@authhero/proxy 0.8.1 → 0.8.3

package/dist/proxy.mjs

@@ -1944,7 +1944,97 @@ e.object({
 }).extend(fn.shape).extend({
 	id: e.string(),
 	is_control_plane: e.boolean().optional()
-}), e.object({
+});
+var pn = e.enum([
+	"provision",
+	"seed",
+	"upgrade",
+	"backup",
+	"deprovision"
+]), mn = e.enum([
+	"pending",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled"
+]), hn = e.enum(["inline", "cloudflare-workflows"]);
+e.object({
+	tenant_id: e.string().max(255).nullable().default(null),
+	rollout_id: e.string().max(255).nullable().optional(),
+	kind: pn,
+	engine: hn,
+	engine_instance_id: e.string().max(100).nullable().optional(),
+	target_worker_version: e.string().max(255).nullable().optional(),
+	target_database_version: e.string().max(255).nullable().optional(),
+	initiated_by: e.string().max(255).nullable().optional()
+}).extend({
+	id: e.string(),
+	status: mn,
+	current_step: e.string().max(255).nullable().optional(),
+	error: e.string().nullable().optional(),
+	created_at: e.string(),
+	updated_at: e.string(),
+	finished_at: e.string().nullable().optional()
+}).pick({
+	status: !0,
+	current_step: !0,
+	engine_instance_id: !0,
+	target_worker_version: !0,
+	target_database_version: !0,
+	error: !0,
+	finished_at: !0
+}).partial();
+var gn = e.enum([
+	"started",
+	"succeeded",
+	"failed",
+	"retried",
+	"skipped",
+	"reconciled"
+]);
+e.object({
+	operation_id: e.string().max(255),
+	step: e.string().max(255),
+	outcome: gn,
+	detail: e.record(e.string(), e.unknown()).nullable().optional(),
+	attempt: e.number().int().min(1).default(1)
+}).extend({
+	id: e.string(),
+	created_at: e.string()
+});
+var _n = e.enum([
+	"upgrade",
+	"reseed",
+	"backup"
+]), vn = e.enum([
+	"pending",
+	"canary",
+	"rolling",
+	"paused",
+	"done",
+	"failed"
+]);
+e.object({
+	kind: _n,
+	target_worker_version: e.string().max(255).nullable().optional(),
+	target_database_version: e.string().max(255).nullable().optional(),
+	wave_size: e.number().int().min(1).default(10),
+	canary_tenant_ids: e.array(e.string()).nullable().optional(),
+	filter: e.record(e.string(), e.unknown()).nullable().optional(),
+	initiated_by: e.string().max(255).nullable().optional()
+}).extend({
+	id: e.string(),
+	status: vn,
+	created_at: e.string(),
+	updated_at: e.string(),
+	finished_at: e.string().nullable().optional()
+}).pick({
+	status: !0,
+	wave_size: !0,
+	canary_tenant_ids: !0,
+	filter: !0,
+	finished_at: !0
+}).partial(), e.object({
 	access_token: e.string(),
 	id_token: e.string().optional(),
 	scope: e.string().optional(),
@@ -1956,7 +2046,7 @@ e.object({
 	code: e.string(),
 	state: e.string().optional()
 });
-var pn = e.object({
+var yn = e.object({
 	button_border_radius: e.number(),
 	button_border_weight: e.number(),
 	buttons_style: e.enum([
@@ -1974,7 +2064,7 @@ var pn = e.object({
 	show_widget_shadow: e.boolean(),
 	widget_border_weight: e.number(),
 	widget_corner_radius: e.number()
-}), mn = e.object({
+}), bn = e.object({
 	base_focus_color: e.string(),
 	base_hover_color: e.string(),
 	body_text: e.string(),
@@ -2001,7 +2091,7 @@ var pn = e.object({
 }), A = e.object({
 	bold: e.boolean(),
 	size: e.number()
-}), hn = e.object({
+}), xn = e.object({
 	body_text: A,
 	buttons_text: A,
 	font_url: e.string(),
@@ -2011,7 +2101,7 @@ var pn = e.object({
 	reference_text_size: e.number(),
 	subtitle: A,
 	title: A
-}), gn = e.object({
+}), Sn = e.object({
 	background_color: e.string(),
 	background_image_url: e.string(),
 	page_layout: e.enum([
@@ -2024,7 +2114,7 @@ var pn = e.object({
 		"chip",
 		"none"
 	]).optional()
-}), _n = e.object({
+}), Cn = e.object({
 	header_text_alignment: e.enum([
 		"center",
 		"left",
@@ -2041,39 +2131,39 @@ var pn = e.object({
 	social_buttons_layout: e.enum(["bottom", "top"])
 });
 e.object({
-	borders: pn,
-	colors: mn,
+	borders: yn,
+	colors: bn,
 	displayName: e.string(),
-	fonts: hn,
-	page_background: gn,
-	widget: _n
+	fonts: xn,
+	page_background: Sn,
+	widget: Cn
 }).extend({ themeId: e.string() }), e.object({
 	universal_login_experience: e.enum(["new", "classic"]).default("new"),
 	identifier_first: e.boolean().default(!0),
 	password_first: e.boolean().default(!1),
 	webauthn_platform_first_factor: e.boolean()
 });
-var vn = e.object({
+var wn = e.object({
 	hosts: e.array(e.string()).optional(),
 	methods: e.array(e.string()).optional(),
 	path: e.string().default("/*"),
