@xylex-group/athena 2.12.1 → 2.14.0

package/dist/next/client.cjs

@@ -162,7 +162,7 @@ var getSessionCookie = (request2, config) => {
 
 // src/utils/athena-request-headers.ts
 var NO_CACHE_HEADER_VALUE = "no-cache";
-var API_KEY_HEADER_CANDIDATES = ["X-Api-Key", "x-api-key", "apikey"];
+var API_KEY_HEADER_CANDIDATES = ["X-Athena-Key", "x-athena-key", "X-Api-Key", "x-api-key", "apikey"];
 var ATHENA_KEY_HEADER_CANDIDATES = ["X-Athena-Key", "x-athena-key"];
 var SESSION_TOKEN_HEADER_CANDIDATES = ["X-Athena-Auth-Session-Token"];
 var BEARER_MIRROR_HEADER_CANDIDATES = ["X-Athena-Auth-Bearer-Token"];
@@ -264,17 +264,6 @@ function buildServiceRequestHeaders(profile, sdkHeaderValue, config, options, ex
   });
 }
 function applyAthenaApiKeyHeaders(headers, apiKey, athenaKey) {
-  if (apiKey) {
-    if (!hasHeaderIgnoreCase(headers, "apikey")) {
-      headers.apikey = apiKey;
-    }
-    if (!Object.hasOwn(headers, "x-api-key")) {
-      headers["x-api-key"] = apiKey;
-    }
-    if (!Object.hasOwn(headers, "X-Api-Key")) {
-      headers["X-Api-Key"] = apiKey;
-    }
-  }
   const resolvedAthenaKey = normalizeHeaderValue(athenaKey) ?? normalizeHeaderValue(apiKey);
   if (resolvedAthenaKey && !hasHeaderIgnoreCase(headers, "X-Athena-Key")) {
     headers["X-Athena-Key"] = resolvedAthenaKey;
@@ -400,7 +389,7 @@ function buildAthenaRequestHeaders(input) {
 
 // package.json
 var package_default = {
-  version: "2.12.1"
+  version: "2.14.0"
 };
 
 // src/sdk-version.ts
@@ -2829,39 +2818,224 @@ async function withRetry(config, fn) {
   throw new Error("withRetry reached an unexpected state");
 }
 
-// src/db/module.ts
-function createDbModule(input) {
-  const db = {
-    from: input.from,
-    select(table, first, second) {
-      if (first && typeof first === "object" && !Array.isArray(first)) {
-        return input.from(table).select(void 0, first);
+// src/storage/direct-upload.ts
+var SERVICE = "s3";
+var TERMINATOR = "aws4_request";
+async function putDirectStorageUploadBody(config, bucket, storageKey, body, uploadHeaders, signal, onProgress) {
+  if (config.bucket && bucket && config.bucket !== bucket) {
+    throw new Error(
+      `athena.storage.file.upload direct mode bucket mismatch: configured ${config.bucket} but Athena returned ${bucket}`
+    );
+  }
+  const target = createDirectUploadTarget(config, bucket, storageKey);
+  const bytes = await bodyToArrayBuffer(body);
+  const payloadHash = await sha256Hex(bytes);
+  const headers = new Headers(uploadHeaders);
+  if (isBlobBody(body) && body.type && !headers.has("Content-Type")) {
+    headers.set("Content-Type", body.type);
+  }
+  const signed = await signDirectUploadRequest(config, target, headers, payloadHash);
+  if (typeof XMLHttpRequest !== "undefined") {
+    return putWithXhr(target.toString(), signed, body, signal, onProgress);
+  }
+  onProgress({ loaded: 0 });
+  const response = await fetch(target, {
+    method: "PUT",
+    headers: signed.requestHeaders,
+    body,
+    signal
+  });
+  if (!response.ok) {
+    throw new Error(`athena.storage.file.upload failed with status ${response.status}`);
+  }
+  onProgress({ loaded: bytes.byteLength });
+  return response;
+}
+function createDirectUploadTarget(config, bucket, storageKey) {
+  const resolvedBucket = config.bucket ?? bucket;
+  if (!resolvedBucket?.trim()) {
+    throw new Error(
+      "athena.storage.file.upload direct mode requires a bucket in experimental.directStorageUpload or the server upload response"
+    );
+  }
+  if (!storageKey.trim()) {
+    throw new Error("athena.storage.file.upload direct mode requires a storage key");
+  }
+  let endpoint;
+  try {
+    endpoint = new URL(config.endpoint);
+  } catch (error) {
+    throw new Error(
+      `athena.storage.file.upload direct mode received an invalid endpoint: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (endpoint.search || endpoint.hash) {
+    throw new Error("athena.storage.file.upload direct mode endpoint must not contain a query or hash");
+  }
+  const endpointPath = endpoint.pathname.replace(/\/+$/, "");
+  const pathParts = config.forcePathStyle === false ? [endpointPath, storageKey] : [endpointPath, resolvedBucket, storageKey];
+  if (config.forcePathStyle === false) {
+    endpoint.hostname = `${resolvedBucket}.${endpoint.hostname}`;
+  }
+  endpoint.pathname = pathParts.filter(Boolean).flatMap((part) => part.split("/")).map(awsEncode).join("/").replace(/^([^/])/, "/$1");
+  return endpoint;
+}
+async function signDirectUploadRequest(config, target, inputHeaders, payloadHash) {
+  const accessKeyId = config.accessKeyId.trim();
+  const secretAccessKey = config.secretAccessKey.trim();
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error(
+      "athena.storage.file.upload direct mode requires accessKeyId and secretAccessKey"
+    );
+  }
+  const now = /* @__PURE__ */ new Date();
+  const amzDate = formatAmzDate(now);
+  const shortDate = amzDate.slice(0, 8);
+  const region = config.region?.trim() || "auto";
+  const headers = {};
+  inputHeaders.forEach((value, key) => {
+    if (key.toLowerCase() !== "authorization" && key.toLowerCase() !== "host") {
+      headers[key.toLowerCase()] = value.trim().replace(/\s+/g, " ");
+    }
+  });
+  headers["x-amz-content-sha256"] = payloadHash;
+  headers["x-amz-date"] = amzDate;
+  if (config.sessionToken?.trim()) {
+    headers["x-amz-security-token"] = config.sessionToken.trim();
+  }
+  const canonicalHeaders = Object.keys(headers).sort().map((key) => `${key}:${headers[key]}
+`).join("");
+  const signedHeaders = Object.keys(headers).sort().join(";");
+  const canonicalRequest = [
+    "PUT",
+    target.pathname,
+    "",
+    `host:${target.host}
+${canonicalHeaders}`,
+    `host;${signedHeaders}`,
+    payloadHash
+  ].join("\n");
+  const credentialScope = `${shortDate}/${region}/${SERVICE}/${TERMINATOR}`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    await sha256Hex(canonicalRequest)
+  ].join("\n");
+  const dateKey = await hmac(`AWS4${secretAccessKey}`, shortDate);
+  const regionKey = await hmac(dateKey, region);
+  const serviceKey = await hmac(regionKey, SERVICE);
+  const signingKey = await hmac(serviceKey, TERMINATOR);
+  const signature = await hmacHex(signingKey, stringToSign);
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${credentialScope}, SignedHeaders=host;${signedHeaders}, Signature=${signature}`;
+  return { requestHeaders: headers };
