@authhero/proxy 0.5.1 → 0.6.0

package/dist/proxy.mjs

@@ -91,12 +91,12 @@ e.object({
 	tenant_id: e.string(),
 	number: e.number().int()
 }).extend(n.shape);
-var ee = e.enum([
+var p = e.enum([
 	"user_action",
 	"admin_action",
 	"system",
 	"api"
-]), te = e.object({
+]), m = e.object({
 	type: e.enum([
 		"user",
 		"admin",
@@ -110,7 +110,7 @@ var ee = e.enum([
 	org_name: e.string().optional(),
 	scopes: e.array(e.string()).optional(),
 	client_id: e.string().optional()
-}), ne = e.object({
+}), h = e.object({
 	type: e.string(),
 	id: e.string(),
 	before: e.record(e.string(), e.unknown()).optional(),
@@ -119,7 +119,7 @@ var ee = e.enum([
 		old: e.unknown(),
 		new: e.unknown()
 	})).optional()
-}), re = e.object({
+}), ee = e.object({
 	method: e.string(),
 	path: e.string(),
 	query: e.record(e.string(), e.string()).optional(),
@@ -127,17 +127,17 @@ var ee = e.enum([
 	ip: e.string(),
 	user_agent: e.string().optional(),
 	correlation_id: e.string().optional()
-}), ie = e.object({
+}), te = e.object({
 	status_code: e.number(),
 	body: e.unknown().optional()
-}), ae = e.object({
+}), ne = e.object({
 	country_code: e.string(),
 	city_name: e.string(),
 	latitude: e.string(),
 	longitude: e.string(),
 	time_zone: e.string(),
 	continent_code: e.string()
-}), oe = e.object({
+}), re = e.object({
 	name: e.string(),
 	version: e.string(),
 	env: e.record(e.string(), e.string()).optional()
@@ -147,18 +147,18 @@ e.object({
 	event_type: e.string(),
 	log_type: e.string(),
 	description: e.string().optional(),
-	category: ee,
-	actor: te,
-	target: ne,
-	request: re,
-	response: ie.optional(),
+	category: p,
+	actor: m,
+	target: h,
+	request: ee,
+	response: te.optional(),
 	connection: e.string().optional(),
 	strategy: e.string().optional(),
 	strategy_type: e.string().optional(),
 	audience: e.string().optional(),
 	scope: e.string().optional(),
-	location: ae.optional(),
-	auth0_client: oe.optional(),
+	location: ne.optional(),
+	auth0_client: re.optional(),
 	hostname: e.string(),
 	is_mobile: e.boolean().optional(),
 	timestamp: e.string()
@@ -173,14 +173,14 @@ e.object({
 	"SEND_REQUEST",
 	"SEND_EMAIL"
 ]), e.enum(["VERIFY_EMAIL"]);
-var se = e.object({
+var ie = e.object({
 	require_mx_record: e.boolean().optional(),
 	block_aliases: e.boolean().optional(),
 	block_free_emails: e.boolean().optional(),
 	block_disposable_emails: e.boolean().optional(),
 	blocklist: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional()
-}), ce = e.object({
+}), ae = e.object({
 	id: e.string(),
 	alias: e.string().max(100).optional(),
 	type: e.literal("AUTH0"),
@@ -192,7 +192,7 @@ var se = e.object({
 		user_id: e.string(),
 		changes: e.record(e.string(), e.any())
 	})
-}), le = e.object({
+}), oe = e.object({
 	id: e.string(),
 	alias: e.string().max(100).optional(),
 	type: e.literal("EMAIL"),
@@ -201,13 +201,13 @@ var se = e.object({
 	mask_output: e.boolean().optional(),
 	params: e.object({
 		email: e.string(),
-		rules: se.optional()
+		rules: ie.optional()
 	})
-}), ue = e.enum([
+}), se = e.enum([
 	"change-email",
 	"account",
 	"custom"
-]), de = e.object({
+]), ce = e.object({
 	id: e.string(),
 	alias: e.string().max(100).optional(),
 	type: e.literal("REDIRECT"),
@@ -215,17 +215,17 @@ var se = e.object({
 	allow_failure: e.boolean().optional(),
 	mask_output: e.boolean().optional(),
 	params: e.object({
-		target: ue.openapi({ description: "The predefined target to redirect to, or 'custom' for a custom URL" }),
+		target: se.openapi({ description: "The predefined target to redirect to, or 'custom' for a custom URL" }),
 		custom_url: e.string().optional().openapi({ description: "Custom URL to redirect to when target is 'custom'" })
 	})
-}), fe = e.union([
-	ce,
-	le,
-	de
+}), le = e.union([
+	ae,
+	oe,
+	ce
 ]);
 e.object({
 	name: e.string().min(1).max(150).openapi({ description: "The name of the flow" }),
-	actions: e.array(fe).optional().default([]).openapi({ description: "The list of actions to execute in sequence" })
+	actions: e.array(le).optional().default([]).openapi({ description: "The list of actions to execute in sequence" })
 }).extend(n.shape).extend({ id: e.string().openapi({
 	description: "Unique identifier for the flow",
 	example: "af_12tMpdJ3iek7svMyZkSh5M"
@@ -241,7 +241,7 @@ e.object({
 	length: e.number(),
 	total: e.number().optional()
 });
-var pe = e.object({
+var ue = e.object({
 	email: e.string().optional(),
 	email_verified: e.boolean().optional(),
 	name: e.string().optional(),
@@ -250,7 +250,7 @@ var pe = e.object({
 	phone_number: e.string().optional(),
 	phone_verified: e.boolean().optional(),
 	family_name: e.string().optional()
-}).catchall(e.any()), me = e.object({
+}).catchall(e.any()), de = e.object({
 	connection: e.string(),
 	user_id: e.string(),
 	provider: e.string(),
@@ -263,15 +263,15 @@ var pe = e.object({
 	access_token: e.string().optional(),
 	access_token_secret: e.string().optional(),
 	refresh_token: e.string().optional(),
-	profileData: pe.optional()
-}), he = e.object({
+	profileData: ue.optional()
+}), fe = e.object({
 	formatted: e.string().optional(),
 	street_address: e.string().optional(),
 	locality: e.string().optional(),
 	region: e.string().optional(),
 	postal_code: e.string().optional(),
 	country: e.string().optional()
-}).optional(), ge = e.object({
+}).optional(), pe = e.object({
 	email: e.string().transform((e) => e.toLowerCase()).optional(),
 	username: e.string().refine((e) => !e.includes("@"), { message: "Usernames must not contain \"@\". Use the email field for email addresses." }).optional(),
 	phone_number: e.string().optional(),
@@ -294,9 +294,9 @@ var pe = e.object({
 	gender: e.string().optional(),
 	birthdate: e.string().optional(),
 	zoneinfo: e.string().optional(),
-	address: he
+	address: fe
 });
-ge.extend({
+pe.extend({
 	email_verified: e.boolean().default(!1),
 	verify_email: e.boolean().optional(),
 	last_ip: e.string().optional(),
@@ -316,24 +316,24 @@ ge.extend({
 	is_social: e.boolean(),
 	email: e.string().optional(),
 	login_count: e.number().default(0),
-	identities: e.array(me).optional()
-}).omit({ registration_completed_at: !0 }), ge.extend({
+	identities: e.array(de).optional()
+}).omit({ registration_completed_at: !0 }), pe.extend({
 	login_count: e.number(),
 	multifactor: e.array(e.string()).optional(),
 	last_ip: e.string().optional(),
 	last_login: e.string().optional(),
 	user_id: e.string()
 }).catchall(e.any());
-var _e = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", ve = (e = 21) => {
+var me = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", he = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += _e[n[e] & 63];
+	for (; e--;) t += me[n[e] & 63];
 	return t;
-}, ye = e.object({
+}, ge = e.object({
 	client_id: e.string().optional().openapi({ description: "ID of this client. Generated server-side if omitted (Auth0 behavior)." }),
 	name: e.string().min(1).openapi({ description: "Name of this client (min length: 1 character, does not allow < or >)." }),
 	description: e.string().max(140).optional().openapi({ description: "Free text description of this client (max length: 140 characters)." }),
 	global: e.boolean().default(!1).openapi({ description: "Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false)." }),
-	client_secret: e.string().default(() => ve()).optional().openapi({ description: "Client secret (which you must not make public)." }),
+	client_secret: e.string().default(() => he()).optional().openapi({ description: "Client secret (which you must not make public)." }),
 	app_type: e.enum([
 		"native",
 		"spa",
@@ -444,8 +444,8 @@ var _e = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", ve
 e.object({
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(ye.shape).extend({ client_id: e.string() });
-var be = e.object({
+}).extend(ge.shape).extend({ client_id: e.string() });
+var _e = e.object({
 	client_id: e.string().min(1).openapi({ description: "ID of the client." }),
 	audience: e.string().min(1).openapi({ description: "The audience (API identifier) of this client grant." }),
 	scope: e.array(e.string()).optional().openapi({ description: "Scopes allowed for this client grant." }),
@@ -458,15 +458,15 @@ var be = e.object({
 	is_system: e.boolean().optional().openapi({ description: "If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly." }),