 	headers: e.record(e.string(), e.string()).optional(),
 	query: e.record(e.string(), e.string()).optional()
-}), yn = e.object({
+}), Tn = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
 }), j = e.object({
 	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
-	match: vn,
-	handlers: e.array(yn).min(1)
-}), bn = j.extend({
+	match: wn,
+	handlers: e.array(Tn).min(1)
+}), En = j.extend({
 	id: e.string(),
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), xn = j.partial().omit({
+}), Dn = j.partial().omit({
 	id: !0,
 	custom_domain_id: !0
 });
@@ -2084,7 +2174,7 @@ e.object({
 	credentials: e.record(e.string(), e.unknown()),
 	settings: e.object({}).optional()
 });
-var Sn = e.enum([
+var On = e.enum([
 	"verify_email",
 	"verify_email_by_code",
 	"reset_email",
@@ -2099,7 +2189,7 @@ var Sn = e.enum([
 	"user_invitation"
 ]);
 e.object({
-	template: Sn,
+	template: On,
 	body: e.string(),
 	from: e.string(),
 	subject: e.string(),
@@ -2137,10 +2227,10 @@ e.object({
 	name: e.string(),
 	options: e.object({})
 });
-var Cn = e.object({
+var kn = e.object({
 	value: e.string(),
 	description: e.string().optional()
-}), wn = e.object({
+}), An = e.object({
 	token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
 	enforce_policies: e.boolean().optional(),
 	allow_skipping_userinfo: e.boolean().optional(),
@@ -2148,11 +2238,11 @@ var Cn = e.object({
 	persist_client_authorization: e.boolean().optional(),
 	enable_introspection_endpoint: e.boolean().optional(),
 	mtls: e.object({ bound_access_tokens: e.boolean().optional() }).optional()
-}), Tn = e.object({
+}), jn = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	identifier: e.string(),
-	scopes: e.array(Cn).optional(),
+	scopes: e.array(kn).optional(),
 	signing_alg: e.string().optional(),
 	signing_secret: e.string().optional(),
 	token_lifetime: e.number().default(86400),
@@ -2160,20 +2250,20 @@ var Cn = e.object({
 	skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
 	allow_offline_access: e.boolean().optional(),
 	verificationKey: e.string().optional(),
-	options: wn.optional(),
+	options: An.optional(),
 	is_system: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional()
 }).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Tn);
-var En = e.object({
+e.array(jn);
+var Mn = e.object({
 	role_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string()
 }).extend({ created_at: e.string() });
-e.array(En), e.object({
+e.array(Mn), e.object({
 	user_id: e.string().openapi({ description: "The id of the user that granted the consent" }),
 	clientID: e.string().openapi({ description: "The id of the client the grant was issued to" }),
 	audience: e.string().optional().openapi({ description: "The audience the grant applies to" }),
@@ -2186,7 +2276,7 @@ e.array(En), e.object({
 	failed_logins: e.array(e.string()).optional(),
 	last_password_reset: e.string().optional()
 });
-var Dn = e.object({
+var Nn = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string(),
@@ -2195,8 +2285,8 @@ var Dn = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Dn);
-var On = e.object({
+e.array(Nn);
+var Pn = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	resource_server_name: e.string(),
@@ -2205,8 +2295,8 @@ var On = e.object({
 	created_at: e.string().optional(),
 	organization_id: e.string().optional()
 });
-e.array(On);
-var kn = e.object({
+e.array(Pn);
+var Fn = e.object({
 	user_id: e.string(),
 	role_id: e.string(),
 	organization_id: e.string().optional()
@@ -2214,8 +2304,8 @@ var kn = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(kn);
-var An = e.object({
+e.array(Fn);
+var In = e.object({
 	id: e.string().optional().openapi({ description: "The unique identifier of the role. If not provided, one will be generated." }),
 	name: e.string().min(1).max(50).openapi({ description: "The name of the role. Cannot include '<' or '>'" }),
 	description: e.string().max(255).optional().openapi({ description: "The description of the role" }),
@@ -2226,19 +2316,19 @@ var An = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(An);
-var jn = e.object({
+e.array(In);
+var Ln = e.object({
 	logo_url: e.string().optional().openapi({ description: "URL of the organization's logo" }),
 	colors: e.object({
 		primary: e.string().optional().openapi({ description: "Primary color in hex format (e.g., #FF0000)" }),
