@xylex-group/athena 2.4.0 → 2.6.0

package/dist/index.js

@@ -130,12 +130,685 @@ function buildAthenaGatewayUrl(baseUrl, path) {
   return `${baseUrl}${path}`;
 }
 
+// src/cookies/base64.ts
+function getAtob() {
+  const candidate = globalThis.atob;
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function getBtoa() {
+  const candidate = globalThis.btoa;
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function bytesToBinaryString(bytes) {
+  let result = "";
+  for (const byte of bytes) {
+    result += String.fromCharCode(byte);
+  }
+  return result;
+}
+function binaryStringToBytes(binary) {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function encodeBase64(bytes) {
+  const btoaFn = getBtoa();
+  if (btoaFn) {
+    return btoaFn(bytesToBinaryString(bytes));
+  }
+  return Buffer.from(bytes).toString("base64");
+}
+function decodeBase64(base64) {
+  const atobFn = getAtob();
+  if (atobFn) {
+    return binaryStringToBytes(atobFn(base64));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function encodeBytesToBase64Url(bytes) {
+  return encodeBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeStringToBase64Url(value) {
+  const bytes = new TextEncoder().encode(value);
+  return encodeBytesToBase64Url(bytes);
+}
+function decodeBase64UrlToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingLength = normalized.length % 4;
+  const padded = paddingLength === 0 ? normalized : `${normalized}${"=".repeat(4 - paddingLength)}`;
+  return decodeBase64(padded);
+}
+function decodeBase64UrlToString(value) {
+  return new TextDecoder().decode(decodeBase64UrlToBytes(value));
+}
+
+// src/cookies/cookie-utils.ts
+var SECURE_COOKIE_PREFIX = "__Secure-";
+function parseCookies(cookieHeader) {
+  const cookies = cookieHeader.split("; ");
+  const cookieMap = /* @__PURE__ */ new Map();
+  cookies.forEach((cookie) => {
+    const [name, value] = cookie.split(/=(.*)/s);
+    cookieMap.set(name, value);
+  });
+  return cookieMap;
+}
+
+// src/cookies/crypto.ts
+var HS256_ALG = "HS256";
+async function getSubtleCrypto() {
+  const globalCrypto = globalThis.crypto;
+  if (globalCrypto?.subtle) {
+    return globalCrypto.subtle;
+  }
+  const { webcrypto } = await import('crypto');
+  const subtle = webcrypto.subtle;
+  if (!subtle) {
+    throw new Error("Web Crypto subtle API is unavailable.");
+  }
+  return subtle;
+}
+async function importHmacKey(secret, usage) {
+  const subtle = await getSubtleCrypto();
+  return subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    {
+      name: "HMAC",
+      hash: "SHA-256"
+    },
+    false,
+    [usage]
+  );
+}
+function bufferToBytes(buffer) {
+  return new Uint8Array(buffer);
+}
+function parseJwtPayload(payloadSegment) {
+  try {
+    const decoded = decodeBase64UrlToString(payloadSegment);
+    const payload = JSON.parse(decoded);
+    if (!payload || typeof payload !== "object") {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function isJwtExpired(payload) {
+  const exp = payload.exp;
+  if (typeof exp !== "number") {
+    return false;
+  }
+  return exp < Math.floor(Date.now() / 1e3);
+}
+async function signHmacBase64Url(secret, value) {
+  const subtle = await getSubtleCrypto();
+  const key = await importHmacKey(secret, "sign");
+  const signature = await subtle.sign("HMAC", key, new TextEncoder().encode(value));
+  return encodeBytesToBase64Url(bufferToBytes(signature));
+}
+async function signJwtHS256(payload, secret, expiresIn = 60 * 5) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: HS256_ALG, typ: "JWT" };
+  const fullPayload = {
+    ...payload,
+    iat: now,
+    exp: now + expiresIn
+  };
+  const headerPart = encodeStringToBase64Url(JSON.stringify(header));
+  const payloadPart = encodeStringToBase64Url(JSON.stringify(fullPayload));
+  const message = `${headerPart}.${payloadPart}`;
+  const signature = await signHmacBase64Url(secret, message);
+  return `${message}.${signature}`;
+}
+async function verifyJwtHS256(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [headerPart, payloadPart, signaturePart] = parts;
+  if (!headerPart || !payloadPart || !signaturePart) {
+    return null;
+  }
+  let header = null;
+  try {
+    header = JSON.parse(decodeBase64UrlToString(headerPart));
+  } catch {
+    return null;
+  }
+  if (!header || header.alg !== HS256_ALG) {
+    return null;
+  }
+  const payload = parseJwtPayload(payloadPart);
+  if (!payload) {
+    return null;
+  }
+  const expectedSignature = await signHmacBase64Url(secret, `${headerPart}.${payloadPart}`);
+  if (expectedSignature !== signaturePart) {
+    return null;
+  }
+  if (isJwtExpired(payload)) {
+    return null;
+  }
+  return payload;
+}
+
+// src/cookies/session-store.ts
+var ALLOWED_COOKIE_SIZE = 4096;
+var ESTIMATED_EMPTY_COOKIE_SIZE = 200;
+var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+function getChunkIndex(cookieName) {
+  const parts = cookieName.split(".");
+  const lastPart = parts[parts.length - 1];
+  const index = parseInt(lastPart || "0", 10);
+  return Number.isNaN(index) ? 0 : index;
+}
+function readExistingChunks(cookieName, ctx) {
+  const chunks = {};
+  const cookies = parseCookies(ctx.headers?.get("cookie") || "");
+  for (const [name, value] of cookies) {
+    if (name.startsWith(cookieName)) {
+      chunks[name] = value;
+    }
+  }
+  return chunks;
+}
+function joinChunks(chunks) {
+  const sortedKeys = Object.keys(chunks).sort((left, right) => getChunkIndex(left) - getChunkIndex(right));
+  return sortedKeys.map((key) => chunks[key]).join("");
+}
+function chunkCookie(storeName, cookie, chunks, ctx) {
+  const chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE);
+  if (chunkCount === 1) {
+    chunks[cookie.name] = cookie.value;
+    return [cookie];
+  }
+  const cookies = [];
+  for (let index = 0; index < chunkCount; index++) {
+    const name = `${cookie.name}.${index}`;
+    const start = index * CHUNK_SIZE;
+    const value = cookie.value.substring(start, start + CHUNK_SIZE);
+    cookies.push({
+      ...cookie,
+      name,
+      value
+    });
+    chunks[name] = value;
+  }
+  ctx.logger?.debug?.(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {
+    message: `${storeName} cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,
+    emptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,
+    valueSize: cookie.value.length,
+    chunkCount,
+    chunks: cookies.map((entry) => entry.value.length + ESTIMATED_EMPTY_COOKIE_SIZE)
+  });
+  return cookies;
+}
+function getCleanCookies(chunks, cookieOptions) {
+  const cleanedChunks = {};
+  for (const name in chunks) {
+    cleanedChunks[name] = {
+      name,
+      value: "",
+      attributes: {
+        ...cookieOptions,
+        maxAge: 0
+      }
+    };
+  }
+  return cleanedChunks;
+}
+var storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {
+  const chunks = readExistingChunks(cookieName, ctx);
+  return {
+    getValue() {
+      return joinChunks(chunks);
+    },
+    hasChunks() {
+      return Object.keys(chunks).length > 0;
+    },
+    chunk(value, options) {
+      const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+      for (const name in chunks) {
+        delete chunks[name];
+      }
+      const cookies = cleanedChunks;
+      const chunked = chunkCookie(
+        storeName,
+        {
+          name: cookieName,
+          value,
+          attributes: {
+            ...cookieOptions,
+            ...options
+          }
+        },
+        chunks,
+        ctx
+      );
+      for (const chunk of chunked) {
+        cookies[chunk.name] = chunk;
+      }
+      return Object.values(cookies);
+    },
+    clean() {
+      const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+      for (const name in chunks) {
+        delete chunks[name];
+      }
+      return Object.values(cleanedChunks);
+    },
+    setCookies(cookies) {
+      for (const cookie of cookies) {
+        ctx.setCookie(cookie.name, cookie.value, cookie.attributes);
+      }
+    }
+  };
+};
+var createSessionStore = storeFactory("Session");
+var createAccountStore = storeFactory("Account");
+
+// src/cookies/index.ts
+var DEFAULT_COOKIE_PREFIX = "athena-auth";
+var LEGACY_COOKIE_PREFIX = "better-auth";
+var DEFAULT_SESSION_MAX_AGE = 7 * 24 * 60 * 60;
+var DEFAULT_CACHE_MAX_AGE = 60 * 5;
+function isProductionRuntime() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function getEnvironmentSecret() {
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  return process.env?.ATHENA_AUTH_SECRET || process.env?.BETTER_AUTH_SECRET || process.env?.AUTH_SECRET;
+}
+function isDynamicBaseURLConfig(baseURL) {
+  return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts);
+}
+function resolveCookiePrefixes(primaryPrefix) {
+  const prefixes = [primaryPrefix];
+  if (!prefixes.includes(DEFAULT_COOKIE_PREFIX)) {
+    prefixes.push(DEFAULT_COOKIE_PREFIX);
+  }
+  if (!prefixes.includes(LEGACY_COOKIE_PREFIX)) {
+    prefixes.push(LEGACY_COOKIE_PREFIX);
+  }
+  return prefixes;
+}
+function createError(message) {
+  return new Error(`@xylex-group/athena/cookies: ${message}`);
+}
+function getSecretOrThrow(secret) {
+  const resolved = secret || getEnvironmentSecret();
+  if (!resolved) {
+    throw createError(
+      "getCookieCache requires a secret. Pass `secret` or set ATHENA_AUTH_SECRET/BETTER_AUTH_SECRET/AUTH_SECRET."
