: C,
+	...k,
+	trigger_id: w,
 	url: e.string()
 }), Pt = e.object({
-	...O,
-	trigger_id: w,
+	...k,
+	trigger_id: T,
 	form_id: e.string()
 }), Ft = e.object({
-	...O,
-	trigger_id: T,
-	template_id: D
-}), It = e.object({
-	...O,
+	...k,
 	trigger_id: E,
+	template_id: O
+}), It = e.object({
+	...k,
+	trigger_id: D,
 	code_id: e.string()
 });
 e.union([
@@ -1294,26 +1298,26 @@ e.union([
 	It
 ]);
 var Lt = e.object({
-	...O,
-	trigger_id: C
+	...k,
+	trigger_id: w
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	url: e.string()
 }), Rt = e.object({
-	...O,
-	trigger_id: w
+	...k,
+	trigger_id: T
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	form_id: e.string()
 }), zt = e.object({
-	...O,
-	trigger_id: T
+	...k,
+	trigger_id: E
 }).extend(n.shape).extend({
 	hook_id: e.string(),
-	template_id: D
+	template_id: O
 }), Bt = e.object({
-	...O,
-	trigger_id: E
+	...k,
+	trigger_id: D
 }).extend(n.shape).extend({
 	hook_id: e.string(),
 	code_id: e.string()
@@ -1446,7 +1450,7 @@ e.object({
 	created_at: e.string(),
 	updated_at: e.string()
 });
-var k = {
+var A = {
 	ACLS_SUMMARY: "acls_summary",
 	ACTIONS_EXECUTION_FAILED: "actions_execution_failed",
 	API_LIMIT: "api_limit",
@@ -1606,10 +1610,10 @@ var k = {
 	WARNING_DURING_LOGIN: "w",
 	WARNING_SENDING_NOTIFICATION: "wn",
 	WARNING_USER_MANAGEMENT: "wum"
-}, Jt = e.string().refine((e) => Object.values(k).includes(e), { message: "Invalid log type" });
-k.ACLS_SUMMARY, k.ACTIONS_EXECUTION_FAILED, k.API_LIMIT, k.API_LIMIT_WARNING, k.APPI, k.CIBA_EXCHANGE_FAILED, k.CIBA_EXCHANGE_SUCCEEDED, k.CIBA_START_FAILED, k.CIBA_START_SUCCEEDED, k.CODE_LINK_SENT, k.CODE_SENT, k.DEPRECATION_NOTICE, k.FAILED_LOGIN, k.FAILED_BY_CONNECTOR, k.FAILED_CHANGE_EMAIL, k.FAILED_BY_CORS, k.FAILED_CROSS_ORIGIN_AUTHENTICATION, k.FAILED_CHANGE_PASSWORD, k.FAILED_POST_CHANGE_PASSWORD_HOOK, k.FAILED_CHANGE_PHONE_NUMBER, k.FAILED_CHANGE_PASSWORD_REQUEST, k.FAILED_CONNECTOR_PROVISIONING, k.FAILED_CHANGE_USERNAME, k.FAILED_DELEGATION, k.FAILED_DEVICE_ACTIVATION, k.FAILED_DEVICE_AUTHORIZATION_REQUEST, k.USER_CANCELED_DEVICE_CONFIRMATION, k.FAILED_USER_DELETION, k.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, k.FAILED_EXCHANGE_CUSTOM_TOKEN, k.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, k.FAILED_FEDERATED_LOGOUT, k.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN, k.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN, k.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, k.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, k.FAILED_HOOK, k.FAILED_IMPERSONATION, k.FAILED_INVITE_ACCEPT, k.FAILED_LOGOUT, k.FLOWS_EXECUTION_COMPLETED, k.FLOWS_EXECUTION_FAILED, k.FAILED_SENDING_NOTIFICATION, k.FORMS_SUBMISSION_FAILED, k.FORMS_SUBMISSION_SUCCEEDED, k.FAILED_LOGIN_INCORRECT_PASSWORD, k.FAILED_PUSHED_AUTHORIZATION_REQUEST, k.FAILED_POST_USER_REGISTRATION_HOOK, k.FAILED_SIGNUP, k.FAILED_SILENT_AUTH, k.FAILED_LOGIN_INVALID_EMAIL_USERNAME, k.FAILED_USERS_IMPORT, k.FAILED_VERIFICATION_EMAIL, k.FAILED_VERIFICATION_EMAIL_REQUEST, k.EMAIL_VERIFICATION_CONFIRMED, k.EMAIL_VERIFICATION_FAILED, k.MFA_AUTH_FAILED, k.MFA_AUTH_REJECTED, k.MFA_AUTH_SUCCESS, k.MFA_ENROLLMENT_COMPLETE, k.TOO_MANY_MFA_FAILURES, k.MFA_RECOVERY_FAILED, k.MFA_RECOVERY_RATE_LIMIT_EXCEED, k.MFA_RECOVERY_SUCCESS, k.MFA_EMAIL_SENT, k.EMAIL_VERIFICATION_SENT, k.EMAIL_VERIFICATION_SEND_FAILURE, k.PUSH_NOTIFICATION_SENT, k.ERROR_SENDING_MFA_PUSH_NOTIFICATION, k.MFA_SMS_SENT, k.ERROR_SENDING_MFA_SMS, k.MFA_VOICE_CALL_SUCCESS, k.MFA_VOICE_CALL_FAILED, k.SECOND_FACTOR_STARTED, k.MFA_ENROLL_STARTED, k.MFA_ENROLLMENT_FAILED, k.GUARDIAN_TENANT_UPDATE, k.UNENROLL_DEVICE_ACCOUNT, k.UPDATE_DEVICE_ACCOUNT, k.WEBAUTHN_CHALLENGE_FAILED, k.WEBAUTHN_ENROLLMENT_FAILED, k.FAILED_KMS_API_OPERATION, k.SUCCESS_KMS_API_OPERATION, k.KMS_KEY_STATE_CHANGED, k.TOO_MANY_CALLS_TO_DELEGATION, k.BLOCKED_IP_ADDRESS, k.BLOCKED_ACCOUNT_IP, k.BLOCKED_ACCOUNT_EMAIL, k.INFORMATION, k.MFA_REQUIRED, k.MANAGEMENT_API_READ_OPERATION, k.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, k.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, k.FAILED_OIDC_BACKCHANNEL_LOGOUT, k.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT, k.ORGANIZATION_MEMBER_ADDED, k.PASSKEY_CHALLENGE_FAILED, k.PASSKEY_CHALLENGE_STARTED, k.PRE_LOGIN_ASSESSMENT, k.BREACHED_PASSWORD, k.BREACHED_PASSWORD_ON_RESET, k.SUCCESS_RESOURCE_CLEANUP, k.RICH_CONSENTS_ACCESS_ERROR, k.SUCCESS_LOGIN, k.SUCCESS_API_OPERATION, k.FAILED_API_OPERATION, k.SUCCESS_CHANGE_EMAIL, k.SUCCESS_CROSS_ORIGIN_AUTHENTICATION, k.SUCCESS_CHANGE_PASSWORD, k.SUCCESS_CHANGE_PHONE_NUMBER, k.SUCCESS_CHANGE_PASSWORD_REQUEST, k.SUCCESS_CHANGE_USERNAME, k.SUCCESS_CREDENTIAL_VALIDATION, k.SUCCESS_DELEGATION, k.SUCCESS_USER_DELETION, k.