@xylex-group/athena 2.4.1 → 2.7.0

package/dist/browser.js

@@ -125,6 +125,60 @@ function buildAthenaGatewayUrl(baseUrl, path) {
   return `${baseUrl}${path}`;
 }
 
+// src/cookies/base64.ts
+function getAtob() {
+  const candidate = globalThis.atob;
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function getBtoa() {
+  const candidate = globalThis.btoa;
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function bytesToBinaryString(bytes) {
+  let result = "";
+  for (const byte of bytes) {
+    result += String.fromCharCode(byte);
+  }
+  return result;
+}
+function binaryStringToBytes(binary) {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function encodeBase64(bytes) {
+  const btoaFn = getBtoa();
+  if (btoaFn) {
+    return btoaFn(bytesToBinaryString(bytes));
+  }
+  return Buffer.from(bytes).toString("base64");
+}
+function decodeBase64(base64) {
+  const atobFn = getAtob();
+  if (atobFn) {
+    return binaryStringToBytes(atobFn(base64));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function encodeBytesToBase64Url(bytes) {
+  return encodeBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeStringToBase64Url(value) {
+  const bytes = new TextEncoder().encode(value);
+  return encodeBytesToBase64Url(bytes);
+}
+function decodeBase64UrlToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingLength = normalized.length % 4;
+  const padded = paddingLength === 0 ? normalized : `${normalized}${"=".repeat(4 - paddingLength)}`;
+  return decodeBase64(padded);
+}
+function decodeBase64UrlToString(value) {
+  return new TextDecoder().decode(decodeBase64UrlToBytes(value));
+}
+
 // src/cookies/cookie-utils.ts
 var SECURE_COOKIE_PREFIX = "__Secure-";
 function parseCookies(cookieHeader) {
@@ -136,24 +190,615 @@ function parseCookies(cookieHeader) {
   });
   return cookieMap;
 }
+
+// src/cookies/crypto.ts
+var HS256_ALG = "HS256";
+async function getSubtleCrypto() {
+  const globalCrypto = globalThis.crypto;
+  if (globalCrypto?.subtle) {
+    return globalCrypto.subtle;
+  }
+  const { webcrypto } = await import('crypto');
+  const subtle = webcrypto.subtle;
+  if (!subtle) {
+    throw new Error("Web Crypto subtle API is unavailable.");
+  }
+  return subtle;
+}
+async function importHmacKey(secret, usage) {
+  const subtle = await getSubtleCrypto();
+  return subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    {
+      name: "HMAC",
+      hash: "SHA-256"
+    },
+    false,
+    [usage]
+  );
+}
+function bufferToBytes(buffer) {
+  return new Uint8Array(buffer);
+}
+function parseJwtPayload(payloadSegment) {
+  try {
+    const decoded = decodeBase64UrlToString(payloadSegment);
+    const payload = JSON.parse(decoded);
+    if (!payload || typeof payload !== "object") {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function isJwtExpired(payload) {
+  const exp = payload.exp;
+  if (typeof exp !== "number") {
+    return false;
+  }
+  return exp < Math.floor(Date.now() / 1e3);
+}
+async function signHmacBase64Url(secret, value) {
+  const subtle = await getSubtleCrypto();
+  const key = await importHmacKey(secret, "sign");
+  const signature = await subtle.sign("HMAC", key, new TextEncoder().encode(value));
+  return encodeBytesToBase64Url(bufferToBytes(signature));
+}
+async function signJwtHS256(payload, secret, expiresIn = 60 * 5) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: HS256_ALG, typ: "JWT" };
+  const fullPayload = {
+    ...payload,
+    iat: now,
+    exp: now + expiresIn
+  };
+  const headerPart = encodeStringToBase64Url(JSON.stringify(header));
+  const payloadPart = encodeStringToBase64Url(JSON.stringify(fullPayload));
+  const message = `${headerPart}.${payloadPart}`;
+  const signature = await signHmacBase64Url(secret, message);
+  return `${message}.${signature}`;
+}
+async function verifyJwtHS256(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [headerPart, payloadPart, signaturePart] = parts;
+  if (!headerPart || !payloadPart || !signaturePart) {
+    return null;
+  }
+  let header = null;
+  try {
+    header = JSON.parse(decodeBase64UrlToString(headerPart));
+  } catch {
+    return null;
+  }
+  if (!header || header.alg !== HS256_ALG) {
+    return null;
+  }
+  const payload = parseJwtPayload(payloadPart);
+  if (!payload) {
+    return null;
+  }
+  const expectedSignature = await signHmacBase64Url(secret, `${headerPart}.${payloadPart}`);
+  if (expectedSignature !== signaturePart) {
+    return null;
+  }
+  if (isJwtExpired(payload)) {
+    return null;
+  }
+  return payload;
+}
+
+// src/cookies/session-store.ts
+var ALLOWED_COOKIE_SIZE = 4096;
+var ESTIMATED_EMPTY_COOKIE_SIZE = 200;
+var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+function getChunkIndex(cookieName) {
+  const parts = cookieName.split(".");
+  const lastPart = parts[parts.length - 1];
+  const index = parseInt(lastPart || "0", 10);
+  return Number.isNaN(index) ? 0 : index;
+}
+function readExistingChunks(cookieName, ctx) {
+  const chunks = {};
+  const cookies = parseCookies(ctx.headers?.get("cookie") || "");
+  for (const [name, value] of cookies) {
+    if (name.startsWith(cookieName)) {
+      chunks[name] = value;
+    }
+  }
+  return chunks;
+}
+function joinChunks(chunks) {
+  const sortedKeys = Object.keys(chunks).sort((left, right) => getChunkIndex(left) - getChunkIndex(right));
+  return sortedKeys.map((key) => chunks[key]).join("");
+}
+function chunkCookie(storeName, cookie, chunks, ctx) {
+  const chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE);
+  if (chunkCount === 1) {
+    chunks[cookie.name] = cookie.value;
+    return [cookie];
+  }
+  const cookies = [];
+  for (let index = 0; index < chunkCount; index++) {
+    const name = `${cookie.name}.${index}`;
+    const start = index * CHUNK_SIZE;
+    const value = cookie.value.substring(start, start + CHUNK_SIZE);
+    cookies.push({
+      ...cookie,
+      name,
+      value
+    });
+    chunks[name] = value;
+  }
+  ctx.logger?.debug?.(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {
+    message: `${storeName} cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,
+    emptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,
+    valueSize: cookie.value.length,
+    chunkCount,
+    chunks: cookies.map((entry) => entry.value.length + ESTIMATED_EMPTY_COOKIE_SIZE)
+  });
+  return cookies;
+}
+function getCleanCookies(chunks, cookieOptions) {
+  const cleanedChunks = {};
+  for (const name in chunks) {
+    cleanedChunks[name] = {
+      name,
+      value: "",
+      attributes: {
+        ...cookieOptions,
+        maxAge: 0
+      }
+    };
+  }
+  return cleanedChunks;
+}
+var storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {
+  const chunks = readExistingChunks(cookieName, ctx);
+  return {
+    getValue() {
+      return joinChunks(chunks);
+    },
+    hasChunks() {
+      return Object.keys(chunks).length > 0;
+    },
+    chunk(value, options) {
+      const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+      for (const name in chunks) {
+        delete chunks[name];
+      }
+      const cookies = cleanedChunks;
+      const chunked = chunkCookie(
+        storeName,
+        {
+          name: cookieName,
+          value,
+          attributes: {
+            ...cookieOptions,
+            ...options
+          }
+        },
+        chunks,
+        ctx
+      );
+      for (const chunk of chunked) {
+        cookies[chunk.name] = chunk;
+      }
+      return Object.values(cookies);
+    },
+    clean() {
+      const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+      for (const name in chunks) {
+        delete chunks[name];
+      }
+      return Object.values(cleanedChunks);
+    },
+    setCookies(cookies) {
+      for (const cookie of cookies) {
+        ctx.setCookie(cookie.name, cookie.value, cookie.attributes);
+      }
+    }
+  };
+};
+var createSessionStore = storeFactory("Session");
+var createAccountStore = storeFactory("Account");
+
+// src/cookies/index.ts
+var DEFAULT_COOKIE_PREFIX = "athena-auth";
+var LEGACY_COOKIE_PREFIX = "better-auth";
+var DEFAULT_SESSION_MAX_AGE = 7 * 24 * 60 * 60;
+var DEFAULT_CACHE_MAX_AGE = 60 * 5;
+function isProductionRuntime() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function getEnvironmentSecret() {
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  return process.env?.ATHENA_AUTH_SECRET || process.env?.BETTER_AUTH_SECRET || process.env?.AUTH_SECRET;
+}
+function isDynamicBaseURLConfig(baseURL) {
+  return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts);
+}
+function resolveCookiePrefixes(primaryPrefix) {
+  const prefixes = [primaryPrefix];
+  if (!prefixes.includes(DEFAULT_COOKIE_PREFIX)) {
+    prefixes.push(DEFAULT_COOKIE_PREFIX);
+  }
+  if (!prefixes.includes(LEGACY_COOKIE_PREFIX)) {
+    prefixes.push(LEGACY_COOKIE_PREFIX);
+  }
+  return prefixes;
+}
+function createError(message) {
+  return new Error(`@xylex-group/athena/cookies: ${message}`);
+}
+function getSecretOrThrow(secret) {
+  const resolved = secret || getEnvironmentSecret();
+  if (!resolved) {
+    throw createError(
+      "getCookieCache requires a secret. Pass `secret` or set ATHENA_AUTH_SECRET/BETTER_AUTH_SECRET/AUTH_SECRET."