+}
+async function putWithXhr(url, signed, body, signal, onProgress) {
+  const Xhr = XMLHttpRequest;
+  if (Xhr === void 0) {
+    return Promise.reject(new Error("athena.storage.file.upload direct mode requires XMLHttpRequest in this runtime"));
+  }
+  return new Promise((resolve, reject) => {
+    const xhr = new Xhr();
+    const abort = () => xhr.abort();
+    xhr.open("PUT", url);
+    Object.entries(signed.requestHeaders).forEach(([key, value]) => xhr.setRequestHeader(key, value));
+    xhr.upload.onprogress = (event) => onProgress({ loaded: event.loaded });
+    xhr.onload = () => {
+      signal?.removeEventListener("abort", abort);
+      if (xhr.status < 200 || xhr.status >= 300) {
+        reject(new Error(`athena.storage.file.upload failed with status ${xhr.status}`));
+        return;
       }
-      return input.from(table).select(first, second);
-    },
-    insert(table, values, options) {
-      return Array.isArray(values) ? input.from(table).insert(values, options) : input.from(table).insert(values, options);
-    },
-    upsert(table, values, options) {
-      return Array.isArray(values) ? input.from(table).upsert(values, options) : input.from(table).upsert(values, options);
-    },
-    update(table, values, options) {
-      return input.from(table).update(values, options);
-    },
-    delete(table, options) {
-      return input.from(table).delete(options);
-    },
-    rpc(fn, args, options) {
-      return input.rpc(fn, args, options);
-    },
-    query(query, options) {
-      return input.query(query, options);
+      onProgress({ loaded: bodySize(body) });
+      resolve(new Response(xhr.response, {
+        status: xhr.status,
+        statusText: xhr.statusText,
+        headers: parseXhrHeaders(xhr.getAllResponseHeaders())
+      }));
+    };
+    xhr.onerror = () => {
+      signal?.removeEventListener("abort", abort);
+      reject(new Error("athena.storage.file.upload failed with a network error"));
+    };
+    xhr.onabort = () => {
+      signal?.removeEventListener("abort", abort);
+      reject(new DOMException("Upload aborted", "AbortError"));
+    };
+    if (signal) {
+      if (signal.aborted) {
+        abort();
+        return;
+      }
+      signal.addEventListener("abort", abort, { once: true });
     }
-  };
-  return db;
+    xhr.send(body);
+  });
+}
+function isBlobBody(body) {
+  return typeof Blob !== "undefined" && body instanceof Blob;
+}
+async function bodyToArrayBuffer(body) {
+  if (isBlobBody(body)) return body.arrayBuffer();
+  if (body instanceof ArrayBuffer) return body;
+  if (ArrayBuffer.isView(body)) {
+    return body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
+  }
+  throw new Error("athena.storage.file.upload direct mode does not support ReadableStream bodies");
+}
+function bodySize(body) {
+  if (isBlobBody(body)) return body.size;
+  if (body instanceof ArrayBuffer) return body.byteLength;
+  if (ArrayBuffer.isView(body)) return body.byteLength;
+  return 0;
+}
+function awsEncode(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function formatAmzDate(date) {
+  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+async function sha256Hex(value) {
+  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return toHex(new Uint8Array(digest));
+}
+async function hmac(key, value) {
+  const keyBytes = typeof key === "string" ? new TextEncoder().encode(key) : key;
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyBytes,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(value));
+}
+async function hmacHex(key, value) {
+  return toHex(new Uint8Array(await hmac(key, value)));
+}
+function toHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function parseXhrHeaders(rawHeaders) {
+  const headers = new Headers();
+  rawHeaders.trim().split(/[\r\n]+/).forEach((line) => {
+    const separator = line.indexOf(":");
+    if (separator > 0) {
+      headers.set(line.slice(0, separator).trim(), line.slice(separator + 1).trim());
+    }
+  });
+  return headers;
 }
 
 // src/storage/file.ts
+function mergeUploadHeaders(serverHeaders, inputHeaders) {
+  const headers = { ...serverHeaders };
+  new Headers(inputHeaders).forEach((value, key) => {
+    headers[key] = value;
+  });
+  return headers;
+}
 function createStorageFileModule(base, config = {}) {
   const upload = async (input, options) => {
     const sources = normalizeUploadSources(input);
@@ -2897,16 +3071,25 @@ function createStorageFileModule(base, config = {}) {
     for (let index = 0; index < uploadRequests.length; index += 1) {
       const request2 = uploadRequests[index];
       const uploadUrl = uploadUrls[index];
-      const response = await putUploadBody(
+      const aggregateProgress = (progress) => {
+        aggregateLoaded[index] = progress.loaded;
+        input.onProgress?.(createProgressSnapshot("uploading", sources, index, progress.loaded, sum(aggregateLoaded)));
+      };
+      const response = config.directUpload ? await putDirectStorageUploadBody(
+        config.directUpload,
+        uploadUrl.upload.bucket,
+        uploadUrl.upload.storage_key,
+        request2.source.source,
+        mergeUploadHeaders(uploadUrl.upload.headers ?? {}, input.uploadHeaders),
+        options?.signal,
+        aggregateProgress
+      ) : await putUploadBody(
         uploadUrl.upload.url,
         uploadUrl.upload.headers ?? {},
         request2.source,
         input,
         options,
-        (progress) => {
-          aggregateLoaded[index] = progress.loaded;
-          input.onProgress?.(createProgressSnapshot("uploading", sources, index, progress.loaded, sum(aggregateLoaded)));
-        }
+        aggregateProgress
       );
       uploaded.push({
         file: uploadUrl.file,
@@ -3057,7 +3240,7 @@ function putUploadBodyWithXhr(url, source, headers, options, onProgress) {
       resolve(new Response(xhr.response, {
         status: xhr.status,
         statusText: xhr.statusText,
-        headers: parseXhrHeaders(xhr.getAllResponseHeaders())
+        headers: parseXhrHeaders2(xhr.getAllResponseHeaders())
       }));
     };
     xhr.onerror = () => {
@@ -3195,7 +3378,7 @@ function createProgressSnapshot(phase, sources, fileIndex, loaded, aggregateLoad
 function sum(values) {
   return values.reduce((total, value) => total + value, 0);
 }
-function parseXhrHeaders(raw) {
+function parseXhrHeaders2(raw) {
   const headers = new Headers();