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, k.SUCCESS_EXCHANGE_CUSTOM_TOKEN, k.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN, k.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, k.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, k.SUCCESS_IMPERSONATION, k.SUCCESSFULLY_ACCEPTED_USER_INVITE, k.BREACHED_PASSWORD_ON_SIGNUP, k.SUCCESS_LOGOUT, k.SUCCESS_HOOK, k.SUCCESS_PASSWORD_MIGRATION, k.SUCCESS_REVOCATION, k.SUCCESS_SIGNUP, k.FAILED_SS_SSO_OPERATION, k.INFORMATION_FROM_SS_SSO_OPERATION, k.SUCCESS_SS_SSO_OPERATION, k.SUCCESS_SILENT_AUTH, k.SUCCESSFUL_SCIM_OPERATION, k.SUCCESSFULLY_IMPORTED_USERS, k.SUCCESS_VERIFICATION_EMAIL, k.SUCCESS_VERIFICATION_EMAIL_REQUEST, k.MAX_AMOUNT_OF_AUTHENTICATORS, k.USER_LOGIN_BLOCK_RELEASED, k.FAILED_UNIVERSAL_LOGOUT, k.SUCCESSFUL_UNIVERSAL_LOGOUT, k.WARNING_DURING_LOGIN, k.WARNING_SENDING_NOTIFICATION, k.WARNING_USER_MANAGEMENT, (() => {
+}, Jt = e.string().refine((e) => Object.values(A).includes(e), { message: "Invalid log type" });
+A.ACLS_SUMMARY, A.ACTIONS_EXECUTION_FAILED, A.API_LIMIT, A.API_LIMIT_WARNING, A.APPI, A.CIBA_EXCHANGE_FAILED, A.CIBA_EXCHANGE_SUCCEEDED, A.CIBA_START_FAILED, A.CIBA_START_SUCCEEDED, A.CODE_LINK_SENT, A.CODE_SENT, A.DEPRECATION_NOTICE, A.FAILED_LOGIN, A.FAILED_BY_CONNECTOR, A.FAILED_CHANGE_EMAIL, A.FAILED_BY_CORS, A.FAILED_CROSS_ORIGIN_AUTHENTICATION, A.FAILED_CHANGE_PASSWORD, A.FAILED_POST_CHANGE_PASSWORD_HOOK, A.FAILED_CHANGE_PHONE_NUMBER, A.FAILED_CHANGE_PASSWORD_REQUEST, A.FAILED_CONNECTOR_PROVISIONING, A.FAILED_CHANGE_USERNAME, A.FAILED_DELEGATION, A.FAILED_DEVICE_ACTIVATION, A.FAILED_DEVICE_AUTHORIZATION_REQUEST, A.USER_CANCELED_DEVICE_CONFIRMATION, A.FAILED_USER_DELETION, A.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, A.FAILED_EXCHANGE_CUSTOM_TOKEN, A.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, A.FAILED_FEDERATED_LOGOUT, A.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN, A.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN, A.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, A.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, A.FAILED_HOOK, A.FAILED_IMPERSONATION, A.FAILED_INVITE_ACCEPT, A.FAILED_LOGOUT, A.FLOWS_EXECUTION_COMPLETED, A.FLOWS_EXECUTION_FAILED, A.FAILED_SENDING_NOTIFICATION, A.FORMS_SUBMISSION_FAILED, A.FORMS_SUBMISSION_SUCCEEDED, A.FAILED_LOGIN_INCORRECT_PASSWORD, A.FAILED_PUSHED_AUTHORIZATION_REQUEST, A.FAILED_POST_USER_REGISTRATION_HOOK, A.FAILED_SIGNUP, A.FAILED_SILENT_AUTH, A.FAILED_LOGIN_INVALID_EMAIL_USERNAME, A.FAILED_USERS_IMPORT, A.FAILED_VERIFICATION_EMAIL, A.FAILED_VERIFICATION_EMAIL_REQUEST, A.EMAIL_VERIFICATION_CONFIRMED, A.EMAIL_VERIFICATION_FAILED, A.MFA_AUTH_FAILED, A.MFA_AUTH_REJECTED, A.MFA_AUTH_SUCCESS, A.MFA_ENROLLMENT_COMPLETE, A.TOO_MANY_MFA_FAILURES, A.MFA_RECOVERY_FAILED, A.MFA_RECOVERY_RATE_LIMIT_EXCEED, A.MFA_RECOVERY_SUCCESS, A.MFA_EMAIL_SENT, A.EMAIL_VERIFICATION_SENT, A.EMAIL_VERIFICATION_SEND_FAILURE, A.PUSH_NOTIFICATION_SENT, A.ERROR_SENDING_MFA_PUSH_NOTIFICATION, A.MFA_SMS_SENT, A.ERROR_SENDING_MFA_SMS, A.MFA_VOICE_CALL_SUCCESS, A.MFA_VOICE_CALL_FAILED, A.SECOND_FACTOR_STARTED, A.MFA_ENROLL_STARTED, A.MFA_ENROLLMENT_FAILED, A.GUARDIAN_TENANT_UPDATE, A.UNENROLL_DEVICE_ACCOUNT, A.UPDATE_DEVICE_ACCOUNT, A.WEBAUTHN_CHALLENGE_FAILED, A.WEBAUTHN_ENROLLMENT_FAILED, A.FAILED_KMS_API_OPERATION, A.SUCCESS_KMS_API_OPERATION, A.KMS_KEY_STATE_CHANGED, A.TOO_MANY_CALLS_TO_DELEGATION, A.BLOCKED_IP_ADDRESS, A.BLOCKED_ACCOUNT_IP, A.BLOCKED_ACCOUNT_EMAIL, A.INFORMATION, A.MFA_REQUIRED, A.MANAGEMENT_API_READ_OPERATION, A.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, A.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, A.FAILED_OIDC_BACKCHANNEL_LOGOUT, A.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT, A.ORGANIZATION_MEMBER_ADDED, A.PASSKEY_CHALLENGE_FAILED, A.PASSKEY_CHALLENGE_STARTED, A.PRE_LOGIN_ASSESSMENT, A.BREACHED_PASSWORD, A.BREACHED_PASSWORD_ON_RESET, A.SUCCESS_RESOURCE_CLEANUP, A.RICH_CONSENTS_ACCESS_ERROR, A.SUCCESS_LOGIN, A.SUCCESS_API_OPERATION, A.FAILED_API_OPERATION, A.SUCCESS_CHANGE_EMAIL, A.SUCCESS_CROSS_ORIGIN_AUTHENTICATION, A.SUCCESS_CHANGE_PASSWORD, A.SUCCESS_CHANGE_PHONE_NUMBER, A.SUCCESS_CHANGE_PASSWORD_REQUEST, A.SUCCESS_CHANGE_USERNAME, A.SUCCESS_CREDENTIAL_VALIDATION, A.SUCCESS_DELEGATION, A.SUCCESS_USER_DELETION, A.