+    );
+  }
+  return resolved;
+}
+function asObject(value) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  return value;
+}
+function getSessionTokenFromPair(session) {
+  const token = session.session?.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw createError("setSessionCookie requires `session.session.token` to be a non-empty string.");
+  }
+  return token;
+}
+async function resolveCookieVersion(versionConfig, session, user) {
+  if (!versionConfig) {
+    return "1";
+  }
+  if (typeof versionConfig === "string") {
+    return versionConfig;
+  }
+  return versionConfig(session, user);
+}
+function getSessionCookieCacheName(cookiePrefix, cookieName, isSecure) {
+  return isSecure ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}`;
+}
+async function setCookieValue(ctx, name, value, attributes) {
+  const secret = ctx.context.secret;
+  if (secret && typeof ctx.setSignedCookie === "function") {
+    await ctx.setSignedCookie(name, value, secret, attributes);
+    return;
+  }
+  ctx.setCookie(name, value, attributes);
+}
+function parseJsonSafely(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+function getIsSecureCookie(config) {
+  if (config?.isSecure !== void 0) {
+    return config.isSecure;
+  }
+  return isProductionRuntime();
+}
+function createCookieGetter(options) {
+  const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0;
+  const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0;
+  const secure = options.advanced?.useSecureCookies !== void 0 ? options.advanced.useSecureCookies : dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("https://") : isProductionRuntime();
+  const secureCookiePrefix = secure ? SECURE_COOKIE_PREFIX : "";
+  const crossSubdomainEnabled = !!options.advanced?.crossSubDomainCookies?.enabled;
+  const domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain || (baseURLString ? new URL(baseURLString).hostname : void 0) : void 0;
+  if (crossSubdomainEnabled && !domain && !isDynamicBaseURLConfig(options.baseURL)) {
+    throw createError("baseURL is required when `crossSubDomainCookies.enabled` is true.");
+  }
+  function createCookie(cookieName, overrideAttributes = {}) {
+    const prefix = options.advanced?.cookiePrefix || DEFAULT_COOKIE_PREFIX;
+    const name = options.advanced?.cookies?.[cookieName]?.name || `${prefix}.${cookieName}`;
+    const attributes = options.advanced?.cookies?.[cookieName]?.attributes || {};
+    return {
+      name: `${secureCookiePrefix}${name}`,
+      attributes: {
+        secure: !!secureCookiePrefix,
+        sameSite: "lax",
+        path: "/",
+        httpOnly: true,
+        ...crossSubdomainEnabled ? { domain } : {},
+        ...options.advanced?.defaultCookieAttributes,
+        ...overrideAttributes,
+        ...attributes
+      }
+    };
+  }
+  return createCookie;
+}
+function getCookies(options) {
+  const createCookie = createCookieGetter(options);
+  const sessionToken = createCookie("session_token", { maxAge: options.session?.expiresIn || DEFAULT_SESSION_MAX_AGE });
+  const sessionData = createCookie("session_data", { maxAge: options.session?.cookieCache?.maxAge || DEFAULT_CACHE_MAX_AGE });
+  const accountData = createCookie("account_data", { maxAge: options.session?.cookieCache?.maxAge || DEFAULT_CACHE_MAX_AGE });
+  const dontRememberToken = createCookie("dont_remember");
+  return {
+    sessionToken: {
+      name: sessionToken.name,
+      attributes: sessionToken.attributes
+    },
+    sessionData: {
+      name: sessionData.name,
+      attributes: sessionData.attributes
+    },
+    dontRememberToken: {
+      name: dontRememberToken.name,
+      attributes: dontRememberToken.attributes
+    },
+    accountData: {
+      name: accountData.name,
+      attributes: accountData.attributes
+    }
+  };
+}
+async function setCookieCache(ctx, session, dontRememberMe) {
+  const cookieCacheConfig = ctx.context.options?.session?.cookieCache;
+  if (!cookieCacheConfig?.enabled) {
+    return;
+  }
+  const version = await resolveCookieVersion(
+    cookieCacheConfig.version,
+    session.session,
+    session.user
+  );
+  const sessionData = {
+    session: session.session,
+    user: session.user,
+    updatedAt: Date.now(),
+    version
+  };
+  const baseAttributes = ctx.context.authCookies.sessionData.attributes;
+  const maxAge = dontRememberMe ? void 0 : baseAttributes.maxAge;
+  const options = {
+    ...baseAttributes,
+    maxAge
+  };
+  const expiresAt = Date.now() + (options.maxAge || 60) * 1e3;
+  const strategy = cookieCacheConfig.strategy || "compact";
+  const secret = getSecretOrThrow(ctx.context.secret);
+  let encoded;
+  if (strategy === "jwt") {
+    encoded = await signJwtHS256(sessionData, secret, options.maxAge || DEFAULT_CACHE_MAX_AGE);
+  } else if (strategy === "jwe") {
+    throw createError("`jwe` strategy is not supported by the SDK cookie helper.");
+  } else {
+    const signature = await signHmacBase64Url(
+      secret,
+      JSON.stringify({
+        ...sessionData,
+        expiresAt
+      })
+    );
+    encoded = encodeStringToBase64Url(
+      JSON.stringify({
+        session: sessionData,
+        expiresAt,
+        signature
+      })
+    );
+  }
+  if (encoded.length > 4093) {
+    const store = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+    const cookies = store.chunk(encoded, options);
+    store.setCookies(cookies);
+  } else {
+    const store = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+    if (store.hasChunks()) {
+      store.setCookies(store.clean());
+    }
+    ctx.setCookie(ctx.context.authCookies.sessionData.name, encoded, options);
+  }
+}
+async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
+  if (dontRememberMe === void 0 && typeof ctx.getSignedCookie === "function" && ctx.context.secret) {
+    const existingFlag = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
+    dontRememberMe = !!existingFlag;
+  }
+  const resolvedDontRememberMe = dontRememberMe ?? false;
+  const token = getSessionTokenFromPair(session);
+  const options = ctx.context.authCookies.sessionToken.attributes;
+  const maxAge = resolvedDontRememberMe ? void 0 : ctx.context.sessionConfig?.expiresIn;
+  await setCookieValue(ctx, ctx.context.authCookies.sessionToken.name, token, {
+    ...options,
+    maxAge,
+    ...overrides
+  });
+  if (resolvedDontRememberMe) {
+    await setCookieValue(
+      ctx,
+      ctx.context.authCookies.dontRememberToken.name,
+      "true",
+      ctx.context.authCookies.dontRememberToken.attributes
+    );
+  }
+  await setCookieCache(ctx, session, resolvedDontRememberMe);
+  ctx.context.setNewSession?.(session);
+}
+function expireCookie(ctx, cookie) {
+  ctx.setCookie(cookie.name, "", {
+    ...cookie.attributes,
+    maxAge: 0
+  });
+}
+function deleteSessionCookie(ctx, skipDontRememberMe) {
+  expireCookie(ctx, ctx.context.authCookies.sessionToken);
+  expireCookie(ctx, ctx.context.authCookies.sessionData);
+  if (ctx.context.options?.account?.storeAccountCookie) {
+    expireCookie(ctx, ctx.context.authCookies.accountData);
+    const accountStore = createAccountStore(
+      ctx.context.authCookies.accountData.name,
+      ctx.context.authCookies.accountData.attributes,
+      ctx
+    );
+    accountStore.setCookies(accountStore.clean());
+  }
+  const sessionStore = createSessionStore(
+    ctx.context.authCookies.sessionData.name,
+    ctx.context.authCookies.sessionData.attributes,
+    ctx
+  );
+  sessionStore.setCookies(sessionStore.clean());
+  if (!skipDontRememberMe) {
+    expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
+  }
+}
+var getSessionCookie = (request, config) => {
+  const cookies = (request instanceof Headers || !("headers" in request) ? request : request.headers).get("cookie");
+  if (!cookies) {
+    return null;
+  }
+  const { cookieName = "session_token", cookiePrefix = "athena-auth" } = config || {};
+  const parsedCookie = parseCookies(cookies);
+  const getCookie = (name) => parsedCookie.get(name) || parsedCookie.get(`${SECURE_COOKIE_PREFIX}${name}`);
+  const sessionToken = getCookie(`${cookiePrefix}.${cookieName}`) || getCookie(`${cookiePrefix}-${cookieName}`);
+  if (sessionToken) {
+    return sessionToken;
+  }
+  return null;
+};
+var getCookieCache = async (request, config) => {
+  const headers = request instanceof Headers || !("headers" in request) ? request : request.headers;
+  const cookieHeader = headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  const parsedCookie = parseCookies(cookieHeader);
+  const cookieName = config?.cookieName || "session_data";
+  const requestedPrefix = config?.cookiePrefix || DEFAULT_COOKIE_PREFIX;
+  const strategy = config?.strategy || "compact";
+  const cookiePrefixes = resolveCookiePrefixes(requestedPrefix);
+  const isSecure = getIsSecureCookie(config);
+  const secret = getSecretOrThrow(config?.secret);
+  let sessionData;
+  for (const prefix of cookiePrefixes) {
+    const candidate = getSessionCookieCacheName(prefix, cookieName, isSecure);
+    const cookieValue = parsedCookie.get(candidate);
+    if (cookieValue) {
+      sessionData = cookieValue;
+      break;
+    }
+  }
+  if (!sessionData) {
+    const reconstructedChunks = [];
+    for (const prefix of cookiePrefixes) {
+      const candidate = getSessionCookieCacheName(prefix, cookieName, isSecure);
+      for (const [name, value] of parsedCookie.entries()) {
+        if (!name.startsWith(`${candidate}.`)) {
+          continue;
+        }
+        const parts = name.split(".");
+        const indexStr = parts[parts.length - 1];
+        const index = parseInt(indexStr || "0", 10);
+        if (!Number.isNaN(index)) {
+          reconstructedChunks.push({ index, value });
+        }
+      }
+      if (reconstructedChunks.length > 0) {
+        break;
+      }
+    }
+    if (reconstructedChunks.length > 0) {
+      reconstructedChunks.sort((left, right) => left.index - right.index);
+      sessionData = reconstructedChunks.map((chunk) => chunk.value).join("");
+    }
+  }
+  if (!sessionData) {
+    return null;
+  }
+  if (strategy === "jwe") {
+    throw createError(
+      "`jwe` strategy is not supported by the SDK cookie helper. Use compact/jwt or pass cookie data through the auth server."