   for (const line of raw.trim().split(/[\r\n]+/)) {
     const index = line.indexOf(":");
@@ -3212,6 +3395,230 @@ function isRecord5(value) {
   return Boolean(value) && typeof value === "object";
 }
 
+// src/storage/backup.ts
+function backupError(message, status, endpoint, method, cause, raw) {
+  const error = new Error(message);
+  error.name = "AthenaStorageError";
+  error.code = status === 0 ? "NETWORK_ERROR" : "HTTP_ERROR";
+  error.status = status;
+  error.endpoint = endpoint;
+  error.method = method;
+  error.cause = cause;
+  error.raw = raw;
+  throw error;
+}
+function isRecord6(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function asPath(path) {
+  return path;
+}
+function appendQuery(path, query) {
+  if (!query) return path;
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null || value === "") continue;
+    params.set(key, String(value));
+  }
+  const text = params.toString();
+  return text ? `${path}?${text}` : path;
+}
+function unwrapAthenaData(payload) {
+  if (isRecord6(payload) && "data" in payload) {
+    return payload.data;
+  }
+  return payload;
+}
+function requireKey(key) {
+  const trimmed = key.trim();
+  if (!trimmed || trimmed === "undefined" || trimmed === "null") {
+    backupError("Backup object key is required", 400, "/admin/backups/{key}", "DELETE");
+  }
+  return trimmed;
+}
+function resolveMessage(payload, fallback) {
+  if (isRecord6(payload)) {
+    const message = payload.message ?? payload.error ?? payload.details;
+    if (typeof message === "string" && message.trim()) return message.trim();
+  }
+  if (typeof payload === "string" && payload.trim()) return payload.trim();
+  return fallback;
+}
+async function callBackupEndpoint(gateway, path, method, payload, options, runtime) {
+  const endpoint = asPath(path);
+  const baseUrl = options?.baseUrl ? normalizeAthenaGatewayBaseUrl(options.baseUrl) : gateway.baseUrl;
+  const url = buildAthenaGatewayUrl(baseUrl, endpoint);
+  const headers = gateway.buildHeaders(options);
+  const init = {
+    method,
+    headers,
+    signal: options?.signal
+  };
+  if (payload !== void 0 && method !== "GET") {
+    init.body = JSON.stringify(payload);
+  }
+  let response;
+  try {
+    response = await fetch(url, init);
+  } catch (error) {
+    backupError(
+      error instanceof Error ? error.message : "Backup network error",
+      0,
+      path,
+      method,
+      error
+    );
+  }
+  const rawText = await response.text();
+  let parsed = null;
+  if (rawText) {
+    try {
+      parsed = JSON.parse(rawText);
+    } catch {
+      parsed = rawText;
+    }
+  }
+  if (!response.ok) {
+    backupError(
+      resolveMessage(parsed, `Backup ${method} ${path} failed (${response.status})`),
+      response.status,
+      path,
+      method,
+      void 0,
+      parsed
+    );
+  }
+  return unwrapAthenaData(parsed);
+}
+function createStorageBackupModule(gateway, runtimeOptions) {
+  const resolvedBaseUrl = () => String(gateway.baseUrl ?? "").replace(/\/+$/, "");
+  return {
+    async list(query, options) {
+      const path = appendQuery("/admin/backups", {
+        limit: query?.limit ?? 10,
+        client_name: query?.client_name,
+        cursor: query?.cursor ?? void 0
+      });
+      const data = await callBackupEndpoint(gateway, path, "GET", void 0, options);
+      const backups = (data?.backups ?? []).map((row) => ({
+        ...row,
+        key: row.key ?? row.s3_key
+      }));
+      return {
+        backups,
+        next_cursor: data?.next_cursor ?? null
+      };
+    },
+    async create(input, options) {
+      const data = await callBackupEndpoint(gateway, "/admin/backups", "POST", input, options);
+      return {
+        job_id: Number(data?.job_id ?? 0),
+        client_name: String(data?.client_name ?? input.client_name),
+        status: String(data?.status ?? "pending")
+      };
+    },
+    async restore(key, input, options) {
+      const backupKey = requireKey(key);
+      const path = `/admin/backups/${encodeURIComponent(backupKey)}/restore`;
+      const data = await callBackupEndpoint(gateway, path, "POST", input, options);
+      return {
+        job_id: Number(data?.job_id ?? 0),
+        client_name: String(data?.client_name ?? input.client_name),
+        status: String(data?.status ?? "pending"),
+        key: String(data?.key ?? backupKey)
+      };
+    },
+    async delete(key, options) {
+      const backupKey = requireKey(key);
+      await callBackupEndpoint(
+        gateway,
+        `/admin/backups/${encodeURIComponent(backupKey)}`,
+        "DELETE",
+        void 0,
+        options);
+    },
+    downloadUrl(key, options) {
+      const backupKey = requireKey(key);
+      const base = `${resolvedBaseUrl()}/admin/backups/${encodeURIComponent(backupKey)}/download`;
+      return options?.apiKey ? `${base}?api_key=${encodeURIComponent(options.apiKey)}` : base;
+    },
+    jobs: {
+      async list(query, options) {
+        const path = appendQuery("/admin/backups/jobs", query ?? {});
+        const data = await callBackupEndpoint(gateway, path, "GET", void 0, options);
+        if (Array.isArray(data)) return data;
+        if (isRecord6(data) && Array.isArray(data.jobs)) return data.jobs;
+        return [];
+      },
+      async get(jobId, options) {
+        return callBackupEndpoint(
+          gateway,
+          `/admin/backups/jobs/${encodeURIComponent(String(jobId))}`,
+          "GET",
+          void 0,
+          options);
+      },
+      async cancel(jobId, options) {
+        return callBackupEndpoint(
+          gateway,
+          `/admin/backups/jobs/${encodeURIComponent(String(jobId))}/cancel`,
+          "POST",
+          {},
+          options);
+      },
+      async delete(jobId, options) {
+        await callBackupEndpoint(
+          gateway,
+          `/admin/backups/jobs/${encodeURIComponent(String(jobId))}`,
+          "DELETE",
+          void 0,
+          options);
+      },
+      async openObjectUrl(jobId, options) {
+        const data = await callBackupEndpoint(
+          gateway,
+          `/admin/backups/jobs/${encodeURIComponent(String(jobId))}/s3-open`,
+          "GET",
+          void 0,
+          options);
+        return String(data?.url ?? "");
+      }
+    },
+    schedules: {
+      async list(options) {
+        const data = await callBackupEndpoint(gateway, "/admin/backups/schedules", "GET", void 0, options);