 	subject_type: e.enum(["client", "user"]).optional().openapi({ description: "The type of application access the client grant allows. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement." }),
 	authorization_details_types: e.array(e.string()).optional().openapi({ description: "Types of authorization_details allowed for this client grant. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement." })
-}), xe = e.object({ id: e.string().openapi({ description: "ID of the client grant." }) }).extend(be.shape).extend({
+}), ve = e.object({ id: e.string().openapi({ description: "ID of the client grant." }) }).extend(_e.shape).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(xe);
-var Se = e.enum(["iat", "rat"]), Ce = e.object({
+e.array(ve);
+var ye = e.enum(["iat", "rat"]), be = e.object({
 	id: e.string(),
 	token_hash: e.string(),
-	type: Se,
+	type: ye,
 	client_id: e.string().optional(),
 	sub: e.string().optional(),
 	constraints: e.record(e.string(), e.unknown()).optional(),
@@ -477,23 +477,23 @@ e.object({
 	created_at: e.string(),
 	used_at: e.string().optional(),
 	revoked_at: e.string().optional()
-}).extend(Ce.shape);
-var p = e.object({
+}).extend(be.shape);
+var g = e.object({
 	x: e.number(),
 	y: e.number()
-}), we = /* @__PURE__ */ function(e) {
+}), xe = /* @__PURE__ */ function(e) {
 	return e.RICH_TEXT = "RICH_TEXT", e.NEXT_BUTTON = "NEXT_BUTTON", e.BACK_BUTTON = "BACK_BUTTON", e.SUBMIT_BUTTON = "SUBMIT_BUTTON", e.DIVIDER = "DIVIDER", e.TEXT = "TEXT", e.EMAIL = "EMAIL", e.PASSWORD = "PASSWORD", e.NUMBER = "NUMBER", e.PHONE = "PHONE", e.DATE = "DATE", e.CHECKBOX = "CHECKBOX", e.RADIO = "RADIO", e.SELECT = "SELECT", e.HIDDEN = "HIDDEN", e.LEGAL = "LEGAL", e;
-}({}), Te = /* @__PURE__ */ function(e) {
+}({}), Se = /* @__PURE__ */ function(e) {
 	return e.BLOCK = "BLOCK", e.FIELD = "FIELD", e;
-}({}), m = e.object({
+}({}), _ = e.object({
 	id: e.string(),
-	category: e.nativeEnum(Te),
-	type: e.nativeEnum(we)
-}), Ee = m.extend({
+	category: e.nativeEnum(Se),
+	type: e.nativeEnum(xe)
+}), Ce = _.extend({
 	category: e.literal("BLOCK"),
 	type: e.literal("RICH_TEXT"),
 	config: e.object({ content: e.string() }).passthrough()
-}), De = m.extend({
+}), we = _.extend({
 	category: e.literal("BLOCK"),
 	type: e.union([
 		e.literal("NEXT_BUTTON"),
@@ -501,13 +501,13 @@ var p = e.object({
 		e.literal("SUBMIT_BUTTON")
 	]),
 	config: e.object({ text: e.string() }).passthrough()
-}), Oe = m.extend({
+}), Te = _.extend({
 	category: e.literal("FIELD"),
 	type: e.literal("LEGAL"),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional(),
 	config: e.object({ text: e.string() }).passthrough()
-}), ke = m.extend({
+}), Ee = _.extend({
 	category: e.literal("FIELD"),
 	type: e.union([
 		e.literal("TEXT"),
@@ -527,38 +527,38 @@ var p = e.object({
 		label: e.string().optional(),
 		placeholder: e.string().optional()
 	}).passthrough()
-}), Ae = e.object({
+}), De = e.object({
 	id: e.string(),
 	category: e.string(),
 	type: e.string()
-}).passthrough(), je = e.union([
+}).passthrough(), Oe = e.union([
+	Ce,
+	we,
+	Te,
 	Ee,
-	De,
-	Oe,
-	ke,
-	Ae
-]), Me = e.object({
+	De
+]), ke = e.object({
 	id: e.string(),
 	type: e.literal("STEP"),
-	coordinates: p,
+	coordinates: g,
 	alias: e.string().optional(),
 	config: e.object({
-		components: e.array(je),
+		components: e.array(Oe),
 		next_node: e.string()
 	}).passthrough()
-}), Ne = e.object({
+}), Ae = e.object({
 	id: e.string(),
 	type: e.literal("FLOW"),
-	coordinates: p,
+	coordinates: g,
 	alias: e.string().optional(),
 	config: e.object({
 		flow_id: e.string(),
 		next_node: e.string()
 	})
-}), Pe = e.object({
+}), je = e.object({
 	id: e.string(),
 	type: e.literal("ACTION"),
-	coordinates: p,
+	coordinates: g,
 	alias: e.string().optional(),
 	config: e.object({
 		action_type: e.enum(["REDIRECT"]).openapi({ description: "The type of action to perform" }),
@@ -570,29 +570,29 @@ var p = e.object({
 		custom_url: e.string().optional().openapi({ description: "Custom URL when target is 'custom'" }),
 		next_node: e.string().openapi({ description: "The next node to navigate to after action (for non-redirect actions)" })
 	}).passthrough()
-}), Fe = e.object({
+}), Me = e.object({
 	id: e.string(),
 	type: e.string(),
-	coordinates: p
-}).passthrough(), Ie = e.union([
-	Me,
-	Ne,
-	Pe,
-	Fe
-]), Le = e.object({
+	coordinates: g
+}).passthrough(), Ne = e.union([
+	ke,
+	Ae,
+	je,
+	Me
+]), Pe = e.object({
 	next_node: e.string(),
-	coordinates: p
-}).passthrough(), Re = e.object({
+	coordinates: g
+}).passthrough(), Fe = e.object({
 	resume_flow: e.boolean().optional(),
-	coordinates: p
+	coordinates: g
 }).passthrough();
 e.object({
 	id: e.string(),
 	name: e.string(),
 	languages: e.object({ primary: e.string() }).passthrough(),
-	nodes: e.array(Ie),
-	start: Le,
-	ending: Re,
+	nodes: e.array(Ne),
+	start: Pe,
+	ending: Fe,
 	created_at: e.string(),
 	updated_at: e.string(),
 	links: e.object({
@@ -604,24 +604,24 @@ e.object({
 	created_at: !0,
 	updated_at: !0
 });
-var ze = /* @__PURE__ */ function(e) {
+var Ie = /* @__PURE__ */ function(e) {
 	return e.TOKEN = "token", e.ID_TOKEN = "id_token", e.TOKEN_ID_TOKEN = "id_token token", e.CODE = "code", e.CODE_ID_TOKEN = "code id_token", e.CODE_TOKEN = "code token", e.CODE_ID_TOKEN_TOKEN = "code id_token token", e;
-}({}), Be = /* @__PURE__ */ function(e) {
+}({}), Le = /* @__PURE__ */ function(e) {
 	return e.QUERY = "query", e.FRAGMENT = "fragment", e.FORM_POST = "form_post", e.WEB_MESSAGE = "web_message", e.SAML_POST = "saml_post", e;
-}({}), Ve = /* @__PURE__ */ function(e) {
+}({}), Re = /* @__PURE__ */ function(e) {
 	return e.S256 = "S256", e.Plain = "plain", e;
-}({}), h = e.union([e.null(), e.object({
+}({}), ze = e.union([e.null(), e.object({
 	essential: e.boolean().optional(),
 	value: e.unknown().optional(),
 	values: e.array(e.unknown()).optional()
-})]).nullable(), He = e.object({
-	userinfo: e.record(e.string(), h).optional(),
-	id_token: e.record(e.string(), h).optional()
-}), Ue = e.object({
+})]).nullable(), Be = e.object({
+	userinfo: e.record(e.string(), ze).optional(),
+	id_token: e.record(e.string(), ze).optional()
+}), Ve = e.object({
 	client_id: e.string(),
 	act_as: e.string().optional(),
-	response_type: e.nativeEnum(ze).optional(),
-	response_mode: e.nativeEnum(Be).optional(),
+	response_type: e.nativeEnum(Ie).optional(),
+	response_mode: e.nativeEnum(Le).optional(),
 	redirect_uri: e.string().optional(),
 	audience: e.string().optional(),
 	organization: e.string().optional(),
@@ -629,13 +629,13 @@ var ze = /* @__PURE__ */ function(e) {
 	nonce: e.string().optional(),
 	scope: e.string().optional(),
 	prompt: e.string().optional(),
-	code_challenge_method: e.nativeEnum(Ve).optional(),
+	code_challenge_method: e.nativeEnum(Re).optional(),
 	code_challenge: e.string().optional(),
 	username: e.string().optional(),
 	ui_locales: e.string().optional(),
 	max_age: e.number().optional(),
 	acr_values: e.string().optional(),
-	claims: He.optional(),
+	claims: Be.optional(),
 	vendor_id: e.string().optional()
 });
 e.object({
@@ -658,7 +658,7 @@ e.object({
 		"auto"
 	]).optional()
 });
-var We = e.enum([
+var He = e.enum([
 	"password_reset",
 	"email_verification",
 	"otp",
@@ -671,7 +671,7 @@ e.object({
 	code_id: e.string().openapi({ description: "The code that will be used in for instance an email verification flow" }),
 	login_id: e.string().openapi({ description: "The id of the login session that the code is connected to" }),
 	connection_id: e.string().optional().openapi({ description: "The connection that the code is connected to" }),
-	code_type: We,
+	code_type: He,
 	code_verifier: e.string().optional().openapi({ description: "The code verifier used in PKCE in outbound flows" }),
 	code_challenge: e.string().optional().openapi({ description: "The code challenge used in PKCE in outbound flows" }),
 	code_challenge_method: e.enum(["plain", "S256"]).optional().openapi({ description: "The code challenge method used in PKCE in outbound flows" }),
@@ -683,7 +683,7 @@ e.object({
 	used_at: e.string().optional(),
 	user_id: e.string().optional()
 }).extend({ created_at: e.string() });
-var Ge = e.object({
+var Ue = e.object({
 	kid: e.string().optional(),
 	team_id: e.string().optional(),
 	realms: e.string().optional(),
@@ -799,23 +799,23 @@ var Ge = e.object({