 		page_background: e.string().optional().openapi({ description: "Page background color in hex format (e.g., #FFFFFF)" })
 	}).optional()
-}).optional(), Mn = e.object({
+}).optional(), Rn = e.object({
 	connection_id: e.string().openapi({ description: "ID of the connection" }),
 	assign_membership_on_login: e.boolean().default(!1).openapi({ description: "Whether to assign membership to the organization on login" }),
 	show_as_button: e.boolean().default(!0).openapi({ description: "Whether to show this connection as a button in the login screen" }),
 	is_signup_enabled: e.boolean().default(!0).openapi({ description: "Whether signup is enabled for this connection" })
-}), Nn = e.object({ client_credentials: e.object({
+}), zn = e.object({ client_credentials: e.object({
 	enforce: e.boolean().default(!1).openapi({ description: "Whether to enforce token quota limits" }),
 	per_day: e.number().min(0).default(0).openapi({ description: "Maximum tokens per day (0 = unlimited)" }),
 	per_hour: e.number().min(0).default(0).openapi({ description: "Maximum tokens per hour (0 = unlimited)" })
@@ -2247,15 +2337,15 @@ e.object({
 	id: e.string().optional(),
 	name: e.string().min(1).regex(/^[a-z0-9_-]+$/, { message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores" }).openapi({ description: "The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores." }),
 	display_name: e.string().optional().openapi({ description: "The display name of the organization" }),
-	branding: jn,
+	branding: Ln,
 	metadata: e.record(e.string(), e.any()).default({}).optional().openapi({ description: "Custom metadata for the organization" }),
-	enabled_connections: e.array(Mn).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
-	token_quota: Nn
+	enabled_connections: e.array(Rn).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
+	token_quota: zn
 }).extend(n.shape).extend({
 	id: e.string(),
 	name: e.string().min(1).openapi({ description: "The name of the organization" })
 });
-var Pn = e.object({
+var Bn = e.object({
 	connection_id: e.string().openapi({ description: "ID of the tenant-level connection to enable for the org." }),
 	assign_membership_on_login: e.boolean().optional().default(!1),
 	show_as_button: e.boolean().optional().default(!0),
@@ -2268,7 +2358,7 @@ var Pn = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Pn), e.object({
+e.array(Bn), e.object({
 	user_id: e.string().openapi({ description: "ID of the user" }),
 	organization_id: e.string().openapi({ description: "ID of the organization" })
 }).extend(n.shape).extend({ id: e.string() }), e.object({
@@ -2386,6 +2476,7 @@ e.array(Pn), e.object({
 	"sessions",
 	"logouts",
 	"password-changes",
+	"password-migrations",
 	"mfa",
 	"email-verifications",
 	"codes-sent"
@@ -2406,22 +2497,22 @@ e.array(Pn), e.object({
 	"passwordless",
 	"enterprise"
 ]);
-var Fn = e.object({
+var Vn = e.object({
 	name: e.string(),
 	type: e.string()
-}), In = e.object({
+}), Hn = e.object({
 	elapsed: e.number(),
 	rows_read: e.number().optional(),
 	bytes_read: e.number().optional()
 });
 e.object({
-	meta: e.array(Fn),
+	meta: e.array(Vn),
 	data: e.array(e.record(e.string(), e.any())),
 	rows: e.number(),
 	rows_before_limit_at_least: e.number().optional(),
-	statistics: In.optional()
+	statistics: Hn.optional()
 });
-var Ln = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Rn = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+var Un = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Wn = e.record(e.string(), e.record(e.string(), e.string())).openapi({
 	type: "object",
 	additionalProperties: {
 		type: "object",
@@ -2429,11 +2520,11 @@ var Ln = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.
 	}
 });
 e.object({
-	prompt: Ln,
+	prompt: Un,
 	language: e.string(),
-	custom_text: Rn
+	custom_text: Wn
 });
-var zn = e.enum([
+var Gn = e.enum([
 	"phone",
 	"totp",
 	"email",
@@ -2443,7 +2534,7 @@ var zn = e.enum([
 	"passkey"
 ]), M = e.object({
 	user_id: e.string(),
-	type: zn,
+	type: Gn,
 	phone_number: e.string().optional(),
 	totp_secret: e.string().optional(),
 	credential_id: e.string().optional(),
@@ -2488,12 +2579,12 @@ M.superRefine(N), M.extend({
 });
 //#endregion
 //#region src/data-plane/cache.ts
-var Bn = 1e4;
+var Kn = 1e4;
 function P(e, t, n) {
 	let r = typeof t == "number" ? {
 		freshTtlMs: t,
 		maxEntries: n
-	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? Bn, l = r.waitUntil, u = /* @__PURE__ */ new Map();