+    );
+  }
+  return resolved;
+}
+function asObject(value) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  return value;
+}
+function getSessionTokenFromPair(session) {
+  const token = session.session?.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw createError("setSessionCookie requires `session.session.token` to be a non-empty string.");
+  }
+  return token;
+}
+async function resolveCookieVersion(versionConfig, session, user) {
+  if (!versionConfig) {
+    return "1";
+  }
+  if (typeof versionConfig === "string") {
+    return versionConfig;
+  }
+  return versionConfig(session, user);
+}
+function getSessionCookieCacheName(cookiePrefix, cookieName, isSecure) {
+  return isSecure ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}`;
+}
+async function setCookieValue(ctx, name, value, attributes) {
+  const secret = ctx.context.secret;
+  if (secret && typeof ctx.setSignedCookie === "function") {
+    await ctx.setSignedCookie(name, value, secret, attributes);
+    return;
+  }
+  ctx.setCookie(name, value, attributes);
+}
+function parseJsonSafely(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+function getIsSecureCookie(config) {
+  if (config?.isSecure !== void 0) {
+    return config.isSecure;
+  }
+  return isProductionRuntime();
+}
+function createCookieGetter(options) {
+  const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0;
+  const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0;
+  const secure = options.advanced?.useSecureCookies !== void 0 ? options.advanced.useSecureCookies : dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("https://") : isProductionRuntime();
+  const secureCookiePrefix = secure ? SECURE_COOKIE_PREFIX : "";
+  const crossSubdomainEnabled = !!options.advanced?.crossSubDomainCookies?.enabled;
+  const domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain || (baseURLString ? new URL(baseURLString).hostname : void 0) : void 0;
+  if (crossSubdomainEnabled && !domain && !isDynamicBaseURLConfig(options.baseURL)) {
+    throw createError("baseURL is required when `crossSubDomainCookies.enabled` is true.");
+  }
+  function createCookie(cookieName, overrideAttributes = {}) {
+    const prefix = options.advanced?.cookiePrefix || DEFAULT_COOKIE_PREFIX;
+    const name = options.advanced?.cookies?.[cookieName]?.name || `${prefix}.${cookieName}`;
+    const attributes = options.advanced?.cookies?.[cookieName]?.attributes || {};
+    return {
+      name: `${secureCookiePrefix}${name}`,
+      attributes: {
+        secure: !!secureCookiePrefix,
+        sameSite: "lax",
+        path: "/",
+        httpOnly: true,
+        ...crossSubdomainEnabled ? { domain } : {},
+        ...options.advanced?.defaultCookieAttributes,
+        ...overrideAttributes,
+        ...attributes
+      }
+    };
+  }
+  return createCookie;
+}
+function getCookies(options) {
+  const createCookie = createCookieGetter(options);
+  const sessionToken = createCookie("session_token", { maxAge: options.session?.expiresIn || DEFAULT_SESSION_MAX_AGE });
+  const sessionData = createCookie("session_data", { maxAge: options.session?.cookieCache?.maxAge || DEFAULT_CACHE_MAX_AGE });
+  const accountData = createCookie("account_data", { maxAge: options.session?.cookieCache?.maxAge || DEFAULT_CACHE_MAX_AGE });
+  const dontRememberToken = createCookie("dont_remember");
+  return {
+    sessionToken: {
+      name: sessionToken.name,
+      attributes: sessionToken.attributes
+    },
+    sessionData: {
+      name: sessionData.name,
+      attributes: sessionData.attributes
+    },
+    dontRememberToken: {
+      name: dontRememberToken.name,
+      attributes: dontRememberToken.attributes
+    },
+    accountData: {
+      name: accountData.name,
+      attributes: accountData.attributes
+    }
+  };
+}
+async function setCookieCache(ctx, session, dontRememberMe) {
+  const cookieCacheConfig = ctx.context.options?.session?.cookieCache;
+  if (!cookieCacheConfig?.enabled) {
+    return;
+  }
+  const version = await resolveCookieVersion(
+    cookieCacheConfig.version,
+    session.session,
+    session.user
+  );
+  const sessionData = {
+    session: session.session,
+    user: session.user,
+    updatedAt: Date.now(),
+    version
+  };
+  const baseAttributes = ctx.context.authCookies.sessionData.attributes;
+  const maxAge = dontRememberMe ? void 0 : baseAttributes.maxAge;
+  const options = {
+    ...baseAttributes,
+    maxAge
+  };
+  const expiresAt = Date.now() + (options.maxAge || 60) * 1e3;
+  const strategy = cookieCacheConfig.strategy || "compact";
+  const secret = getSecretOrThrow(ctx.context.secret);
+  let encoded;
+  if (strategy === "jwt") {
+    encoded = await signJwtHS256(sessionData, secret, options.maxAge || DEFAULT_CACHE_MAX_AGE);
+  } else if (strategy === "jwe") {
+    throw createError("`jwe` strategy is not supported by the SDK cookie helper.");
+  } else {
+    const signature = await signHmacBase64Url(
+      secret,
+      JSON.stringify({
+        ...sessionData,
+        expiresAt
+      })
+    );
+    encoded = encodeStringToBase64Url(
+      JSON.stringify({
+        session: sessionData,
+        expiresAt,
+        signature
+      })
+    );
+  }
+  if (encoded.length > 4093) {
+    const store = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+    const cookies = store.chunk(encoded, options);
+    store.setCookies(cookies);
+  } else {
+    const store = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+    if (store.hasChunks()) {
+      store.setCookies(store.clean());
+    }
+    ctx.setCookie(ctx.context.authCookies.sessionData.name, encoded, options);
+  }
+}
+async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
+  if (dontRememberMe === void 0 && typeof ctx.getSignedCookie === "function" && ctx.context.secret) {
+    const existingFlag = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
+    dontRememberMe = !!existingFlag;
+  }
+  const resolvedDontRememberMe = dontRememberMe ?? false;
+  const token = getSessionTokenFromPair(session);
+  const options = ctx.context.authCookies.sessionToken.attributes;
+  const maxAge = resolvedDontRememberMe ? void 0 : ctx.context.sessionConfig?.expiresIn;
+  await setCookieValue(ctx, ctx.context.authCookies.sessionToken.name, token, {
+    ...options,
+    maxAge,
+    ...overrides
+  });
+  if (resolvedDontRememberMe) {
+    await setCookieValue(
+      ctx,
+      ctx.context.authCookies.dontRememberToken.name,
+      "true",
+      ctx.context.authCookies.dontRememberToken.attributes
+    );
+  }
+  await setCookieCache(ctx, session, resolvedDontRememberMe);
+  ctx.context.setNewSession?.(session);
+}
+function expireCookie(ctx, cookie) {
+  ctx.setCookie(cookie.name, "", {
+    ...cookie.attributes,
+    maxAge: 0
+  });
+}
+function deleteSessionCookie(ctx, skipDontRememberMe) {
+  expireCookie(ctx, ctx.context.authCookies.sessionToken);
+  expireCookie(ctx, ctx.context.authCookies.sessionData);
+  if (ctx.context.options?.account?.storeAccountCookie) {
+    expireCookie(ctx, ctx.context.authCookies.accountData);
+    const accountStore = createAccountStore(
+      ctx.context.authCookies.accountData.name,
+      ctx.context.authCookies.accountData.attributes,
+      ctx
+    );
+    accountStore.setCookies(accountStore.clean());
+  }
+  const sessionStore = createSessionStore(
+    ctx.context.authCookies.sessionData.name,
+    ctx.context.authCookies.sessionData.attributes,
+    ctx
+  );
+  sessionStore.setCookies(sessionStore.clean());
+  if (!skipDontRememberMe) {
+    expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
+  }
+}
 var getSessionCookie = (request, config) => {
   const cookies = (request instanceof Headers || !("headers" in request) ? request : request.headers).get("cookie");
   if (!cookies) {
     return null;
   }
-  const { cookieName = "session_token", cookiePrefix = "athena-auth" } = {};
+  const { cookieName = "session_token", cookiePrefix = "athena-auth" } = config || {};
   const parsedCookie = parseCookies(cookies);
   const getCookie = (name) => parsedCookie.get(name) || parsedCookie.get(`${SECURE_COOKIE_PREFIX}${name}`);
-  const sessionToken = getCookie(`${cookiePrefix}.${cookieName}`) || getCookie(`${cookiePrefix}-${cookieName}`);
-  if (sessionToken) {
-    return sessionToken;
+  const candidateCookieNames = Array.from(/* @__PURE__ */ new Set([
+    cookieName,
+    cookieName.replace(/_/g, "-"),
+    cookieName.replace(/-/g, "_")
+  ])).filter(Boolean);
+  for (const candidateName of candidateCookieNames) {
+    const sessionToken = getCookie(`${cookiePrefix}.${candidateName}`) || getCookie(`${cookiePrefix}-${candidateName}`);
+    if (sessionToken) {
+      return sessionToken;
+    }
   }
   return null;
 };
+var getCookieCache = async (request, config) => {
+  const headers = request instanceof Headers || !("headers" in request) ? request : request.headers;
+  const cookieHeader = headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  const parsedCookie = parseCookies(cookieHeader);
+  const cookieName = config?.cookieName || "session_data";
+  const requestedPrefix = config?.cookiePrefix || DEFAULT_COOKIE_PREFIX;
+  const strategy = config?.strategy || "compact";
+  const cookiePrefixes = resolveCookiePrefixes(requestedPrefix);
+  const isSecure = getIsSecureCookie(config);
+  const secret = getSecretOrThrow(config?.secret);
+  let sessionData;
+  for (const prefix of cookiePrefixes) {
+    const candidate = getSessionCookieCacheName(prefix, cookieName, isSecure);
+    const cookieValue = parsedCookie.get(candidate);
+    if (cookieValue) {
+      sessionData = cookieValue;
+      break;
+    }
+  }
+  if (!sessionData) {
+    const reconstructedChunks = [];
+    for (const prefix of cookiePrefixes) {
+      const candidate = getSessionCookieCacheName(prefix, cookieName, isSecure);
+      for (const [name, value] of parsedCookie.entries()) {
+        if (!name.startsWith(`${candidate}.`)) {
+          continue;
+        }
+        const parts = name.split(".");
+        const indexStr = parts[parts.length - 1];
+        const index = parseInt(indexStr || "0", 10);
+        if (!Number.isNaN(index)) {
+          reconstructedChunks.push({ index, value });
+        }
+      }
+      if (reconstructedChunks.length > 0) {
+        break;
+      }
+    }
+    if (reconstructedChunks.length > 0) {
+      reconstructedChunks.sort((left, right) => left.index - right.index);
+      sessionData = reconstructedChunks.map((chunk) => chunk.value).join("");
+    }
+  }
+  if (!sessionData) {
+    return null;
+  }
+  if (strategy === "jwe") {
+    throw createError(
+      "`jwe` strategy is not supported by the SDK cookie helper. Use compact/jwt or pass cookie data through the auth server."