 		"never_on_login"
 	]).optional()
 });
-function g(e) {
+function v(e) {
 	if (e !== null) {
-		if (Array.isArray(e)) return e.filter((e) => e !== null).map(g);
+		if (Array.isArray(e)) return e.filter((e) => e !== null).map(v);
 		if (e && typeof e == "object") {
 			let t = {};
-			for (let [n, r] of Object.entries(e)) r !== null && (t[n] = g(r));
+			for (let [n, r] of Object.entries(e)) r !== null && (t[n] = v(r));
 			return t;
 		}
 		return e;
 	}
 }
-var Ke = e.object({
+var We = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	display_name: e.string().optional(),
 	strategy: e.string(),
-	options: e.preprocess((e) => e === null ? {} : g(e), Ge).default({}),
+	options: e.preprocess((e) => e === null ? {} : v(e), Ue).default({}),
 	enabled_clients: e.array(e.string()).default([]).optional(),
 	response_type: e.custom().optional(),
 	response_mode: e.custom().optional(),
@@ -828,8 +828,8 @@ e.object({
 	id: e.string(),
 	created_at: e.string().transform((e) => e === null ? "" : e),
 	updated_at: e.string().transform((e) => e === null ? "" : e)
-}).extend(Ke.shape);
-var _ = e.object({
+}).extend(We.shape);
+var Ge = e.object({
 	domain: e.string(),
 	custom_domain_id: e.string().optional(),
 	type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -843,7 +843,7 @@ var _ = e.object({
 		"null"
 	]).optional(),
 	domain_metadata: e.record(e.string(), e.string().max(255)).optional()
-}), qe = e.discriminatedUnion("name", [e.object({
+}), Ke = e.discriminatedUnion("name", [e.object({
 	name: e.literal("txt"),
 	record: e.string(),
 	domain: e.string()
@@ -851,7 +851,7 @@ var _ = e.object({
 	name: e.literal("http"),
 	http_body: e.string(),
 	http_url: e.string()
-})]), Je = _.extend({
+})]), qe = Ge.extend({
 	custom_domain_id: e.string(),
 	primary: e.boolean(),
 	status: e.enum([
@@ -861,28 +861,28 @@ var _ = e.object({
 		"ready"
 	]),
 	origin_domain_name: e.string().optional(),
-	verification: e.object({ methods: e.array(qe) }).optional(),
+	verification: e.object({ methods: e.array(Ke) }).optional(),
 	tls_policy: e.string().optional()
 });
-_.pick({
+Ge.pick({
 	tls_policy: !0,
 	custom_client_ip_header: !0,
 	domain_metadata: !0
-}).strict(), Je.extend({ tenant_id: e.string() }), e.object({
+}).strict(), qe.extend({ tenant_id: e.string() }), e.object({
 	certificate: e.string().regex(/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/, "must be PEM-encoded; include the full certificate chain in leaf-first order"),
 	private_key: e.string().regex(/-----BEGIN (RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+-----END \1PRIVATE KEY-----\s*$/, "must be a PEM-encoded private key")
 });
-var v = e.object({
+var y = e.object({
 	id: e.string(),
 	order: e.number().optional(),
 	visible: e.boolean().optional().default(!0)
-}), y = v.extend({ category: e.literal("BLOCK").optional() }), Ye = y.extend({
+}), b = y.extend({ category: e.literal("BLOCK").optional() }), Je = b.extend({
 	type: e.literal("DIVIDER"),
 	config: e.object({ text: e.string().optional() }).optional()
-}), Xe = y.extend({
+}), Ye = b.extend({
 	type: e.literal("HTML"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), Ze = y.extend({
+}), Xe = b.extend({
 	type: e.literal("IMAGE"),
 	config: e.object({
 		src: e.string().optional(),
@@ -890,43 +890,43 @@ var v = e.object({
 		width: e.number().optional(),
 		height: e.number().optional()
 	}).optional()
-}), Qe = y.extend({
+}), Ze = b.extend({
 	type: e.literal("JUMP_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		target_step: e.string().optional()
 	})
-}), $e = y.extend({
+}), Qe = b.extend({
 	type: e.literal("RESEND_BUTTON"),
 	config: e.object({
 		text: e.string().optional(),
 		resend_action: e.string().optional()
 	})
-}), et = y.extend({
+}), $e = b.extend({
 	type: e.literal("NEXT_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), tt = y.extend({
+}), et = b.extend({
 	type: e.literal("PREVIOUS_BUTTON"),
 	config: e.object({ text: e.string().optional() })
-}), nt = y.extend({
+}), tt = b.extend({
 	type: e.literal("RICH_TEXT"),
 	config: e.object({ content: e.string().optional() }).optional()
-}), b = v.extend({
+}), x = y.extend({
 	category: e.literal("WIDGET").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), rt = b.extend({
+}), nt = x.extend({
 	type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
 	config: e.object({ credential_type: e.string().optional() })
-}), it = b.extend({
+}), rt = x.extend({
 	type: e.literal("GMAPS_ADDRESS"),
 	config: e.object({ api_key: e.string().optional() })
-}), at = b.extend({
+}), it = x.extend({
 	type: e.literal("RECAPTCHA"),
 	config: e.object({ site_key: e.string().optional() })
-}), x = v.extend({
+}), S = y.extend({
 	category: e.literal("FIELD").optional(),
 	label: e.string().min(1).optional(),
 	hint: e.string().min(1).max(500).optional(),
@@ -942,10 +942,10 @@ var v = e.object({
 	})).optional(),
 	required: e.boolean().optional(),
 	sensitive: e.boolean().optional()
-}), ot = x.extend({
+}), at = S.extend({
 	type: e.literal("BOOLEAN"),
 	config: e.object({ default_value: e.boolean().optional() }).optional()
-}), st = x.extend({
+}), ot = S.extend({
 	type: e.literal("CARDS"),
 	config: e.object({
 		options: e.array(e.object({
@@ -956,7 +956,7 @@ var v = e.object({
 		})).optional(),
 		multi_select: e.boolean().optional()
 	}).optional()
-}), ct = x.extend({
+}), st = S.extend({
 	type: e.literal("CHOICE"),
 	config: e.object({
 		options: e.array(e.object({
@@ -967,7 +967,7 @@ var v = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), lt = x.extend({
+}), ct = S.extend({
 	type: e.literal("CUSTOM"),
 	config: e.object({
 		component: e.string().optional(),
@@ -975,7 +975,7 @@ var v = e.object({
 		schema: e.record(e.string(), e.any()).optional(),
 		code: e.string().optional()
 	})
-}), ut = x.extend({
+}), lt = S.extend({
 	type: e.literal("DATE"),
 	config: e.object({
 		format: e.string().optional(),
@@ -983,7 +983,7 @@ var v = e.object({
 		max: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), dt = x.extend({
+}), ut = S.extend({
 	type: e.literal("DROPDOWN"),
 	config: e.object({
 		options: e.array(e.object({
@@ -995,26 +995,26 @@ var v = e.object({
 		multiple: e.boolean().optional(),
 		default_value: e.union([e.string(), e.array(e.string())]).optional()
 	}).optional()
-}), ft = x.extend({
+}), dt = S.extend({
 	type: e.literal("EMAIL"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), pt = x.extend({
+}), ft = S.extend({
 	type: e.literal("FILE"),
 	config: e.object({
 		accept: e.string().optional(),
 		max_size: e.number().optional(),
 		multiple: e.boolean().optional()
 	}).optional()
-}), mt = x.extend({
+}), pt = S.extend({
 	type: e.literal("LEGAL"),
 	config: e.object({
 		text: e.string(),
 		html: e.boolean().optional()
 	}).optional()
-}), ht = x.extend({
+}), mt = S.extend({
 	type: e.literal("NUMBER"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1023,7 +1023,7 @@ var v = e.object({
 		step: e.number().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), gt = x.extend({
+}), ht = S.extend({
 	type: e.literal("PASSWORD"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1032,13 +1032,13 @@ var v = e.object({
 		forgot_password_link: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), _t = x.extend({
+}), gt = S.extend({
 	type: e.literal("PAYMENT"),
 	config: e.object({
 		provider: e.string().optional(),
 		currency: e.string().optional()
 	}).optional()
-}), vt = x.extend({
+}), _t = S.extend({
 	type: e.literal("SOCIAL"),
 	config: e.object({
 		providers: e.array(e.string()).optional(),
@@ -1050,7 +1050,7 @@ var v = e.object({
 			href: e.string().optional()
 		})).optional()
 	}).optional()
-}), yt = x.extend({
+}), vt = S.extend({
 	type: e.literal("TEL"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1058,7 +1058,7 @@ var v = e.object({
 		default_value: e.string().optional(),
 		allow_email: e.boolean().optional()
 	}).optional()
-}), bt = x.extend({
+}), yt = S.extend({
 	type: e.literal("TEXT"),
 	config: e.object({
 		placeholder: e.string().optional(),
@@ -1066,36 +1066,37 @@ var v = e.object({
 		max_length: e.number().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), xt = x.extend({
+}), bt = S.extend({
 	type: e.literal("COUNTRY"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), St = x.extend({