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, A.SUCCESS_EXCHANGE_CUSTOM_TOKEN, A.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN, A.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, A.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, A.SUCCESS_IMPERSONATION, A.SUCCESSFULLY_ACCEPTED_USER_INVITE, A.BREACHED_PASSWORD_ON_SIGNUP, A.SUCCESS_LOGOUT, A.SUCCESS_HOOK, A.SUCCESS_PASSWORD_MIGRATION, A.SUCCESS_REVOCATION, A.SUCCESS_SIGNUP, A.FAILED_SS_SSO_OPERATION, A.INFORMATION_FROM_SS_SSO_OPERATION, A.SUCCESS_SS_SSO_OPERATION, A.SUCCESS_SILENT_AUTH, A.SUCCESSFUL_SCIM_OPERATION, A.SUCCESSFULLY_IMPORTED_USERS, A.SUCCESS_VERIFICATION_EMAIL, A.SUCCESS_VERIFICATION_EMAIL_REQUEST, A.MAX_AMOUNT_OF_AUTHENTICATORS, A.USER_LOGIN_BLOCK_RELEASED, A.FAILED_UNIVERSAL_LOGOUT, A.SUCCESSFUL_UNIVERSAL_LOGOUT, A.WARNING_DURING_LOGIN, A.WARNING_SENDING_NOTIFICATION, A.WARNING_USER_MANAGEMENT, (() => {
 	let e = {};
-	for (let [t, n] of Object.entries(k)) t.startsWith("SUCCESS_") || t.startsWith("SUCCESSFUL_") || t.startsWith("SUCCESSFULLY_") || t.endsWith("_SUCCEEDED") || t.endsWith("_COMPLETED") ? e[n] = "success" : t.startsWith("FAILED_") || t.startsWith("ERROR_") || t.startsWith("BREACHED_") || t.startsWith("BLOCKED_") || t === "MFA_AUTH_FAILED" || t === "MFA_AUTH_REJECTED" || t === "MFA_RECOVERY_FAILED" || t === "MFA_ENROLLMENT_FAILED" || t === "EMAIL_VERIFICATION_FAILED" || t === "WEBAUTHN_CHALLENGE_FAILED" || t === "WEBAUTHN_ENROLLMENT_FAILED" || t === "PASSKEY_CHALLENGE_FAILED" || t === "FLOWS_EXECUTION_FAILED" || t === "FORMS_SUBMISSION_FAILED" || t === "CIBA_EXCHANGE_FAILED" || t === "CIBA_START_FAILED" || t === "ACTIONS_EXECUTION_FAILED" || t === "RICH_CONSENTS_ACCESS_ERROR" || t === "USER_CANCELED_DEVICE_CONFIRMATION" || t === "TOO_MANY_MFA_FAILURES" || t === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || t === "API_LIMIT" || t === "MAX_AMOUNT_OF_AUTHENTICATORS" ? e[n] = "failure" : t.startsWith("WARNING_") || t === "API_LIMIT_WARNING" || t === "DEPRECATION_NOTICE" || t === "PRE_LOGIN_ASSESSMENT" ? e[n] = "warning" : t === "CODE_SENT" || t === "CODE_LINK_SENT" || t === "MFA_EMAIL_SENT" || t === "MFA_SMS_SENT" || t === "EMAIL_VERIFICATION_SENT" || t === "PUSH_NOTIFICATION_SENT" ? e[n] = "code_sent" : t === "INFORMATION" || t === "INFORMATION_FROM_SS_SSO_OPERATION" || t === "MANAGEMENT_API_READ_OPERATION" || t === "APPI" || t === "ACLS_SUMMARY" || t === "ORGANIZATION_MEMBER_ADDED" ? e[n] = "info" : e[n] = "other";
+	for (let [t, n] of Object.entries(A)) t.startsWith("SUCCESS_") || t.startsWith("SUCCESSFUL_") || t.startsWith("SUCCESSFULLY_") || t.endsWith("_SUCCEEDED") || t.endsWith("_COMPLETED") ? e[n] = "success" : t.startsWith("FAILED_") || t.startsWith("ERROR_") || t.startsWith("BREACHED_") || t.startsWith("BLOCKED_") || t === "MFA_AUTH_FAILED" || t === "MFA_AUTH_REJECTED" || t === "MFA_RECOVERY_FAILED" || t === "MFA_ENROLLMENT_FAILED" || t === "EMAIL_VERIFICATION_FAILED" || t === "WEBAUTHN_CHALLENGE_FAILED" || t === "WEBAUTHN_ENROLLMENT_FAILED" || t === "PASSKEY_CHALLENGE_FAILED" || t === "FLOWS_EXECUTION_FAILED" || t === "FORMS_SUBMISSION_FAILED" || t === "CIBA_EXCHANGE_FAILED" || t === "CIBA_START_FAILED" || t === "ACTIONS_EXECUTION_FAILED" || t === "RICH_CONSENTS_ACCESS_ERROR" || t === "USER_CANCELED_DEVICE_CONFIRMATION" || t === "TOO_MANY_MFA_FAILURES" || t === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || t === "API_LIMIT" || t === "MAX_AMOUNT_OF_AUTHENTICATORS" ? e[n] = "failure" : t.startsWith("WARNING_") || t === "API_LIMIT_WARNING" || t === "DEPRECATION_NOTICE" || t === "PRE_LOGIN_ASSESSMENT" ? e[n] = "warning" : t === "CODE_SENT" || t === "CODE_LINK_SENT" || t === "MFA_EMAIL_SENT" || t === "MFA_SMS_SENT" || t === "EMAIL_VERIFICATION_SENT" || t === "PUSH_NOTIFICATION_SENT" ? e[n] = "code_sent" : t === "INFORMATION" || t === "INFORMATION_FROM_SS_SSO_OPERATION" || t === "MANAGEMENT_API_READ_OPERATION" || t === "APPI" || t === "ACLS_SUMMARY" || t === "ORGANIZATION_MEMBER_ADDED" ? e[n] = "info" : e[n] = "other";
 	return e;
 })();
 var Yt = e.object({
@@ -1654,7 +1658,7 @@ var Zt = e.enum([
 	"splunk",
 	"datadog",
 	"sumo"
-]), A = e.enum([
+]), j = e.enum([
 	"active",
 	"paused",
 	"suspended"
@@ -1665,13 +1669,13 @@ var Zt = e.enum([
 e.object({
 	name: e.string(),
 	type: Zt,