+	} : t, i = r.freshTtlMs, a = r.staleTtlMs ?? 0, o = r.staleIfErrorTtlMs ?? 0, s = r.negativeTtlMs ?? i, c = r.maxEntries ?? Kn, l = r.waitUntil, u = /* @__PURE__ */ new Map();
 	function d(e) {
 		for (let [t, n] of u) n.stale_if_error_until <= e && n.stale_until <= e && !n.refreshing && u.delete(t);
 		for (; u.size >= c;) {
@@ -2576,27 +2667,27 @@ function I(e) {
 //#endregion
 //#region src/data-plane/handlers/util.ts
 var L = "__authhero_proxy_request__", R = "__authhero_proxy_tenant_id__", z = "__authhero_proxy_custom_domain_id__", B = "__authhero_proxy_domain__", V = "x-authhero-proxy-mutability-probe";
-function Vn(e, t) {
+function qn(e, t) {
 	e.set(L, t);
 }
 function H(e) {
 	return e.get(L) ?? e.req.raw;
 }
-function Hn(e, t) {
+function Jn(e, t) {
 	e.set(R, t.tenant_id), e.set(z, t.custom_domain_id), e.set(B, t.domain);
 }
-function Un(e) {
+function Yn(e) {
 	return e.get(R);
 }
-function Wn(e) {
+function Xn(e) {
 	return e.get(z);
 }
-function Gn(e) {
+function Zn(e) {
 	return e.get(B);
 }
 function U(e, t) {
 	let n = H(e), r = new Headers(n.headers);
-	t(r), Vn(e, new Request(n, { headers: r }));
+	t(r), qn(e, new Request(n, { headers: r }));
 }
 function W(e) {
 	let t = e.res;
@@ -2613,7 +2704,7 @@ function W(e) {
 }
 //#endregion
 //#region src/data-plane/handlers/cors.ts
-var Kn = e.object({
+var Qn = e.object({
 	origins: e.array(e.string()).optional(),
 	allow_credentials: e.boolean().optional(),
 	allow_headers: e.array(e.string()).optional(),
@@ -2625,9 +2716,9 @@ function G(e, t) {
 	let n = new Headers(), r = e.origins ?? ["*"], i = r.includes("*");
 	return i && !e.allow_credentials ? n.set("Access-Control-Allow-Origin", "*") : t && (i || r.includes(t)) && (n.set("Access-Control-Allow-Origin", t), n.append("Vary", "Origin")), e.allow_credentials && n.set("Access-Control-Allow-Credentials", "true"), e.allow_methods?.length && n.set("Access-Control-Allow-Methods", e.allow_methods.join(", ")), e.allow_headers?.length && n.set("Access-Control-Allow-Headers", e.allow_headers.join(", ")), e.expose_headers?.length && n.set("Access-Control-Expose-Headers", e.expose_headers.join(", ")), e.max_age !== void 0 && n.set("Access-Control-Max-Age", String(e.max_age)), n;
 }
-var qn = I({
+var $n = I({
 	type: "cors",
-	optionsSchema: Kn,
+	optionsSchema: Qn,
 	build(e) {
 		return async (t, n) => {
 			let r = t.req.header("origin") ?? null;
@@ -2645,20 +2736,20 @@ var qn = I({
 			});
 		};
 	}
-}), Jn = e.object({
+}), er = e.object({
 	username: e.string(),
 	password: e.string(),
 	realm: e.string().optional()
 });
-function Yn(e, t) {
+function tr(e, t) {
 	let n = `${e}:${t}`;
 	return typeof btoa == "function" ? btoa(n) : Buffer.from(n, "utf-8").toString("base64");
 }
-var Xn = I({
+var nr = I({
 	type: "basic_auth",
-	optionsSchema: Jn,
+	optionsSchema: er,
 	build(e) {
-		let t = Yn(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
+		let t = tr(e.username, e.password), n = (e.realm ?? "Restricted").replace(/["\\\r\n]/g, "");
 		return async (e, r) => {
 			let i = e.req.header("authorization");
 			if (i) {
@@ -2674,7 +2765,7 @@ var Xn = I({
 			});
 		};
 	}
-}), Zn = I({
+}), rr = I({
 	type: "headers",
 	optionsSchema: e.object({
 		request: e.record(e.string(), e.string()).optional(),
@@ -2689,7 +2780,7 @@ var Xn = I({
 			}), await n(), (e.response || e.remove_response) && (W(t), e.remove_response?.forEach((e) => t.res.headers.delete(e)), e.response)) for (let [n, r] of Object.entries(e.response)) t.res.headers.set(n, r);
 		};
 	}
-}), Qn = I({
+}), ir = I({
 	type: "cache",
 	optionsSchema: e.object({ ttl_seconds: e.number().int().positive() }),
 	build(e) {
@@ -2700,7 +2791,7 @@ var Xn = I({
 			}
 		};
 	}
-}), $n = I({
+}), ar = I({
 	type: "forwarded_headers",
 	optionsSchema: e.object({
 		client_ip_header: e.string().default("cf-connecting-ip"),
@@ -2717,33 +2808,33 @@ var Xn = I({
 			}), await n();
 		};
 	}
-}), er = e.object({ upstream_host: e.string().optional() });
-function tr(e) {
+}), or = e.object({ upstream_host: e.string().optional() });
+function sr(e) {
 	return e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function nr(e) {
+function cr(e) {
 	if (typeof e.getSetCookie == "function") return e.getSetCookie();
 	let t = [];
 	return e.forEach((e, n) => {
 		n.toLowerCase() === "set-cookie" && t.push(e);