+}), xt = S.extend({
 	type: e.literal("URL"),
 	config: e.object({
 		placeholder: e.string().optional(),
 		default_value: e.string().optional()
 	}).optional()
-}), Ct = e.discriminatedUnion("type", [
+}), St = e.discriminatedUnion("type", [
+	Je,
 	Ye,
 	Xe,
 	Ze,
 	Qe,
 	$e,
 	et,
-	tt,
-	nt
-]), wt = e.discriminatedUnion("type", [
+	tt
+]), Ct = e.discriminatedUnion("type", [
+	nt,
 	rt,
-	it,
-	at
-]), Tt = e.discriminatedUnion("type", [
+	it
+]), wt = e.discriminatedUnion("type", [
+	at,
 	ot,
 	st,
+	bt,
 	ct,
-	xt,
 	lt,
 	ut,
 	dt,
@@ -1107,12 +1108,11 @@ var v = e.object({
 	_t,
 	vt,
 	yt,
-	bt,
-	St
-]), S = e.union([
+	xt
+]), Tt = e.union([
+	St,
 	Ct,
-	wt,
-	Tt
+	wt
 ]);
 new Set([
 	"BOOLEAN",
@@ -1170,7 +1170,7 @@ var C = e.object({
 	coordinates: C,
 	alias: e.string().min(1).max(150).optional(),
 	config: e.object({
-		components: e.array(S),
+		components: e.array(Tt),
 		next_node: e.string().optional()
 	})
 }), kt = e.discriminatedUnion("type", [
@@ -1234,7 +1234,7 @@ e.object({
 	method: e.enum(["POST", "GET"]),
 	title: e.string().optional(),
 	description: e.string().optional(),
-	components: e.array(S),
+	components: e.array(Tt),
 	messages: e.array(jt).optional(),
 	links: e.array(Mt).optional(),
 	footer: e.string().optional()
@@ -1431,7 +1431,7 @@ var Gt = /* @__PURE__ */ function(e) {
 e.object({
 	csrf_token: e.string(),
 	auth0Client: e.string().optional(),
-	authParams: Ue,
+	authParams: Ve,
 	expires_at: e.string(),
 	deleted_at: e.string().optional(),
 	ip: e.string().optional(),
@@ -1658,52 +1658,52 @@ var Zt = e.enum([
 	"splunk",
 	"datadog",
 	"sumo"
-]), j = e.enum([
+]), Qt = e.enum([
 	"active",
 	"paused",
 	"suspended"
-]), Qt = e.object({
+]), $t = e.object({
 	type: e.string(),
 	name: e.string()
 });
 e.object({
 	name: e.string(),
 	type: Zt,
-	status: j.optional(),
+	status: Qt.optional(),
 	sink: e.record(e.string(), e.unknown()),
-	filters: e.array(Qt).optional(),
+	filters: e.array($t).optional(),
 	isPriority: e.boolean().optional()
 }).extend({
 	id: e.string(),
-	status: j,
+	status: Qt,
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-var $t = e.enum([
+var en = e.enum([
 	"auth0",
 	"cognito",
 	"okta",
 	"oidc"
-]), en = e.object({
+]), tn = e.object({
 	domain: e.string(),
 	client_id: e.string(),
 	client_secret: e.string(),
 	audience: e.string().optional(),
 	scope: e.string().optional()
-}), tn = e.object({
+}), nn = e.object({
 	id: e.string().optional(),
 	name: e.string(),
-	provider: $t,
+	provider: en,
 	connection: e.string(),
 	enabled: e.boolean().default(!0),
-	credentials: en
+	credentials: tn
 });
 e.object({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(tn.shape);
-var nn = e.object({
+}).extend(nn.shape);
+var rn = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	admin_notification_frequency: e.array(e.string()).optional(),
@@ -1712,13 +1712,13 @@ var nn = e.object({
 		"pre-user-registration": e.object({ shields: e.array(e.string()).optional() }).optional(),
 		"pre-change-password": e.object({ shields: e.array(e.string()).optional() }).optional()
 	}).optional()
-}), rn = e.object({
+}), an = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
 	mode: e.string().optional(),
 	max_attempts: e.number().optional()
-}), an = e.object({
+}), on = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
@@ -1732,10 +1732,10 @@ var nn = e.object({
 			rate: e.number().optional()
 		}).optional()
 	}).optional()
-}), on = e.object({
-	breached_password_detection: nn.optional(),
-	brute_force_protection: rn.optional(),
-	suspicious_ip_throttling: an.optional()
+}), sn = e.object({
+	breached_password_detection: rn.optional(),
+	brute_force_protection: an.optional(),
+	suspicious_ip_throttling: on.optional()
 });
 e.object({
 	id: e.string().optional(),
@@ -1748,14 +1748,14 @@ e.object({
 	created_at: e.string(),
 	updated_at: e.string()
 });
-var M = e.object({
+var cn = e.object({
 	initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
 	initial_ip: e.string().describe("First IP address associated with this session"),
 	initial_asn: e.string().describe("First autonomous system number associated with this session"),
 	last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
 	last_ip: e.string().describe("Last IP address from which this user logged in"),
 	last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), sn = e.object({
+}), ln = e.object({
 	id: e.string(),
 	revoked_at: e.string().optional(),
 	used_at: e.string().optional(),
@@ -1763,7 +1763,7 @@ var M = e.object({
 	expires_at: e.string().optional(),
 	login_session_id: e.string(),
 	idle_expires_at: e.string().optional(),
-	device: M.describe("Metadata related to the device used in the session"),
+	device: cn.describe("Metadata related to the device used in the session"),
 	clients: e.array(e.string()).describe("List of client details for the session")
 });
 e.object({
@@ -1771,7 +1771,7 @@ e.object({
 	updated_at: e.string(),
 	authenticated_at: e.string(),
 	last_interaction_at: e.string()
-}).extend(sn.shape), e.object({
+}).extend(ln.shape), e.object({
 	kid: e.string().openapi({ description: "The key id of the signing key" }),
 	tenant_id: e.string().optional().openapi({ description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped." }),
 	cert: e.string().openapi({ description: "The public certificate of the signing key" }),
@@ -1788,7 +1788,7 @@ e.object({
 	connection: e.string().optional().openapi({ description: "The connection identifier associated with the key" }),
 	type: e.enum(["jwt_signing", "saml_encryption"]).openapi({ description: "The type of the signing key" })
 });
-var cn = e.object({
+var un = e.object({
 	id: e.string().optional(),
 	audience: e.string().optional(),
 	friendly_name: e.string(),
@@ -1905,7 +1905,7 @@ var cn = e.object({
 		"shared_planetscale"
 	]).optional(),
 	d1_database_id: e.string().max(64).optional(),
-	attack_protection: on.optional(),
+	attack_protection: sn.optional(),
 	mfa: e.object({
 		policy: e.enum(["never", "always"]).default("never").optional(),
 		factors: e.object({
@@ -1936,7 +1936,7 @@ var cn = e.object({
 e.object({
 	created_at: e.string().nullable().transform((e) => e ?? ""),
 	updated_at: e.string().nullable().transform((e) => e ?? "")
-}).extend(cn.shape).extend({
+}).extend(un.shape).extend({
 	id: e.string(),
 	is_control_plane: e.boolean().optional()
 }), e.object({
@@ -1951,7 +1951,7 @@ e.object({
 	code: e.string(),
 	state: e.string().optional()
 });
-var ln = e.object({
+var dn = e.object({
 	button_border_radius: e.number(),
 	button_border_weight: e.number(),
 	buttons_style: e.enum([
@@ -1969,7 +1969,7 @@ var ln = e.object({
 	show_widget_shadow: e.boolean(),
 	widget_border_weight: e.number(),
 	widget_corner_radius: e.number()
-}), un = e.object({
+}), fn = e.object({
 	base_focus_color: e.string(),
 	base_hover_color: e.string(),
 	body_text: e.string(),
@@ -1993,20 +1993,20 @@ var ln = e.object({
 	success: e.string(),
 	widget_background: e.string(),
 	widget_border: e.string()
-}), N = e.object({
+}), j = e.object({
 	bold: e.boolean(),
 	size: e.number()
-}), dn = e.object({
-	body_text: N,
-	buttons_text: N,
+}), pn = e.object({
+	body_text: j,
+	buttons_text: j,
 	font_url: e.string(),
-	input_labels: N,
-	links: N,
+	input_labels: j,
+	links: j,
 	links_style: e.enum(["normal", "underlined"]),
 	reference_text_size: e.number(),
-	subtitle: N,
-	title: N
-}), fn = e.object({
+	subtitle: j,
+	title: j
+}), mn = e.object({
 	background_color: e.string(),
 	background_image_url: e.string(),
 	page_layout: e.enum([
@@ -2019,7 +2019,7 @@ var ln = e.object({
 		"chip",
 		"none"
 	]).optional()
-}), pn = e.object({
+}), hn = e.object({
 	header_text_alignment: e.enum([
 		"center",
 		"left",
@@ -2036,39 +2036,39 @@ var ln = e.object({
 	social_buttons_layout: e.enum(["bottom", "top"])
 });
 e.object({
-	borders: ln,
-	colors: un,
+	borders: dn,
+	colors: fn,
 	displayName: e.string(),
-	fonts: dn,
-	page_background: fn,
-	widget: pn
+	fonts: pn,
+	page_background: mn,
+	widget: hn
 }).extend({ themeId: e.string() }), e.object({
 	universal_login_experience: e.enum(["new", "classic"]).default("new"),
 	identifier_first: e.boolean().default(!0),
 	password_first: e.boolean().default(!1),
 	webauthn_platform_first_factor: e.boolean()
 });