-	status: A.optional(),
+	status: j.optional(),
 	sink: e.record(e.string(), e.unknown()),
 	filters: e.array(Qt).optional(),
 	isPriority: e.boolean().optional()
 }).extend({
 	id: e.string(),
-	status: A,
+	status: j,
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
@@ -1744,7 +1748,7 @@ e.object({
 	created_at: e.string(),
 	updated_at: e.string()
 });
-var j = e.object({
+var M = e.object({
 	initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
 	initial_ip: e.string().describe("First IP address associated with this session"),
 	initial_asn: e.string().describe("First autonomous system number associated with this session"),
@@ -1759,7 +1763,7 @@ var j = e.object({
 	expires_at: e.string().optional(),
 	login_session_id: e.string(),
 	idle_expires_at: e.string().optional(),
-	device: j.describe("Metadata related to the device used in the session"),
+	device: M.describe("Metadata related to the device used in the session"),
 	clients: e.array(e.string()).describe("List of client details for the session")
 });
 e.object({
@@ -1989,19 +1993,19 @@ var ln = e.object({
 	success: e.string(),
 	widget_background: e.string(),
 	widget_border: e.string()
-}), M = e.object({
+}), N = e.object({
 	bold: e.boolean(),
 	size: e.number()
 }), dn = e.object({
-	body_text: M,
-	buttons_text: M,
+	body_text: N,
+	buttons_text: N,
 	font_url: e.string(),
-	input_labels: M,
-	links: M,
+	input_labels: N,
+	links: N,
 	links_style: e.enum(["normal", "underlined"]),
 	reference_text_size: e.number(),
-	subtitle: M,
-	title: M
+	subtitle: N,
+	title: N
 }), fn = e.object({
 	background_color: e.string(),
 	background_image_url: e.string(),
@@ -2044,27 +2048,27 @@ e.object({
 	password_first: e.boolean().default(!1),
 	webauthn_platform_first_factor: e.boolean()
 });
-var N = e.object({
+var P = e.object({
 	hosts: e.array(e.string()).optional(),
 	methods: e.array(e.string()).optional(),
 	path: e.string().default("/*"),
 	headers: e.record(e.string(), e.string()).optional(),
 	query: e.record(e.string(), e.string()).optional()
-}), P = e.object({
+}), F = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
-}), F = e.object({
+}), I = e.object({
 	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
-	match: N,
-	handlers: e.array(P).min(1)
-}), mn = F.extend({
+	match: P,
+	handlers: e.array(F).min(1)
+}), mn = I.extend({
 	id: e.string(),
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), hn = F.partial().omit({
+}), hn = I.partial().omit({
 	id: !0,
 	custom_domain_id: !0
 });
@@ -2107,7 +2111,7 @@ e.object({
 	expires_at: e.string().optional(),
 	idle_expires_at: e.string().optional(),
 	last_exchanged_at: e.string().optional(),
-	device: j,
+	device: M,
 	resource_servers: e.array(e.object({
 		audience: e.string(),
 		scopes: e.string()
@@ -2420,7 +2424,7 @@ var Nn = e.enum([
 	"webauthn-roaming",
 	"webauthn-platform",
 	"passkey"
-]), I = e.object({
+]), L = e.object({
 	user_id: e.string(),
 	type: Nn,
 	phone_number: e.string().optional(),
@@ -2433,7 +2437,7 @@ var Nn = e.enum([
 	friendly_name: e.string().optional(),
 	confirmed: e.boolean().default(!1)
 });
-function L(t, n) {
+function R(t, n) {
 	t.type === "phone" && !t.phone_number && n.addIssue({
 		code: e.ZodIssueCode.custom,
 		message: "phone_number is required when type is 'phone'",
@@ -2456,15 +2460,15 @@ function L(t, n) {
 		path: ["public_key"]
 	}));
 }
-I.superRefine(L), I.extend({
+L.superRefine(R), L.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).superRefine(L);
+}).superRefine(R);
 //#endregion
 //#region src/data-plane/cache.ts
 var Pn = 1e4;
-function R(e, t, n) {
+function z(e, t, n) {
 	let r = typeof t == "number" ? {
 		freshTtlMs: t,
 		maxEntries: n
@@ -2520,7 +2524,7 @@ function R(e, t, n) {
 }
 //#endregion
 //#region src/data-plane/registry.ts
-var z = class {
+var B = class {
 	definitions = /* @__PURE__ */ new Map();
 	bindings;
 	constructor(e = {}) {
@@ -2540,23 +2544,20 @@ var z = class {
 		return n.build(r.data, { bindings: this.bindings });
 	}
 };
-function B(e) {
+function V(e) {
 	return e;
 }
 //#endregion
 //#region src/data-plane/handlers/util.ts
-var V = "__authhero_proxy_request__", H = "__authhero_proxy_tenant_id__", U = "__authhero_proxy_custom_domain_id__", W = "__authhero_proxy_domain__", G = "x-authhero-proxy-mutability-probe";
-function Fn(e, t) {
-	e.set(V, t);