+        if (Array.isArray(data)) return data;
+        if (isRecord6(data) && Array.isArray(data.schedules)) return data.schedules;
+        return [];
+      },
+      async create(input, options) {
+        return callBackupEndpoint(
+          gateway,
+          "/admin/backups/schedules",
+          "POST",
+          input,
+          options);
+      },
+      async update(id, input, options) {
+        return callBackupEndpoint(
+          gateway,
+          `/admin/backups/schedules/${encodeURIComponent(String(id))}`,
+          "PATCH",
+          input,
+          options);
+      },
+      async delete(id, options) {
+        await callBackupEndpoint(
+          gateway,
+          `/admin/backups/schedules/${encodeURIComponent(String(id))}`,
+          "DELETE",
+          void 0,
+          options);
+      }
+    }
+  };
+}
+
 // src/storage/module.ts
 var storageSdkManifest = {
   methods: [
@@ -3254,6 +3661,53 @@ var storageSdkManifest = {
       responseEnvelope: "raw",
       responseType: "{ data: S3CredentialListItem[] }"
     },
+    {
+      name: "backup.list",
+      method: "GET",
+      path: "/admin/backups",
+      responseEnvelope: "athena",
+      responseType: "StorageBackupListPage",
+      note: "Admin backup archives on server S3/R2 profile"
+    },
+    {
+      name: "backup.create",
+      method: "POST",
+      path: "/admin/backups",
+      requestType: "StorageBackupCreateRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageBackupQueuedJob"
+    },
+    {
+      name: "backup.restore",
+      method: "POST",
+      path: "/admin/backups/{key}/restore",
+      pathParams: ["key"],
+      requestType: "StorageBackupRestoreRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageBackupQueuedJob"
+    },
+    {
+      name: "backup.delete",
+      method: "DELETE",
+      path: "/admin/backups/{key}",
+      pathParams: ["key"],
+      responseEnvelope: "athena",
+      responseType: "void"
+    },
+    {
+      name: "backup.jobs.list",
+      method: "GET",
+      path: "/admin/backups/jobs",
+      responseEnvelope: "athena",
+      responseType: "StorageBackupJob[]"
+    },
+    {
+      name: "backup.schedules.list",
+      method: "GET",
+      path: "/admin/backups/schedules",
+      responseEnvelope: "athena",
+      responseType: "StorageBackupSchedule[]"
+    },
     {
       name: "createStorageUploadUrl",
       method: "POST",
@@ -3901,7 +4355,7 @@ var AthenaStorageError = class extends Error {
     };
   }
 };
-function isRecord6(value) {
+function isRecord7(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function causeToString(cause) {
@@ -3999,7 +4453,7 @@ function parseResponseBody3(rawText, contentType) {
     return { parsed: rawText, parseFailed: true };
   }
 }
-function appendQuery(path, query) {
+function appendQuery2(path, query) {
   if (!query) return path;
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(query)) {
@@ -4025,7 +4479,7 @@ function withPathParam(path, name, value) {
   return path.replace(`{${name}}`, encodeURIComponent(value));
 }
 function resolveErrorMessage3(payload, fallback) {
-  if (isRecord6(payload)) {
+  if (isRecord7(payload)) {
     const message = payload.message ?? payload.error ?? payload.details;
     if (typeof message === "string" && message.trim()) {
       return message.trim();
@@ -4037,12 +4491,12 @@ function resolveErrorMessage3(payload, fallback) {
   return fallback;
 }
 function resolveErrorHint2(payload) {
-  if (!isRecord6(payload)) return void 0;
+  if (!isRecord7(payload)) return void 0;
   const hint = payload.hint ?? payload.suggestion;
   return typeof hint === "string" && hint.trim() ? hint.trim() : void 0;
 }
 function resolveErrorCause(payload) {
-  if (!isRecord6(payload)) return void 0;
+  if (!isRecord7(payload)) return void 0;
   const cause = payload.cause ?? payload.reason;
   return typeof cause === "string" && cause.trim() ? cause.trim() : void 0;
 }
@@ -4161,7 +4615,7 @@ async function callStorageEndpoint(gateway, endpoint, method, envelope, payload,
     );
   }
   if (envelope === "athena") {
-    if (!isRecord6(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
+    if (!isRecord7(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
       return rejectStorageError(
         {
           code: "INVALID_ATHENA_ENVELOPE",
@@ -4269,7 +4723,7 @@ async function callStorageBinaryEndpoint(gateway, endpoint, method, options, run
     runtimeOptions
   );
 }
-function isBlobBody(body) {
+function isBlobBody2(body) {
   return typeof Blob !== "undefined" && body instanceof Blob;
 }
 function isReadableStreamBody(body) {
@@ -4278,7 +4732,7 @@ function isReadableStreamBody(body) {
 async function putPresignedUploadBody(uploadUrl, uploadHeaders, body, options) {
   const headers = new Headers(uploadHeaders);
   Object.entries(options?.headers ?? {}).forEach(([key, value]) => headers.set(key, value));
-  if (!headers.has("Content-Type") && isBlobBody(body) && body.type) {
+  if (!headers.has("Content-Type") && isBlobBody2(body) && body.type) {
     headers.set("Content-Type", body.type);
   }
   const init = {
@@ -4373,7 +4827,7 @@ async function callStorageUploadBinaryEndpoint(gateway, endpoint, body, options,
   }
   delete headers["Content-Type"];
   delete headers["content-type"];
-  if (isBlobBody(body) && body.type) {
+  if (isBlobBody2(body) && body.type) {
     headers["Content-Type"] = body.type;
   }
   const requestInit = {
@@ -4458,7 +4912,7 @@ async function callStorageUploadBinaryEndpoint(gateway, endpoint, body, options,
       runtimeOptions
     );
   }
-  if (!isRecord6(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
+  if (!isRecord7(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
     return rejectStorageError(
       {
         code: "INVALID_ATHENA_ENVELOPE",
@@ -4530,14 +4984,14 @@ function createStorageModule(gateway, runtimeOptions) {
       return callAthena2(withPathParam("/storage/files/{file_id}", "file_id", fileId), "GET", void 0, options);
     },
     getStorageFileUrl(fileId, query, options) {
-      const path = appendQuery(
+      const path = appendQuery2(
         withPathParam("/storage/files/{file_id}/url", "file_id", fileId),
         query
       );
       return callAthena2(path, "GET", void 0, options);
     },
     getStorageFileProxy(fileId, query, options) {
-      const path = appendQuery(
+      const path = appendQuery2(