-var P = e.object({
+var gn = e.object({
 	hosts: e.array(e.string()).optional(),
 	methods: e.array(e.string()).optional(),
 	path: e.string().default("/*"),
 	headers: e.record(e.string(), e.string()).optional(),
 	query: e.record(e.string(), e.string()).optional()
-}), F = e.object({
+}), _n = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
-}), I = e.object({
+}), M = e.object({
 	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
-	match: P,
-	handlers: e.array(F).min(1)
-}), mn = I.extend({
+	match: gn,
+	handlers: e.array(_n).min(1)
+}), vn = M.extend({
 	id: e.string(),
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), hn = I.partial().omit({
+}), yn = M.partial().omit({
 	id: !0,
 	custom_domain_id: !0
 });
@@ -2079,7 +2079,7 @@ e.object({
 	credentials: e.record(e.string(), e.unknown()),
 	settings: e.object({}).optional()
 });
-var gn = e.enum([
+var bn = e.enum([
 	"verify_email",
 	"verify_email_by_code",
 	"reset_email",
@@ -2094,7 +2094,7 @@ var gn = e.enum([
 	"user_invitation"
 ]);
 e.object({
-	template: gn,
+	template: bn,
 	body: e.string(),
 	from: e.string(),
 	subject: e.string(),
@@ -2111,7 +2111,7 @@ e.object({
 	expires_at: e.string().optional(),
 	idle_expires_at: e.string().optional(),
 	last_exchanged_at: e.string().optional(),
-	device: M,
+	device: cn,
 	resource_servers: e.array(e.object({
 		audience: e.string(),
 		scopes: e.string()
@@ -2132,10 +2132,10 @@ e.object({
 	name: e.string(),
 	options: e.object({})
 });
-var _n = e.object({
+var xn = e.object({
 	value: e.string(),
 	description: e.string().optional()
-}), vn = e.object({
+}), Sn = e.object({
 	token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
 	enforce_policies: e.boolean().optional(),
 	allow_skipping_userinfo: e.boolean().optional(),
@@ -2143,11 +2143,11 @@ var _n = e.object({
 	persist_client_authorization: e.boolean().optional(),
 	enable_introspection_endpoint: e.boolean().optional(),
 	mtls: e.object({ bound_access_tokens: e.boolean().optional() }).optional()
-}), yn = e.object({
+}), Cn = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	identifier: e.string(),
-	scopes: e.array(_n).optional(),
+	scopes: e.array(xn).optional(),
 	signing_alg: e.string().optional(),
 	signing_secret: e.string().optional(),
 	token_lifetime: e.number().default(86400),
@@ -2155,26 +2155,26 @@ var _n = e.object({
 	skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
 	allow_offline_access: e.boolean().optional(),
 	verificationKey: e.string().optional(),
-	options: vn.optional(),
+	options: Sn.optional(),
 	is_system: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional()
 }).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(yn);
-var bn = e.object({
+e.array(Cn);
+var wn = e.object({
 	role_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string()
 }).extend({ created_at: e.string() });
-e.array(bn), e.object({
+e.array(wn), e.object({
 	user_id: e.string().openapi({ description: "The id of the user that granted the consent" }),
 	clientID: e.string().openapi({ description: "The id of the client the grant was issued to" }),
 	audience: e.string().optional().openapi({ description: "The audience the grant applies to" }),
 	scope: e.array(e.string()).default([]).openapi({ description: "The list of OAuth scopes the user has consented to" })
 }).extend({ id: e.string() });
-var xn = e.object({
+var Tn = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string(),
@@ -2183,8 +2183,8 @@ var xn = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(xn);
-var Sn = e.object({
+e.array(Tn);
+var En = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	resource_server_name: e.string(),
@@ -2193,8 +2193,8 @@ var Sn = e.object({
 	created_at: e.string().optional(),
 	organization_id: e.string().optional()
 });
-e.array(Sn);
-var Cn = e.object({
+e.array(En);
+var Dn = e.object({
 	user_id: e.string(),
 	role_id: e.string(),
 	organization_id: e.string().optional()
@@ -2202,8 +2202,8 @@ var Cn = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Cn);
-var wn = e.object({
+e.array(Dn);
+var On = e.object({
 	id: e.string().optional().openapi({ description: "The unique identifier of the role. If not provided, one will be generated." }),
 	name: e.string().min(1).max(50).openapi({ description: "The name of the role. Cannot include '<' or '>'" }),
 	description: e.string().max(255).optional().openapi({ description: "The description of the role" }),
@@ -2214,19 +2214,19 @@ var wn = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(wn);
-var Tn = e.object({
+e.array(On);
+var kn = e.object({
 	logo_url: e.string().optional().openapi({ description: "URL of the organization's logo" }),
 	colors: e.object({
 		primary: e.string().optional().openapi({ description: "Primary color in hex format (e.g., #FF0000)" }),
 		page_background: e.string().optional().openapi({ description: "Page background color in hex format (e.g., #FFFFFF)" })
 	}).optional()
-}).optional(), En = e.object({
+}).optional(), An = e.object({
 	connection_id: e.string().openapi({ description: "ID of the connection" }),
 	assign_membership_on_login: e.boolean().default(!1).openapi({ description: "Whether to assign membership to the organization on login" }),
 	show_as_button: e.boolean().default(!0).openapi({ description: "Whether to show this connection as a button in the login screen" }),
 	is_signup_enabled: e.boolean().default(!0).openapi({ description: "Whether signup is enabled for this connection" })
-}), Dn = e.object({ client_credentials: e.object({
+}), jn = e.object({ client_credentials: e.object({
 	enforce: e.boolean().default(!1).openapi({ description: "Whether to enforce token quota limits" }),
 	per_day: e.number().min(0).default(0).openapi({ description: "Maximum tokens per day (0 = unlimited)" }),
 	per_hour: e.number().min(0).default(0).openapi({ description: "Maximum tokens per hour (0 = unlimited)" })
@@ -2235,15 +2235,15 @@ e.object({
 	id: e.string().optional(),
 	name: e.string().min(1).regex(/^[a-z0-9_-]+$/, { message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores" }).openapi({ description: "The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores." }),
 	display_name: e.string().optional().openapi({ description: "The display name of the organization" }),
-	branding: Tn,
+	branding: kn,
 	metadata: e.record(e.string(), e.any()).default({}).optional().openapi({ description: "Custom metadata for the organization" }),
-	enabled_connections: e.array(En).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
-	token_quota: Dn
+	enabled_connections: e.array(An).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
+	token_quota: jn
 }).extend(n.shape).extend({
 	id: e.string(),
 	name: e.string().min(1).openapi({ description: "The name of the organization" })
 });
-var On = e.object({
+var Mn = e.object({
 	connection_id: e.string().openapi({ description: "ID of the tenant-level connection to enable for the org." }),
 	assign_membership_on_login: e.boolean().optional().default(!1),
 	show_as_button: e.boolean().optional().default(!0),
@@ -2256,7 +2256,7 @@ var On = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(On), e.object({
+e.array(Mn), e.object({
 	user_id: e.string().openapi({ description: "ID of the user" }),
 	organization_id: e.string().openapi({ description: "ID of the organization" })
 }).extend(n.shape).extend({ id: e.string() }), e.object({
@@ -2389,22 +2389,22 @@ e.array(On), e.object({
 	"passwordless",
 	"enterprise"
 ]);
-var kn = e.object({
+var Nn = e.object({
 	name: e.string(),
 	type: e.string()
-}), An = e.object({
+}), Pn = e.object({
 	elapsed: e.number(),
 	rows_read: e.number().optional(),
 	bytes_read: e.number().optional()
 });
 e.object({
-	meta: e.array(kn),
+	meta: e.array(Nn),
 	data: e.array(e.record(e.string(), e.any())),
 	rows: e.number(),
 	rows_before_limit_at_least: e.number().optional(),
-	statistics: An.optional()
+	statistics: Pn.optional()
 });
-var jn = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Mn = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+var Fn = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), In = e.record(e.string(), e.record(e.string(), e.string())).openapi({
 	type: "object",
 	additionalProperties: {
 		type: "object",
@@ -2412,11 +2412,11 @@ var jn = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.