+    );
+  }
+  if (strategy === "jwt") {
+    const payload = await verifyJwtHS256(sessionData, secret);
+    if (!payload) {
+      return null;
+    }
+    const sessionRecord = asObject(payload.session);
+    const userRecord = asObject(payload.user);
+    const updatedAt = payload.updatedAt;
+    if (!sessionRecord || !userRecord || typeof updatedAt !== "number") {
+      return null;
+    }
+    if (config?.version) {
+      const cookieVersion = typeof payload.version === "string" ? payload.version : "1";
+      const expectedVersion = typeof config.version === "string" ? config.version : await config.version(sessionRecord, userRecord);
+      if (cookieVersion !== expectedVersion) {
+        return null;
+      }
+    }
+    return {
+      session: sessionRecord,
+      user: userRecord,
+      updatedAt,
+      version: typeof payload.version === "string" ? payload.version : void 0
+    };
+  }
+  const compactPayload = parseJsonSafely(decodeBase64UrlToString(sessionData));
+  if (!compactPayload) {
+    return null;
+  }
+  const expectedSignature = await signHmacBase64Url(
+    secret,
+    JSON.stringify({
+      ...compactPayload.session,
+      expiresAt: compactPayload.expiresAt
+    })
+  );
+  if (expectedSignature !== compactPayload.signature) {
+    return null;
+  }
+  if (compactPayload.expiresAt <= Date.now()) {
+    return null;
+  }
+  const resolvedSession = compactPayload.session;
+  if (config?.version) {
+    const cookieVersion = resolvedSession.version || "1";
+    const expectedVersion = typeof config.version === "string" ? config.version : await config.version(resolvedSession.session, resolvedSession.user);
+    if (cookieVersion !== expectedVersion) {
+      return null;
+    }
+  }
+  const sessionObject = asObject(resolvedSession.session);
+  const userObject = asObject(resolvedSession.user);
+  if (!sessionObject || !userObject) {
+    return null;
+  }
+  return {
+    session: sessionObject,
+    user: userObject,
+    updatedAt: resolvedSession.updatedAt,
+    version: resolvedSession.version
+  };
+};
+
+// package.json
+var package_default = {
+  version: "2.6.0"
+};
+
+// src/sdk-version.ts
+var PACKAGE_VERSION = package_default.version;
+function buildSdkHeaderValue(sdkName) {
+  return `${sdkName} ${PACKAGE_VERSION}`;
+}
+
 // src/gateway/client.ts
 var DEFAULT_CLIENT = "railway_direct";
-var FALLBACK_SDK_VERSION = "1.3.0";
 var SDK_NAME = "xylex-group/athena";
-var SDK_VERSION = typeof process !== "undefined" && process?.env?.npm_package_version ? process.env.npm_package_version : FALLBACK_SDK_VERSION;
-var SDK_HEADER_VALUE = `${SDK_NAME} ${SDK_VERSION}`;
+var SDK_HEADER_VALUE = buildSdkHeaderValue(SDK_NAME);
 function parseResponseBody(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -154,6 +827,37 @@ function parseResponseBody(rawText, contentType) {
 function normalizeHeaderValue(value) {
   return value ? value : void 0;
 }
+function resolveHeaderValue(headers, candidates) {
+  for (const candidate of candidates) {
+    const direct = normalizeHeaderValue(headers[candidate]);
+    if (direct) return direct;
+  }
+  const loweredCandidates = new Set(candidates.map((candidate) => candidate.toLowerCase()));
+  for (const [key, value] of Object.entries(headers)) {
+    if (!loweredCandidates.has(key.toLowerCase())) {
+      continue;
+    }
+    const normalized = normalizeHeaderValue(value);
+    if (normalized) return normalized;
+  }
+  return void 0;
+}
+function resolveBearerTokenFromAuthorizationHeader(headers) {
+  const authorization = resolveHeaderValue(headers, ["Authorization"]);
+  if (!authorization) {
+    return void 0;
+  }
+  const match = authorization.match(/^Bearer\s+(.+)$/i);
+  const token = match?.[1]?.trim();
+  return token ? token : void 0;
+}
+function resolveSessionTokenFromCookieHeader(headers) {
+  const cookie = resolveHeaderValue(headers, ["Cookie"]);
+  if (!cookie) {
+    return void 0;
+  }
+  return getSessionCookie(new Headers({ cookie })) ?? void 0;
+}
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -271,7 +975,7 @@ function buildRpcGetEndpoint(payload) {
           status: 0
         });
       }
-      query.set(filter.column, toRpcFilterQueryValue(filter));
+      query.append(filter.column, toRpcFilterQueryValue(filter));
     }
   }
   const endpoint = `/rpc/${encodeURIComponent(functionName)}`;
@@ -317,6 +1021,20 @@ function buildHeaders(config, options) {
     headers["apikey"] = finalApiKey;
     headers["x-api-key"] = headers["x-api-key"] ?? finalApiKey;
   }
+  const explicitSessionToken = resolveHeaderValue(extraHeaders, [
+    "X-Athena-Auth-Session-Token"
+  ]);
+  const derivedSessionToken = explicitSessionToken ?? resolveSessionTokenFromCookieHeader(extraHeaders);
+  if (derivedSessionToken) {
+    headers["X-Athena-Auth-Session-Token"] = derivedSessionToken;
+  }
+  const explicitBearerToken = resolveHeaderValue(extraHeaders, [
+    "X-Athena-Auth-Bearer-Token"
+  ]);
+  const derivedBearerToken = explicitBearerToken ?? resolveBearerTokenFromAuthorizationHeader(extraHeaders);
+  if (derivedBearerToken) {
+    headers["X-Athena-Auth-Bearer-Token"] = derivedBearerToken;
+  }
   const athenaClientKeys = ["x-athena-client", "X-Athena-Client"];
   Object.entries(extraHeaders).forEach(([key, value]) => {
     if (athenaClientKeys.includes(key)) return;
@@ -1012,10 +1730,8 @@ async function resolveReactEmailPayloadFields(input, fields, options) {
 
 // src/auth/client.ts
 var DEFAULT_AUTH_BASE_URL = "http://localhost:3001/api/auth";
-var FALLBACK_SDK_VERSION2 = "1.0.0";
 var SDK_NAME2 = "xylex-group/athena-auth";
-var SDK_VERSION2 = typeof process !== "undefined" && process?.env?.npm_package_version ? process.env.npm_package_version : FALLBACK_SDK_VERSION2;
-var SDK_HEADER_VALUE2 = `${SDK_NAME2} ${SDK_VERSION2}`;
+var SDK_HEADER_VALUE2 = buildSdkHeaderValue(SDK_NAME2);
 function normalizeBaseUrl(baseUrl) {
   return (baseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/$/, "");
 }
@@ -2655,47 +3371,739 @@ function createDbModule(input) {
   return db;
 }
 
-// src/query-ast.ts
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var FILTER_OPERATORS = /* @__PURE__ */ new Set([
-  "eq",
-  "neq",
-  "gt",
-  "gte",
-  "lt",
-  "lte",
-  "like",
-  "ilike",
-  "is",
-  "in",
-  "contains",
-  "containedBy"
-]);
-var BOOLEAN_SAFE_OPERATORS = /* @__PURE__ */ new Set([
-  "eq",
-  "neq",
-  "gt",
-  "gte",
-  "lt",
-  "lte",
-  "like",
-  "ilike",
-  "is"
-]);
-function isRecord5(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function isUuidString(value) {
-  return UUID_PATTERN.test(value.trim());
-}
-function isUuidIdentifierColumn(column) {
-  return column === "id" || /(?:^|_)uuid(?:_|$)/i.test(column) || /_id$/i.test(column);
-}
-function shouldUseUuidTextComparison(column, value) {
+// src/storage/module.ts
+var storageSdkManifest = {
+  namespace: "storage",
+  basePath: "/storage",
+  envelopeKinds: {
+    raw: "response body is the payload",
+    athena: "response body is { status, message, data }"
+  },
+  methods: [
+    {
+      name: "listStorageCatalogs",
+      method: "GET",
+      path: "/storage/catalogs",
+      responseEnvelope: "raw",
+      responseType: "{ data: S3CatalogItem[] }"
+    },
+    {
+      name: "createStorageCatalog",
+      method: "POST",
+      path: "/storage/catalogs",
+      requestType: "CreateStorageCatalogRequest",
+      responseEnvelope: "raw",
+      responseType: "S3CatalogItem"
+    },
+    {
+      name: "updateStorageCatalog",
+      method: "PATCH",
+      path: "/storage/catalogs/{id}",
+      pathParams: ["id"],
+      requestType: "UpdateStorageCatalogRequest",
+      responseEnvelope: "raw",
+      responseType: "S3CatalogItem"
+    },
+    {
+      name: "deleteStorageCatalog",
+      method: "DELETE",
+      path: "/storage/catalogs/{id}",
+      pathParams: ["id"],
+      responseEnvelope: "raw",
+      responseType: "{ id: string; deleted: boolean }"
+    },
+    {
+      name: "listStorageCredentials",
+      method: "GET",
+      path: "/storage/credentials",
+      responseEnvelope: "raw",
+      responseType: "{ data: S3CredentialListItem[] }"
+    },
+    {
+      name: "createStorageUploadUrl",
+      method: "POST",
+      path: "/storage/files/upload-url",
+      requestType: "CreateStorageUploadUrlRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageUploadUrlResponse"
+    },
+    {
+      name: "createStorageUploadUrls",
+      method: "POST",
+      path: "/storage/files/upload-urls",
+      requestType: "CreateStorageUploadUrlsRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageBatchUploadUrlResponse"
+    },
+    {
+      name: "listStorageFiles",
+      method: "POST",
+      path: "/storage/files/list",
+      requestType: "ListStorageFilesRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageListFilesResponse"
+    },
+    {
+      name: "getStorageFile",
+      method: "GET",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "getStorageFileUrl",
+      method: "GET",
+      path: "/storage/files/{file_id}/url",
+      pathParams: ["file_id"],
+      queryParams: ["purpose"],
+      responseEnvelope: "athena",
+      responseType: "PresignedFileUrlResponse"
+    },
+    {
+      name: "getStorageFileProxy",
+      method: "GET",
+      path: "/storage/files/{file_id}/proxy",
+      pathParams: ["file_id"],
+      queryParams: ["purpose"],
+      responseEnvelope: "raw",
+      responseType: "Response",
+      binary: true
+    },
+    {
+      name: "updateStorageFile",
+      method: "PATCH",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      requestType: "UpdateStorageFileRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "deleteStorageFile",
+      method: "DELETE",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "setStorageFileVisibility",
+      method: "PATCH",
+      path: "/storage/files/{file_id}/visibility",
+      pathParams: ["file_id"],
+      requestType: "SetStorageFileVisibilityRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "deleteStorageFolder",
+      method: "POST",
+      path: "/storage/folders/delete",
+      requestType: "DeleteStorageFolderRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFolderMutationResponse"
+    },
+    {
+      name: "moveStorageFolder",
+      method: "POST",
+      path: "/storage/folders/move",
+      requestType: "MoveStorageFolderRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFolderMutationResponse"
+    }
+  ]
+};
+var AthenaStorageErrorCode = {
+  InvalidUrl: "INVALID_URL",
+  NetworkError: "NETWORK_ERROR",
+  HttpError: "HTTP_ERROR",
+  InvalidJson: "INVALID_JSON",
+  InvalidAthenaEnvelope: "INVALID_ATHENA_ENVELOPE",
+  UnknownError: "UNKNOWN_ERROR"
+};
+var AthenaStorageError = class extends Error {
+  code;
+  athenaCode;
+  kind;
+  category;
+  retryable;
+  status;
+  endpoint;
+  method;
+  requestId;
+  hint;
+  causeDetail;
+  raw;