         withPathParam("/storage/files/{file_id}/proxy", "file_id", fileId),
         query
       );
@@ -4561,7 +5015,7 @@ function createStorageModule(gateway, runtimeOptions) {
   };
   const fileFacade = createStorageFileModule(base, runtimeOptions);
   const fileUpload = ((input, options) => {
-    if (isRecord6(input) && "files" in input) {
+    if (isRecord7(input) && "files" in input) {
       return fileFacade.upload(input, options);
     }
     return base.createStorageUploadUrl(
@@ -4623,7 +5077,7 @@ function createStorageModule(gateway, runtimeOptions) {
       return callAthena2(withPathParam("/storage/files/{file_id}/public-url", "file_id", fileId), "GET", void 0, options);
     },
     proxyUrl(fileId, query, options) {
-      const path = appendQuery(
+      const path = appendQuery2(
         withPathParam("/storage/files/{file_id}/proxy-url", "file_id", fileId),
         query
       );
@@ -4661,7 +5115,7 @@ function createStorageModule(gateway, runtimeOptions) {
     },
     retention: {
       get(fileId, query, options) {
-        const path = appendQuery(
+        const path = appendQuery2(
           withPathParam("/storage/files/{file_id}/retention", "file_id", fileId),
           query
         );
@@ -4863,6 +5317,7 @@ function createStorageModule(gateway, runtimeOptions) {
       return callAthena2("/storage/audit/list", "POST", input, options);
     }
   };
+  const backup = createStorageBackupModule(gateway);
   return {
     ...base,
     credentials,
@@ -4874,6 +5329,7 @@ function createStorageModule(gateway, runtimeOptions) {
     bucket,
     multipart,
     audit,
+    backup,
     delete: file.delete
   };
 }
@@ -4923,7 +5379,7 @@ function normalizeWsUrl(value, label) {
   parsed.pathname = parsed.pathname.replace(/\/+$/, "");
   return parsed.toString().replace(/\/$/, "");
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function parseResponseBody4(rawText, contentType) {
@@ -4945,7 +5401,7 @@ function resolveRequestId3(headers) {
   return headers.get("x-request-id") ?? headers.get("x-correlation-id") ?? headers.get("x-athena-request-id") ?? void 0;
 }
 function resolveErrorMessage4(payload, fallback) {
-  if (isRecord7(payload)) {
+  if (isRecord8(payload)) {
     for (const candidate of [payload.error, payload.message, payload.details]) {
       if (typeof candidate === "string" && candidate.trim().length > 0) {
         return candidate.trim();
@@ -5559,7 +6015,7 @@ var BOOLEAN_SAFE_OPERATORS = /* @__PURE__ */ new Set([
   "ilike",
   "is"
 ]);
-function isRecord8(value) {
+function isRecord9(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isUuidString(value) {
@@ -5572,7 +6028,7 @@ function shouldUseUuidTextComparison(column, value) {
   return typeof value === "string" && isUuidString(value) && isUuidIdentifierColumn(column);
 }
 function isRelationSelectNode(value) {
-  return isRecord8(value) && isRecord8(value.select);
+  return isRecord9(value) && isRecord9(value.select);
 }
 function normalizeIdentifier(value, label) {
   const normalized = value.trim();
@@ -5628,7 +6084,7 @@ function compileRelationToken(key, node) {
   return `${prefix}${relationToken}(${nested})`;
 }
 function compileSelectShape(select) {
-  if (!isRecord8(select)) {
+  if (!isRecord9(select)) {
     throw new Error("findMany select must be an object");
   }
   const tokens = [];
@@ -5652,7 +6108,7 @@ function compileSelectShape(select) {
   return tokens.join(",");
 }
 function selectShapeUsesRelationSchema(select) {
-  if (!isRecord8(select)) {
+  if (!isRecord9(select)) {
     return false;
   }
   for (const rawValue of Object.values(select)) {
@@ -5670,7 +6126,7 @@ function selectShapeUsesRelationSchema(select) {
 }
 function compileColumnWhere(column, input) {
   const normalizedColumn = normalizeIdentifier(column, "where column");
-  if (!isRecord8(input)) {
+  if (!isRecord9(input)) {
     return [buildGatewayCondition("eq", normalizedColumn, input)];
   }
   const conditions = [];
@@ -5698,7 +6154,7 @@ function compileColumnWhere(column, input) {
   return conditions;
 }
 function compileBooleanExpressionTerms(clause, label) {
-  if (!isRecord8(clause)) {
+  if (!isRecord9(clause)) {
     throw new Error(`findMany where.${label} clauses must be objects`);
   }
   const entries = Object.entries(clause).filter(([, value]) => value !== void 0);
@@ -5707,7 +6163,7 @@ function compileBooleanExpressionTerms(clause, label) {
   }
   const [rawColumn, rawValue] = entries[0];
   const column = normalizeIdentifier(rawColumn, `where.${label} column`);
-  if (!isRecord8(rawValue)) {
+  if (!isRecord9(rawValue)) {
     return [`${column}.eq.${stringifyFilterValue(rawValue)}`];
   }
   const operatorEntries = Object.entries(rawValue).filter(([, value]) => value !== void 0);
@@ -5731,7 +6187,7 @@ function compileWhere(where) {
   if (where === void 0) {
     return void 0;
   }
-  if (!isRecord8(where)) {
+  if (!isRecord9(where)) {
     throw new Error("findMany where must be an object");
   }
   const conditions = [];
@@ -5781,7 +6237,7 @@ function compileOrderBy(orderBy) {
   if (orderBy === void 0) {
     return void 0;
   }
-  if (!isRecord8(orderBy)) {
+  if (!isRecord9(orderBy)) {
     throw new Error("findMany orderBy must be an object");
   }
   if ("column" in orderBy) {
@@ -5956,11 +6412,11 @@ function toFindManyAstOrder(order) {
     ascending: order.direction !== "descending"
   };
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeFindManyAstColumnPredicate(value) {
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     return {
       eq: value
     };
@@ -5984,7 +6440,7 @@ function normalizeFindManyAstBooleanOperand(clause) {
   return normalized;
 }
 function normalizeFindManyAstWhere(where) {
-  if (!where || !isRecord9(where)) {
+  if (!where || !isRecord10(where)) {
     return where;
   }
   const normalized = {};
@@ -5998,7 +6454,7 @@ function normalizeFindManyAstWhere(where) {
       );
       continue;
     }
-    if (key === "not" && isRecord9(value)) {
+    if (key === "not" && isRecord10(value)) {
       normalized.not = normalizeFindManyAstBooleanOperand(
         value
       );
@@ -6009,7 +6465,7 @@ function normalizeFindManyAstWhere(where) {
   return normalized;
 }
 function predicateRequiresUuidQueryFallback(column, value) {
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     return shouldUseUuidTextComparison(column, value);
   }
   const eqValue = value.eq;