 	}
 });
 e.object({
-	prompt: jn,
+	prompt: Fn,
 	language: e.string(),
-	custom_text: Mn
+	custom_text: In
 });
-var Nn = e.enum([
+var Ln = e.enum([
 	"phone",
 	"totp",
 	"email",
@@ -2424,9 +2424,9 @@ var Nn = e.enum([
 	"webauthn-roaming",
 	"webauthn-platform",
 	"passkey"
-]), L = e.object({
+]), N = e.object({
 	user_id: e.string(),
-	type: Nn,
+	type: Ln,
 	phone_number: e.string().optional(),
 	totp_secret: e.string().optional(),
 	credential_id: e.string().optional(),
@@ -2437,7 +2437,7 @@ var Nn = e.enum([
 	friendly_name: e.string().optional(),
 	confirmed: e.boolean().default(!1)
 });
-function R(t, n) {
+function P(t, n) {
 	t.type === "phone" && !t.phone_number && n.addIssue({
 		code: e.ZodIssueCode.custom,
 		message: "phone_number is required when type is 'phone'",
@@ -2460,71 +2460,76 @@ function R(t, n) {
 		path: ["public_key"]
 	}));
 }
-L.superRefine(R), L.extend({
+N.superRefine(P), N.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).superRefine(R);
+}).superRefine(P);
 //#endregion
 //#region src/data-plane/cache.ts
-var Pn = 1e4;
-function z(e, t, n) {
+var Rn = 1e4;
+function F(e, t, n) {
 	let r = typeof t == "number" ? {
 		freshTtlMs: t,
 		maxEntries: n
-	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.negativeTtlMs ?? i, s = r.maxEntries ?? Pn, c = r.waitUntil, l = /* @__PURE__ */ new Map();
-	function u(e) {
-		for (let [t, n] of l) n.stale_until <= e && !n.refreshing && l.delete(t);
-		for (; l.size >= s;) {
-			let e = l.keys().next().value;
+	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? Rn, l = r.waitUntil, u = /* @__PURE__ */ new Map();
+	function d(e) {
+		for (let [t, n] of u) n.stale_if_error_until <= e && n.stale_until <= e && !n.refreshing && u.delete(t);
+		for (; u.size >= c;) {
+			let e = u.keys().next().value;
 			if (e === void 0) break;
-			l.delete(e);
+			u.delete(e);
 		}
 	}
-	function d(e, t, n) {
-		let r = n + (t === null ? o : i), s = {
+	function f(e, t, n) {
+		let r = n + (t === null ? s : i), c = t === null ? r : r + a, l = {
 			value: t,
 			fresh_until: r,
-			stale_until: t === null ? r : r + a
+			stale_until: c,
+			stale_if_error_until: t === null ? c : c + o
 		};
-		return l.delete(e), u(n), l.set(e, s), s;
+		return u.delete(e), d(n), u.set(e, l), l;
 	}
-	function f(t) {
-		let n = l.get(t);
+	function p(t) {
+		let n = u.get(t);
 		if (n?.refreshing) return n.refreshing;
 		let r = n ?? {
 			value: null,
 			fresh_until: 0,
-			stale_until: 0
-		};
-		n || (u(Date.now()), l.set(t, r));
-		let i = (async () => {
+			stale_until: 0,
+			stale_if_error_until: 0
+		}, i = (async () => {
 			try {
 				let n = await e.resolveHost(t);
-				return d(t, n, Date.now()), n;
+				return f(t, n, Date.now()), n;
 			} catch (e) {
-				let n = l.get(t);
-				throw n && (n.refreshing = void 0, n.stale_until <= Date.now() && l.delete(t)), e;
+				let n = u.get(t);
+				throw n && (n.refreshing = void 0, n.stale_if_error_until <= Date.now() && u.delete(t)), e;
 			}
 		})();
-		return r.refreshing = i, i;
+		return r.refreshing = i, n || (d(Date.now()), u.set(t, r)), i;
 	}
 	return { async resolveHost(e) {
-		let t = Date.now(), n = l.get(e);
-		if (n && n.fresh_until > t) return l.delete(e), l.set(e, n), n.value;
+		let t = Date.now(), n = u.get(e);
+		if (n && n.fresh_until > t) return u.delete(e), u.set(e, n), n.value;
 		if (n && n.stale_until > t) {
-			if (l.delete(e), l.set(e, n), !n.refreshing) {
-				let t = f(e).catch(() => void 0);
-				c && c(t);
+			if (u.delete(e), u.set(e, n), !n.refreshing) {
+				let t = p(e).catch(() => void 0);
+				l && l(t);
 			}
 			return n.value;
 		}
-		return f(e);
+		try {
+			return await p(e);
+		} catch (e) {
+			if (n && n.stale_if_error_until > t) return n.value;
+			throw e;
+		}
 	} };
 }
 //#endregion
 //#region src/data-plane/registry.ts
-var B = class {
+var I = class {
 	definitions = /* @__PURE__ */ new Map();
 	bindings;
 	constructor(e = {}) {
@@ -2544,38 +2549,38 @@ var B = class {
 		return n.build(r.data, { bindings: this.bindings });
 	}
 };
-function V(e) {
+function L(e) {
 	return e;
 }
 //#endregion
 //#region src/data-plane/handlers/util.ts
-var H = "__authhero_proxy_request__", U = "__authhero_proxy_tenant_id__", W = "__authhero_proxy_custom_domain_id__", G = "__authhero_proxy_domain__", Fn = "x-authhero-proxy-mutability-probe";
-function In(e, t) {
-	e.set(H, t);
+var R = "__authhero_proxy_request__", z = "__authhero_proxy_tenant_id__", B = "__authhero_proxy_custom_domain_id__", V = "__authhero_proxy_domain__", H = "x-authhero-proxy-mutability-probe";
+function zn(e, t) {
+	e.set(R, t);
 }
-function K(e) {
-	return e.get(H) ?? e.req.raw;
+function U(e) {
+	return e.get(R) ?? e.req.raw;
 }
-function Ln(e, t) {
-	e.set(U, t.tenant_id), e.set(W, t.custom_domain_id), e.set(G, t.domain);
+function Bn(e, t) {
+	e.set(z, t.tenant_id), e.set(B, t.custom_domain_id), e.set(V, t.domain);
 }
-function Rn(e) {
-	return e.get(U);
+function Vn(e) {
+	return e.get(z);
 }
-function zn(e) {
-	return e.get(W);
+function Hn(e) {
+	return e.get(B);
 }
-function Bn(e) {
-	return e.get(G);
+function Un(e) {
+	return e.get(V);
 }
-function q(e, t) {
-	let n = K(e), r = new Headers(n.headers);
-	t(r), In(e, new Request(n, { headers: r }));
+function W(e, t) {
+	let n = U(e), r = new Headers(n.headers);
+	t(r), zn(e, new Request(n, { headers: r }));
 }
-function J(e) {
+function G(e) {
 	let t = e.res;
 	try {
-		t.headers.append(Fn, "1"), t.headers.delete(Fn);
+		t.headers.append(H, "1"), t.headers.delete(H);
 		return;
 	} catch {
 		e.res = new Response(t.body, {
@@ -2587,7 +2592,7 @@ function J(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var Vn = e.object({
+var Wn = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2595,44 +2600,44 @@ var Vn = e.object({
 	expose_headers: e.array(e.string()).optional(),
 	max_age: e.number().int().optional()
 }).refine((e) => !(e.allow_credentials && e.origins?.includes("*")), { message: "Cannot use wildcard origin (*) with allow_credentials" });
-function Hn(e, t) {
+function K(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var Un = V({
+var Gn = L({
 	type: "cors",
-	optionsSchema: Vn,
+	optionsSchema: Wn,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
 			if (t.req.method === "OPTIONS" && r !== null && t.req.header("access-control-request-method") !== void 0) {
-				let t = Hn(e, r);
+				let t = K(e, r);
 				return new Response(null, {
 					status: 204,
 					headers: t
 				});
 			}
 			await n();
-			let i = Hn(e, r);
-			J(t), i.forEach((e, n) => {
+			let i = K(e, r);
+			G(t), i.forEach((e, n) => {
 				n.toLowerCase() === "vary" ? t.res.headers.append(n, e) : t.res.headers.set(n, e);
 			});
 		};
 	}
-}), Wn = e.object({
+}), Kn = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function Gn(e, t) {
+function qn(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var Kn = V({
+var Jn = L({
 	type: "basic_auth",
-	optionsSchema: Wn,
+	optionsSchema: Kn,
 	build(e) {
-		let t = Gn(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = qn(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2648,7 +2653,7 @@ var Kn = V({
 			});
 		};
 	}
-}), qn = V({
+}), Yn = L({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2658,23 +2663,23 @@ var Kn = V({
 	}),
 	build(e) {
 		return async (t, n) => {
-			if ((e.request || e.remove_request) && q(t, (t) => {
+			if ((e.request || e.remove_request) && W(t, (t) => {
 				if (e.remove_request?.forEach((e) => t.delete(e)), e.request) for (let [n, r] of Object.entries(e.request)) t.set(n, r);
-			}), await n(), (e.response || e.remove_response) && (J(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
+			}), await n(), (e.response || e.remove_response) && (G(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), Jn = V({
+}), Xn = L({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
 		return async (t, n) => {
 			if (await n(), !t.res.headers.has("Cache-Control")) {
 				let n = t.res.headers.has("set-cookie") ? "private" : "public";
-				J(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
+				G(t), t.res.headers.set("Cache-Control", `${n}, max-age=${e.ttl_seconds}`);
 			}
 		};
 	}
-}), Yn = V({
+}), Zn = L({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
@@ -2684,40 +2689,40 @@ var Kn = V({
 	build(e) {
 		return async (t, n) => {
 			let r = new URL(t.req.url);
-			q(t, (n) => {
+			W(t, (n) => {
 				n.set("x-forwarded-host", r.host), n.set("x-forwarded-proto", r.protocol.replace(":", "")), e.set_x_original_url && n.set("x-original-url", t.req.url);
 				let i = n.get(e.client_ip_header), a = (n.get("x-forwarded-for") ?? "").split(",").map((e) => e.trim()).filter(Boolean), o = i ?? a[a.length - 1] ?? "127.0.0.1", s = a.length === 0 || a[a.length - 1] !== o, c = a.length ? s ? `${a.join(", ")}, ${o}` : a.join(", ") : o;
 				n.set("x-forwarded-for", c), e.set_x_real_ip && n.set("x-real-ip", o);
 			}), await n();
 		};
 	}
-}), Xn = e.object({ upstream_host: e.string().optional() });
-function Zn(e) {
+}), Qn = e.object({ upstream_host: e.string().optional() });
+function $n(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function Qn(e) {
+function er(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var $n = V({
+var tr = L({
 	type: "rewrite_cookies",
-	optionsSchema: Xn,
+	optionsSchema: Qn,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = Qn(t.res.headers);
+			let a = er(t.res.headers);
 			if (a.length === 0) return;
-			let o = Zn(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
-			J(t), t.res.headers.delete("set-cookie");