+    );
+  }
+  if (strategy === "jwt") {
+    const payload = await verifyJwtHS256(sessionData, secret);
+    if (!payload) {
+      return null;
+    }
+    const sessionRecord = asObject(payload.session);
+    const userRecord = asObject(payload.user);
+    const updatedAt = payload.updatedAt;
+    if (!sessionRecord || !userRecord || typeof updatedAt !== "number") {
+      return null;
+    }
+    if (config?.version) {
+      const cookieVersion = typeof payload.version === "string" ? payload.version : "1";
+      const expectedVersion = typeof config.version === "string" ? config.version : await config.version(sessionRecord, userRecord);
+      if (cookieVersion !== expectedVersion) {
+        return null;
+      }
+    }
+    return {
+      session: sessionRecord,
+      user: userRecord,
+      updatedAt,
+      version: typeof payload.version === "string" ? payload.version : void 0
+    };
+  }
+  const compactPayload = parseJsonSafely(decodeBase64UrlToString(sessionData));
+  if (!compactPayload) {
+    return null;
+  }
+  const expectedSignature = await signHmacBase64Url(
+    secret,
+    JSON.stringify({
+      ...compactPayload.session,
+      expiresAt: compactPayload.expiresAt
+    })
+  );
+  if (expectedSignature !== compactPayload.signature) {
+    return null;
+  }
+  if (compactPayload.expiresAt <= Date.now()) {
+    return null;
+  }
+  const resolvedSession = compactPayload.session;
+  if (config?.version) {
+    const cookieVersion = resolvedSession.version || "1";
+    const expectedVersion = typeof config.version === "string" ? config.version : await config.version(resolvedSession.session, resolvedSession.user);
+    if (cookieVersion !== expectedVersion) {
+      return null;
+    }
+  }
+  const sessionObject = asObject(resolvedSession.session);
+  const userObject = asObject(resolvedSession.user);
+  if (!sessionObject || !userObject) {
+    return null;
+  }
+  return {
+    session: sessionObject,
+    user: userObject,
+    updatedAt: resolvedSession.updatedAt,
+    version: resolvedSession.version
+  };
+};
 
 // package.json
 var package_default = {
-  version: "2.4.1"
+  version: "2.7.0"
 };
 
 // src/sdk-version.ts
@@ -2690,42 +3335,1450 @@ async function withRetry(config, fn) {
       if (!retry) {
         throw error;
       }
-      const delay = computeDelayMs(currentAttempt, error, resolvedConfig);
-      await sleep(delay);
+      const delay = computeDelayMs(currentAttempt, error, resolvedConfig);
+      await sleep(delay);
+    }
+  }
+  throw new Error("withRetry reached an unexpected state");
+}
+
+// src/db/module.ts
+function createDbModule(input) {
+  const db = {
+    from(table, options) {
+      return input.from(table, options);
+    },
+    select(table, columns, options) {
+      return input.from(table).select(columns, options);
+    },
+    insert(table, values, options) {
+      return Array.isArray(values) ? input.from(table).insert(values, options) : input.from(table).insert(values, options);
+    },
+    upsert(table, values, options) {
+      return Array.isArray(values) ? input.from(table).upsert(values, options) : input.from(table).upsert(values, options);
+    },
+    update(table, values, options) {
+      return input.from(table).update(values, options);
+    },
+    delete(table, options) {
+      return input.from(table).delete(options);
+    },
+    rpc(fn, args, options) {
+      return input.rpc(fn, args, options);
+    },
+    query(query, options) {
+      return input.query(query, options);
+    }
+  };
+  return db;
+}
+
+// src/storage/file.ts
+function createStorageFileModule(base, config = {}) {
+  const upload = async (input, options) => {
+    const sources = normalizeUploadSources(input);
+    validateUploadConstraints(sources, input);
+    const uploadRequests = sources.map((source, index) => {
+      const storageKey = resolveUploadStorageKey(input, source, index, options, config);
+      return {
+        source,
+        uploadRequest: {
+          s3_id: input.s3_id,
+          bucket: input.bucket,
+          storage_key: storageKey,
+          name: input.name ?? source.fileName,
+          original_name: input.original_name ?? source.fileName,
+          resource_id: input.resource_id ?? input.resourceId,
+          mime_type: input.mime_type ?? source.contentType,
+          content_type: input.content_type ?? source.contentType,
+          size_bytes: source.sizeBytes,
+          public: input.public,
+          metadata: input.metadata
+        }
+      };
+    });
+    input.onProgress?.(createProgressSnapshot("preparing", sources, 0, 0, 0));
+    const uploadUrls = uploadRequests.length === 1 ? [await base.createStorageUploadUrl(uploadRequests[0].uploadRequest, options)] : (await base.createStorageUploadUrls({ files: uploadRequests.map((request) => request.uploadRequest) }, options)).files;
+    const aggregateLoaded = new Array(uploadRequests.length).fill(0);
+    const uploaded = [];
+    for (let index = 0; index < uploadRequests.length; index += 1) {
+      const request = uploadRequests[index];
+      const uploadUrl = uploadUrls[index];
+      const response = await putUploadBody(uploadUrl.upload.url, request.source, input, options, (progress) => {
+        aggregateLoaded[index] = progress.loaded;
+        input.onProgress?.(createProgressSnapshot("uploading", sources, index, progress.loaded, sum(aggregateLoaded)));
+      });
+      uploaded.push({
+        file: uploadUrl.file,
+        upload: uploadUrl.upload,
+        source: request.source.source,
+        fileName: request.source.fileName,
+        storage_key: request.uploadRequest.storage_key,
+        response
+      });
+      aggregateLoaded[index] = request.source.sizeBytes;
+      input.onProgress?.(createProgressSnapshot("complete", sources, index, request.source.sizeBytes, sum(aggregateLoaded)));
+    }
+    return {
+      files: uploaded,
+      count: uploaded.length
+    };
+  };
+  const download = ((input, queryOrOptions, maybeOptions) => {
+    const { fileIds, query, options } = normalizeDownloadArgs(input, queryOrOptions, maybeOptions);
+    const downloads = fileIds.map((fileId) => base.getStorageFileProxy(fileId, query, options));
+    return Array.isArray(input) || isRecord5(input) && Array.isArray(input.fileIds) ? Promise.all(downloads) : downloads[0];
+  });
+  const deleteFile = ((input, options) => {
+    if (Array.isArray(input)) {
+      return Promise.all(input.map((fileId) => base.deleteStorageFile(fileId, options)));
+    }
+    return base.deleteStorageFile(input, options);
+  });
+  return {
+    upload,
+    download,
+    list(input, options) {
+      const prefix = resolveStoragePath(input.prefix ?? "", input, options, config);
+      return base.listStorageFiles(
+        {
+          s3_id: input.s3_id,
+          prefix
+        },
+        options
+      );
+    },
+    delete: deleteFile
+  };
+}
+function resolveStoragePath(path, input, options, config = {}) {
+  const context = createPathContext(input, options, config);
+  const prefixPath = input.prefixPath ?? config.prefixPath;
+  const prefix = typeof prefixPath === "function" ? prefixPath(context) : prefixPath;
+  return joinStoragePath(renderStorageTemplate(prefix ?? "", context), renderStorageTemplate(path, context));
+}
+function resolveUploadStorageKey(input, source, index, options, config) {
+  const explicitKey = input.storage_key ?? input.storageKey;
+  const keyTemplate = input.storageKeyTemplate;
+  const fallbackName = source.fileName;
+  const context = createPathContext(input, options, config);
+  const key = keyTemplate ? renderStorageTemplate(keyTemplate, {
+    ...context,
+    vars: {
+      ...context.vars,
+      index,
+      fileName: source.fileName,
+      name: source.fileName
+    }
+  }) : explicitKey ?? fallbackName;
+  return resolveStoragePath(key, input, options, config);
+}
+function normalizeUploadSources(input) {
+  const files = toArray(input.files);
+  if (files.length === 0) {
+    throw new Error("athena.storage.file.upload requires at least one file");
+  }
+  return files.map((source, index) => {
+    const fileName = input.fileName ?? sourceName(source) ?? `file-${index + 1}`;
+    const sizeBytes = sourceSize(source);
+    const contentType = input.content_type ?? input.mime_type ?? sourceContentType(source);
+    return {
+      source,
+      fileName,
+      sizeBytes,
+      contentType
+    };
+  });
+}
+function validateUploadConstraints(sources, input) {
+  const maxFiles = input.maxFiles ?? 1;
+  if (sources.length > maxFiles) {
+    throw new Error(`athena.storage.file.upload accepts at most ${maxFiles} file${maxFiles === 1 ? "" : "s"} for this call`);
+  }
+  const maxFileSizeBytes = input.maxFileSizeBytes ?? (input.maxFileSizeMb === void 0 ? void 0 : Math.floor(input.maxFileSizeMb * 1024 * 1024));
+  if (maxFileSizeBytes !== void 0) {
+    const tooLarge = sources.find((source) => source.sizeBytes > maxFileSizeBytes);
+    if (tooLarge) {
+      throw new Error(`athena.storage.file.upload rejected ${tooLarge.fileName}: file exceeds ${maxFileSizeBytes} bytes`);
+    }
+  }
+  const allowedExtensions = normalizeExtensions(input.allowedExtensions ?? input.extensions);
+  if (allowedExtensions.size > 0) {
+    const invalid = sources.find((source) => !allowedExtensions.has(fileExtension(source.fileName)));
+    if (invalid) {
+      throw new Error(`athena.storage.file.upload rejected ${invalid.fileName}: extension is not allowed`);
+    }
+  }
+}
+async function putUploadBody(url, source, input, options, onProgress) {
+  const headers = new Headers(input.uploadHeaders);
+  if (source.contentType && !headers.has("Content-Type")) {
+    headers.set("Content-Type", source.contentType);
+  }
+  if (typeof XMLHttpRequest !== "undefined") {
+    return putUploadBodyWithXhr(url, source, headers, options, onProgress);
+  }
+  onProgress({ loaded: 0 });
+  const response = await fetch(url, {
+    method: "PUT",
+    headers,
+    body: source.source,
+    signal: options?.signal
+  });
+  if (!response.ok) {
+    throw new Error(`athena.storage.file.upload failed with status ${response.status}`);
+  }
+  onProgress({ loaded: source.sizeBytes });
+  return response;
+}
+function putUploadBodyWithXhr(url, source, headers, options, onProgress) {
+  const Xhr = XMLHttpRequest;
+  if (Xhr === void 0) {
+    return Promise.reject(new Error("athena.storage.file.upload requires XMLHttpRequest in this runtime"));
+  }
+  return new Promise((resolve, reject) => {
+    const xhr = new Xhr();
+    const abort = () => xhr.abort();