+var H = "__authhero_proxy_request__", U = "__authhero_proxy_tenant_id__", W = "__authhero_proxy_custom_domain_id__", G = "__authhero_proxy_domain__", Fn = "x-authhero-proxy-mutability-probe";
+function In(e, t) {
+	e.set(H, t);
 }
 function K(e) {
-	return e.get(V) ?? e.req.raw;
+	return e.get(H) ?? e.req.raw;
 }
-function In(e, t) {
-	e.set(H, t.tenant_id), e.set(U, t.custom_domain_id), e.set(W, t.domain);
-}
-function Ln(e) {
-	return e.get(H);
+function Ln(e, t) {
+	e.set(U, t.tenant_id), e.set(W, t.custom_domain_id), e.set(G, t.domain);
 }
 function Rn(e) {
 	return e.get(U);
@@ -2564,14 +2565,17 @@ function Rn(e) {
 function zn(e) {
 	return e.get(W);
 }
+function Bn(e) {
+	return e.get(G);
+}
 function q(e, t) {
 	let n = K(e), r = new Headers(n.headers);
-	t(r), Fn(e, new Request(n, { headers: r }));
+	t(r), In(e, new Request(n, { headers: r }));
 }
 function J(e) {
 	let t = e.res;
 	try {
-		t.headers.append(G, "1"), t.headers.delete(G);
+		t.headers.append(Fn, "1"), t.headers.delete(Fn);
 		return;
 	} catch {
 		e.res = new Response(t.body, {
@@ -2583,7 +2587,7 @@ function J(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var Bn = e.object({
+var Vn = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2591,44 +2595,44 @@ var Bn = e.object({
 	expose_headers: e.array(e.string()).optional(),
 	max_age: e.number().int().optional()
 }).refine((e) => !(e.allow_credentials && e.origins?.includes("*")), { message: "Cannot use wildcard origin (*) with allow_credentials" });
-function Y(e, t) {
+function Hn(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var Vn = B({
+var Un = V({
 	type: "cors",
-	optionsSchema: Bn,
+	optionsSchema: Vn,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
 			if (t.req.method === "OPTIONS" && r !== null && t.req.header("access-control-request-method") !== void 0) {
-				let t = Y(e, r);
+				let t = Hn(e, r);
 				return new Response(null, {
 					status: 204,
 					headers: t
 				});
 			}
 			await n();
-			let i = Y(e, r);
+			let i = Hn(e, r);
 			J(t), i.forEach((e, n) => {
 				n.toLowerCase() === "vary" ? t.res.headers.append(n, e) : t.res.headers.set(n, e);
 			});
 		};
 	}
-}), Hn = e.object({
+}), Wn = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function Un(e, t) {
+function Gn(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var Wn = B({
+var Kn = V({
 	type: "basic_auth",
-	optionsSchema: Hn,
+	optionsSchema: Wn,
 	build(e) {
-		let t = Un(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = Gn(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2644,7 +2648,7 @@ var Wn = B({
 			});
 		};
 	}
-}), Gn = B({
+}), qn = V({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2659,7 +2663,7 @@ var Wn = B({
 			}), await n(), (e.response || e.remove_response) && (J(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), Kn = B({
+}), Jn = V({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
@@ -2670,7 +2674,7 @@ var Wn = B({
 			}
 		};
 	}
-}), qn = B({
+}), Yn = V({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
@@ -2687,33 +2691,33 @@ var Wn = B({
 			}), await n();
 		};
 	}
-}), Jn = e.object({ upstream_host: e.string().optional() });
-function Yn(e) {
+}), Xn = e.object({ upstream_host: e.string().optional() });
+function Zn(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function Xn(e) {
+function Qn(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var Zn = B({
+var $n = V({
 	type: "rewrite_cookies",
-	optionsSchema: Jn,
+	optionsSchema: Xn,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = Xn(t.res.headers);
+			let a = Qn(t.res.headers);
 			if (a.length === 0) return;
-			let o = Yn(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			let o = Zn(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
 			J(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), Qn = B({
+}), er = V({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
@@ -2736,7 +2740,7 @@ var Zn = B({
 			J(t), t.res.headers.set("location", c);
 		};
 	}
-}), $n = new Set([
+}), tr = new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -2745,24 +2749,24 @@ var Zn = B({
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), er = 3e4, tr = e.object({
+]), nr = 3e4, rr = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function nr(e, t) {
+function ir(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function rr(e) {
+function ar(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function ir(e, t) {
+function or(e, t) {