+			let o = $n(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			G(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), er = V({
+}), nr = L({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
@@ -2737,10 +2742,33 @@ var $n = V({
 			}
 			if (o.origin !== a) return;
 			let s = new URL(t.req.url), c = `${`${s.protocol}//${s.host}`}${o.pathname}${o.search}${o.hash}`;
-			J(t), t.res.headers.set("location", c);
+			G(t), t.res.headers.set("location", c);
 		};
 	}
-}), tr = new Set([
+}), rr = class extends Error {
+	ms;
+	constructor(e, t) {
+		super(`${t ?? "Operation"} timed out after ${e}ms`), this.name = "TimeoutError", this.ms = e;
+	}
+};
+function q(e) {
+	return e instanceof rr ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
+}
+function J(e, t) {
+	let n = new AbortController(), r = setTimeout(() => n.abort(), e);
+	return t(n.signal).finally(() => clearTimeout(r));
+}
+function Y(e, t, n) {
+	let r, i = new Promise((e, i) => {
+		r = setTimeout(() => i(new rr(t, n)), t);
+	});
+	return Promise.race([e, i]).finally(() => {
+		r && clearTimeout(r);
+	});
+}
+//#endregion
+//#region src/data-plane/handlers/http.ts
+var ir = new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -2749,24 +2777,24 @@ var $n = V({
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), nr = 3e4, rr = e.object({
+]), ar = 3e4, or = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function ir(e, t) {
+function sr(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function ar(e) {
+function cr(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function or(e, t) {
+function lr(e, t) {
 	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = ir(r.pathname, n.pathname), r.search = n.search;
+	r.pathname = sr(r.pathname, n.pathname), r.search = n.search;
 	let i = new Headers(t.headers);
-	for (let e of tr) i.delete(e);
+	for (let e of ir) i.delete(e);
 	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = ar(t.method) ? t.body : void 0, o = {
+	let a = cr(t.method) ? t.body : void 0, o = {
 		method: t.method,
 		headers: i,
 		body: a,
@@ -2777,93 +2805,107 @@ function or(e, t) {
 		init: o
 	};
 }
-var Y = V({
+var ur = L({
 	type: "http",
-	optionsSchema: rr,
+	optionsSchema: or,
 	build(e) {
-		let t = e.timeout_ms ?? nr;
+		let t = e.timeout_ms ?? ar;
 		return async (n) => {
-			let { target: r, init: i } = or(e, K(n));
+			let { target: r, init: i } = lr(e, U(n));
 			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
-			let a = new AbortController(), o = setTimeout(() => a.abort(), t);
 			try {
-				return await fetch(r.toString(), {
+				return await J(t, (e) => fetch(r.toString(), {
 					...i,
-					signal: a.signal
-				});
+					signal: e
+				}));
 			} catch (e) {
-				if (e instanceof Error && e.name === "AbortError") return new Response("Upstream timeout", { status: 504 });
-				throw e;
-			} finally {
-				clearTimeout(o);
+				return q(e) ? n.text("Upstream timeout", 504, { "x-authhero-proxy-error": "http_timeout" }) : n.text("Bad gateway", 502, { "x-authhero-proxy-error": "http_failed" });
 			}
 		};
 	}
-}), sr = e.object({
+}), dr = 3e4, fr = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
-	preserve_host: e.boolean().default(!0)
+	preserve_host: e.boolean().default(!0),
+	timeout_ms: e.number().int().positive().optional()
 });
-function cr(e) {
+function pr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var lr = V({
+var mr = L({
 	type: "service_binding",
-	optionsSchema: sr,
+	optionsSchema: fr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!cr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
-		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`;
+		if (!pr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? dr;
 		return async (t) => {
-			let i = K(t), { target: a, init: o } = or({
+			let a = U(t), { target: o, init: s } = lr({
 				upstream_url: r,
 				preserve_host: e.preserve_host
-			}, i);
-			return t.set("__proxy_upstream_host__", a.hostname), t.set("__proxy_upstream_origin__", `${a.protocol}//${a.host}`), n.fetch(new Request(a.toString(), o));
+			}, a);
+			t.set("__proxy_upstream_host__", o.hostname), t.set("__proxy_upstream_origin__", `${o.protocol}//${o.host}`);
+			try {
+				return await J(i, async (e) => n.fetch(new Request(o.toString(), {
+					...s,
+					signal: e
+				})));
+			} catch (e) {
+				return q(e) ? t.text(`service_binding timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "service_binding_timeout" }) : t.text("Bad gateway", 502, { "x-authhero-proxy-error": "service_binding_failed" });
+			}
 		};
 	}
-}), ur = e.object({
+}), hr = 3e4, gr = e.object({
 	binding: e.string(),
 	script_name: e.string(),
 	cpu_ms: e.number().int().positive().optional(),
-	subrequests: e.number().int().positive().optional()
+	subrequests: e.number().int().positive().optional(),
+	timeout_ms: e.number().int().positive().optional()
 });
-function dr(e) {
+function _r(e) {
 	return typeof e == "object" && !!e && typeof e.get == "function";
 }
 var X = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
-function fr(e) {
+function vr(e) {
 	return X.lastIndex = 0, X.test(e);
 }
-var pr = V({
+var yr = L({
 	type: "dispatch_namespace",
-	optionsSchema: ur,
+	optionsSchema: gr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!dr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
-		let r = fr(e.script_name), i = e.cpu_ms || e.subrequests ? { limits: {
+		if (!_r(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = vr(e.script_name), i = e.timeout_ms ?? hr, a = e.cpu_ms || e.subrequests ? { limits: {
 			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
 			...e.subrequests ? { subrequests: e.subrequests } : {}
 		} } : void 0;
 		return async (t) => {
-			let a = e.script_name;
+			let o = e.script_name;
 			if (r) {
-				let n = Rn(t), r = zn(t), i = Bn(t), o = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
-				if (a = a.replace(X, (e, t) => {
+				let n = Vn(t), r = Hn(t), i = Un(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				if (o = o.replace(X, (e, t) => {
 					switch (t) {
 						case "tenant_id": return n ?? "";
 						case "custom_domain_id": return r ?? "";
 						case "domain": return i ?? "";
-						case "host": return o;
+						case "host": return a;
 						default: return "";
 					}
-				}), a.includes("{") || a === "") return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`, 500);
+				}), o.includes("{") || o === "") return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`, 500);
+			}
+			let s = U(t);
+			try {
+				let e = n.get(o, void 0, a);
+				return await J(i, async (t) => {
+					let n = new Request(s, { signal: t });
+					return e.fetch(n);
+				});
+			} catch (e) {
+				return q(e) ? t.text(`dispatch_namespace timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "dispatch_namespace_timeout" }) : t.text("Bad gateway", 502, { "x-authhero-proxy-error": "dispatch_namespace_failed" });
 			}
-			let o = n.get(a, void 0, i), s = K(t);
-			return o.fetch(s);
 		};
 	}
-}), mr = V({
+}), br = L({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -2892,7 +2934,7 @@ var pr = V({
 			});
 		};
 	}
-}), hr = V({
+}), xr = L({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -2912,15 +2954,15 @@ var pr = V({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function gr(e) {
-	e.add(Un).add(Kn).add(qn).add(Jn).add(Yn).add($n).add(er).add(Y).add(lr).add(pr).add(mr).add(hr);
+function Sr(e) {
+	e.add(Gn).add(Jn).add(Yn).add(Xn).add(Zn).add(tr).add(nr).add(ur).add(mr).add(yr).add(br).add(xr);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
-function _r(e) {
+function Z(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function vr(e, t) {
+function Cr(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -2929,13 +2971,13 @@ function vr(e, t) {
 	}
 	return !1;
 }
-function yr(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => vr(e, t));
+function wr(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => Cr(e, t));
 }
-function br(e) {
+function Tr(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !yr(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r && !wr(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -2952,7 +2994,7 @@ function br(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var xr = [
+var Er = [
 	"GET",
 	"POST",
 	"PUT",
@@ -2961,130 +3003,168 @@ var xr = [
 	"OPTIONS",
 	"HEAD"
 ];
-function Sr(e, n, r) {
+function Dr(e, n, r) {
 	let i = new t();
 	r && i.use("*", async (e, t) => {
-		Ln(e, r), await t();
+		Bn(e, r), await t();
 	});
-	let a = _r(e);
+	let a = Z(e);
 	for (let e of a) {
 		let t = [];
-		t.push(br(e.match));
+		t.push(Tr(e.match));
 		for (let r of e.handlers) t.push(n.build(r.type, r.options));
-		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : xr, a = e.match.path || "/*";
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : Er, a = e.match.path || "/*";
 		i.on(r, [a], ...t);
 	}
-	return i.all("*", (e) => e.text("No matching route", 404)), i;
+	return i.all("*", (e) => e.text("No matching route", 404)), i.onError((e, t) => {
+		let n = q(e);
+		return t.text(n ? "Upstream timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "handler_timeout" : "handler_failed" });
+	}), i;
 }
 //#endregion
 //#region src/data-plane/router.ts
-function Cr(e) {
-	return e.resolver ? e.resolver : e.cache ? z(e.data, e.cache) : z(e.data, e.cacheTtlMs ?? 3e4);
+var Or = 5e3;
+function kr(e) {
+	return e.resolver ? e.resolver : e.cache ? F(e.data, e.cache) : F(e.data, e.cacheTtlMs ?? 3e4);
 }
-function wr(e) {
+function Ar(e) {
 	if (e.registry) return e.registry;
-	let t = new B(e.bindings ?? {});
-	return gr(t), t;
+	let t = new I(e.bindings ?? {});