+    xhr.open("PUT", url);
+    headers.forEach((value, key) => xhr.setRequestHeader(key, value));
+    xhr.upload.onprogress = (event) => {
+      onProgress({ loaded: event.loaded });
+    };
+    xhr.onload = () => {
+      if (options?.signal) {
+        options.signal.removeEventListener("abort", abort);
+      }
+      if (xhr.status < 200 || xhr.status >= 300) {
+        reject(new Error(`athena.storage.file.upload failed with status ${xhr.status}`));
+        return;
+      }
+      onProgress({ loaded: source.sizeBytes });
+      resolve(new Response(xhr.response, {
+        status: xhr.status,
+        statusText: xhr.statusText,
+        headers: parseXhrHeaders(xhr.getAllResponseHeaders())
+      }));
+    };
+    xhr.onerror = () => {
+      if (options?.signal) {
+        options.signal.removeEventListener("abort", abort);
+      }
+      reject(new Error("athena.storage.file.upload failed with a network error"));
+    };
+    xhr.onabort = () => {
+      if (options?.signal) {
+        options.signal.removeEventListener("abort", abort);
+      }
+      reject(new DOMException("Upload aborted", "AbortError"));
+    };
+    if (options?.signal) {
+      if (options.signal.aborted) {
+        abort();
+        return;
+      }
+      options.signal.addEventListener("abort", abort, { once: true });
+    }
+    xhr.send(source.source);
+  });
+}
+function normalizeDownloadArgs(input, queryOrOptions, maybeOptions) {
+  if (typeof input === "string") {
+    return { fileIds: [input], query: queryOrOptions, options: maybeOptions };
+  }
+  if (Array.isArray(input)) {
+    return { fileIds: [...input], query: queryOrOptions, options: maybeOptions };
+  }
+  const downloadInput = input;
+  const { fileId, fileIds, ...query } = downloadInput;
+  return {
+    fileIds: fileIds ? [...fileIds] : fileId ? [fileId] : [],
+    query,
+    options: queryOrOptions
+  };
+}
+function createPathContext(input, options, config) {
+  const organizationId = input.organizationId ?? input.organization_id ?? options?.organizationId ?? void 0;
+  const userId = input.userId ?? input.user_id ?? options?.userId ?? void 0;
+  const resourceId = input.resourceId ?? input.resource_id ?? void 0;
+  const vars = {
+    ...config.vars ?? {},
+    ...input.vars ?? {}
+  };
+  if (organizationId !== void 0) {
+    vars.organizationId = organizationId;
+    vars.organization_id = organizationId;
+  }
+  if (userId !== void 0) {
+    vars.userId = userId;
+    vars.user_id = userId;
+  }
+  if (resourceId !== void 0) {
+    vars.resourceId = resourceId;
+    vars.resource_id = resourceId;
+  }
+  return {
+    vars,
+    env: {
+      ...readProcessEnv(),
+      ...config.env ?? {},
+      ...input.env ?? {}
+    },
+    organizationId,
+    organization_id: organizationId,
+    userId,
+    user_id: userId,
+    resourceId,
+    resource_id: resourceId
+  };
+}
+function renderStorageTemplate(template, context) {
+  return template.replace(/\$\{([^}]+)\}|\{([^}]+)\}/g, (_match, shellToken, braceToken) => {
+    const token = (shellToken ?? braceToken ?? "").trim();
+    if (!token) return "";
+    const value = resolveTemplateToken(token, context);
+    return value === void 0 || value === null ? "" : String(value);
+  });
+}
+function resolveTemplateToken(token, context) {
+  if (token.startsWith("env.")) {
+    return context.env[token.slice(4)];
+  }
+  if (token in context.vars) {
+    return context.vars[token];
+  }
+  return context.env[token];
+}
+function joinStoragePath(...parts) {
+  return parts.map((part) => part.trim().replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+}
+function toArray(files) {
+  if (isUploadSource(files)) return [files];
+  return Array.from(files);
+}
+function isUploadSource(value) {
+  return value instanceof Blob || value instanceof ArrayBuffer || value instanceof Uint8Array;
+}
+function sourceName(source) {
+  return isRecord5(source) && typeof source.name === "string" && source.name.trim() ? source.name.trim() : void 0;
+}
+function sourceSize(source) {
+  if (source instanceof Blob) return source.size;
+  return source.byteLength;
+}
+function sourceContentType(source) {
+  return source instanceof Blob && source.type.trim() ? source.type.trim() : void 0;
+}
+function normalizeExtensions(extensions) {
+  return new Set((extensions ?? []).map((extension) => extension.replace(/^\./, "").toLowerCase()).filter(Boolean));
+}
+function fileExtension(fileName) {
+  const lastDot = fileName.lastIndexOf(".");
+  return lastDot === -1 ? "" : fileName.slice(lastDot + 1).toLowerCase();
+}
+function createProgressSnapshot(phase, sources, fileIndex, loaded, aggregateLoaded) {
+  const total = sources[fileIndex]?.sizeBytes ?? 0;
+  const aggregateTotal = sources.reduce((totalBytes, source) => totalBytes + source.sizeBytes, 0);
+  return {
+    phase,
+    fileIndex,
+    fileCount: sources.length,
+    fileName: sources[fileIndex]?.fileName ?? "",
+    loaded,
+    total,
+    percent: total > 0 ? Math.round(loaded / total * 100) : 100,
+    aggregateLoaded,
+    aggregateTotal,
+    aggregatePercent: aggregateTotal > 0 ? Math.round(aggregateLoaded / aggregateTotal * 100) : 100
+  };
+}
+function sum(values) {
+  return values.reduce((total, value) => total + value, 0);
+}
+function parseXhrHeaders(raw) {
+  const headers = new Headers();
+  for (const line of raw.trim().split(/[\r\n]+/)) {
+    const index = line.indexOf(":");
+    if (index === -1) continue;
+    headers.set(line.slice(0, index).trim(), line.slice(index + 1).trim());
+  }
+  return headers;
+}
+function readProcessEnv() {
+  const processLike = globalThis.process;
+  return processLike?.env ?? {};
+}
+function isRecord5(value) {
+  return Boolean(value) && typeof value === "object";
+}
+
+// src/storage/module.ts
+var storageSdkManifest = {
+  namespace: "storage",
+  basePath: "/storage",
+  envelopeKinds: {
+    raw: "response body is the payload",
+    athena: "response body is { status, message, data }"
+  },
+  methods: [
+    {
+      name: "listStorageCatalogs",
+      method: "GET",
+      path: "/storage/catalogs",
+      responseEnvelope: "raw",
+      responseType: "{ data: S3CatalogItem[] }"
+    },
+    {
+      name: "createStorageCatalog",
+      method: "POST",
+      path: "/storage/catalogs",
+      requestType: "CreateStorageCatalogRequest",
+      responseEnvelope: "raw",
+      responseType: "S3CatalogItem"
+    },
+    {
+      name: "updateStorageCatalog",
+      method: "PATCH",
+      path: "/storage/catalogs/{id}",
+      pathParams: ["id"],
+      requestType: "UpdateStorageCatalogRequest",
+      responseEnvelope: "raw",
+      responseType: "S3CatalogItem"
+    },
+    {
+      name: "deleteStorageCatalog",
+      method: "DELETE",
+      path: "/storage/catalogs/{id}",
+      pathParams: ["id"],
+      responseEnvelope: "raw",
+      responseType: "{ id: string; deleted: boolean }"
+    },
+    {
+      name: "listStorageCredentials",
+      method: "GET",
+      path: "/storage/credentials",
+      responseEnvelope: "raw",
+      responseType: "{ data: S3CredentialListItem[] }"
+    },
+    {
+      name: "createStorageUploadUrl",
+      method: "POST",
+      path: "/storage/files/upload-url",
+      requestType: "CreateStorageUploadUrlRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageUploadUrlResponse"
+    },
+    {
+      name: "createStorageUploadUrls",
+      method: "POST",
+      path: "/storage/files/upload-urls",
+      requestType: "CreateStorageUploadUrlsRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageBatchUploadUrlResponse"
+    },
+    {
+      name: "listStorageFiles",
+      method: "POST",
+      path: "/storage/files/list",
+      requestType: "ListStorageFilesRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageListFilesResponse"
+    },
+    {
+      name: "getStorageFile",
+      method: "GET",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "getStorageFileUrl",
+      method: "GET",
+      path: "/storage/files/{file_id}/url",
+      pathParams: ["file_id"],
+      queryParams: ["purpose"],
+      responseEnvelope: "athena",
+      responseType: "PresignedFileUrlResponse"
+    },
+    {
+      name: "getStorageFileProxy",
+      method: "GET",
+      path: "/storage/files/{file_id}/proxy",
+      pathParams: ["file_id"],
+      queryParams: ["purpose"],
+      responseEnvelope: "raw",
+      responseType: "Response",
+      binary: true
+    },
+    {
+      name: "updateStorageFile",
+      method: "PATCH",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      requestType: "UpdateStorageFileRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "deleteStorageFile",
+      method: "DELETE",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "setStorageFileVisibility",
+      method: "PATCH",
+      path: "/storage/files/{file_id}/visibility",
+      pathParams: ["file_id"],
+      requestType: "SetStorageFileVisibilityRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "deleteStorageFolder",
+      method: "POST",
+      path: "/storage/folders/delete",
+      requestType: "DeleteStorageFolderRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFolderMutationResponse"
+    },
+    {
+      name: "moveStorageFolder",
+      method: "POST",
+      path: "/storage/folders/move",
+      requestType: "MoveStorageFolderRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFolderMutationResponse"
+    }
+  ]
+};
+var AthenaStorageErrorCode = {
+  InvalidUrl: "INVALID_URL",
+  NetworkError: "NETWORK_ERROR",
+  HttpError: "HTTP_ERROR",
+  InvalidJson: "INVALID_JSON",
+  InvalidAthenaEnvelope: "INVALID_ATHENA_ENVELOPE",
+  UnknownError: "UNKNOWN_ERROR"
+};
+var AthenaStorageError = class extends Error {
+  code;
+  athenaCode;
+  kind;
+  category;
+  retryable;
+  status;
+  endpoint;
+  method;
+  requestId;
+  hint;
+  causeDetail;
+  raw;
+  normalized;
+  __athenaNormalizedError;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "AthenaStorageError";
+    this.code = input.code;
+    this.status = input.status;
+    this.endpoint = input.endpoint;
+    this.method = input.method;
+    this.requestId = input.requestId;
+    this.hint = input.hint;
+    this.causeDetail = causeToString(input.cause);
+    this.raw = input.raw ?? null;
+    this.normalized = normalizeStorageErrorInput(input);
+    this.__athenaNormalizedError = this.normalized;
+    this.athenaCode = this.normalized.code;
+    this.kind = this.normalized.kind;
+    this.category = this.normalized.category;
+    this.retryable = this.normalized.retryable;
+    Object.defineProperty(this, "__athenaNormalizedError", {