@@ -6027,7 +6483,7 @@ function booleanOperandRequiresUuidQueryFallback(clause) {
   return false;
 }
 function findManyAstWhereRequiresLegacyTransport(where) {
-  if (!where || !isRecord9(where)) {
+  if (!where || !isRecord10(where)) {
     return false;
   }
   for (const [key, value] of Object.entries(where)) {
@@ -6042,7 +6498,7 @@ function findManyAstWhereRequiresLegacyTransport(where) {
       }
       continue;
     }
-    if (key === "not" && isRecord9(value)) {
+    if (key === "not" && isRecord10(value)) {
       if (booleanOperandRequiresUuidQueryFallback(value)) {
         return true;
       }
@@ -6662,7 +7118,7 @@ async function executeExperimentalRead(experimental, runner) {
     throw error;
   }
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function firstNonEmptyString2(...values) {
@@ -6674,8 +7130,8 @@ function firstNonEmptyString2(...values) {
   return void 0;
 }
 function resolveStructuredErrorPayload2(raw) {
-  if (!isRecord10(raw)) return null;
-  return isRecord10(raw.error) ? raw.error : raw;
+  if (!isRecord11(raw)) return null;
+  return isRecord11(raw.error) ? raw.error : raw;
 }
 function resolveStructuredErrorDetails(payload, message) {
   if (!payload || !("details" in payload)) {
@@ -6691,7 +7147,7 @@ function resolveStructuredErrorDetails(payload, message) {
   return details;
 }
 function createResultError(response, result, normalized) {
-  const rawRecord = isRecord10(response.raw) ? response.raw : null;
+  const rawRecord = isRecord11(response.raw) ? response.raw : null;
   const payload = resolveStructuredErrorPayload2(response.raw);
   const message = firstNonEmptyString2(
     response.error,
@@ -8439,7 +8895,30 @@ function createClientFromConfig(config, sourceConfig) {
     config.experimental,
     queryTracer
   );
-  const db = createDbModule({ from, rpc, query });
+  const untypedDbFrom = from;
+  const db = {
+    from,
+    select(table, first, second) {
+      if (first && typeof first === "object" && !Array.isArray(first)) {
+        return untypedDbFrom(table).select(void 0, first);
+      }
+      return untypedDbFrom(table).select(first, second);
+    },
+    insert(table, values, options) {
+      return Array.isArray(values) ? untypedDbFrom(table).insert(values, options) : untypedDbFrom(table).insert(values, options);
+    },
+    upsert(table, values, options) {
+      return Array.isArray(values) ? untypedDbFrom(table).upsert(values, options) : untypedDbFrom(table).upsert(values, options);
+    },
+    update(table, values, options) {
+      return untypedDbFrom(table).update(values, options);
+    },
+    delete(table, options) {
+      return untypedDbFrom(table).delete(options);
+    },
+    rpc,
+    query
+  };
   const chat = createChatModule({
     baseUrl: config.chatUrl,
     apiKey: config.apiKey,
@@ -8577,6 +9056,7 @@ function createClientFromConfig(config, sourceConfig) {
       withOptions: storageWithOptions,
       storage: createStorageModule(gateway, {
         ...config.experimental.storage,
+        ...config.experimental.directStorageUpload ? { directUpload: config.experimental.directStorageUpload } : {},
         ...config.storageUrl ? {
           baseUrl: config.storageUrl,
           stripBasePath: true
@@ -8590,7 +9070,9 @@ function createClientFromConfig(config, sourceConfig) {
 var AthenaClient = class {
   /** Create a fluent builder for a strongly-typed Athena SDK client. */
   static builder() {
-    return createAthenaClientBuilder((config) => createClientFromInput(config));
+    return createAthenaClientBuilder(
+      (config) => createClientFromInput(config)
+    );
   }
   static fromEnvironment(options = {}) {
     const env = options.env ?? process.env;
@@ -8621,11 +9103,12 @@ var AthenaClient = class {
     });
   }
 };
-function createClient(configOrUrl, apiKey, options) {
+function createClient(...args) {
+  const [configOrUrl, apiKey, options] = args;
   if (typeof configOrUrl === "string" || configOrUrl === null || configOrUrl === void 0) {
     return createClientFromInput({
       url: configOrUrl,
-      key: "",
+      key: apiKey ?? "",
       ...options
     });
   }
@@ -8669,6 +9152,403 @@ function createAdapterClient(options, context) {
   return client;
 }
 
+// src/next/session-bridge/constants.ts
+var ATHENA_AUTH_SESSION_BRIDGE_ROUTE = "/api/athena-auth/session";
+var ATHENA_AUTH_SESSION_COOKIE_NAME = "athena-auth.session-token";
+var ATHENA_AUTH_SESSION_COOKIE_NAMES = [
+  ATHENA_AUTH_SESSION_COOKIE_NAME,
+  "athena-auth.session_token"
+];
+
+// src/next/session-bridge/client.ts
+var JSON_CONTENT_TYPE = "application/json";
+function isBrowserRuntime() {
+  return typeof globalThis !== "undefined" && "window" in globalThis;
+}
+async function persistAthenaAuthSessionOnAppHost(payload, options) {
+  if (!(payload && isBrowserRuntime())) {
+    return;
+  }
+  const route = options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
+  const fetchImpl = options?.fetch ?? fetch;
+  const response = await fetchImpl(route, {
+    body: JSON.stringify(payload),
+    credentials: "same-origin",
+    headers: {
+      "Content-Type": JSON_CONTENT_TYPE
+    },
+    method: "POST"
+  });
+  if (!response.ok) {
+    throw new Error("Failed to persist the Athena Auth session on the app host");
+  }
+}
+async function clearAthenaAuthSessionOnAppHost(options) {
+  if (!isBrowserRuntime()) {
+    return;
+  }
+  const route = options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
+  const fetchImpl = options?.fetch ?? fetch;
+  const response = await fetchImpl(route, {
+    credentials: "same-origin",
+    method: "DELETE"
+  });
+  if (!response.ok) {
+    throw new Error("Failed to clear the Athena Auth session on the app host");
+  }
+}
+
+// src/next/session-bridge/payload.ts
+function resolveSessionBridgePayload(payload) {
+  const token = payload?.session?.token ?? payload?.token;
+  if (typeof token !== "string") {
+    return null;
+  }
+  const normalizedToken = token.trim();
+  if (!normalizedToken) {
+    return null;
+  }
+  return {
+    token: normalizedToken,
+    expiresAt: typeof payload?.session?.expiresAt === "string" ? payload.session.expiresAt : void 0
+  };
+}
+
+// src/utils/hostname.ts
+var LOCAL_IPV4_PATTERN = /^127(?:\.\d{1,3}){3}$/;
+function isLocalHostname(hostname) {
+  const normalized = hostname.trim().replace(/\.$/, "").toLowerCase();
+  if (!normalized) {
+    return false;
+  }