 	}), t;
 }
-var rr = I({
+var lr = I({
 	type: "rewrite_cookies",
-	optionsSchema: er,
+	optionsSchema: or,
 	build(e) {
 		return async (t, n) => {
 			await n();
 			let r = new URL(t.req.url).hostname, i = e.upstream_host ?? t.get("__proxy_upstream_host__");
 			if (!i) return;
-			let a = nr(t.res.headers);
+			let a = cr(t.res.headers);
 			if (a.length === 0) return;
-			let o = tr(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
+			let o = sr(i), s = RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`, "i");
 			W(t), t.res.headers.delete("set-cookie");
 			for (let e of a) t.res.headers.append("set-cookie", e.replace(s, `Domain=${r}`));
 		};
 	}
-}), ir = I({
+}), ur = I({
 	type: "rewrite_location",
 	optionsSchema: e.object({ upstream_origin: e.string().optional() }),
 	build(e) {
@@ -2766,14 +2857,14 @@ var rr = I({
 			W(t), t.res.headers.set("location", c);
 		};
 	}
-}), ar = class extends Error {
+}), dr = class extends Error {
 	ms;
 	constructor(e, t) {
 		super(`${t ?? "Operation"} timed out after ${e}ms`), this.name = "TimeoutError", this.ms = e;
 	}
 };
 function K(e) {
-	return e instanceof ar ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
+	return e instanceof dr ? !0 : e instanceof Error ? e.name === "AbortError" || e.name === "TimeoutError" : !1;
 }
 function q(e, t) {
 	let n = new AbortController(), r = setTimeout(() => n.abort(), e);
@@ -2781,7 +2872,7 @@ function q(e, t) {
 }
 function J(e, t, n) {
 	let r, i = new Promise((e, i) => {
-		r = setTimeout(() => i(new ar(t, n)), t);
+		r = setTimeout(() => i(new dr(t, n)), t);
 	});
 	return Promise.race([e, i]).finally(() => {
 		r && clearTimeout(r);
@@ -2789,7 +2880,7 @@ function J(e, t, n) {
 }
 //#endregion
 //#region src/data-plane/handlers/http.ts
-var or = /* @__PURE__ */ new Set([
+var fr = /* @__PURE__ */ new Set([
 	"connection",
 	"keep-alive",
 	"proxy-authenticate",
@@ -2798,24 +2889,24 @@ var or = /* @__PURE__ */ new Set([
 	"trailers",
 	"transfer-encoding",
 	"upgrade"
-]), sr = 3e4, cr = e.object({
+]), pr = 3e4, mr = e.object({
 	upstream_url: e.string(),
 	preserve_host: e.boolean().default(!1),
 	timeout_ms: e.number().int().positive().optional()
 });
-function lr(e, t) {
+function hr(e, t) {
 	return e === "" || e === "/" ? t : `${e.endsWith("/") ? e.slice(0, -1) : e}${t.startsWith("/") ? t : `/${t}`}`;
 }
-function ur(e) {
+function gr(e) {
 	return e !== "GET" && e !== "HEAD";
 }
-function dr(e, t) {
+function _r(e, t) {
 	let n = new URL(t.url), r = new URL(e.upstream_url);
-	r.pathname = lr(r.pathname, n.pathname), r.search = n.search;
+	r.pathname = hr(r.pathname, n.pathname), r.search = n.search;
 	let i = new Headers(t.headers);
-	for (let e of or) i.delete(e);
+	for (let e of fr) i.delete(e);
 	e.preserve_host || i.set("host", r.host), i.has("x-forwarded-host") || i.set("x-forwarded-host", n.host), i.has("x-forwarded-proto") || i.set("x-forwarded-proto", n.protocol.replace(":", ""));
-	let a = ur(t.method) ? t.body : void 0, o = {
+	let a = gr(t.method) ? t.body : void 0, o = {
 		method: t.method,
 		headers: i,
 		body: a,
@@ -2826,13 +2917,13 @@ function dr(e, t) {
 		init: o
 	};
 }
-var fr = I({
+var vr = I({
 	type: "http",
-	optionsSchema: cr,
+	optionsSchema: mr,
 	build(e) {
-		let t = e.timeout_ms ?? sr;
+		let t = e.timeout_ms ?? pr;
 		return async (n) => {
-			let { target: r, init: i } = dr(e, H(n));
+			let { target: r, init: i } = _r(e, H(n));
 			n.set("__proxy_upstream_host__", r.hostname), n.set("__proxy_upstream_origin__", `${r.protocol}//${r.host}`);
 			try {
 				return await q(t, (e) => fetch(r.toString(), {
@@ -2844,24 +2935,24 @@ var fr = I({
 			}
 		};
 	}
-}), pr = 3e4, mr = e.object({
+}), yr = 3e4, br = e.object({
 	binding: e.string(),
 	upstream_url: e.string().optional(),
 	preserve_host: e.boolean().default(!0),
 	timeout_ms: e.number().int().positive().optional()
 });
-function hr(e) {
+function xr(e) {
 	return typeof e == "object" && !!e && typeof e.fetch == "function";
 }
-var gr = I({
+var Sr = I({
 	type: "service_binding",
-	optionsSchema: mr,
+	optionsSchema: br,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!hr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
-		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? pr;
+		if (!xr(n)) throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);