+      value: this.normalized,
+      enumerable: false,
+      configurable: false,
+      writable: false
+    });
+  }
+  toDetails() {
+    return {
+      code: this.code,
+      athenaCode: this.athenaCode,
+      kind: this.kind,
+      category: this.category,
+      retryable: this.retryable,
+      message: this.message,
+      status: this.status,
+      endpoint: this.endpoint,
+      method: this.method,
+      requestId: this.requestId,
+      hint: this.hint,
+      cause: this.causeDetail,
+      raw: this.raw
+    };
+  }
+};
+function isRecord6(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function causeToString(cause) {
+  if (cause === void 0 || cause === null) return void 0;
+  if (typeof cause === "string") return cause;
+  if (cause instanceof Error && cause.message.trim()) return cause.message.trim();
+  try {
+    return JSON.stringify(cause);
+  } catch {
+    return String(cause);
+  }
+}
+function storageGatewayCode(code) {
+  if (code === "INVALID_URL") return "INVALID_URL";
+  if (code === "NETWORK_ERROR") return "NETWORK_ERROR";
+  if (code === "INVALID_JSON" || code === "INVALID_ATHENA_ENVELOPE") return "INVALID_JSON";
+  if (code === "HTTP_ERROR") return "HTTP_ERROR";
+  return "UNKNOWN_ERROR";
+}
+function headerValue(headers, names) {
+  for (const name of names) {
+    const value = headers.get(name);
+    if (value?.trim()) return value.trim();
+  }
+  return void 0;
+}
+function storageOperationFromEndpoint(endpoint, method) {
+  const endpointPath = String(endpoint).split("?")[0];
+  for (const candidate of storageSdkManifest.methods) {
+    if (candidate.method !== method) continue;
+    const pattern = `^${candidate.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{[^/]+\\\}/g, "[^/]+")}$`;
+    if (new RegExp(pattern).test(endpointPath)) {
+      return candidate.name;
+    }
+  }
+  return `storage:${method.toLowerCase()}`;
+}
+function normalizeStorageErrorInput(input) {
+  return normalizeAthenaError(
+    {
+      data: null,
+      error: {
+        message: input.message,
+        gatewayCode: storageGatewayCode(input.code),
+        status: input.status,
+        raw: input.raw ?? input.cause ?? null
+      },
+      errorDetails: {
+        code: storageGatewayCode(input.code),
+        message: input.message,
+        status: input.status,
+        endpoint: input.endpoint,
+        method: input.method,
+        requestId: input.requestId,
+        hint: input.hint,
+        cause: causeToString(input.cause)
+      },
+      raw: input.raw ?? input.cause ?? null,
+      status: input.status
+    },
+    { operation: storageOperationFromEndpoint(input.endpoint, input.method) }
+  );
+}
+function createAthenaStorageError(input) {
+  return new AthenaStorageError(input);
+}
+async function notifyStorageError(error, options, runtimeOptions) {
+  const handlers = [runtimeOptions?.onError, options?.onError].filter(
+    (handler) => typeof handler === "function"
+  );
+  for (const handler of handlers) {
+    try {
+      await handler(error);
+    } catch {
+    }
+  }
+}
+async function rejectStorageError(input, options, runtimeOptions) {
+  const error = createAthenaStorageError(input);
+  await notifyStorageError(error, options, runtimeOptions);
+  throw error;
+}
+function parseResponseBody3(rawText, contentType) {
+  if (!rawText) {
+    return { parsed: null, parseFailed: false };
+  }
+  const contentTypeSuggestsJson = contentType?.toLowerCase().includes("application/json") ?? false;
+  const looksJson = contentTypeSuggestsJson || rawText.startsWith("{") || rawText.startsWith("[");
+  if (!looksJson) {
+    return { parsed: rawText, parseFailed: false };
+  }
+  try {
+    return { parsed: JSON.parse(rawText), parseFailed: false };
+  } catch {
+    return { parsed: rawText, parseFailed: true };
+  }
+}
+function appendQuery(path, query) {
+  if (!query) return path;
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null) continue;
+    params.set(key, String(value));
+  }
+  const queryText = params.toString();
+  return queryText ? `${path}?${queryText}` : path;
+}
+function storagePath(path) {
+  return path;
+}
+function withPathParam(path, name, value) {
+  return path.replace(`{${name}}`, encodeURIComponent(value));
+}
+function resolveErrorMessage3(payload, fallback) {
+  if (isRecord6(payload)) {
+    const message = payload.message ?? payload.error ?? payload.details;
+    if (typeof message === "string" && message.trim()) {
+      return message.trim();
+    }
+  }
+  if (typeof payload === "string" && payload.trim()) {
+    return payload.trim();
+  }
+  return fallback;
+}
+function resolveErrorHint2(payload) {
+  if (!isRecord6(payload)) return void 0;
+  const hint = payload.hint ?? payload.suggestion;
+  return typeof hint === "string" && hint.trim() ? hint.trim() : void 0;
+}
+function resolveErrorCause(payload) {
+  if (!isRecord6(payload)) return void 0;
+  const cause = payload.cause ?? payload.reason;
+  return typeof cause === "string" && cause.trim() ? cause.trim() : void 0;
+}
+function storageCodeFromUnknown(error) {
+  if (isAthenaGatewayError(error)) {
+    if (error.code === "INVALID_URL") return "INVALID_URL";
+    if (error.code === "NETWORK_ERROR") return "NETWORK_ERROR";
+    if (error.code === "INVALID_JSON") return "INVALID_JSON";
+    if (error.code === "HTTP_ERROR") return "HTTP_ERROR";
+  }
+  return "UNKNOWN_ERROR";
+}
+async function callStorageEndpoint(gateway, endpoint, method, envelope, payload, options, runtimeOptions) {
+  let url;
+  let headers;
+  try {
+    const baseUrl = options?.baseUrl ? normalizeAthenaGatewayBaseUrl(options.baseUrl) : gateway.baseUrl;
+    url = buildAthenaGatewayUrl(baseUrl, endpoint);
+    headers = gateway.buildHeaders(options);
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: storageCodeFromUnknown(error),
+        message: error instanceof Error ? error.message : `Athena storage ${method} ${endpoint} failed before sending the request`,
+        status: isAthenaGatewayError(error) ? error.status : 0,
+        endpoint,
+        method,
+        raw: error,
+        requestId: isAthenaGatewayError(error) ? error.requestId : void 0,
+        hint: isAthenaGatewayError(error) ? error.hint : void 0,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  const requestInit = {
+    method,
+    headers,
+    signal: options?.signal
+  };
+  if (payload !== void 0 && method !== "GET") {
+    requestInit.body = JSON.stringify(payload);
+  }
+  let response;
+  try {
+    response = await fetch(url, requestInit);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Network error while calling Athena storage ${method} ${endpoint}: ${message}`,
+        status: 0,
+        endpoint,
+        method,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  let rawText;
+  try {
+    rawText = await response.text();
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Athena storage ${method} ${endpoint} response body could not be read`,
+        status: response.status,
+        endpoint,
+        method,
+        requestId: headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]),
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  const parsedBody = parseResponseBody3(rawText ?? "", response.headers.get("content-type"));
+  const requestId = headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]);
+  if (parsedBody.parseFailed) {
+    return rejectStorageError(
+      {
+        code: "INVALID_JSON",
+        message: `Athena storage ${method} ${endpoint} returned malformed JSON`,
+        status: response.status,
+        endpoint,
+        method,
+        requestId,
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (!response.ok) {
+    return rejectStorageError(
+      {
+        code: "HTTP_ERROR",
+        message: resolveErrorMessage3(
+          parsedBody.parsed,
+          `Athena storage ${method} ${endpoint} failed with status ${response.status}`
+        ),
+        status: response.status,
+        endpoint,
+        method,
+        requestId,
+        hint: resolveErrorHint2(parsedBody.parsed),
+        cause: resolveErrorCause(parsedBody.parsed),
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (envelope === "athena") {
+    if (!isRecord6(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
+      return rejectStorageError(
+        {
+          code: "INVALID_ATHENA_ENVELOPE",
+          message: `Athena storage ${method} ${endpoint} returned an invalid Athena envelope`,
+          status: response.status,
+          endpoint,
+          method,
+          requestId,
+          raw: parsedBody.parsed
+        },
+        options,
+        runtimeOptions
+      );
+    }
+    return parsedBody.parsed.data;
+  }
+  return parsedBody.parsed;
+}
+async function callStorageBinaryEndpoint(gateway, endpoint, method, options, runtimeOptions) {
+  let url;
+  let headers;
+  try {
+    const baseUrl = options?.baseUrl ? normalizeAthenaGatewayBaseUrl(options.baseUrl) : gateway.baseUrl;
+    url = buildAthenaGatewayUrl(baseUrl, endpoint);
+    headers = gateway.buildHeaders(options);
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: storageCodeFromUnknown(error),
+        message: error instanceof Error ? error.message : `Athena storage ${method} ${endpoint} failed before sending the request`,
+        status: isAthenaGatewayError(error) ? error.status : 0,
+        endpoint,
+        method,
+        raw: error,
+        requestId: isAthenaGatewayError(error) ? error.requestId : void 0,
+        hint: isAthenaGatewayError(error) ? error.hint : void 0,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  let response;
+  try {
+    response = await fetch(url, {
+      method,
+      headers,
+      signal: options?.signal
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Network error while calling Athena storage ${method} ${endpoint}: ${message}`,
+        status: 0,
+        endpoint,
+        method,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (response.ok) {
+    return response;
+  }
+  const requestId = headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]);
+  let rawErrorBody = null;
+  try {
+    const rawText = await response.text();
+    const parsedBody = parseResponseBody3(rawText ?? "", response.headers.get("content-type"));
+    rawErrorBody = parsedBody.parsed;
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Athena storage ${method} ${endpoint} error response body could not be read`,
+        status: response.status,
+        endpoint,
+        method,