+  normalized;
+  __athenaNormalizedError;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "AthenaStorageError";
+    this.code = input.code;
+    this.status = input.status;
+    this.endpoint = input.endpoint;
+    this.method = input.method;
+    this.requestId = input.requestId;
+    this.hint = input.hint;
+    this.causeDetail = causeToString(input.cause);
+    this.raw = input.raw ?? null;
+    this.normalized = normalizeStorageErrorInput(input);
+    this.__athenaNormalizedError = this.normalized;
+    this.athenaCode = this.normalized.code;
+    this.kind = this.normalized.kind;
+    this.category = this.normalized.category;
+    this.retryable = this.normalized.retryable;
+    Object.defineProperty(this, "__athenaNormalizedError", {
+      value: this.normalized,
+      enumerable: false,
+      configurable: false,
+      writable: false
+    });
+  }
+  toDetails() {
+    return {
+      code: this.code,
+      athenaCode: this.athenaCode,
+      kind: this.kind,
+      category: this.category,
+      retryable: this.retryable,
+      message: this.message,
+      status: this.status,
+      endpoint: this.endpoint,
+      method: this.method,
+      requestId: this.requestId,
+      hint: this.hint,
+      cause: this.causeDetail,
+      raw: this.raw
+    };
+  }
+};
+function isRecord5(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function causeToString(cause) {
+  if (cause === void 0 || cause === null) return void 0;
+  if (typeof cause === "string") return cause;
+  if (cause instanceof Error && cause.message.trim()) return cause.message.trim();
+  try {
+    return JSON.stringify(cause);
+  } catch {
+    return String(cause);
+  }
+}
+function storageGatewayCode(code) {
+  if (code === "INVALID_URL") return "INVALID_URL";
+  if (code === "NETWORK_ERROR") return "NETWORK_ERROR";
+  if (code === "INVALID_JSON" || code === "INVALID_ATHENA_ENVELOPE") return "INVALID_JSON";
+  if (code === "HTTP_ERROR") return "HTTP_ERROR";
+  return "UNKNOWN_ERROR";
+}
+function headerValue(headers, names) {
+  for (const name of names) {
+    const value = headers.get(name);
+    if (value?.trim()) return value.trim();
+  }
+  return void 0;
+}
+function storageOperationFromEndpoint(endpoint, method) {
+  const endpointPath = String(endpoint).split("?")[0];
+  for (const candidate of storageSdkManifest.methods) {
+    if (candidate.method !== method) continue;
+    const pattern = `^${candidate.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^/]+\\\}/g, "[^/]+")}$`;
+    if (new RegExp(pattern).test(endpointPath)) {
+      return candidate.name;
+    }
+  }
+  return `storage:${method.toLowerCase()}`;
+}
+function normalizeStorageErrorInput(input) {
+  return normalizeAthenaError(
+    {
+      data: null,
+      error: {
+        message: input.message,
+        gatewayCode: storageGatewayCode(input.code),
+        status: input.status,
+        raw: input.raw ?? input.cause ?? null
+      },
+      errorDetails: {
+        code: storageGatewayCode(input.code),
+        message: input.message,
+        status: input.status,
+        endpoint: input.endpoint,
+        method: input.method,
+        requestId: input.requestId,
+        hint: input.hint,
+        cause: causeToString(input.cause)
+      },
+      raw: input.raw ?? input.cause ?? null,
+      status: input.status
+    },
+    { operation: storageOperationFromEndpoint(input.endpoint, input.method) }
+  );
+}
+function createAthenaStorageError(input) {
+  return new AthenaStorageError(input);
+}
+async function notifyStorageError(error, options, runtimeOptions) {
+  const handlers = [runtimeOptions?.onError, options?.onError].filter(
+    (handler) => typeof handler === "function"
+  );
+  for (const handler of handlers) {
+    try {
+      await handler(error);
+    } catch {
+    }
+  }
+}
+async function rejectStorageError(input, options, runtimeOptions) {
+  const error = createAthenaStorageError(input);
+  await notifyStorageError(error, options, runtimeOptions);
+  throw error;
+}
+function parseResponseBody3(rawText, contentType) {
+  if (!rawText) {
+    return { parsed: null, parseFailed: false };
+  }
+  const contentTypeSuggestsJson = contentType?.toLowerCase().includes("application/json") ?? false;
+  const looksJson = contentTypeSuggestsJson || rawText.startsWith("{") || rawText.startsWith("[");
+  if (!looksJson) {
+    return { parsed: rawText, parseFailed: false };
+  }
+  try {
+    return { parsed: JSON.parse(rawText), parseFailed: false };
+  } catch {
+    return { parsed: rawText, parseFailed: true };
+  }
+}
+function appendQuery(path, query) {
+  if (!query) return path;
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null) continue;
+    params.set(key, String(value));
+  }
+  const queryText = params.toString();
+  return queryText ? `${path}?${queryText}` : path;
+}
+function storagePath(path) {
+  return path;
+}
+function withPathParam(path, name, value) {
+  return path.replace(`{${name}}`, encodeURIComponent(value));
+}
+function resolveErrorMessage3(payload, fallback) {
+  if (isRecord5(payload)) {
+    const message = payload.message ?? payload.error ?? payload.details;
+    if (typeof message === "string" && message.trim()) {
+      return message.trim();
+    }
+  }
+  if (typeof payload === "string" && payload.trim()) {
+    return payload.trim();
+  }
+  return fallback;
+}
+function resolveErrorHint2(payload) {
+  if (!isRecord5(payload)) return void 0;
+  const hint = payload.hint ?? payload.suggestion;
+  return typeof hint === "string" && hint.trim() ? hint.trim() : void 0;
+}
+function resolveErrorCause(payload) {
+  if (!isRecord5(payload)) return void 0;
+  const cause = payload.cause ?? payload.reason;
+  return typeof cause === "string" && cause.trim() ? cause.trim() : void 0;
+}
+function storageCodeFromUnknown(error) {
+  if (isAthenaGatewayError(error)) {
+    if (error.code === "INVALID_URL") return "INVALID_URL";
+    if (error.code === "NETWORK_ERROR") return "NETWORK_ERROR";
+    if (error.code === "INVALID_JSON") return "INVALID_JSON";
+    if (error.code === "HTTP_ERROR") return "HTTP_ERROR";
+  }
+  return "UNKNOWN_ERROR";
+}
+async function callStorageEndpoint(gateway, endpoint, method, envelope, payload, options, runtimeOptions) {
+  let url;
+  let headers;
+  try {
+    const baseUrl = options?.baseUrl ? normalizeAthenaGatewayBaseUrl(options.baseUrl) : gateway.baseUrl;
+    url = buildAthenaGatewayUrl(baseUrl, endpoint);
+    headers = gateway.buildHeaders(options);
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: storageCodeFromUnknown(error),
+        message: error instanceof Error ? error.message : `Athena storage ${method} ${endpoint} failed before sending the request`,
+        status: isAthenaGatewayError(error) ? error.status : 0,
+        endpoint,
+        method,
+        raw: error,
+        requestId: isAthenaGatewayError(error) ? error.requestId : void 0,
+        hint: isAthenaGatewayError(error) ? error.hint : void 0,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  const requestInit = {
+    method,
+    headers,
+    signal: options?.signal
+  };
+  if (payload !== void 0 && method !== "GET") {
+    requestInit.body = JSON.stringify(payload);
+  }
+  let response;
+  try {
+    response = await fetch(url, requestInit);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Network error while calling Athena storage ${method} ${endpoint}: ${message}`,
+        status: 0,
+        endpoint,
+        method,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  let rawText;
+  try {
+    rawText = await response.text();
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Athena storage ${method} ${endpoint} response body could not be read`,
+        status: response.status,
+        endpoint,
+        method,
+        requestId: headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]),
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  const parsedBody = parseResponseBody3(rawText ?? "", response.headers.get("content-type"));
+  const requestId = headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]);
+  if (parsedBody.parseFailed) {
+    return rejectStorageError(
+      {
+        code: "INVALID_JSON",
+        message: `Athena storage ${method} ${endpoint} returned malformed JSON`,
+        status: response.status,
+        endpoint,
+        method,
+        requestId,
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (!response.ok) {
+    return rejectStorageError(
+      {
+        code: "HTTP_ERROR",
+        message: resolveErrorMessage3(
+          parsedBody.parsed,
+          `Athena storage ${method} ${endpoint} failed with status ${response.status}`
+        ),
+        status: response.status,
+        endpoint,
+        method,
+        requestId,
+        hint: resolveErrorHint2(parsedBody.parsed),
+        cause: resolveErrorCause(parsedBody.parsed),
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (envelope === "athena") {
+    if (!isRecord5(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
+      return rejectStorageError(
+        {
+          code: "INVALID_ATHENA_ENVELOPE",
+          message: `Athena storage ${method} ${endpoint} returned an invalid Athena envelope`,
+          status: response.status,
+          endpoint,
+          method,
+          requestId,
+          raw: parsedBody.parsed
+        },
+        options,
+        runtimeOptions
+      );
+    }
+    return parsedBody.parsed.data;
+  }
+  return parsedBody.parsed;
+}
+async function callStorageBinaryEndpoint(gateway, endpoint, method, options, runtimeOptions) {
+  let url;
+  let headers;
+  try {
+    const baseUrl = options?.baseUrl ? normalizeAthenaGatewayBaseUrl(options.baseUrl) : gateway.baseUrl;
+    url = buildAthenaGatewayUrl(baseUrl, endpoint);
+    headers = gateway.buildHeaders(options);
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: storageCodeFromUnknown(error),
+        message: error instanceof Error ? error.message : `Athena storage ${method} ${endpoint} failed before sending the request`,
+        status: isAthenaGatewayError(error) ? error.status : 0,
+        endpoint,
+        method,
+        raw: error,
+        requestId: isAthenaGatewayError(error) ? error.requestId : void 0,
+        hint: isAthenaGatewayError(error) ? error.hint : void 0,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method,
+      headers,
+      signal: options?.signal
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Network error while calling Athena storage ${method} ${endpoint}: ${message}`,
+        status: 0,
+        endpoint,
+        method,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (response.ok) {
+    return response;
+  }
+  const requestId = headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]);
+  let rawErrorBody = null;
+  try {
+    const rawText = await response.text();