 	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = nr(r.pathname, n.pathname), r.search = n.search;
+	r.pathname = ir(r.pathname, n.pathname), r.search = n.search;
 	let i = new Headers(t.headers);
-	for (let e of $n) i.delete(e);
+	for (let e of tr) i.delete(e);
 	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = rr(t.method) ? t.body : void 0, o = {
+	let a = ar(t.method) ? t.body : void 0, o = {
 		method: t.method,
 		headers: i,
 		body: a,
@@ -2773,13 +2777,13 @@ function ir(e, t) {
 		init: o
 	};
 }
-var ar = B({
+var Y = V({
 	type: "http",
-	optionsSchema: tr,
+	optionsSchema: rr,
 	build(e) {
-		let t = e.timeout_ms ?? er;
+		let t = e.timeout_ms ?? nr;
 		return async (n) => {
-			let { target: r, init: i } = ir(e, K(n));
+			let { target: r, init: i } = or(e, K(n));
 			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
 			let a = new AbortController(), o = setTimeout(() => a.abort(), t);
 			try {
@@ -2795,56 +2799,56 @@ var ar = B({
 			}
 		};
 	}
-}), or = e.object({
+}), sr = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
 	preserve_host: e.boolean().default(!0)
 });
-function sr(e) {
+function cr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var cr = B({
+var lr = V({
 	type: "service_binding",
-	optionsSchema: or,
+	optionsSchema: sr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!sr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		if (!cr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
 		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`;
 		return async (t) => {
-			let i = K(t), { target: a, init: o } = ir({
+			let i = K(t), { target: a, init: o } = or({
 				upstream_url: r,
 				preserve_host: e.preserve_host
 			}, i);
 			return t.set("__proxy_upstream_host__", a.hostname), t.set("__proxy_upstream_origin__", `${a.protocol}//${a.host}`), n.fetch(new Request(a.toString(), o));
 		};
 	}
-}), lr = e.object({
+}), ur = e.object({
 	binding: e.string(),
 	script_name: e.string(),
 	cpu_ms: e.number().int().positive().optional(),
 	subrequests: e.number().int().positive().optional()
 });
-function ur(e) {
+function dr(e) {
 	return typeof e == "object" && !!e && typeof e.get == "function";
 }
 var X = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
-function dr(e) {
+function fr(e) {
 	return X.lastIndex = 0, X.test(e);
 }
-var fr = B({
+var pr = V({
 	type: "dispatch_namespace",
-	optionsSchema: lr,
+	optionsSchema: ur,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!ur(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
-		let r = dr(e.script_name), i = e.cpu_ms || e.subrequests ? { limits: {
+		if (!dr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = fr(e.script_name), i = e.cpu_ms || e.subrequests ? { limits: {
 			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
 			...e.subrequests ? { subrequests: e.subrequests } : {}
 		} } : void 0;
 		return async (t) => {
 			let a = e.script_name;
 			if (r) {
-				let n = Ln(t), r = Rn(t), i = zn(t), o = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				let n = Rn(t), r = zn(t), i = Bn(t), o = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
 				if (a = a.replace(X, (e, t) => {
 					switch (t) {
 						case "tenant_id": return n ?? "";
@@ -2859,7 +2863,7 @@ var fr = B({
 			return o.fetch(s);
 		};
 	}
-}), pr = B({
+}), mr = V({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -2888,7 +2892,7 @@ var fr = B({
 			});
 		};
 	}
-}), mr = B({
+}), hr = V({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -2908,15 +2912,15 @@ var fr = B({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function hr(e) {
-	e.add(Vn).add(Wn).add(Gn).add(Kn).add(qn).add(Zn).add(Qn).add(ar).add(cr).add(fr).add(pr).add(mr);
+function gr(e) {
+	e.add(Un).add(Kn).add(qn).add(Jn).add(Yn).add($n).add(er).add(Y).add(lr).add(pr).add(mr).add(hr);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
-function gr(e) {
+function _r(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function _r(e, t) {
+function vr(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -2925,13 +2929,13 @@ function _r(e, t) {
 	}
 	return !1;
 }
-function vr(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => _r(e, t));
+function yr(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => vr(e, t));
 }
-function yr(e) {
+function br(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !vr(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r && !yr(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -2948,7 +2952,7 @@ function yr(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var br = [