+		let r = e.upstream_url ?? `https://${e.binding}.binding.invalid/`, i = e.timeout_ms ?? yr;
 		return async (t) => {
-			let a = H(t), { target: o, init: s } = dr({
+			let a = H(t), { target: o, init: s } = _r({
 				upstream_url: r,
 				preserve_host: e.preserve_host
 			}, a);
@@ -2876,34 +2967,34 @@ var gr = I({
 			}
 		};
 	}
-}), _r = 3e4, vr = e.object({
+}), Cr = 3e4, wr = e.object({
 	binding: e.string(),
 	script_name: e.string(),
 	cpu_ms: e.number().int().positive().optional(),
 	subrequests: e.number().int().positive().optional(),
 	timeout_ms: e.number().int().positive().optional()
 });
-function yr(e) {
+function Tr(e) {
 	return typeof e == "object" && !!e && typeof e.get == "function";
 }
 var Y = /\{(tenant_id|custom_domain_id|domain|host)\}/g;
-function br(e) {
+function Er(e) {
 	return Y.lastIndex = 0, Y.test(e);
 }
-var xr = I({
+var Dr = I({
 	type: "dispatch_namespace",
-	optionsSchema: vr,
+	optionsSchema: wr,
 	build(e, t) {
 		let n = t.bindings[e.binding];
-		if (!yr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
-		let r = br(e.script_name), i = e.timeout_ms ?? _r, a = e.cpu_ms || e.subrequests ? { limits: {
+		if (!Tr(n)) throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);
+		let r = Er(e.script_name), i = e.timeout_ms ?? Cr, a = e.cpu_ms || e.subrequests ? { limits: {
 			...e.cpu_ms ? { cpuMs: e.cpu_ms } : {},
 			...e.subrequests ? { subrequests: e.subrequests } : {}
 		} } : void 0;
 		return async (t) => {
 			let o = e.script_name;
 			if (r) {
-				let n = Un(t), r = Wn(t), i = Gn(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
+				let n = Yn(t), r = Xn(t), i = Zn(t), a = t.req.header("host") ?? t.req.header("x-forwarded-host") ?? "";
 				if (o = o.replace(Y, (e, t) => {
 					switch (t) {
 						case "tenant_id": return n ?? "";
@@ -2926,7 +3017,7 @@ var xr = I({
 			}
 		};
 	}
-}), Sr = I({
+}), Or = I({
 	type: "redirect",
 	optionsSchema: e.object({
 		upstream_url: e.string().refine((e) => {
@@ -2955,7 +3046,7 @@ var xr = I({
 			});
 		};
 	}
-}), Cr = I({
+}), kr = I({
 	type: "static",
 	optionsSchema: e.object({
 		status: e.number().int().default(200),
@@ -2975,15 +3066,15 @@ var xr = I({
 });
 //#endregion
 //#region src/data-plane/handlers/index.ts
-function wr(e) {
-	e.add(qn).add(Xn).add(Zn).add(Qn).add($n).add(rr).add(ir).add(fr).add(gr).add(xr).add(Sr).add(Cr);
+function Ar(e) {
+	e.add($n).add(nr).add(rr).add(ir).add(ar).add(lr).add(ur).add(vr).add(Sr).add(Dr).add(Or).add(kr);
 }
 //#endregion
 //#region src/data-plane/matcher.ts
 function X(e) {
 	return [...e].sort((e, t) => e.priority === t.priority ? e.created_at.localeCompare(t.created_at) : e.priority - t.priority);
 }
-function Tr(e, t) {
+function jr(e, t) {
 	let n = e.toLowerCase(), r = t.toLowerCase();
 	if (n === r) return !0;
 	if (n.startsWith("*.")) {
@@ -2992,13 +3083,16 @@ function Tr(e, t) {
 	}
 	return !1;
 }
-function Er(e, t) {
-	return !e || e.length === 0 ? !0 : e.some((e) => Tr(e, t));
+function Mr(e, t) {
+	return !e || e.length === 0 ? !0 : e.some((e) => jr(e, t));
 }
-function Dr(e) {
+function Nr(e) {
 	let t = (e.headers ? Object.entries(e.headers) : []).map(([e, t]) => [e.toLowerCase(), new RegExp(t)]), n = (e.query ? Object.entries(e.query) : []).map(([e, t]) => [e, new RegExp(t)]), r = e.hosts;
 	return async (e, i) => {
-		if (r && !Er(r, e.req.header("host") ?? "")) return new Response("No matching route", { status: 404 });
+		if (r) {
+			let t = e.req.header("host") ?? "";
+			if (!Mr(r, t)) return new Response("No matching route", { status: 404 });
+		}
 		for (let [n, r] of t) {
 			let t = e.req.header(n);
 			if (t === void 0 || !r.test(t)) return new Response("No matching route", { status: 404 });
@@ -3015,7 +3109,7 @@ function Dr(e) {
 }
 //#endregion
 //#region src/data-plane/compile.ts
-var Or = [
+var Pr = [
 	"GET",
 	"POST",
 	"PUT",
@@ -3027,34 +3121,34 @@ var Or = [
 function Z(e, n, r, i) {
 	let a = new t();
 	r && a.use("*", async (e, t) => {
-		Hn(e, r), await t();
+		Jn(e, r), await t();
 	});
 	let o = X(e);
 	for (let e of o) {
 		let t = [];
-		t.push(Dr(e.match));
+		t.push(Nr(e.match));
 		for (let r of e.handlers) t.push(n.build(r.type, r.options));
-		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : Or, i = e.match.path || "/*";
+		let r = e.match.methods?.length ? e.match.methods.map((e) => e.toUpperCase()) : Pr, i = e.match.path || "/*";