+  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+    return true;
+  }
+  if (normalized === "127.0.0.1" || LOCAL_IPV4_PATTERN.test(normalized) || normalized === "::1" || normalized === "[::1]" || normalized === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  return false;
+}
+
+// src/utils/auth-cookies.ts
+var ATHENA_AUTH_COOKIE_PREFIXES = [
+  "athena-auth",
+  "__Secure-athena-auth",
+  "better-auth",
+  "__Secure-better-auth"
+];
+function extractCookieNames(cookieHeader) {
+  const names = /* @__PURE__ */ new Set();
+  for (const rawCookie of cookieHeader.split(";")) {
+    const trimmed = rawCookie.trim();
+    if (!trimmed) continue;
+    const eqPos = trimmed.indexOf("=");
+    const name = (eqPos > -1 ? trimmed.slice(0, eqPos) : trimmed).trim();
+    if (name) {
+      names.add(name);
+    }
+  }
+  return Array.from(names);
+}
+function buildCookieDomainCandidates(hostname) {
+  const normalized = hostname.trim().replace(/\.$/, "").toLowerCase();
+  if (!normalized || isLocalHostname(normalized)) {
+    return [];
+  }
+  const labels = normalized.split(".").filter(Boolean);
+  if (labels.length < 2) {
+    return [normalized, `.${normalized}`];
+  }
+  const domains = /* @__PURE__ */ new Set();
+  for (let index = 0; index <= labels.length - 2; index += 1) {
+    const domain = labels.slice(index).join(".");
+    domains.add(domain);
+    domains.add(`.${domain}`);
+  }
+  return Array.from(domains);
+}
+function getCookieStore() {
+  const candidate = globalThis.document;
+  if (!candidate || typeof candidate.cookie !== "string") {
+    return null;
+  }
+  return candidate;
+}
+function getRuntimeHostname() {
+  const fromWindow = globalThis.window?.location?.hostname;
+  if (typeof fromWindow === "string") {
+    return fromWindow;
+  }
+  const fromLocation = globalThis.location?.hostname;
+  if (typeof fromLocation === "string") {
+    return fromLocation;
+  }
+  return "";
+}
+function writeExpiredCookie(cookieStore, name, path, domain) {
+  const domainClause = domain ? ` domain=${domain};` : "";
+  cookieStore.cookie = `${name}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; path=${path};${domainClause}`;
+}
+function clearAuthCookies(options = {}) {
+  const cookieStore = getCookieStore();
+  if (!cookieStore) {
+    return [];
+  }
+  const cookieHeader = options.cookieHeader ?? cookieStore.cookie;
+  if (!cookieHeader?.trim()) {
+    return [];
+  }
+  const prefixes = options.prefixes?.length ? options.prefixes : [...ATHENA_AUTH_COOKIE_PREFIXES];
+  const cookieNames = extractCookieNames(cookieHeader);
+  const namesToClear = cookieNames.filter(
+    (name) => prefixes.some((prefix) => name.startsWith(prefix))
+  );
+  if (namesToClear.length === 0) {
+    return [];
+  }
+  const path = options.path?.trim() || "/";
+  const hostname = options.hostname ?? getRuntimeHostname();
+  const domainCandidates = buildCookieDomainCandidates(hostname);
+  for (const name of namesToClear) {
+    writeExpiredCookie(cookieStore, name, path);
+    for (const domain of domainCandidates) {
+      writeExpiredCookie(cookieStore, name, path, domain);
+    }
+  }
+  return namesToClear;
+}
+
+// src/utils/auth-routes.ts
+var AUTH_DEFAULT_VIEW = "sign-in";
+var AUTH_VIEW_BY_SEGMENT = {
+  "accept-invitation": "accept-invitation",
+  "check-email": "check-email",
+  "forget-password": "forgot-password",
+  "forgot-password": "forgot-password",
+  logout: "logout",
+  "reset-email-sent": "reset-email-sent",
+  "reset-password": "reset-password",
+  "sign-in": "sign-in",
+  "sign-up": "sign-up"
+};
+var AUTHENTICATED_REDIRECT_VIEW_SET = /* @__PURE__ */ new Set([
+  "sign-in",
+  "sign-up",
+  "forgot-password"
+]);
+function resolveAuthViewFromSegment(segment) {
+  if (!segment) {
+    return AUTH_DEFAULT_VIEW;
+  }
+  return AUTH_VIEW_BY_SEGMENT[segment] ?? null;
+}
+function shouldRedirectAuthenticatedAuthView(view) {
+  return AUTHENTICATED_REDIRECT_VIEW_SET.has(view);
+}
+var AUTH_ROUTES = {
+  acceptInvitation: "/auth/accept-invitation",
+  appHome: "/",
+  checkEmail: "/auth/check-email",
+  forgotPassword: "/auth/forgot-password",
+  logout: "/auth/logout",
+  resetEmailSent: "/auth/reset-email-sent",
+  resetPassword: "/auth/reset-password",
+  signIn: "/auth/sign-in",
+  signUp: "/auth/sign-up",
+  socialCallback: "/auth/social-callback"
+};
+function createAuthModeRedirects(routes = AUTH_ROUTES) {
+  return {
+    "forgot-password": routes.forgotPassword,
+    login: routes.signIn,
+    logout: routes.logout,
+    "reset-password": routes.resetPassword,
+    signup: routes.signUp
+  };
+}
+var AUTH_MODE_REDIRECTS = createAuthModeRedirects();
+new Set(Object.keys(AUTH_MODE_REDIRECTS));
+
+// src/utils/athena-auth-url.ts
+var ATHENA_AUTH_PATH = "/api/auth";
+var LOCAL_DEV_ORIGIN = "http://localhost:3000";
+var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";
+var ATHENA_AUTH_UPSTREAM_ENV_KEYS = [
+  "ATHENA_AUTH_UPSTREAM_URL",
+  "ATHENA_AUTH_URL",
+  "NEXT_PUBLIC_ATHENA_AUTH_UPSTREAM_URL",
+  "NEXT_PUBLIC_ATHENA_AUTH_URL"
+];
+var ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES = ATHENA_AUTH_UPSTREAM_ENV_KEYS;
+var LEADING_SLASHES_REGEX = /^\/+/;
+function stripTrailingSlashes(value) {
+  return value.replace(/\/+$/g, "");
+}
+function ensureLeadingSlash(value) {
+  return value.startsWith("/") ? value : `/${value}`;
+}
+function ensureAthenaAuthPath(pathname) {
+  const normalizedPath = stripTrailingSlashes(
+    ensureLeadingSlash(pathname.trim())
+  );
+  if (!normalizedPath || normalizedPath === "/") {
+    return ATHENA_AUTH_PATH;
+  }
+  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
+    return normalizedPath;
+  }
+  return `${normalizedPath}${ATHENA_AUTH_PATH}`;
+}
+function stripAthenaAuthPath(pathname) {
+  const normalizedPath = stripTrailingSlashes(
+    ensureLeadingSlash(pathname.trim())
+  );
+  if (!normalizedPath || normalizedPath === "/") {
+    return "/";
+  }
+  if (normalizedPath === ATHENA_AUTH_PATH) {
+    return "/";
+  }
+  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
+    const withoutAuthPath = normalizedPath.slice(0, -ATHENA_AUTH_PATH.length);
+    return withoutAuthPath ? ensureLeadingSlash(withoutAuthPath) : "/";
+  }
+  return normalizedPath;
+}
+function readProcessEnv2() {
+  try {
+    const maybeProcess = globalThis.process;
+    return maybeProcess?.env;
+  } catch {
+    return void 0;
+  }
+}
+function getBrowserOrigin() {