+    const parsedBody = parseResponseBody3(rawText ?? "", response.headers.get("content-type"));
+    rawErrorBody = parsedBody.parsed;
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Athena storage ${method} ${endpoint} error response body could not be read`,
+        status: response.status,
+        endpoint,
+        method,
+        requestId,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  return rejectStorageError(
+    {
+      code: "HTTP_ERROR",
+      message: resolveErrorMessage3(
+        rawErrorBody,
+        `Athena storage ${method} ${endpoint} failed with status ${response.status}`
+      ),
+      status: response.status,
+      endpoint,
+      method,
+      requestId,
+      hint: resolveErrorHint2(rawErrorBody),
+      cause: resolveErrorCause(rawErrorBody),
+      raw: rawErrorBody
+    },
+    options,
+    runtimeOptions
+  );
+}
+function createStorageModule(gateway, runtimeOptions) {
+  return {
+    listStorageCatalogs(options) {
+      return callStorageEndpoint(gateway, storagePath("/storage/catalogs"), "GET", "raw", void 0, options, runtimeOptions);
+    },
+    createStorageCatalog(input, options) {
+      return callStorageEndpoint(gateway, storagePath("/storage/catalogs"), "POST", "raw", input, options, runtimeOptions);
+    },
+    updateStorageCatalog(id, input, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/catalogs/{id}", "id", id)),
+        "PATCH",
+        "raw",
+        input,
+        options,
+        runtimeOptions
+      );
+    },
+    deleteStorageCatalog(id, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/catalogs/{id}", "id", id)),
+        "DELETE",
+        "raw",
+        void 0,
+        options,
+        runtimeOptions
+      );
+    },
+    listStorageCredentials(options) {
+      return callStorageEndpoint(gateway, storagePath("/storage/credentials"), "GET", "raw", void 0, options, runtimeOptions);
+    },
+    createStorageUploadUrl(input, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath("/storage/files/upload-url"),
+        "POST",
+        "athena",
+        input,
+        options,
+        runtimeOptions
+      );
+    },
+    createStorageUploadUrls(input, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath("/storage/files/upload-urls"),
+        "POST",
+        "athena",
+        input,
+        options,
+        runtimeOptions
+      );
+    },
+    listStorageFiles(input, options) {
+      return callStorageEndpoint(gateway, storagePath("/storage/files/list"), "POST", "athena", input, options, runtimeOptions);
+    },
+    getStorageFile(fileId, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/files/{file_id}", "file_id", fileId)),
+        "GET",
+        "athena",
+        void 0,
+        options,
+        runtimeOptions
+      );
+    },
+    getStorageFileUrl(fileId, query, options) {
+      const path = appendQuery(
+        withPathParam("/storage/files/{file_id}/url", "file_id", fileId),
+        query
+      );
+      return callStorageEndpoint(gateway, storagePath(path), "GET", "athena", void 0, options, runtimeOptions);
+    },
+    getStorageFileProxy(fileId, query, options) {
+      const path = appendQuery(
+        withPathParam("/storage/files/{file_id}/proxy", "file_id", fileId),
+        query
+      );
+      return callStorageBinaryEndpoint(gateway, storagePath(path), "GET", options, runtimeOptions);
+    },
+    updateStorageFile(fileId, input, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/files/{file_id}", "file_id", fileId)),
+        "PATCH",
+        "athena",
+        input,
+        options,
+        runtimeOptions
+      );
+    },
+    deleteStorageFile(fileId, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/files/{file_id}", "file_id", fileId)),
+        "DELETE",
+        "athena",
+        void 0,
+        options,
+        runtimeOptions
+      );
+    },
+    setStorageFileVisibility(fileId, input, options) {
+      return callStorageEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/files/{file_id}/visibility", "file_id", fileId)),
+        "PATCH",
+        "athena",
+        input,
+        options,
+        runtimeOptions
+      );
+    },
+    deleteStorageFolder(input, options) {
+      return callStorageEndpoint(gateway, storagePath("/storage/folders/delete"), "POST", "athena", input, options, runtimeOptions);
+    },
+    moveStorageFolder(input, options) {
+      return callStorageEndpoint(gateway, storagePath("/storage/folders/move"), "POST", "athena", input, options, runtimeOptions);
+    }
+  };
+}
+
+// src/query-ast.ts
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var FILTER_OPERATORS = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "ilike",
+  "is",
+  "in",
+  "contains",
+  "containedBy"
+]);
+var BOOLEAN_SAFE_OPERATORS = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "ilike",
+  "is"
+]);
+function isRecord6(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isUuidString(value) {
+  return UUID_PATTERN.test(value.trim());
+}
+function isUuidIdentifierColumn(column) {
+  return column === "id" || /(?:^|_)uuid(?:_|$)/i.test(column) || /_id$/i.test(column);
+}
+function shouldUseUuidTextComparison(column, value) {
   return typeof value === "string" && isUuidString(value) && isUuidIdentifierColumn(column);
 }
 function isRelationSelectNode(value) {
-  return isRecord5(value) && isRecord5(value.select);
+  return isRecord6(value) && isRecord6(value.select);
 }
 function normalizeIdentifier(value, label) {
   const normalized = value.trim();
@@ -2751,7 +4159,7 @@ function compileRelationToken(key, node) {
   return `${prefix}${relationToken}(${nested})`;
 }
 function compileSelectShape(select) {
-  if (!isRecord5(select)) {
+  if (!isRecord6(select)) {
     throw new Error("findMany select must be an object");
   }
   const tokens = [];
@@ -2775,7 +4183,7 @@ function compileSelectShape(select) {
   return tokens.join(",");
 }
 function selectShapeUsesRelationSchema(select) {
-  if (!isRecord5(select)) {
+  if (!isRecord6(select)) {
     return false;
   }
   for (const rawValue of Object.values(select)) {
@@ -2793,7 +4201,7 @@ function selectShapeUsesRelationSchema(select) {
 }
 function compileColumnWhere(column, input) {
   const normalizedColumn = normalizeIdentifier(column, "where column");
-  if (!isRecord5(input)) {
+  if (!isRecord6(input)) {
     return [buildGatewayCondition("eq", normalizedColumn, input)];
   }
   const conditions = [];
@@ -2821,7 +4229,7 @@ function compileColumnWhere(column, input) {
   return conditions;
 }
 function compileBooleanExpressionTerms(clause, label) {
-  if (!isRecord5(clause)) {
+  if (!isRecord6(clause)) {
     throw new Error(`findMany where.${label} clauses must be objects`);
   }
   const entries = Object.entries(clause).filter(([, value]) => value !== void 0);
@@ -2830,7 +4238,7 @@ function compileBooleanExpressionTerms(clause, label) {
   }
   const [rawColumn, rawValue] = entries[0];
   const column = normalizeIdentifier(rawColumn, `where.${label} column`);
-  if (!isRecord5(rawValue)) {
+  if (!isRecord6(rawValue)) {
     return [`${column}.eq.${stringifyFilterValue(rawValue)}`];
   }
   const operatorEntries = Object.entries(rawValue).filter(([, value]) => value !== void 0);
@@ -2854,7 +4262,7 @@ function compileWhere(where) {
   if (where === void 0) {
     return void 0;
   }
-  if (!isRecord5(where)) {
+  if (!isRecord6(where)) {
     throw new Error("findMany where must be an object");
   }
   const conditions = [];
@@ -2904,7 +4312,7 @@ function compileOrderBy(orderBy) {
   if (orderBy === void 0) {
     return void 0;
   }
-  if (!isRecord5(orderBy)) {
+  if (!isRecord6(orderBy)) {
     throw new Error("findMany orderBy must be an object");
   }
   if ("column" in orderBy) {
@@ -3000,7 +4408,7 @@ function buildStructuredWhere(conditions) {
     if (!condition.column) {
       return null;
     }
-    if (condition.column_cast !== void 0 || condition.value_cast !== void 0) {
+    if (condition.value_cast !== void 0) {
       return null;
     }
     const operand = condition.value;
@@ -3079,6 +4487,104 @@ function toFindManyAstOrder(order) {
     ascending: order.direction !== "descending"
   };
 }
+function isRecord7(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeFindManyAstColumnPredicate(value) {
+  if (!isRecord7(value)) {
+    return {
+      eq: value
+    };
+  }
+  const normalized = {};
+  for (const [key, operand] of Object.entries(value)) {
+    if (operand !== void 0) {
+      normalized[key] = operand;
+    }
+  }
+  return normalized;
+}
+function normalizeFindManyAstBooleanOperand(clause) {
+  const normalized = {};
+  for (const [column, value] of Object.entries(clause)) {
+    if (value === void 0) {
+      continue;
+    }
+    normalized[column] = normalizeFindManyAstColumnPredicate(value);
+  }
+  return normalized;
+}
+function normalizeFindManyAstWhere(where) {
+  if (!where || !isRecord7(where)) {
+    return where;
+  }
+  const normalized = {};
+  for (const [key, value] of Object.entries(where)) {
+    if (value === void 0) {
+      continue;
+    }
+    if (key === "or" && Array.isArray(value)) {
+      normalized.or = value.map(
+        (clause) => normalizeFindManyAstBooleanOperand(clause)
+      );
+      continue;
+    }
+    if (key === "not" && isRecord7(value)) {
+      normalized.not = normalizeFindManyAstBooleanOperand(
+        value
+      );
+      continue;
+    }
+    normalized[key] = normalizeFindManyAstColumnPredicate(value);
+  }
+  return normalized;
+}
+function predicateRequiresUuidQueryFallback(column, value) {
+  if (!isRecord7(value)) {
+    return shouldUseUuidTextComparison(column, value);
+  }
+  const eqValue = value.eq;
+  return eqValue !== void 0 && shouldUseUuidTextComparison(column, eqValue);
+}
+function booleanOperandRequiresUuidQueryFallback(clause) {
+  for (const [column, value] of Object.entries(clause)) {
+    if (value === void 0) {
+      continue;
+    }
+    if (predicateRequiresUuidQueryFallback(column, value)) {
+      return true;
+    }
+  }
+  return false;
+}
+function findManyAstWhereRequiresLegacyTransport(where) {
+  if (!where || !isRecord7(where)) {
+    return false;
+  }
+  for (const [key, value] of Object.entries(where)) {
+    if (value === void 0) {
+      continue;
+    }
+    if (key === "or" && Array.isArray(value)) {
+      if (value.some(
+        (clause) => booleanOperandRequiresUuidQueryFallback(clause)
+      )) {
+        return true;
+      }
+      continue;
+    }
+    if (key === "not" && isRecord7(value)) {
+      if (booleanOperandRequiresUuidQueryFallback(value)) {
+        return true;
+      }
+      continue;
+    }
+    if (predicateRequiresUuidQueryFallback(key, value)) {
+      return true;
+    }
+  }
+  return false;
+}
 function resolvePagination(input) {
   let limit = input.limit;
   let offset = input.offset;
@@ -3097,25 +4603,6 @@ function hasTypedEqualityComparison(conditions) {
 }