+        requestId,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  return rejectStorageError(
+    {
+      code: "HTTP_ERROR",
+      message: resolveErrorMessage3(
+        rawErrorBody,
+        `Athena storage ${method} ${endpoint} failed with status ${response.status}`
+      ),
+      status: response.status,
+      endpoint,
+      method,
+      requestId,
+      hint: resolveErrorHint2(rawErrorBody),
+      cause: resolveErrorCause(rawErrorBody),
+      raw: rawErrorBody
+    },
+    options,
+    runtimeOptions
+  );
+}
+function isBlobBody(body) {
+  return typeof Blob !== "undefined" && body instanceof Blob;
+}
+function isReadableStreamBody(body) {
+  return typeof ReadableStream !== "undefined" && body instanceof ReadableStream;
+}
+async function putPresignedUploadBody(uploadUrl, uploadHeaders, body, options) {
+  const headers = new Headers(uploadHeaders);
+  Object.entries(options?.headers ?? {}).forEach(([key, value]) => headers.set(key, value));
+  if (!headers.has("Content-Type") && isBlobBody(body) && body.type) {
+    headers.set("Content-Type", body.type);
+  }
+  const init = {
+    method: "PUT",
+    headers,
+    body,
+    signal: options?.signal
+  };
+  if (isReadableStreamBody(body)) {
+    init.duplex = "half";
+  }
+  return fetch(uploadUrl, init);
+}
+function attachManagedUpload(upload) {
+  const headers = {};
+  return {
+    ...upload,
+    method: "PUT",
+    headers,
+    expiresAt: upload.expires_at,
+    put(body, options) {
+      return putPresignedUploadBody(upload.url, headers, body, options);
+    }
+  };
+}
+function attachUploadHelper(response) {
+  return {
+    ...response,
+    upload: attachManagedUpload(response.upload)
+  };
+}
+function attachUploadHelpers(response) {
+  return {
+    files: response.files.map(attachUploadHelper)
+  };
+}
+function normalizeUploadUrlRequest(input) {
+  const s3_id = input.s3_id ?? input.s3Id;
+  const storage_key = input.storage_key ?? input.storageKey;
+  if (!s3_id?.trim()) {
+    throw new Error("athena.storage.file.upload requires s3_id or s3Id");
+  }
+  if (!storage_key?.trim()) {
+    throw new Error("athena.storage.file.upload requires storage_key or storageKey");
+  }
+  const fileName = input.fileName?.trim();
+  const originalName = input.originalName?.trim();
+  return {
+    s3_id,
+    bucket: input.bucket,
+    storage_key,
+    name: input.name ?? fileName,
+    original_name: input.original_name ?? originalName ?? fileName,
+    resource_id: input.resource_id ?? input.resourceId,
+    mime_type: input.mime_type ?? input.mimeType,
+    content_type: input.content_type ?? input.contentType,
+    size_bytes: input.size_bytes ?? input.sizeBytes,
+    file_id: input.file_id ?? input.fileId,
+    public: input.public,
+    visibility: input.visibility,
+    metadata: input.metadata
+  };
+}
+async function callStorageUploadBinaryEndpoint(gateway, endpoint, body, options, runtimeOptions) {
+  let url;
+  let headers;
+  try {
+    const baseUrl = options?.baseUrl ? normalizeAthenaGatewayBaseUrl(options.baseUrl) : gateway.baseUrl;
+    url = buildAthenaGatewayUrl(baseUrl, endpoint);
+    headers = gateway.buildHeaders(options);
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: storageCodeFromUnknown(error),
+        message: error instanceof Error ? error.message : `Athena storage PUT ${endpoint} failed before sending the request`,
+        status: isAthenaGatewayError(error) ? error.status : 0,
+        endpoint,
+        method: "PUT",
+        raw: error,
+        requestId: isAthenaGatewayError(error) ? error.requestId : void 0,
+        hint: isAthenaGatewayError(error) ? error.hint : void 0,
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  delete headers["Content-Type"];
+  delete headers["content-type"];
+  if (isBlobBody(body) && body.type) {
+    headers["Content-Type"] = body.type;
+  }
+  const requestInit = {
+    method: "PUT",
+    headers,
+    body,
+    signal: options?.signal
+  };
+  if (isReadableStreamBody(body)) {
+    requestInit.duplex = "half";
+  }
+  let response;
+  try {
+    response = await fetch(url, requestInit);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Network error while calling Athena storage PUT ${endpoint}: ${message}`,
+        status: 0,
+        endpoint,
+        method: "PUT",
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  let rawText;
+  try {
+    rawText = await response.text();
+  } catch (error) {
+    return rejectStorageError(
+      {
+        code: "NETWORK_ERROR",
+        message: `Athena storage PUT ${endpoint} response body could not be read`,
+        status: response.status,
+        endpoint,
+        method: "PUT",
+        requestId: headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]),
+        cause: error
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  const parsedBody = parseResponseBody3(rawText ?? "", response.headers.get("content-type"));
+  const requestId = headerValue(response.headers, ["x-athena-request-id", "x-request-id", "request-id"]);
+  if (parsedBody.parseFailed) {
+    return rejectStorageError(
+      {
+        code: "INVALID_JSON",
+        message: `Athena storage PUT ${endpoint} returned malformed JSON`,
+        status: response.status,
+        endpoint,
+        method: "PUT",
+        requestId,
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (!response.ok) {
+    return rejectStorageError(
+      {
+        code: "HTTP_ERROR",
+        message: resolveErrorMessage3(
+          parsedBody.parsed,
+          `Athena storage PUT ${endpoint} failed with status ${response.status}`
+        ),
+        status: response.status,
+        endpoint,
+        method: "PUT",
+        requestId,
+        hint: resolveErrorHint2(parsedBody.parsed),
+        cause: resolveErrorCause(parsedBody.parsed),
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  if (!isRecord6(parsedBody.parsed) || !("data" in parsedBody.parsed)) {
+    return rejectStorageError(
+      {
+        code: "INVALID_ATHENA_ENVELOPE",
+        message: `Athena storage PUT ${endpoint} returned an invalid Athena envelope`,
+        status: response.status,
+        endpoint,
+        method: "PUT",
+        requestId,
+        raw: parsedBody.parsed
+      },
+      options,
+      runtimeOptions
+    );
+  }
+  return parsedBody.parsed.data;
+}
+function createStorageModule(gateway, runtimeOptions) {
+  const callRaw = (path, method, payload, options) => callStorageEndpoint(
+    gateway,
+    storagePath(path),
+    method,
+    "raw",
+    payload,
+    options,
+    runtimeOptions
+  );
+  const callAthena2 = (path, method, payload, options) => callStorageEndpoint(
+    gateway,
+    storagePath(path),
+    method,
+    "athena",
+    payload,
+    options,
+    runtimeOptions
+  );
+  const base = {
+    listStorageCatalogs(options) {
+      return callRaw("/storage/catalogs", "GET", void 0, options);
+    },
+    createStorageCatalog(input, options) {
+      return callRaw("/storage/catalogs", "POST", input, options);
+    },
+    updateStorageCatalog(id, input, options) {
+      return callRaw(withPathParam("/storage/catalogs/{id}", "id", id), "PATCH", input, options);
+    },
+    deleteStorageCatalog(id, options) {
+      return callRaw(withPathParam("/storage/catalogs/{id}", "id", id), "DELETE", void 0, options);
+    },
+    listStorageCredentials(options) {
+      return callRaw("/storage/credentials", "GET", void 0, options);
+    },
+    createStorageUploadUrl(input, options) {
+      return callAthena2("/storage/files/upload-url", "POST", input, options);
+    },
+    createStorageUploadUrls(input, options) {
+      return callAthena2("/storage/files/upload-urls", "POST", input, options);
+    },
+    listStorageFiles(input, options) {
+      return callAthena2("/storage/files/list", "POST", input, options);
+    },
+    getStorageFile(fileId, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}", "file_id", fileId), "GET", void 0, options);
+    },
+    getStorageFileUrl(fileId, query, options) {
+      const path = appendQuery(
+        withPathParam("/storage/files/{file_id}/url", "file_id", fileId),
+        query
+      );
+      return callAthena2(path, "GET", void 0, options);
+    },
+    getStorageFileProxy(fileId, query, options) {
+      const path = appendQuery(
+        withPathParam("/storage/files/{file_id}/proxy", "file_id", fileId),
+        query
+      );
+      return callStorageBinaryEndpoint(gateway, storagePath(path), "GET", options, runtimeOptions);
+    },
+    updateStorageFile(fileId, input, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}", "file_id", fileId), "PATCH", input, options);
+    },
+    deleteStorageFile(fileId, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}", "file_id", fileId), "DELETE", void 0, options);
+    },
+    setStorageFileVisibility(fileId, input, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/visibility", "file_id", fileId), "PATCH", input, options);
+    },
+    deleteStorageFolder(input, options) {
+      return callAthena2("/storage/folders/delete", "POST", input, options);
+    },
+    moveStorageFolder(input, options) {
+      return callAthena2("/storage/folders/move", "POST", input, options);
+    }
+  };
+  const fileFacade = createStorageFileModule(base, runtimeOptions);
+  const fileUpload = ((input, options) => {
+    if (isRecord6(input) && "files" in input) {
+      return fileFacade.upload(input, options);
+    }
+    return base.createStorageUploadUrl(
+      normalizeUploadUrlRequest(input),
+      options
+    ).then(attachUploadHelper);
+  });
+  const fileDelete = ((input, options) => fileFacade.delete(input, options));
+  const file = {
+    ...fileFacade,
+    upload: fileUpload,
+    uploadMany(input, options) {
+      return base.createStorageUploadUrls(
+        { files: input.files.map(normalizeUploadUrlRequest) },
+        options
+      ).then(attachUploadHelpers);
+    },
+    confirmUpload(fileId, input, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/confirm-upload", "file_id", fileId), "POST", input ?? {}, options);
+    },
+    uploadBinary(fileId, body, options) {
+      return callStorageUploadBinaryEndpoint(
+        gateway,
+        storagePath(withPathParam("/storage/files/{file_id}/upload", "file_id", fileId)),
+        body,
+        options,
+        runtimeOptions
+      );
+    },
+    search(input, options) {
+      return callAthena2("/storage/files/search", "POST", input, options);
+    },
+    get(fileId, options) {
+      return base.getStorageFile(fileId, options);
+    },
+    update(fileId, input, options) {