+var xr = [
 	"GET",
 	"POST",
 	"PUT",
@@ -2957,58 +2961,59 @@ var br = [
 	"OPTIONS",
 	"HEAD"
 ];
-function xr(e, n, r) {
+function Sr(e, n, r) {
 	let i = new t();
 	r && i.use("*", async (e, t) => {
-		In(e, r), await t();
+		Ln(e, r), await t();
 	});
-	let a = gr(e);
+	let a = _r(e);
 	for (let e of a) {
 		let t = [];
-		t.push(yr(e.match));
+		t.push(br(e.match));
 		for (let r of e.handlers) t.push(n.build(r.type, r.options));
-		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : br, a = e.match.path || "/*";
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : xr, a = e.match.path || "/*";
 		i.on(r, [a], ...t);
 	}
 	return i.all("*", (e) => e.text("No matching route", 404)), i;
 }
 //#endregion
 //#region src/data-plane/router.ts
-function Sr(e) {
-	return e.resolver ? e.resolver : e.cache ? R(e.data, e.cache) : R(e.data, e.cacheTtlMs ?? 3e4);
-}
 function Cr(e) {
+	return e.resolver ? e.resolver : e.cache ? z(e.data, e.cache) : z(e.data, e.cacheTtlMs ?? 3e4);
+}
+function wr(e) {
 	if (e.registry) return e.registry;
-	let t = new z(e.bindings ?? {});
-	return hr(t), t;
+	let t = new B(e.bindings ?? {});
+	return gr(t), t;
 }
 function Z(e) {
-	let t = Sr(e), n = Cr(e), r = /* @__PURE__ */ new WeakMap();
+	let t = Cr(e), n = wr(e), r = /* @__PURE__ */ new WeakMap();
 	return async (e) => {
 		let i = e.req.header("host") ?? e.req.header("x-forwarded-host");
 		if (!i) return e.text("Missing host", 400);
 		let a = await t.resolveHost(i);
 		if (!a) return e.text("Unknown host", 404);
 		let o = r.get(a);
-		return o || (o = xr(a.routes, n, {
+		return o || (o = Sr(a.routes, n, {
 			tenant_id: a.tenant_id,
 			custom_domain_id: a.custom_domain_id,
 			domain: a.domain
 		}), r.set(a, o)), o.fetch(e.req.raw);
 	};
 }
-function wr(e) {
+function Tr(e) {
 	let n = new t();
 	return n.all("*", Z(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function Tr(e) {
+function Er(e) {
 	let n = new t();
 	return n.all("*", Z({
 		data: e.data,
 		cacheTtlMs: e.cacheTtlMs,
 		cache: e.cache,
+		resolver: e.resolver,
 		registry: e.registry,
 		bindings: e.bindings
 	})), n;
@@ -3018,11 +3023,11 @@ function Tr(e) {
 function Q(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function Er() {
+function Dr() {
 	return globalThis.caches?.default;
 }
-function Dr(e) {
-	let t = e.cache ?? Er();
+function Or(e) {
+	let t = e.cache ?? Dr();
 	if (!t) return e.upstream;
 	let n = e.namespace ?? "authhero-proxy", r = e.cacheTtlSeconds ?? 60, i = e.negativeCacheTtlSeconds ?? 10, a = e.waitUntil;
 	return { async resolveHost(o) {
@@ -3037,15 +3042,57 @@ function Dr(e) {
 		return a ? a(f) : await f.catch(() => void 0), l;
 	} };
 }
-function Or(e, t) {
+function kr(e, t) {
 	return Q(e, t);
 }
 //#endregion
+//#region src/data-plane/cache-adapter-cache.ts
+function Ar(e) {
+	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, negativeTtlMs: a = r, keyPrefix: o = "authhero-proxy-host", waitUntil: s } = e, c = /* @__PURE__ */ new Map();
+	function l(e) {
+		return `${o}:${e.toLowerCase()}`;
+	}
+	async function u(e) {
+		let o = c.get(e);
+		if (o) return o;
+		let s = (async () => {
+			try {
+				let o = await t.resolveHost(e), s = Date.now(), c = o === null ? a : r, u = o === null ? 0 : i, d = {
+					value: o,
+					freshUntilMs: s + c,
+					staleUntilMs: s + c + u
+				}, f = Math.max(1, Math.ceil((c + u) / 1e3));
+				return await n.set(l(e), d, f), o;
+			} finally {
+				c.delete(e);
+			}
+		})();
+		return c.set(e, s), s;
+	}
+	return { async resolveHost(e) {
+		let t = l(e), r = await n.get(t), i = Date.now();
+		if (r && typeof r.freshUntilMs == "number") {
+			if (r.freshUntilMs > i) return r.value;
+			if (r.staleUntilMs > i) {
+				if (!c.has(e)) {
+					let t = u(e).catch(() => void 0);
+					s && s(t);
+				}
+				return r.value;
+			}
+		}
+		return u(e);
+	} };
+}
+function jr(e, t) {
+	return `${e}:${t.toLowerCase()}`;
+}
+//#endregion
 //#region src/static/index.ts
 function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function kr(e, t, n, r, i, a) {
+function Mr(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -3060,10 +3107,10 @@ function kr(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function Ar(e) {
+function Nr(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => kr(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => Mr(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3107,7 +3154,7 @@ function Ar(e) {