 function createSelectTransportPlan(input) {
   const conditions = input.state.conditions.length ? input.state.conditions.map((condition) => ({ ...condition })) : void 0;
-  if (hasTypedEqualityComparison(conditions) && !input.options?.head && !input.options?.count && conditions) {
-    const query = input.buildTypedSelectQuery({
-      tableName: input.tableName,
-      columns: input.columns,
-      conditions,
-      limit: input.state.limit,
-      offset: input.state.offset,
-      currentPage: input.state.currentPage,
-      pageSize: input.state.pageSize,
-      order: input.state.order
-    });
-    if (query) {
-      return {
-        kind: "query",
-        query,
-        payload: { query }
-      };
-    }
-  }
   const pagination = resolvePagination({
     limit: input.state.limit,
     offset: input.state.offset,
@@ -3151,6 +4638,25 @@ function createSelectTransportPlan(input) {
       }
     };
   }
+  if (hasTypedEqualityComparison(conditions) && !input.options?.head && !input.options?.count && conditions) {
+    const query = input.buildTypedSelectQuery({
+      tableName: input.tableName,
+      columns: input.columns,
+      conditions,
+      limit: input.state.limit,
+      offset: input.state.offset,
+      currentPage: input.state.currentPage,
+      pageSize: input.state.pageSize,
+      order: input.state.order
+    });
+    if (query) {
+      return {
+        kind: "query",
+        query,
+        payload: { query }
+      };
+    }
+  }
   return {
     kind: "fetch",
     payload: {
@@ -3207,6 +4713,13 @@ function formatResult(response) {
   }
   return result;
 }
+var EXPERIMENTAL_READ_RETRY_CONFIG = {
+  retries: 2,
+  baseDelayMs: 100,
+  maxDelayMs: 1e3,
+  backoff: "exponential",
+  jitter: true
+};
 function attachNormalizedError(result, normalizedError) {
   Object.defineProperty(result, ATHENA_NORMALIZED_ERROR_KEY, {
     value: normalizedError,
@@ -3228,12 +4741,41 @@ function createResultFormatter(experimental) {
       },
       context
     );
-    result.error = createResultError(response, result, normalizedError);
-    attachNormalizedError(result, normalizedError);
-    return result;
-  };
+    result.error = createResultError(response, result, normalizedError);
+    attachNormalizedError(result, normalizedError);
+    return result;
+  };
+}
+async function executeExperimentalRead(experimental, runner) {
+  if (!experimental?.retryReads) {
+    return runner();
+  }
+  let lastRetryableResult;
+  let lastRetrySignal = null;
+  try {
+    return await withRetry(
+      {
+        ...EXPERIMENTAL_READ_RETRY_CONFIG,
+        shouldRetry: (error) => error === lastRetrySignal || normalizeAthenaError(error).retryable
+      },
+      async () => {
+        const result = await runner();
+        if (result.error?.retryable) {
+          lastRetryableResult = result;
+          lastRetrySignal = result.error;
+          throw lastRetrySignal;
+        }
+        return result;
+      }
+    );
+  } catch (error) {
+    if (lastRetryableResult && error === lastRetrySignal) {
+      return lastRetryableResult;
+    }
+    throw error;
+  }
 }
-function isRecord6(value) {
+function isRecord8(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function firstNonEmptyString2(...values) {
@@ -3245,8 +4787,8 @@ function firstNonEmptyString2(...values) {
   return void 0;
 }
 function resolveStructuredErrorPayload2(raw) {
-  if (!isRecord6(raw)) return null;
-  return isRecord6(raw.error) ? raw.error : raw;
+  if (!isRecord8(raw)) return null;
+  return isRecord8(raw.error) ? raw.error : raw;
 }
 function resolveStructuredErrorDetails(payload, message) {
   if (!payload || !("details" in payload)) {
@@ -3262,7 +4804,7 @@ function resolveStructuredErrorDetails(payload, message) {
   return details;
 }
 function createResultError(response, result, normalized) {
-  const rawRecord = isRecord6(response.raw) ? response.raw : null;
+  const rawRecord = isRecord8(response.raw) ? response.raw : null;
   const payload = resolveStructuredErrorPayload2(response.raw);
   const message = firstNonEmptyString2(
     response.error,
@@ -3457,7 +4999,14 @@ function toSingleResult(response) {
 function mergeOptions(...options) {
   return options.reduce((acc, next) => {
     if (!next) return acc;
-    return { ...acc, ...next };
+    const merged = { ...acc ?? {}, ...next };
+    if (acc?.headers || next.headers) {
+      merged.headers = {
+        ...acc?.headers ?? {},
+        ...next.headers ?? {}
+      };
+    }
+    return merged;
   }, void 0);
 }
 function asAthenaJsonObject(value) {
@@ -4249,42 +5798,48 @@ function createTableBuilder(tableName, client, formatGatewayResult, tracer, expe
       buildTypedSelectQuery
     });
     if (plan.kind === "query") {
-      return executeWithQueryTrace(
+      return executeExperimentalRead(
+        experimental,
+        () => executeWithQueryTrace(
+          tracer,
+          {
+            operation: "select",
+            endpoint: "/gateway/query",
+            table: resolvedTableName,
+            sql: plan.query,
+            payload: plan.payload,
+            options
+          },
+          async () => {
+            const queryResponse = await client.queryGateway(plan.payload, options);
+            return formatGatewayResult(queryResponse, { table: resolvedTableName, operation: "select" });
+          },
+          callsite
+        )
+      );
+    }
+    const sql = buildDebugSelectQuery({
+      tableName: resolvedTableName,
+      ...plan.debug
+    });
+    return executeExperimentalRead(
+      experimental,
+      () => executeWithQueryTrace(
         tracer,
         {
           operation: "select",
-          endpoint: "/gateway/query",
+          endpoint: "/gateway/fetch",
           table: resolvedTableName,
-          sql: plan.query,
+          sql,
           payload: plan.payload,
           options
         },
         async () => {
-          const queryResponse = await client.queryGateway(plan.payload, options);
-          return formatGatewayResult(queryResponse, { table: resolvedTableName, operation: "select" });
+          const response = await client.fetchGateway(plan.payload, options);
+          return formatGatewayResult(response, { table: resolvedTableName, operation: "select" });
         },
         callsite
-      );
-    }
-    const sql = buildDebugSelectQuery({
-      tableName: resolvedTableName,
-      ...plan.debug
-    });
-    return executeWithQueryTrace(
-      tracer,
-      {
-        operation: "select",
-        endpoint: "/gateway/fetch",
-        table: resolvedTableName,
-        sql,
-        payload: plan.payload,
-        options
-      },
-      async () => {
-        const response = await client.fetchGateway(plan.payload, options);
-        return formatGatewayResult(response, { table: resolvedTableName, operation: "select" });
-      },
-      callsite
+      )
     );
   };
   const createSelectChain = (columns, options, initialCallsite) => {
@@ -4354,14 +5909,14 @@ function createTableBuilder(tableName, client, formatGatewayResult, tracer, expe
       if (options.limit !== void 0) {
         executionState.limit = options.limit;
       }
-      if (experimental?.findManyAst && canUseFindManyAstTransport(baseState) && !selectShapeUsesRelationSchema(options.select)) {
+      if (experimental?.findManyAst && canUseFindManyAstTransport(baseState) && !selectShapeUsesRelationSchema(options.select) && !findManyAstWhereRequiresLegacyTransport(options.where)) {
         const resolvedTableName = resolveTableNameForCall(tableName, void 0);
         const payload = {
           table_name: resolvedTableName,
           select: options.select
         };
         if (options.where !== void 0) {
-          payload.where = options.where;
+          payload.where = normalizeFindManyAstWhere(options.where);
         }
         const astOrder = toFindManyAstOrder(executionState.order);
         if (astOrder !== void 0) {
@@ -4377,22 +5932,25 @@ function createTableBuilder(tableName, client, formatGatewayResult, tracer, expe
           limit: executionState.limit,
           order: executionState.order
         });
-        return executeWithQueryTrace(
-          tracer,
-          {
-            operation: "select",
-            endpoint: "/gateway/fetch",
-            table: resolvedTableName,
-            sql,
-            payload
-          },
-          async () => {
-            const response = await client.fetchGateway(
+        return executeExperimentalRead(
+          experimental,
+          () => executeWithQueryTrace(
+            tracer,
+            {
+              operation: "select",
+              endpoint: "/gateway/fetch",
+              table: resolvedTableName,
+              sql,
               payload
-            );
-            return formatGatewayResult(response, { table: resolvedTableName, operation: "select" });
-          },
-          callsite
+            },
+            async () => {
+              const response = await client.fetchGateway(
+                payload
+              );
+              return formatGatewayResult(response, { table: resolvedTableName, operation: "select" });
+            },
+            callsite
+          )
         );
       }
       return runSelect(
@@ -4640,7 +6198,7 @@ function createTableBuilder(tableName, client, formatGatewayResult, tracer, expe
   });
   return builder;
 }
-function createQueryBuilder(client, formatGatewayResult, tracer) {
+function createQueryBuilder(client, formatGatewayResult, experimental, tracer) {
   return async function query(query, options) {
     const normalizedQuery = query.trim();
     if (!normalizedQuery) {
@@ -4648,30 +6206,39 @@ function createQueryBuilder(client, formatGatewayResult, tracer) {
     }
     const payload = { query: normalizedQuery };
     const callsite = captureTraceCallsite(tracer);
-    return executeWithQueryTrace(
-      tracer,
-      {
-        operation: "query",
-        endpoint: "/gateway/query",
-        sql: normalizedQuery,
-        payload,
-        options
-      },
-      async () => {
-        const response = await client.queryGateway(payload, options);
-        return formatGatewayResult(response, { operation: "query" });
-      },
-      callsite
+    return executeExperimentalRead(
+      experimental,
+      () => executeWithQueryTrace(
+        tracer,
+        {
+          operation: "query",
+          endpoint: "/gateway/query",
+          sql: normalizedQuery,
+          payload,
+          options
+        },
+        async () => {
+          const response = await client.queryGateway(payload, options);
+          return formatGatewayResult(response, { operation: "query" });
+        },
+        callsite
+      )
     );
   };
 }
 function createClientFromConfig(config) {
+  const gatewayHeaders = {
+    ...config.headers ?? {}
+  };