+      return base.updateStorageFile(fileId, input, options);
+    },
+    delete: fileDelete,
+    deleteMany(input, options) {
+      return callAthena2("/storage/files/delete-many", "POST", input, options);
+    },
+    updateMany(input, options) {
+      return callAthena2("/storage/files/update-many", "POST", input, options);
+    },
+    restore(fileId, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/restore", "file_id", fileId), "POST", {}, options);
+    },
+    purge(fileId, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/purge", "file_id", fileId), "DELETE", void 0, options);
+    },
+    copy(fileId, input, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/copy", "file_id", fileId), "POST", input, options);
+    },
+    url(fileId, query, options) {
+      return base.getStorageFileUrl(fileId, query, options);
+    },
+    publicUrl(fileId, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/public-url", "file_id", fileId), "GET", void 0, options);
+    },
+    proxy(fileId, query, options) {
+      return base.getStorageFileProxy(fileId, query, options);
+    },
+    visibility: {
+      set(fileId, input, options) {
+        return base.setStorageFileVisibility(fileId, input, options);
+      },
+      setMany(input, options) {
+        return callAthena2("/storage/files/visibility-many", "POST", input, options);
+      }
     }
-  }
-  throw new Error("withRetry reached an unexpected state");
-}
-
-// src/db/module.ts
-function createDbModule(input) {
-  const db = {
-    from(table, options) {
-      return input.from(table, options);
+  };
+  const credentials = {
+    list(options) {
+      return base.listStorageCredentials(options);
+    }
+  };
+  const catalog = {
+    list(options) {
+      return base.listStorageCatalogs(options);
     },
-    select(table, columns, options) {
-      return input.from(table).select(columns, options);
+    create(input, options) {
+      return base.createStorageCatalog(input, options);
     },
-    insert(table, values, options) {
-      return Array.isArray(values) ? input.from(table).insert(values, options) : input.from(table).insert(values, options);
+    update(id, input, options) {
+      return base.updateStorageCatalog(id, input, options);
     },
-    upsert(table, values, options) {
-      return Array.isArray(values) ? input.from(table).upsert(values, options) : input.from(table).upsert(values, options);
+    delete(id, options) {
+      return base.deleteStorageCatalog(id, options);
+    }
+  };
+  const folder = {
+    list(input, options) {
+      return callAthena2("/storage/folders/list", "POST", input, options);
     },
-    update(table, values, options) {
-      return input.from(table).update(values, options);
+    tree(input, options) {
+      return callAthena2("/storage/folders/tree", "POST", input, options);
     },
-    delete(table, options) {
-      return input.from(table).delete(options);
+    delete(input, options) {
+      return base.deleteStorageFolder(input, options);
     },
-    rpc(fn, args, options) {
-      return input.rpc(fn, args, options);
+    move(input, options) {
+      return base.moveStorageFolder(input, options);
+    }
+  };
+  const permission = {
+    list(input, options) {
+      return callAthena2("/storage/permissions/list", "POST", input, options);
     },
-    query(query, options) {
-      return input.query(query, options);
+    grant(input, options) {
+      return callAthena2("/storage/permissions/grant", "POST", input, options);
+    },
+    revoke(input, options) {
+      return callAthena2("/storage/permissions/revoke", "POST", input, options);
+    },
+    check(input, options) {
+      return callAthena2("/storage/permissions/check", "POST", input, options);
     }
   };
-  return db;
+  const objectFolder = {
+    create(input, options) {
+      return callAthena2("/storage/objects/folder", "POST", input, options);
+    },
+    delete(input, options) {
+      return callAthena2("/storage/objects/folder/delete", "POST", input, options);
+    },
+    rename(input, options) {
+      return callAthena2("/storage/objects/folder/rename", "POST", input, options);
+    }
+  };
+  const object = {
+    list(input, options) {
+      return callAthena2("/storage/objects", "POST", input, options);
+    },
+    head(input, options) {
+      return callAthena2("/storage/objects/head", "POST", input, options);
+    },
+    exists(input, options) {
+      return callAthena2("/storage/objects/exists", "POST", input, options);
+    },
+    validate(input, options) {
+      return callAthena2("/storage/objects/validate", "POST", input, options);
+    },
+    update(input, options) {
+      return callAthena2("/storage/objects/update", "POST", input, options);
+    },
+    copy(input, options) {
+      return callAthena2("/storage/objects/copy", "POST", input, options);
+    },
+    url(input, options) {
+      return callAthena2("/storage/objects/url", "POST", input, options);
+    },
+    publicUrl(input, options) {
+      return callAthena2("/storage/objects/public-url", "POST", input, options);
+    },
+    delete(input, options) {
+      return callAthena2("/storage/objects/delete", "POST", input, options);
+    },
+    uploadUrl(input, options) {
+      return callAthena2("/storage/objects/upload-url", "POST", input, options);
+    },
+    folder: objectFolder
+  };
+  const bucket = {
+    list(input, options) {
+      return callAthena2("/storage/buckets/list", "POST", input, options);
+    },
+    create(input, options) {
+      return callAthena2("/storage/buckets/create", "POST", input, options);
+    },
+    delete(input, options) {
+      return callAthena2("/storage/buckets/delete", "POST", input, options);
+    },
+    cors: {
+      get(input, options) {
+        return callAthena2("/storage/buckets/cors", "POST", input, options);
+      },
+      set(input, options) {
+        return callAthena2("/storage/buckets/cors/set", "POST", input, options);
+      },
+      delete(input, options) {
+        return callAthena2("/storage/buckets/cors/delete", "POST", input, options);
+      }
+    }
+  };
+  const multipart = {
+    create(input, options) {
+      return callAthena2("/storage/multipart/create", "POST", input, options);
+    },
+    signPart(input, options) {
+      return callAthena2("/storage/multipart/sign-part", "POST", input, options);
+    },
+    complete(input, options) {
+      return callAthena2("/storage/multipart/complete", "POST", input, options);
+    },
+    abort(input, options) {
+      return callAthena2("/storage/multipart/abort", "POST", input, options);
+    },
+    listParts(input, options) {
+      return callAthena2("/storage/multipart/list-parts", "POST", input, options);
+    }
+  };
+  const audit = {
+    list(input, options) {
+      return callAthena2("/storage/audit/list", "POST", input, options);
+    }
+  };
+  return {
+    ...base,
+    credentials,
+    catalog,
+    file,
+    folder,
+    permission,
+    object,
+    bucket,
+    multipart,
+    audit,
+    delete: file.delete
+  };
 }
 
 // src/query-ast.ts
@@ -2755,7 +4808,7 @@ var BOOLEAN_SAFE_OPERATORS = /* @__PURE__ */ new Set([
   "ilike",
   "is"
 ]);
-function isRecord5(value) {
+function isRecord7(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isUuidString(value) {
@@ -2768,7 +4821,7 @@ function shouldUseUuidTextComparison(column, value) {
   return typeof value === "string" && isUuidString(value) && isUuidIdentifierColumn(column);
 }
 function isRelationSelectNode(value) {
-  return isRecord5(value) && isRecord5(value.select);
+  return isRecord7(value) && isRecord7(value.select);
 }
 function normalizeIdentifier(value, label) {
   const normalized = value.trim();
@@ -2824,7 +4877,7 @@ function compileRelationToken(key, node) {
   return `${prefix}${relationToken}(${nested})`;
 }
 function compileSelectShape(select) {
-  if (!isRecord5(select)) {
+  if (!isRecord7(select)) {
     throw new Error("findMany select must be an object");
   }
   const tokens = [];
@@ -2848,7 +4901,7 @@ function compileSelectShape(select) {
   return tokens.join(",");
 }
 function selectShapeUsesRelationSchema(select) {
-  if (!isRecord5(select)) {
+  if (!isRecord7(select)) {
     return false;
   }
   for (const rawValue of Object.values(select)) {
@@ -2866,7 +4919,7 @@ function selectShapeUsesRelationSchema(select) {
 }
 function compileColumnWhere(column, input) {
   const normalizedColumn = normalizeIdentifier(column, "where column");
-  if (!isRecord5(input)) {
+  if (!isRecord7(input)) {
     return [buildGatewayCondition("eq", normalizedColumn, input)];
   }
   const conditions = [];
@@ -2894,7 +4947,7 @@ function compileColumnWhere(column, input) {
   return conditions;
 }
 function compileBooleanExpressionTerms(clause, label) {
-  if (!isRecord5(clause)) {
+  if (!isRecord7(clause)) {
     throw new Error(`findMany where.${label} clauses must be objects`);
   }
   const entries = Object.entries(clause).filter(([, value]) => value !== void 0);
@@ -2903,7 +4956,7 @@ function compileBooleanExpressionTerms(clause, label) {
   }
   const [rawColumn, rawValue] = entries[0];
   const column = normalizeIdentifier(rawColumn, `where.${label} column`);
-  if (!isRecord5(rawValue)) {
+  if (!isRecord7(rawValue)) {
     return [`${column}.eq.${stringifyFilterValue(rawValue)}`];
   }
   const operatorEntries = Object.entries(rawValue).filter(([, value]) => value !== void 0);
@@ -2927,7 +4980,7 @@ function compileWhere(where) {
   if (where === void 0) {
     return void 0;
   }
-  if (!isRecord5(where)) {
+  if (!isRecord7(where)) {
     throw new Error("findMany where must be an object");
   }
   const conditions = [];
@@ -2977,7 +5030,7 @@ function compileOrderBy(orderBy) {
   if (orderBy === void 0) {
     return void 0;
   }
-  if (!isRecord5(orderBy)) {
+  if (!isRecord7(orderBy)) {
     throw new Error("findMany orderBy must be an object");
   }
   if ("column" in orderBy) {
@@ -3152,11 +5205,11 @@ function toFindManyAstOrder(order) {
     ascending: order.direction !== "descending"
   };
 }
-function isRecord6(value) {
+function isRecord8(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function normalizeFindManyAstColumnPredicate(value) {
-  if (!isRecord6(value)) {
+  if (!isRecord8(value)) {
     return {
       eq: value
     };
@@ -3180,7 +5233,7 @@ function normalizeFindManyAstBooleanOperand(clause) {
   return normalized;
 }
 function normalizeFindManyAstWhere(where) {
-  if (!where || !isRecord6(where)) {
+  if (!where || !isRecord8(where)) {
     return where;
   }
   const normalized = {};