 		}
 	};
 }
-function jr(e, t = {}) {
+function Pr(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3121,8 +3168,11 @@ function jr(e, t = {}) {
 	};
 }
 //#endregion
+//#region src/constants.ts
+var Fr = "proxy:resolve_host";
+//#endregion
 //#region src/http-adapter/index.ts
-function Mr() {
+function Ir() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3144,41 +3194,42 @@ function Mr() {
 		}
 	};
 }
-function Nr(e) {
-	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.tokenRefreshSkewSeconds ?? 60, o = e.timeoutMs ?? 5e3;
-	function s(e) {
-		let t = new AbortController(), n = setTimeout(() => t.abort(), o);
+function Lr(e) {
+	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.scope ?? "proxy:resolve_host", o = e.tokenRefreshSkewSeconds ?? 60, s = e.timeoutMs ?? 5e3;
+	function c(e) {
+		let t = new AbortController(), n = setTimeout(() => t.abort(), s);
 		return e(t.signal).finally(() => clearTimeout(n));
 	}
-	let c = null, l = null;
-	async function u() {
-		let r = await s((r) => t(`${n}/oauth/token`, {
+	let l = null, u = null;
+	async function d() {
+		let r = await c((r) => t(`${n}/oauth/token`, {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: JSON.stringify({
 				grant_type: "client_credentials",
 				client_id: e.clientId,
 				client_secret: e.clientSecret,
-				audience: i
+				audience: i,
+				scope: a
 			}),
 			signal: r
 		}));
 		if (!r.ok) throw Error(`Proxy adapter token request failed: ${r.status} ${await r.text().catch(() => "")}`);
-		let o = await r.json(), l = o.expires_in ?? 3600;
-		return c = {
-			value: o.access_token,
-			expires_at: Date.now() + (l - a) * 1e3
-		}, o.access_token;
+		let s = await r.json(), u = s.expires_in ?? 3600;
+		return l = {
+			value: s.access_token,
+			expires_at: Date.now() + (u - o) * 1e3
+		}, s.access_token;
 	}
-	async function d() {
-		return c && c.expires_at > Date.now() ? c.value : l || (l = u().finally(() => {
-			l = null;
-		}), l);
+	async function f() {
+		return l && l.expires_at > Date.now() ? l.value : u || (u = d().finally(() => {
+			u = null;
+		}), u);
 	}
 	return {
-		proxyRoutes: Mr(),
+		proxyRoutes: Ir(),
 		async resolveHost(e) {
-			let i = await d(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await s((e) => t(a, {
+			let i = await f(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await c((e) => t(a, {
 				headers: { authorization: `Bearer ${i}` },
 				signal: e
 			}));
@@ -3189,4 +3240,4 @@ function Nr(e) {
 	};
 }
 //#endregion
-export { z as HandlerRegistry, Wn as basicAuthHandler, Or as buildCacheApiKey, yr as buildMatchFilter, Kn as cacheHandler, xr as compileHostApp, Vn as corsHandler, Dr as createCacheApiHostCache, Nr as createHttpProxyAdapter, R as createInMemoryHostCache, Tr as createProxyApp, Z as createProxyDataPlaneHandler, wr as createProxyDataPlaneRouter, Ar as createStaticProxyAdapter, B as defineHandler, fr as dispatchNamespaceHandler, qn as forwardedHeadersHandler, P as handlerConfigSchema, Gn as headersHandler, ar as httpHandler, jr as httpRoute, N as matchSchema, vr as matchesAnyHost, _r as matchesHost, F as proxyRouteInsertSchema, mn as proxyRouteSchema, hn as proxyRouteUpdateSchema, pr as redirectHandler, hr as registerBuiltinHandlers, Zn as rewriteCookiesHandler, Qn as rewriteLocationHandler, cr as serviceBindingHandler, gr as sortRoutes, mr as staticHandler };
+export { B as HandlerRegistry, Fr as PROXY_RESOLVE_HOST_SCOPE, Kn as basicAuthHandler, jr as buildCacheAdapterKey, kr as buildCacheApiKey, br as buildMatchFilter, Jn as cacheHandler, Sr as compileHostApp, Un as corsHandler, Ar as createCacheAdapterHostCache, Or as createCacheApiHostCache, Lr as createHttpProxyAdapter, z as createInMemoryHostCache, Er as createProxyApp, Z as createProxyDataPlaneHandler, Tr as createProxyDataPlaneRouter, Nr as createStaticProxyAdapter, V as defineHandler, pr as dispatchNamespaceHandler, Yn as forwardedHeadersHandler, F as handlerConfigSchema, qn as headersHandler, Y as httpHandler, Pr as httpRoute, P as matchSchema, yr as matchesAnyHost, vr as matchesHost, I as proxyRouteInsertSchema, mn as proxyRouteSchema, hn as proxyRouteUpdateSchema, mr as redirectHandler, gr as registerBuiltinHandlers, $n as rewriteCookiesHandler, er as rewriteLocationHandler, lr as serviceBindingHandler, _r as sortRoutes, hr as staticHandler };