+  if (config.auth?.bearerToken && gatewayHeaders["X-Athena-Auth-Bearer-Token"] === void 0 && gatewayHeaders["x-athena-auth-bearer-token"] === void 0) {
+    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = config.auth.bearerToken;
+  }
   const gateway = createAthenaGatewayClient({
     baseUrl: config.baseUrl,
     apiKey: config.apiKey,
     client: config.client,
     backend: config.backend,
-    headers: config.headers
+    headers: gatewayHeaders
   });
   const formatGatewayResult = createResultFormatter(config.experimental);
   const queryTracer = createQueryTracer(config.experimental);
@@ -4698,9 +6265,9 @@ function createClientFromConfig(config) {
       captureTraceCallsite(queryTracer)
     );
   };
-  const query = createQueryBuilder(gateway, formatGatewayResult, queryTracer);
+  const query = createQueryBuilder(gateway, formatGatewayResult, config.experimental, queryTracer);
   const db = createDbModule({ from, rpc, query });
-  return {
+  const sdkClient = {
     from,
     db,
     rpc,
@@ -4708,6 +6275,14 @@ function createClientFromConfig(config) {
     verifyConnection: gateway.verifyConnection,
     auth: auth.auth
   };
+  if (config.experimental?.athenaStorageBackend) {
+    const storageClient = {
+      ...sdkClient,
+      storage: createStorageModule(gateway, config.experimental.storage)
+    };
+    return storageClient;
+  }
+  return sdkClient;
 }
 var DEFAULT_BACKEND = { type: "athena" };
 function toBackendConfig(b) {
@@ -4738,6 +6313,12 @@ function mergeExperimentalOptions(current, next) {
       ...next.traceQueries
     };
   }
+  if (current?.storage || next.storage) {
+    merged.storage = {
+      ...current?.storage ?? {},
+      ...next.storage ?? {}
+    };
+  }
   return merged;
 }
 var AthenaClientBuilderImpl = class {
@@ -4748,7 +6329,6 @@ var AthenaClientBuilderImpl = class {
   defaultHeaders;
   authConfig;
   experimentalOptions;
-  isHealthTrackingEnabled = false;
   url(url) {
     this.baseUrl = url;
     return this;
@@ -4775,7 +6355,7 @@ var AthenaClientBuilderImpl = class {
   }
   experimental(options) {
     this.experimentalOptions = mergeExperimentalOptions(this.experimentalOptions, options);
-    return this;
+    return options.athenaStorageBackend ? this : this;
   }
   options(options) {
     if (options.client !== void 0) {
@@ -4796,11 +6376,7 @@ var AthenaClientBuilderImpl = class {
     if (options.experimental !== void 0) {
       this.experimentalOptions = mergeExperimentalOptions(this.experimentalOptions, options.experimental);
     }
-    return this;
-  }
-  healthTracking(enabled) {
-    this.isHealthTrackingEnabled = enabled;
-    return this;
+    return options.experimental?.athenaStorageBackend ? this : this;
   }
   build() {
     if (!this.baseUrl || !this.apiKey) {
@@ -4812,7 +6388,6 @@ var AthenaClientBuilderImpl = class {
       client: this.clientName,
       backend: this.backendConfig,
       headers: this.defaultHeaders,
-      healthTracking: this.isHealthTrackingEnabled,
       auth: this.authConfig,
       experimental: this.experimentalOptions
     });
@@ -5432,7 +7007,7 @@ function resolveNullishValue(mode) {
   if (mode === "null") return null;
   return "";
 }
-function isRecord7(value) {
+function isRecord9(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isNullableColumn(model, key) {
@@ -5441,7 +7016,7 @@ function isNullableColumn(model, key) {
 }
 function toModelFormDefaults(model, values, options) {
   const source = values;
-  if (!isRecord7(source)) {
+  if (!isRecord9(source)) {
     return {};
   }
   const mode = options?.nullishMode ?? "empty-string";
@@ -5872,6 +7447,90 @@ async function loadGeneratorConfig(options = {}) {
   }
 }
 
+// src/generator/env.ts
+function readEnvStringValue2(key) {
+  if (typeof process === "undefined" || !process.env) {
+    return void 0;
+  }
+  const value = process.env[key];
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function throwMissingEnvVar(key) {
+  throw new Error(
+    `Generator config env var ${key} is missing or empty. Set ${key} or provide a default value.`
+  );
+}
+function resolveEnvValue(key, options, resolver) {
+  const rawValue = readEnvStringValue2(key);
+  if (rawValue === void 0) {
+    if (options?.default !== void 0) {
+      return options.default;
+    }
+    if (options?.optional) {
+      return void 0;
+    }
+    return throwMissingEnvVar(key);
+  }
+  return resolver(rawValue);
+}
+function resolveStringEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => value);
+}
+function resolveBooleanEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => parseBooleanFlag2(value, false));
+}
+function resolveListEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => {
+    const separator = options?.separator ?? ",";
+    return value.split(separator).map((entry) => entry.trim()).filter((entry, index, entries) => entry.length > 0 && entries.indexOf(entry) === index);
+  })?.slice();
+}
+function resolveJsonEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => {
+    try {
+      return JSON.parse(value);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Generator config env var ${key} must contain valid JSON. ${message}`);
+    }
+  });
+}
+function resolveOneOfEnv(key, allowedValues, options) {
+  return resolveEnvValue(key, options, (value) => {
+    if (allowedValues.includes(value)) {
+      return value;
+    }
+    throw new Error(
+      `Generator config env var ${key} must be one of: ${allowedValues.join(", ")}. Received: ${value}.`
+    );
+  });
+}
+function generatorEnvString(key, options) {
+  return resolveStringEnv(key, options);
+}
+function generatorEnvBoolean(key, options) {
+  return resolveBooleanEnv(key, options);
+}
+function generatorEnvList(key, options) {
+  return resolveListEnv(key, options);
+}
+function generatorEnvJson(key, options) {
+  return resolveJsonEnv(key, options);
+}
+function generatorEnvOneOf(key, allowedValues, options) {
+  return resolveOneOfEnv(key, allowedValues, options);
+}
+var generatorEnv = Object.assign(generatorEnvString, {
+  boolean: generatorEnvBoolean,
+  list: generatorEnvList,
+  json: generatorEnvJson,
+  oneOf: generatorEnvOneOf
+});
+
 // src/utils/slugify.ts
 function slugify(input) {
   return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
@@ -6629,6 +8288,433 @@ async function runSchemaGenerator(options = {}) {
   };
 }
 
-export { AthenaClient, AthenaError, AthenaErrorCategory, AthenaErrorCode, AthenaErrorKind, AthenaGatewayError, Backend, DEFAULT_POSTGRES_SCHEMAS, assertInt, coerceInt, createAuthClient, createAuthReactEmailInput, createClient, createModelFormAdapter, createPostgresIntrospectionProvider, createTypedClient, defineAuthEmailTemplate, defineDatabase, defineGeneratorConfig, defineModel, defineRegistry, defineSchema, findGeneratorConfigPath, generateArtifactsFromSnapshot, identifier, isAthenaGatewayError, isOk, loadGeneratorConfig, normalizeAthenaError, normalizeAthenaGatewayBaseUrl, normalizeGeneratorConfig, normalizeSchemaSelection, parseBooleanFlag2 as parseBooleanFlag, renderAthenaReactEmail, requireAffected, requireSuccess, resolveGeneratorProvider, resolvePostgresColumnType, resolveProviderSchemas, runSchemaGenerator, toModelFormDefaults, toModelPayload, unwrap, unwrapOne, unwrapRows, verifyAthenaGatewayUrl, withRetry };
+// src/auth/server.ts
+var DEFAULT_AUTH_BASE_PATH = "/api/auth";
+var ATHENA_AUTH_BASE_ERROR_CODES = {
+  HANDLER_NOT_CONFIGURED: "HANDLER_NOT_CONFIGURED",
+  INVALID_BASE_URL: "INVALID_BASE_URL",
+  UNTRUSTED_HOST: "UNTRUSTED_HOST"
+};
+function capitalize2(value) {
+  return value.length > 0 ? `${value[0]?.toUpperCase()}${value.slice(1)}` : value;
+}
+function serializeSetCookieValue(name, value, attributes) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  const knownKeys = /* @__PURE__ */ new Set([
+    "maxAge",
+    "expires",
+    "domain",
+    "path",
+    "secure",
+    "httpOnly",
+    "partitioned",
+    "sameSite"
+  ]);
+  if (attributes.maxAge !== void 0) {
+    parts.push(`Max-Age=${Math.trunc(attributes.maxAge)}`);
+  }
+  if (attributes.expires instanceof Date) {
+    parts.push(`Expires=${attributes.expires.toUTCString()}`);
+  }
+  if (attributes.domain) {
+    parts.push(`Domain=${attributes.domain}`);
+  }
+  if (attributes.path) {
+    parts.push(`Path=${attributes.path}`);
+  }
+  if (attributes.secure) {
+    parts.push("Secure");
+  }
+  if (attributes.httpOnly) {
+    parts.push("HttpOnly");
+  }
+  if (attributes.partitioned) {
+    parts.push("Partitioned");
+  }
+  if (attributes.sameSite) {
+    parts.push(`SameSite=${capitalize2(attributes.sameSite)}`);
+  }
+  for (const [key, rawValue] of Object.entries(attributes)) {
+    if (knownKeys.has(key) || rawValue === void 0 || rawValue === null || rawValue === false) {
+      continue;
+    }
+    if (rawValue === true) {
+      parts.push(key);
+      continue;
+    }
+    parts.push(`${key}=${String(rawValue)}`);
+  }
+  return parts.join("; ");
+}
+function readCookieFromHeaders(headers, name) {
+  const cookieHeader = headers?.get("cookie");
+  if (!cookieHeader) {
+    return void 0;
+  }
+  return parseCookies(cookieHeader).get(name);
+}
+function isRecord10(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function resolveSessionCandidate(value) {
+  if (!isRecord10(value)) {
+    return null;
+  }
+  const session = isRecord10(value.session) ? value.session : void 0;
+  const user = isRecord10(value.user) ? value.user : void 0;
+  if (session && typeof session.token === "string" && session.token.length > 0 && user) {
+    return {
+      session,
+      user
+    };
+  }
+  return null;
+}
+function inferSessionPair(returned) {
+  return resolveSessionCandidate(returned) ?? (isRecord10(returned) ? resolveSessionCandidate(returned.data) : null) ?? (isRecord10(returned) ? resolveSessionCandidate(returned.session) : null);
+}
+function resolveResponseHeaders(ctx) {
+  if (ctx.context.responseHeaders instanceof Headers) {
+    return ctx.context.responseHeaders;
+  }
+  const headers = new Headers();
+  ctx.context.responseHeaders = headers;
+  return headers;
+}
+function normalizeBaseURL(baseURL) {
+  return baseURL.replace(/\/$/, "");
+}
+function normalizeBasePath(basePath) {
+  if (!basePath || basePath === "/") {
+    return DEFAULT_AUTH_BASE_PATH;
+  }
+  const normalized = basePath.startsWith("/") ? basePath : `/${basePath}`;
+  return normalized.endsWith("/") && normalized.length > 1 ? normalized.slice(0, -1) : normalized;
+}
+function isDynamicBaseURLConfig2(baseURL) {
+  return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts);
+}
+function getRequestUrl(request) {
+  try {
+    return new URL(request.url);
+  } catch {
+    return new URL("http://localhost");
+  }
+}
+function getRequestHost(request, url) {
+  const forwardedHost = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwardedHost || request.headers.get("host") || url.host;