+  try {
+    const origin = globalThis.window?.location?.origin;
+    return typeof origin === "string" && origin.length > 0 ? origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isAbsoluteUrl(value) {
+  const trimmed = value.trim();
+  return trimmed.startsWith("http://") || trimmed.startsWith("https://");
+}
+function readAthenaAuthUpstreamUrlFromEnv(env) {
+  for (const key of ATHENA_AUTH_UPSTREAM_ENV_KEYS) {
+    const value = env[key]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl) {
+  if (typeof rawUpstreamUrl === "string") {
+    const trimmed = rawUpstreamUrl.trim();
+    return trimmed || void 0;
+  }
+  if (rawUpstreamUrl) {
+    return readAthenaAuthUpstreamUrlFromEnv(rawUpstreamUrl);
+  }
+  const processEnv = readProcessEnv2();
+  return processEnv ? readAthenaAuthUpstreamUrlFromEnv(processEnv) : void 0;
+}
+function normalizeAthenaAuthBaseUrl(urlOrPath) {
+  const trimmed = urlOrPath.trim();
+  if (!trimmed) {
+    return ATHENA_AUTH_PATH;
+  }
+  if (isAbsoluteUrl(trimmed)) {
+    const url = new URL(trimmed);
+    url.pathname = ensureAthenaAuthPath(url.pathname);
+    url.search = "";
+    url.hash = "";
+    return stripTrailingSlashes(url.toString());
+  }
+  return ensureAthenaAuthPath(trimmed);
+}
+function resolveAthenaAuthUpstreamUrl(rawUpstreamUrl) {
+  const configuredUpstream = resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl) || DEFAULT_ATHENA_AUTH_ORIGIN;
+  if (isAbsoluteUrl(configuredUpstream)) {
+    const upstreamUrl = new URL(configuredUpstream);
+    upstreamUrl.pathname = stripAthenaAuthPath(upstreamUrl.pathname);
+    upstreamUrl.search = "";
+    upstreamUrl.hash = "";
+    return stripTrailingSlashes(upstreamUrl.toString());
+  }
+  const normalizedPath = stripAthenaAuthPath(configuredUpstream);
+  return stripTrailingSlashes(
+    new URL(normalizedPath, LOCAL_DEV_ORIGIN).toString()
+  );
+}
+function resolveBrowserFacingOrigin(rawUpstreamUrl) {
+  if (resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl)) {
+    return `${resolveAthenaAuthUpstreamUrl(rawUpstreamUrl)}/`;
+  }
+  const browserOrigin = getBrowserOrigin();
+  if (browserOrigin) {
+    return `${browserOrigin}/`;
+  }
+  return `${LOCAL_DEV_ORIGIN}/`;
+}
+function resolvePreservedAthenaAuthBaseUrl(configuredAuthBaseUrl, rawUpstreamUrl) {
+  const trimmed = configuredAuthBaseUrl.trim();
+  const preservedConfiguredBaseUrl = trimmed || ATHENA_AUTH_PATH;
+  if (isAbsoluteUrl(preservedConfiguredBaseUrl)) {
+    return stripTrailingSlashes(preservedConfiguredBaseUrl);
+  }
+  return stripTrailingSlashes(
+    new URL(
+      ensureLeadingSlash(preservedConfiguredBaseUrl),
+      resolveBrowserFacingOrigin(rawUpstreamUrl)
+    ).toString()
+  );
+}
+function resolveAthenaAuthClientBaseUrl(configuredAuthBaseUrl, rawUpstreamUrl, options = {}) {
+  let baseInput;
+  if (typeof configuredAuthBaseUrl === "string") {
+    baseInput = configuredAuthBaseUrl;
+  } else if (configuredAuthBaseUrl) {
+    baseInput = readAthenaAuthUpstreamUrlFromEnv(configuredAuthBaseUrl) ?? ATHENA_AUTH_PATH;
+  } else {
+    const fromEnv = resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl);
+    baseInput = fromEnv ?? ATHENA_AUTH_PATH;
+  }
+  if (options.appendAuthPath === false) {
+    return resolvePreservedAthenaAuthBaseUrl(baseInput, rawUpstreamUrl);
+  }
+  const normalizedConfiguredBaseUrl = normalizeAthenaAuthBaseUrl(baseInput);
+  if (isAbsoluteUrl(normalizedConfiguredBaseUrl)) {
+    return normalizedConfiguredBaseUrl;
+  }
+  const browserOrigin = getBrowserOrigin();
+  if (browserOrigin) {
+    return stripTrailingSlashes(
+      new URL(normalizedConfiguredBaseUrl, browserOrigin).toString()
+    );
+  }
+  if (resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl)) {
+    const upstream = resolveAthenaAuthUpstreamUrl(rawUpstreamUrl);
+    return stripTrailingSlashes(
+      new URL(ATHENA_AUTH_PATH, `${upstream}/`).toString()
+    );
+  }
+  return stripTrailingSlashes(
+    new URL(normalizedConfiguredBaseUrl, LOCAL_DEV_ORIGIN).toString()
+  );
+}
+function resolveAthenaAuthRequestUrl(path, rawBaseUrl) {
+  const normalizedPath = path.replace(LEADING_SLASHES_REGEX, "");
+  const base = resolveAthenaAuthClientBaseUrl(rawBaseUrl);
+  return new URL(normalizedPath, `${base}/`).toString();
+}
+var ATHENA_AUTH_VERIFY_EMAIL_PATH = "verify-email";
+function resolveEmailVerificationCallbackUrl(rawBaseUrl) {
+  return resolveAthenaAuthRequestUrl(ATHENA_AUTH_VERIFY_EMAIL_PATH, rawBaseUrl);
+}
+
 // src/next/client.ts
 var cachedBrowserClient = null;
 function createAthenaBrowserClient(options) {
@@ -8682,6 +9562,29 @@ function createAthenaBrowserClient(options) {
   return createAdapterClient(options);
 }
 
+exports.ATHENA_AUTH_COOKIE_PREFIXES = ATHENA_AUTH_COOKIE_PREFIXES;
+exports.ATHENA_AUTH_PATH = ATHENA_AUTH_PATH;
+exports.ATHENA_AUTH_SESSION_BRIDGE_ROUTE = ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
+exports.ATHENA_AUTH_SESSION_COOKIE_NAME = ATHENA_AUTH_SESSION_COOKIE_NAME;
+exports.ATHENA_AUTH_SESSION_COOKIE_NAMES = ATHENA_AUTH_SESSION_COOKIE_NAMES;
+exports.ATHENA_AUTH_UPSTREAM_ENV_KEYS = ATHENA_AUTH_UPSTREAM_ENV_KEYS;
+exports.ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES = ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES;
+exports.AUTH_DEFAULT_VIEW = AUTH_DEFAULT_VIEW;
+exports.AUTH_ROUTES = AUTH_ROUTES;
+exports.AUTH_VIEW_BY_SEGMENT = AUTH_VIEW_BY_SEGMENT;
+exports.DEFAULT_ATHENA_AUTH_ORIGIN = DEFAULT_ATHENA_AUTH_ORIGIN;
+exports.clearAthenaAuthSessionOnAppHost = clearAthenaAuthSessionOnAppHost;
+exports.clearAuthCookies = clearAuthCookies;
 exports.createAthenaBrowserClient = createAthenaBrowserClient;
+exports.isAbsoluteUrl = isAbsoluteUrl;
+exports.normalizeAthenaAuthBaseUrl = normalizeAthenaAuthBaseUrl;
+exports.persistAthenaAuthSessionOnAppHost = persistAthenaAuthSessionOnAppHost;
+exports.resolveAthenaAuthClientBaseUrl = resolveAthenaAuthClientBaseUrl;
+exports.resolveAthenaAuthRequestUrl = resolveAthenaAuthRequestUrl;
+exports.resolveAthenaAuthUpstreamUrl = resolveAthenaAuthUpstreamUrl;
+exports.resolveAuthViewFromSegment = resolveAuthViewFromSegment;
+exports.resolveEmailVerificationCallbackUrl = resolveEmailVerificationCallbackUrl;
+exports.resolveSessionBridgePayload = resolveSessionBridgePayload;
+exports.shouldRedirectAuthenticatedAuthView = shouldRedirectAuthenticatedAuthView;
 //# sourceMappingURL=client.cjs.map
 //# sourceMappingURL=client.cjs.map