 		a.on(r, [i], ...t);
 	}
-	return i && i.length > 0 ? a.on(Or, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
+	return i && i.length > 0 ? a.on(Pr, ["*"], ...i) : a.all("*", (e) => e.text("No matching route", 404)), a.onError((e, t) => {
 		let n = K(e);
 		return t.text(n ? "Upstream timeout" : "Bad gateway", n ? 504 : 502, { "x-authhero-proxy-error": n ? "handler_timeout" : "handler_failed" });
 	}), a;
 }
 //#endregion
 //#region src/data-plane/router.ts
-var kr = 1e4;
-function Ar(e) {
+var Fr = 1e4;
+function Ir(e) {
 	return e.resolver ? e.resolver : e.cache ? P(e.data, e.cache) : P(e.data, e.cacheTtlMs ?? 3e4);
 }
-function jr(e) {
+function Lr(e) {
 	if (e.registry) return e.registry;
 	let t = new F(e.bindings ?? {});
-	return wr(t), t;
+	return Ar(t), t;
 }
 function Q(e) {
-	let t = Ar(e), n = jr(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? kr, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? e.defaultHandlers.map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
+	let t = Ir(e), n = Lr(e), r = /* @__PURE__ */ new WeakMap(), i = e.resolveHostTimeoutMs ?? Fr, a = e.defaultHandlers && e.defaultHandlers.length > 0 ? e.defaultHandlers.map((e) => n.build(e.type, e.options)) : void 0, o = a ? Z([], n, void 0, a) : void 0;
 	return async (e) => {
 		let s = e.req.header("host") ?? e.req.header("x-forwarded-host");
 		if (!s) return e.text("Missing host", 400);
@@ -3072,13 +3166,13 @@ function Q(e) {
 		}
 	};
 }
-function Mr(e) {
+function Rr(e) {
 	let n = new t();
 	return n.all("*", Q(e)), n;
 }
 //#endregion
 //#region src/app.ts
-function Nr(e) {
+function zr(e) {
 	let n = new t();
 	return n.all("*", Q({
 		data: e.data,
@@ -3096,17 +3190,17 @@ function Nr(e) {
 }
 //#endregion
 //#region src/data-plane/cache-api-cache.ts
-var Pr = 1e3, Fr = 1e3;
-function Ir(e, t) {
+var Br = 1e3, Vr = 1e3;
+function Hr(e, t) {
 	return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`, { method: "GET" });
 }
-function Lr() {
+function Ur() {
 	return globalThis.caches?.default;
 }
-function Rr(e) {
-	let t = e.cache ?? Lr();
+function Wr(e) {
+	let t = e.cache ?? Ur();
 	if (!t) return e.upstream;
-	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? Pr, c = e.cacheWriteTimeoutMs ?? Fr;
+	let n = t, r = e.namespace ?? "authhero-proxy", i = e.cacheTtlSeconds ?? 60, a = e.negativeCacheTtlSeconds ?? 10, o = e.waitUntil, s = e.cacheReadTimeoutMs ?? Br, c = e.cacheWriteTimeoutMs ?? Vr;
 	async function l(e) {
 		try {
 			return await J(Promise.resolve(n.match(e)), s, "cache.match");
@@ -3115,7 +3209,7 @@ function Rr(e) {
 		}
 	}
 	return { async resolveHost(t) {
-		let s = Ir(r, t), u = await l(s);
+		let s = Hr(r, t), u = await l(s);
 		if (u) try {
 			return (await u.json()).value;
 		} catch {}
@@ -3126,14 +3220,14 @@ function Rr(e) {
 		return o ? o(m) : await m, d;
 	} };
 }
-function zr(e, t) {
-	return Ir(e, t);
+function Gr(e, t) {
+	return Hr(e, t);
 }
 //#endregion
 //#region src/data-plane/cache-adapter-cache.ts
-var Br = 1e3, Vr = 1e3;
-function Hr(e) {
-	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = Br, cacheWriteTimeoutMs: u = Vr } = e, d = /* @__PURE__ */ new Map();
+var Kr = 1e3, qr = 1e3;
+function Jr(e) {
+	let { upstream: t, cache: n, freshTtlMs: r, staleTtlMs: i = 0, staleIfErrorTtlMs: a = 0, negativeTtlMs: o = r, keyPrefix: s = "authhero-proxy-host", waitUntil: c, cacheReadTimeoutMs: l = Kr, cacheWriteTimeoutMs: u = qr } = e, d = /* @__PURE__ */ new Map();
 	function f(e) {
 		return `${s}:${e.toLowerCase()}`;
 	}
@@ -3186,7 +3280,7 @@ function Hr(e) {
 		}
 	} };
 }
-function Ur(e, t) {
+function Yr(e, t) {
 	return `${e}:${t.toLowerCase()}`;
 }
 //#endregion
@@ -3194,7 +3288,7 @@ function Ur(e, t) {
 function $() {
 	throw Error("Static proxy adapter is read-only; configure routes at init time");
 }
-function Wr(e, t, n, r, i, a) {
+function Xr(e, t, n, r, i, a) {
 	return {
 		id: e.id ?? `${n}:${t}`,
 		tenant_id: r,
@@ -3209,10 +3303,10 @@ function Wr(e, t, n, r, i, a) {
 		updated_at: e.updated_at ?? a
 	};
 }
-function Gr(e) {
+function Zr(e) {
 	let t = (/* @__PURE__ */ new Date()).toISOString(), n = e.defaultTenantId ?? "static", r = /* @__PURE__ */ new Map();
 	for (let [i, a] of Object.entries(e.hosts)) {
-		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => Wr(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