+  return host || null;
+}
+function getRequestProtocol(request, configuredProtocol, url) {
+  if (configuredProtocol === "http" || configuredProtocol === "https") {
+    return configuredProtocol;
+  }
+  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  if (forwardedProto === "http" || forwardedProto === "https") {
+    return forwardedProto;
+  }
+  if (url.protocol === "http:" || url.protocol === "https:") {
+    return url.protocol.slice(0, -1);
+  }
+  return "http";
+}
+function resolveRequestBaseURL(baseURL, request) {
+  if (typeof baseURL === "string") {
+    return normalizeBaseURL(baseURL);
+  }
+  const requestUrl = getRequestUrl(request);
+  const host = getRequestHost(request, requestUrl);
+  if (!host) {
+    return null;
+  }
+  if (isDynamicBaseURLConfig2(baseURL)) {
+    const allowedHosts = baseURL.allowedHosts ?? [];
+    if (allowedHosts.length > 0 && !allowedHosts.includes(host)) {
+      return null;
+    }
+  }
+  const protocol = typeof baseURL === "object" && baseURL !== null ? getRequestProtocol(request, baseURL.protocol, requestUrl) : getRequestProtocol(request, void 0, requestUrl);
+  return `${protocol}://${host}`;
+}
+function getOrigin(baseURL) {
+  if (!baseURL) {
+    return void 0;
+  }
+  try {
+    return new URL(baseURL).origin;
+  } catch {
+    return void 0;
+  }
+}
+async function resolveTrustedOrigins(config, baseURL, request) {
+  const resolved = typeof config.trustedOrigins === "function" ? await config.trustedOrigins(request) : config.trustedOrigins ?? [];
+  const values = [
+    getOrigin(baseURL),
+    ...resolved
+  ];
+  return Array.from(new Set(values.filter((value) => typeof value === "string" && value.length > 0)));
+}
+async function resolveTrustedProviders(config, request) {
+  const configured = typeof config.trustedProviders === "function" ? await config.trustedProviders(request) : config.trustedProviders ?? [];
+  const values = [
+    ...Object.keys(config.socialProviders ?? {}),
+    ...configured
+  ];
+  return Array.from(new Set(values.filter((value) => typeof value === "string" && value.length > 0)));
+}
+function createJsonResponse(payload, init) {
+  const headers = new Headers(init?.headers);
+  if (!headers.has("content-type")) {
+    headers.set("content-type", "application/json; charset=utf-8");
+  }
+  return new Response(JSON.stringify(payload), {
+    ...init,
+    headers
+  });
+}
+function mergeResponseHeaders(response, headers) {
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function defineAthenaAuthConfig(config) {
+  return config;
+}
+function athenaAuth(config) {
+  const normalizedBasePath = normalizeBasePath(config.basePath);
+  const staticBaseURL = typeof config.baseURL === "string" ? normalizeBaseURL(config.baseURL) : void 0;
+  const runtime = {
+    baseURL: staticBaseURL,
+    basePath: normalizedBasePath,
+    secret: config.secret,
+    cookies: {
+      session: config.session,
+      advanced: config.advanced
+    }
+  };
+  const resolvedDatabase = typeof config.database === "function" ? config.database(runtime) : config.database;
+  const cookies = getCookies({
+    baseURL: staticBaseURL ?? config.baseURL,
+    session: config.session,
+    advanced: config.advanced
+  });
+  const auth = {};
+  const createCookieContext = (input = {}) => {
+    const responseHeaders = input.responseHeaders ?? new Headers();
+    const runtimeHeaders = input.headers;
+    const authCookies = input.cookies ?? auth.cookies;
+    const setCookie = input.setCookie ?? ((name, value, attributes) => {
+      responseHeaders.append(
+        "set-cookie",
+        serializeSetCookieValue(name, value, attributes)
+      );
+    });
+    return {
+      headers: runtimeHeaders,
+      getCookie: input.getCookie ?? ((name) => readCookieFromHeaders(runtimeHeaders, name)),
+      setCookie,
+      logger: input.logger,
+      setSignedCookie: input.setSignedCookie,
+      getSignedCookie: input.getSignedCookie,
+      context: {
+        secret: runtime.secret,
+        authCookies,
+        sessionConfig: {
+          expiresIn: config.session?.expiresIn
+        },
+        options: {
+          session: {
+            cookieCache: config.session?.cookieCache
+          },
+          account: {
+            storeAccountCookie: true
+          }
+        },
+        setNewSession: input.setNewSession
+      }
+    };
+  };
+  const setSession = async (input, session, dontRememberMe, overrides) => {
+    const cookieContext = createCookieContext(input);
+    await setSessionCookie(cookieContext, session, dontRememberMe, overrides);
+  };
+  const clearSession = (input, skipDontRememberMe) => {
+    const cookieContext = createCookieContext(input);
+    deleteSessionCookie(cookieContext, skipDontRememberMe);
+  };
+  const applyResponseCookies = async (ctx) => {
+    const responseHeaders = resolveResponseHeaders(ctx);
+    const session = ctx.context.setSession ?? inferSessionPair(ctx.context.returned);
+    if (ctx.context.clearSession) {
+      clearSession({
+        headers: ctx.headers,
+        responseHeaders
+      });
+    }
+    if (session) {
+      await setSession(
+        {
+          headers: ctx.headers,
+          responseHeaders
+        },
+        session,
+        ctx.context.dontRememberMe,
+        ctx.context.cookieOverrides
+      );
+    }
+    return responseHeaders;
+  };
+  const runAfterHooks = async (ctx) => {
+    for (const plugin of auth.plugins) {
+      for (const hook of plugin.hooks?.after ?? []) {
+        if (!hook.matcher(ctx)) {
+          continue;
+        }
+        await hook.handler({
+          ...ctx,
+          auth
+        });
+      }
+    }
+    return ctx;
+  };
+  const resolveRequestContext = async (request) => {
+    const requestUrl = getRequestUrl(request);
+    const resolvedBaseURL = resolveRequestBaseURL(config.baseURL, request);
+    if (!resolvedBaseURL) {
+      throw new Error(
+        isDynamicBaseURLConfig2(config.baseURL) ? "Could not resolve base URL from request. Check allowedHosts/baseURL." : "Could not resolve base URL from request."
+      );
+    }
+    const requestCookies = getCookies({
+      baseURL: resolvedBaseURL,
+      session: config.session,
+      advanced: config.advanced
+    });
+    const trustedOrigins = await resolveTrustedOrigins(config, resolvedBaseURL, request);
+    const trustedProviders = await resolveTrustedProviders(config, request);
+    return {
+      auth,
+      request,
+      url: requestUrl,
+      path: requestUrl.pathname,
+      basePath: normalizedBasePath,
+      baseURL: resolvedBaseURL,
+      origin: getOrigin(resolvedBaseURL) ?? resolvedBaseURL,
+      headers: request.headers,
+      cookies: requestCookies,
+      trustedOrigins,
+      trustedProviders,
+      options: config,
+      runtime: {
+        ...runtime,
+        baseURL: resolvedBaseURL
+      },
+      database: auth.database,
+      socialProviders: auth.socialProviders
+    };
+  };
+  const handler = async (request) => {
+    const requestContext = await resolveRequestContext(request);
+    if (typeof config.handler !== "function") {
+      return createJsonResponse(
+        {
+          ok: false,
+          code: ATHENA_AUTH_BASE_ERROR_CODES.HANDLER_NOT_CONFIGURED,
+          error: "No native auth handler was configured for this Athena auth instance.",
+          path: requestContext.path,
+          basePath: requestContext.basePath
+        },
+        { status: 501 }
+      );
+    }
+    const result = await config.handler(requestContext);
+    if (result instanceof Response) {
+      return result;
+    }
+    const response = result.response ?? (result.returned !== void 0 ? createJsonResponse(result.returned) : new Response(null, { status: 204 }));
+    const responseHeaders = new Headers(response.headers);
+    await runAfterHooks({
+      path: requestContext.path,
+      headers: request.headers,
+      context: {
+        responseHeaders,
+        returned: result.returned,
+        setSession: result.setSession,
+        clearSession: result.clearSession,
+        dontRememberMe: result.dontRememberMe,
+        cookieOverrides: result.cookieOverrides
+      }
+    });
+    return mergeResponseHeaders(response, responseHeaders);
+  };
+  const api = Object.assign(
+    {
+      applyResponseCookies,
+      clearSession,
+      createCookieContext,
+      getCookieCache,
+      getSessionCookie,
+      resolveRequestContext,
+      runAfterHooks,
+      setSession
+    },
+    config.api ?? {}
+  );
+  const $ERROR_CODES = {
+    ...auth.plugins?.reduce((acc, plugin) => {
+      if (plugin.$ERROR_CODES) {
+        return {
+          ...acc,
+          ...plugin.$ERROR_CODES
+        };
+      }
+      return acc;
+    }, {}),
+    ...config.errorCodes ?? {},
+    ...ATHENA_AUTH_BASE_ERROR_CODES
+  };
+  Object.assign(auth, {
+    config,
+    options: config,
+    runtime,
+    database: resolvedDatabase,
+    socialProviders: config.socialProviders ?? {},
+    plugins: [...config.plugins ?? []],
+    cookies,
+    api,
+    $ERROR_CODES,
+    createCookieContext,
+    setSession,
+    clearSession,
+    applyResponseCookies,
+    runAfterHooks,
+    resolveRequestContext,
+    handler
+  });
+  auth.$context = Promise.all([
+    resolveTrustedOrigins(config, staticBaseURL),
+    resolveTrustedProviders(config)
+  ]).then(([trustedOrigins, trustedProviders]) => ({
+    auth,
+    options: config,
+    runtime,
+    basePath: normalizedBasePath,
+    baseURL: staticBaseURL,
+    origin: getOrigin(staticBaseURL),
+    database: auth.database,
+    socialProviders: auth.socialProviders,
+    plugins: auth.plugins,
+    cookies: auth.cookies,
+    trustedOrigins,
+    trustedProviders
+  }));
+  return auth;
+}
+
+export { ATHENA_AUTH_BASE_ERROR_CODES, AthenaClient, AthenaError, AthenaErrorCategory, AthenaErrorCode, AthenaErrorKind, AthenaGatewayError, AthenaStorageError, AthenaStorageErrorCode, Backend, DEFAULT_POSTGRES_SCHEMAS, assertInt, athenaAuth, coerceInt, createAthenaStorageError, createAuthClient, createAuthReactEmailInput, createClient, createModelFormAdapter, createPostgresIntrospectionProvider, createTypedClient, defineAthenaAuthConfig, defineAuthEmailTemplate, defineDatabase, defineGeneratorConfig, defineModel, defineRegistry, defineSchema, findGeneratorConfigPath, generateArtifactsFromSnapshot, generatorEnv, identifier, isAthenaGatewayError, isOk, loadGeneratorConfig, normalizeAthenaError, normalizeAthenaGatewayBaseUrl, normalizeGeneratorConfig, normalizeSchemaSelection, parseBooleanFlag2 as parseBooleanFlag, renderAthenaReactEmail, requireAffected, requireSuccess, resolveGeneratorProvider, resolvePostgresColumnType, resolveProviderSchemas, runSchemaGenerator, storageSdkManifest, toModelFormDefaults, toModelPayload, unwrap, unwrapOne, unwrapRows, verifyAthenaGatewayUrl, withRetry };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map