+	return Sr(t), t;
 }
-function Z(e) {
-	let t = Cr(e), n = wr(e), r = /* @__PURE__ */ new WeakMap();
+function Q(e) {
+	let t = kr(e), n = Ar(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? Or;
 	return async (e) => {
-		let i = e.req.header("host") ?? e.req.header("x-forwarded-host");
-		if (!i) return e.text("Missing host", 400);
-		let a = await t.resolveHost(i);
-		if (!a) return e.text("Unknown host", 404);
-		let o = r.get(a);
-		return o || (o = Sr(a.routes, n, {
-			tenant_id: a.tenant_id,
-			custom_domain_id: a.custom_domain_id,
-			domain: a.domain
-		}), r.set(a, o)), o.fetch(e.req.raw);
+		let a = e.req.header("host") ?? e.req.header("x-forwarded-host");
+		if (!a) return e.text("Missing host", 400);
+		try {
+			let o = await Y(t.resolveHost(a), i, "resolveHost");
+			if (!o) return e.text("Unknown host", 404);
+			let s = r.get(o);
+			return s || (s = Dr(o.routes, n, {
+				tenant_id: o.tenant_id,
+				custom_domain_id: o.custom_domain_id,
+				domain: o.domain
+			}), r.set(o, s)), await s.fetch(e.req.raw);
+		} catch (t) {
+			return q(t) ? e.text(`Resolve host timed out after ${i}ms`, 504, { "x-authhero-proxy-error": "resolve_host_timeout" }) : e.text("Bad gateway", 502, { "x-authhero-proxy-error": "data_plane_error" });
+		}
 	};
 }
-function Tr(e) {
+function jr(e) {
 	let n = new t();
-	return n.all("*", Z(e)), n;
+	return n.all("*", Q(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function Er(e) {
+function Mr(e) {
 	let n = new t();
-	return n.all("*", Z({
+	return n.all("*", Q({
 		data: e.data,
 		cacheTtlMs: e.cacheTtlMs,
 		cache: e.cache,
 		resolver: e.resolver,
 		registry: e.registry,
-		bindings: e.bindings
-	})), n;
+		bindings: e.bindings,
+		resolveHostTimeoutMs: e.resolveHostTimeoutMs
+	})), n.onError((e, t) => {
+		let n = q(e);
+		return t.text(n ? "Proxy timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "proxy_timeout" : "proxy_error" });
+	}), n;
 }
 //#endregion
 //#region src/data-plane/cache-api-cache.ts
-function Q(e, t) {
+var Nr = 1e3, Pr = 1e3;
+function Fr(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function Dr() {
+function Ir() {
 	return globalThis.caches?.default;
 }
-function Or(e) {
-	let t = e.cache ?? Dr();
+function Lr(e) {
+	let t = e.cache ?? Ir();
 	if (!t) return e.upstream;
-	let n = e.namespace ?? "authhero-proxy", r = e.cacheTtlSeconds ?? 60, i = e.negativeCacheTtlSeconds ?? 10, a = e.waitUntil;
-	return { async resolveHost(o) {
-		let s = Q(n, o), c = await t.match(s);
-		if (c) try {
-			return (await c.json()).value;
+	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? Nr, c = e.cacheWriteTimeoutMs ?? Pr;
+	async function l(e) {
+		try {
+			return await Y(Promise.resolve(n.match(e)), s, "cache.match");
+		} catch {
+			return;
+		}
+	}
+	return { async resolveHost(t) {
+		let s = Fr(r, t), u = await l(s);
+		if (u) try {
+			return (await u.json()).value;
 		} catch {}
-		let l = await e.upstream.resolveHost(o), u = l === null ? i : r, d = new Response(JSON.stringify({ value: l }), { headers: {
+		let d = await e.upstream.resolveHost(t), f = d === null ? a : i, p = new Response(JSON.stringify({ value: d }), { headers: {
 			"content-type": "application/json",
-			"cache-control": `public, max-age=${u}`
-		} }), f = t.put(s, d);
-		return a ? a(f) : await f.catch(() => void 0), l;
+			"cache-control": `public, max-age=${f}`
+		} }), m = Y(Promise.resolve(n.put(s, p)), c, "cache.put").catch(() => void 0);
+		return o ? o(m) : await m, d;
 	} };
 }
-function kr(e, t) {
-	return Q(e, t);
+function Rr(e, t) {
+	return Fr(e, t);
 }
 //#endregion
 //#region src/data-plane/cache-adapter-cache.ts
-function Ar(e) {
-	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, negativeTtlMs: a = r, keyPrefix: o = "authhero-proxy-host", waitUntil: s } = e, c = /* @__PURE__ */ new Map();
-	function l(e) {
-		return `${o}:${e.toLowerCase()}`;
+var zr = 1e3, Br = 1e3;
+function Vr(e) {
+	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = zr, cacheWriteTimeoutMs: u = Br } = e, d = /* @__PURE__ */ new Map();
+	function f(e) {
+		return `${s}:${e.toLowerCase()}`;
+	}
+	async function p(e) {
+		try {
+			return await Y(n.get(e), l, "cache.get") ?? null;
+		} catch {
+			return null;
+		}
+	}
+	function m(e, t, r) {
+		let i = Y(Promise.resolve().then(() => n.set(e, t, r)), u, "cache.set").catch(() => void 0);
+		return c ? (c(i), Promise.resolve()) : i;
 	}
-	async function u(e) {
-		let o = c.get(e);
-		if (o) return o;
+	async function h(e) {
+		let n = d.get(e);
+		if (n) return n;
 		let s = (async () => {
 			try {
-				let o = await t.resolveHost(e), s = Date.now(), c = o === null ? a : r, u = o === null ? 0 : i, d = {
-					value: o,
+				let n = await t.resolveHost(e), s = Date.now(), c = n === null ? o : r, l = n === null ? 0 : i, u = n === null ? 0 : a, d = {
+					value: n,
 					freshUntilMs: s + c,
-					staleUntilMs: s + c + u
-				}, f = Math.max(1, Math.ceil((c + u) / 1e3));
-				return await n.set(l(e), d, f), o;
+					staleUntilMs: s + c + l,
+					staleIfErrorUntilMs: s + c + l + u
+				}, p = Math.max(1, Math.ceil((c + l + u) / 1e3));
+				return await m(f(e), d, p), n;
 			} finally {
-				c.delete(e);
+				d.delete(e);
 			}
 		})();
-		return c.set(e, s), s;
+		return d.set(e, s), s;
 	}
 	return { async resolveHost(e) {
-		let t = l(e), r = await n.get(t), i = Date.now();
-		if (r && typeof r.freshUntilMs == "number") {
-			if (r.freshUntilMs > i) return r.value;
-			if (r.staleUntilMs > i) {
-				if (!c.has(e)) {
-					let t = u(e).catch(() => void 0);
-					s && s(t);
+		let t = await p(f(e)), n = Date.now();
+		if (t && typeof t.freshUntilMs == "number") {
+			if (t.freshUntilMs > n) return t.value;
+			if (t.staleUntilMs > n) {
+				if (!d.has(e)) {
+					let t = h(e).catch(() => void 0);
+					c && c(t);
 				}
-				return r.value;
+				return t.value;
 			}
 		}
-		return u(e);
+		try {
+			return await h(e);
+		} catch (e) {
+			if (t && (t.staleIfErrorUntilMs ?? t.staleUntilMs) > n) return t.value;
+			throw e;
+		}
 	} };
 }
-function jr(e, t) {
+function Hr(e, t) {
 	return `${e}:${t.toLowerCase()}`;
 }
 //#endregion
@@ -3092,7 +3172,7 @@ function jr(e, t) {
 function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function Mr(e, t, n, r, i, a) {
+function Ur(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -3107,10 +3187,10 @@ function Mr(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function Nr(e) {
+function Wr(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => Mr(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => Ur(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3154,7 +3234,7 @@ function Nr(e) {
 		}
 	};
 }
-function Pr(e, t = {}) {
+function Gr(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3169,10 +3249,10 @@ function Pr(e, t = {}) {
 }
 //#endregion
 //#region src/constants.ts
-var Fr = "proxy:resolve_host";
+var Kr = "proxy:resolve_host";
 //#endregion
 //#region src/http-adapter/index.ts
-function Ir() {
+function qr() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3194,7 +3274,7 @@ function Ir() {
 		}
 	};
 }
-function Lr(e) {
+function Jr(e) {
 	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.scope ?? "proxy:resolve_host", o = e.tokenRefreshSkewSeconds ?? 60, s = e.timeoutMs ?? 5e3;
 	function c(e) {
 		let t = new AbortController(), n = setTimeout(() => t.abort(), s);
@@ -3227,7 +3307,7 @@ function Lr(e) {
 		}), u);
 	}
 	return {
-		proxyRoutes: Ir(),
+		proxyRoutes: qr(),
 		async resolveHost(e) {
 			let i = await f(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await c((e) => t(a, {
 				headers: { authorization: `Bearer ${i}` },
@@ -3240,4 +3320,4 @@ function Lr(e) {
 	};
 }
 //#endregion
-export { B as HandlerRegistry, Fr as PROXY_RESOLVE_HOST_SCOPE, Kn as basicAuthHandler, jr as buildCacheAdapterKey, kr as buildCacheApiKey, br as buildMatchFilter, Jn as cacheHandler, Sr as compileHostApp, Un as corsHandler, Ar as createCacheAdapterHostCache, Or as createCacheApiHostCache, Lr as createHttpProxyAdapter, z as createInMemoryHostCache, Er as createProxyApp, Z as createProxyDataPlaneHandler, Tr as createProxyDataPlaneRouter, Nr as createStaticProxyAdapter, V as defineHandler, pr as dispatchNamespaceHandler, Yn as forwardedHeadersHandler, F as handlerConfigSchema, qn as headersHandler, Y as httpHandler, Pr as httpRoute, P as matchSchema, yr as matchesAnyHost, vr as matchesHost, I as proxyRouteInsertSchema, mn as proxyRouteSchema, hn as proxyRouteUpdateSchema, mr as redirectHandler, gr as registerBuiltinHandlers, $n as rewriteCookiesHandler, er as rewriteLocationHandler, lr as serviceBindingHandler, _r as sortRoutes, hr as staticHandler };
+export { I as HandlerRegistry, Kr as PROXY_RESOLVE_HOST_SCOPE, Jn as basicAuthHandler, Hr as buildCacheAdapterKey, Rr as buildCacheApiKey, Tr as buildMatchFilter, Xn as cacheHandler, Dr as compileHostApp, Gn as corsHandler, Vr as createCacheAdapterHostCache, Lr as createCacheApiHostCache, Jr as createHttpProxyAdapter, F as createInMemoryHostCache, Mr as createProxyApp, Q as createProxyDataPlaneHandler, jr as createProxyDataPlaneRouter, Wr as createStaticProxyAdapter, L as defineHandler, yr as dispatchNamespaceHandler, Zn as forwardedHeadersHandler, _n as handlerConfigSchema, Yn as headersHandler, ur as httpHandler, Gr as httpRoute, gn as matchSchema, wr as matchesAnyHost, Cr as matchesHost, M as proxyRouteInsertSchema, vn as proxyRouteSchema, yn as proxyRouteUpdateSchema, br as redirectHandler, Sr as registerBuiltinHandlers, tr as rewriteCookiesHandler, nr as rewriteLocationHandler, mr as serviceBindingHandler, Z as sortRoutes, xr as staticHandler };