+		let e = i.toLowerCase(), o = Array.isArray(a) ? { routes: a } : a, s = o.tenant_id ?? n, c = o.custom_domain_id ?? e, l = o.routes.map((n, r) => Xr(n, r, e, s, c, t)).sort((e, t) => e.priority - t.priority);
 		r.set(e, {
 			tenant_id: s,
 			custom_domain_id: c,
@@ -3256,7 +3350,7 @@ function Gr(e) {
 		}
 	};
 }
-function Kr(e, t = {}) {
+function Qr(e, t = {}) {
 	return {
 		priority: t.priority,
 		match: { path: t.path ?? "/*" },
@@ -3271,10 +3365,10 @@ function Kr(e, t = {}) {
 }
 //#endregion
 //#region src/constants.ts
-var qr = "proxy:resolve_host";
+var $r = "proxy:resolve_host";
 //#endregion
 //#region src/http-adapter/index.ts
-function Jr() {
+function ei() {
 	let e = () => {
 		throw Error("HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3296,7 +3390,7 @@ function Jr() {
 		}
 	};
 }
-function Yr(e) {
+function ti(e) {
 	let t = e.fetch ?? fetch, n = e.baseUrl.replace(/\/+$/, ""), r = e.resolveHostPath ?? "/api/v2/proxy/control-plane/hosts/", i = e.audience ?? `${n}/api/v2/`, a = e.scope ?? "proxy:resolve_host", o = e.tokenRefreshSkewSeconds ?? 60, s = e.timeoutMs ?? 2500;
 	function c(e) {
 		let t = new AbortController(), n = setTimeout(() => t.abort(), s);
@@ -3329,7 +3423,7 @@ function Yr(e) {
 		}), u);
 	}
 	return {
-		proxyRoutes: Jr(),
+		proxyRoutes: ei(),
 		async resolveHost(e) {
 			let i = await f(), a = `${n}${r}${encodeURIComponent(e.toLowerCase())}`, o = await c((e) => t(a, {
 				headers: { authorization: `Bearer ${i}` },
@@ -3343,11 +3437,11 @@ function Yr(e) {
 }
 //#endregion
 //#region src/kv-adapter/index.ts
-var Xr = "authhero-proxy-host:";
-function Zr(e, t) {
+var ni = "authhero-proxy-host:";
+function ri(e, t) {
 	return `${e}${t.toLowerCase()}`;
 }
-function Qr() {
+function ii() {
 	let e = () => {
 		throw Error("KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
 	};
@@ -3369,15 +3463,15 @@ function Qr() {
 		}
 	};
 }
-function $r(e) {
-	let { kv: t, keyPrefix: n = Xr, timeoutMs: r } = e;
+function ai(e) {
+	let { kv: t, keyPrefix: n = ni, timeoutMs: r } = e;
 	return {
-		proxyRoutes: Qr(),
+		proxyRoutes: ii(),
 		async resolveHost(e) {
-			let i = Zr(n, e), a = t.get(i, "json");
+			let i = ri(n, e), a = t.get(i, "json");
 			return (r && r > 0 ? await J(a, r, "kv.get") : await a) ?? null;
 		}
 	};
 }
 //#endregion
-export { Xr as DEFAULT_KV_HOST_KEY_PREFIX, F as HandlerRegistry, qr as PROXY_RESOLVE_HOST_SCOPE, Xn as basicAuthHandler, Ur as buildCacheAdapterKey, zr as buildCacheApiKey, Zr as buildKvHostKey, Dr as buildMatchFilter, Qn as cacheHandler, Z as compileHostApp, qn as corsHandler, Hr as createCacheAdapterHostCache, Rr as createCacheApiHostCache, Yr as createHttpProxyAdapter, P as createInMemoryHostCache, $r as createKvProxyAdapter, Nr as createProxyApp, Q as createProxyDataPlaneHandler, Mr as createProxyDataPlaneRouter, Gr as createStaticProxyAdapter, I as defineHandler, xr as dispatchNamespaceHandler, $n as forwardedHeadersHandler, yn as handlerConfigSchema, Zn as headersHandler, fr as httpHandler, Kr as httpRoute, vn as matchSchema, Er as matchesAnyHost, Tr as matchesHost, j as proxyRouteInsertSchema, bn as proxyRouteSchema, xn as proxyRouteUpdateSchema, Sr as redirectHandler, wr as registerBuiltinHandlers, rr as rewriteCookiesHandler, ir as rewriteLocationHandler, gr as serviceBindingHandler, X as sortRoutes, Cr as staticHandler };
+export { ni as DEFAULT_KV_HOST_KEY_PREFIX, F as HandlerRegistry, $r as PROXY_RESOLVE_HOST_SCOPE, nr as basicAuthHandler, Yr as buildCacheAdapterKey, Gr as buildCacheApiKey, ri as buildKvHostKey, Nr as buildMatchFilter, ir as cacheHandler, Z as compileHostApp, $n as corsHandler, Jr as createCacheAdapterHostCache, Wr as createCacheApiHostCache, ti as createHttpProxyAdapter, P as createInMemoryHostCache, ai as createKvProxyAdapter, zr as createProxyApp, Q as createProxyDataPlaneHandler, Rr as createProxyDataPlaneRouter, Zr as createStaticProxyAdapter, I as defineHandler, Dr as dispatchNamespaceHandler, ar as forwardedHeadersHandler, Tn as handlerConfigSchema, rr as headersHandler, vr as httpHandler, Qr as httpRoute, wn as matchSchema, Mr as matchesAnyHost, jr as matchesHost, j as proxyRouteInsertSchema, En as proxyRouteSchema, Dn as proxyRouteUpdateSchema, Or as redirectHandler, Ar as registerBuiltinHandlers, lr as rewriteCookiesHandler, ur as rewriteLocationHandler, Sr as serviceBindingHandler, X as sortRoutes, kr as staticHandler };