@@ -3194,7 +5247,7 @@ function normalizeFindManyAstWhere(where) {
       );
       continue;
     }
-    if (key === "not" && isRecord6(value)) {
+    if (key === "not" && isRecord8(value)) {
       normalized.not = normalizeFindManyAstBooleanOperand(
         value
       );
@@ -3205,7 +5258,7 @@ function normalizeFindManyAstWhere(where) {
   return normalized;
 }
 function predicateRequiresUuidQueryFallback(column, value) {
-  if (!isRecord6(value)) {
+  if (!isRecord8(value)) {
     return shouldUseUuidTextComparison(column, value);
   }
   const eqValue = value.eq;
@@ -3223,7 +5276,7 @@ function booleanOperandRequiresUuidQueryFallback(clause) {
   return false;
 }
 function findManyAstWhereRequiresLegacyTransport(where) {
-  if (!where || !isRecord6(where)) {
+  if (!where || !isRecord8(where)) {
     return false;
   }
   for (const [key, value] of Object.entries(where)) {
@@ -3238,7 +5291,7 @@ function findManyAstWhereRequiresLegacyTransport(where) {
       }
       continue;
     }
-    if (key === "not" && isRecord6(value)) {
+    if (key === "not" && isRecord8(value)) {
       if (booleanOperandRequiresUuidQueryFallback(value)) {
         return true;
       }
@@ -3440,7 +5493,7 @@ async function executeExperimentalRead(experimental, runner) {
     throw error;
   }
 }
-function isRecord7(value) {
+function isRecord9(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function firstNonEmptyString2(...values) {
@@ -3452,8 +5505,8 @@ function firstNonEmptyString2(...values) {
   return void 0;
 }
 function resolveStructuredErrorPayload2(raw) {
-  if (!isRecord7(raw)) return null;
-  return isRecord7(raw.error) ? raw.error : raw;
+  if (!isRecord9(raw)) return null;
+  return isRecord9(raw.error) ? raw.error : raw;
 }
 function resolveStructuredErrorDetails(payload, message) {
   if (!payload || !("details" in payload)) {
@@ -3469,7 +5522,7 @@ function resolveStructuredErrorDetails(payload, message) {
   return details;
 }
 function createResultError(response, result, normalized) {
-  const rawRecord = isRecord7(response.raw) ? response.raw : null;
+  const rawRecord = isRecord9(response.raw) ? response.raw : null;
   const payload = resolveStructuredErrorPayload2(response.raw);
   const message = firstNonEmptyString2(
     response.error,
@@ -4932,7 +6985,7 @@ function createClientFromConfig(config) {
   };
   const query = createQueryBuilder(gateway, formatGatewayResult, config.experimental, queryTracer);
   const db = createDbModule({ from, rpc, query });
-  return {
+  const sdkClient = {
     from,
     db,
     rpc,
@@ -4940,6 +6993,14 @@ function createClientFromConfig(config) {
     verifyConnection: gateway.verifyConnection,
     auth: auth.auth
   };
+  if (config.experimental?.athenaStorageBackend) {
+    const storageClient = {
+      ...sdkClient,
+      storage: createStorageModule(gateway, config.experimental.storage)
+    };
+    return storageClient;
+  }
+  return sdkClient;
 }
 var DEFAULT_BACKEND = { type: "athena" };
 function toBackendConfig(b) {
@@ -4970,6 +7031,12 @@ function mergeExperimentalOptions(current, next) {
       ...next.traceQueries
     };
   }
+  if (current?.storage || next.storage) {
+    merged.storage = {
+      ...current?.storage ?? {},
+      ...next.storage ?? {}
+    };
+  }
   return merged;
 }
 var AthenaClientBuilderImpl = class {
@@ -5006,7 +7073,7 @@ var AthenaClientBuilderImpl = class {
   }
   experimental(options) {
     this.experimentalOptions = mergeExperimentalOptions(this.experimentalOptions, options);
-    return this;
+    return options.athenaStorageBackend ? this : this;
   }
   options(options) {
     if (options.client !== void 0) {
@@ -5027,7 +7094,7 @@ var AthenaClientBuilderImpl = class {
     if (options.experimental !== void 0) {
       this.experimentalOptions = mergeExperimentalOptions(this.experimentalOptions, options.experimental);
     }
-    return this;
+    return options.experimental?.athenaStorageBackend ? this : this;
   }
   build() {
     if (!this.baseUrl || !this.apiKey) {
@@ -5223,7 +7290,7 @@ function resolveNullishValue(mode) {
   if (mode === "null") return null;
   return "";
 }
-function isRecord8(value) {
+function isRecord10(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function isNullableColumn(model, key) {
@@ -5232,7 +7299,7 @@ function isNullableColumn(model, key) {
 }
 function toModelFormDefaults(model, values, options) {
   const source = values;
-  if (!isRecord8(source)) {
+  if (!isRecord10(source)) {
     return {};
   }
   const mode = options?.nullishMode ?? "empty-string";
@@ -5307,6 +7374,90 @@ function resolveProviderSchemas(providerConfig) {
   return [...DEFAULT_POSTGRES_SCHEMAS];
 }
 
+// src/generator/env.ts
+function readEnvStringValue(key) {
+  if (typeof process === "undefined" || !process.env) {
+    return void 0;
+  }
+  const value = process.env[key];
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function throwMissingEnvVar(key) {
+  throw new Error(
+    `Generator config env var ${key} is missing or empty. Set ${key} or provide a default value.`
+  );
+}
+function resolveEnvValue(key, options, resolver) {
+  const rawValue = readEnvStringValue(key);
+  if (rawValue === void 0) {
+    if (options?.default !== void 0) {
+      return options.default;
+    }
+    if (options?.optional) {
+      return void 0;
+    }
+    return throwMissingEnvVar(key);
+  }
+  return resolver(rawValue);
+}
+function resolveStringEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => value);
+}
+function resolveBooleanEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => parseBooleanFlag2(value, false));
+}
+function resolveListEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => {
+    const separator = options?.separator ?? ",";
+    return value.split(separator).map((entry) => entry.trim()).filter((entry, index, entries) => entry.length > 0 && entries.indexOf(entry) === index);
+  })?.slice();
+}
+function resolveJsonEnv(key, options) {
+  return resolveEnvValue(key, options, (value) => {
+    try {
+      return JSON.parse(value);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Generator config env var ${key} must contain valid JSON. ${message}`);
+    }
+  });
+}
+function resolveOneOfEnv(key, allowedValues, options) {
+  return resolveEnvValue(key, options, (value) => {
+    if (allowedValues.includes(value)) {
+      return value;
+    }
+    throw new Error(
+      `Generator config env var ${key} must be one of: ${allowedValues.join(", ")}. Received: ${value}.`
+    );
+  });
+}
+function generatorEnvString(key, options) {
+  return resolveStringEnv(key, options);
+}
+function generatorEnvBoolean(key, options) {
+  return resolveBooleanEnv(key, options);
+}
+function generatorEnvList(key, options) {
+  return resolveListEnv(key, options);
+}
+function generatorEnvJson(key, options) {
+  return resolveJsonEnv(key, options);
+}
+function generatorEnvOneOf(key, allowedValues, options) {
+  return resolveOneOfEnv(key, allowedValues, options);
+}
+var generatorEnv = Object.assign(generatorEnvString, {
+  boolean: generatorEnvBoolean,
+  list: generatorEnvList,
+  json: generatorEnvJson,
+  oneOf: generatorEnvOneOf
+});
+
 // src/generator/postgres-type-mapping.ts
 var NUMBER_TYPES = /* @__PURE__ */ new Set([
   "int2",
@@ -5423,6 +7574,433 @@ function resolvePostgresColumnType(column) {
   return wrapArrayType(baseType, column.arrayDimensions);
 }
 
+// src/auth/server.ts
+var DEFAULT_AUTH_BASE_PATH = "/api/auth";
+var ATHENA_AUTH_BASE_ERROR_CODES = {
+  HANDLER_NOT_CONFIGURED: "HANDLER_NOT_CONFIGURED",
+  INVALID_BASE_URL: "INVALID_BASE_URL",
+  UNTRUSTED_HOST: "UNTRUSTED_HOST"
+};
+function capitalize(value) {
+  return value.length > 0 ? `${value[0]?.toUpperCase()}${value.slice(1)}` : value;
+}
+function serializeSetCookieValue(name, value, attributes) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  const knownKeys = /* @__PURE__ */ new Set([
+    "maxAge",
+    "expires",
+    "domain",
+    "path",
+    "secure",
+    "httpOnly",
+    "partitioned",
+    "sameSite"
+  ]);
+  if (attributes.maxAge !== void 0) {
+    parts.push(`Max-Age=${Math.trunc(attributes.maxAge)}`);
+  }
+  if (attributes.expires instanceof Date) {
+    parts.push(`Expires=${attributes.expires.toUTCString()}`);
+  }
+  if (attributes.domain) {
+    parts.push(`Domain=${attributes.domain}`);
+  }
+  if (attributes.path) {
+    parts.push(`Path=${attributes.path}`);
+  }
+  if (attributes.secure) {
+    parts.push("Secure");
+  }
+  if (attributes.httpOnly) {
+    parts.push("HttpOnly");
+  }
+  if (attributes.partitioned) {
+    parts.push("Partitioned");
+  }
+  if (attributes.sameSite) {
+    parts.push(`SameSite=${capitalize(attributes.sameSite)}`);
+  }
+  for (const [key, rawValue] of Object.entries(attributes)) {
+    if (knownKeys.has(key) || rawValue === void 0 || rawValue === null || rawValue === false) {
+      continue;
+    }
+    if (rawValue === true) {
+      parts.push(key);
+      continue;
+    }
+    parts.push(`${key}=${String(rawValue)}`);
+  }
+  return parts.join("; ");
+}
+function readCookieFromHeaders(headers, name) {
+  const cookieHeader = headers?.get("cookie");
+  if (!cookieHeader) {
+    return void 0;
+  }
+  return parseCookies(cookieHeader).get(name);
+}
+function isRecord11(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function resolveSessionCandidate(value) {
+  if (!isRecord11(value)) {
+    return null;
+  }
+  const session = isRecord11(value.session) ? value.session : void 0;
+  const user = isRecord11(value.user) ? value.user : void 0;
+  if (session && typeof session.token === "string" && session.token.length > 0 && user) {
+    return {
+      session,
+      user
+    };
+  }
+  return null;
+}
+function inferSessionPair(returned) {
+  return resolveSessionCandidate(returned) ?? (isRecord11(returned) ? resolveSessionCandidate(returned.data) : null) ?? (isRecord11(returned) ? resolveSessionCandidate(returned.session) : null);
+}
+function resolveResponseHeaders(ctx) {
+  if (ctx.context.responseHeaders instanceof Headers) {
+    return ctx.context.responseHeaders;
+  }
+  const headers = new Headers();
+  ctx.context.responseHeaders = headers;
+  return headers;
+}
+function normalizeBaseURL(baseURL) {
+  return baseURL.replace(/\/$/, "");
+}
+function normalizeBasePath(basePath) {
+  if (!basePath || basePath === "/") {
+    return DEFAULT_AUTH_BASE_PATH;
+  }
+  const normalized = basePath.startsWith("/") ? basePath : `/${basePath}`;
+  return normalized.endsWith("/") && normalized.length > 1 ? normalized.slice(0, -1) : normalized;
+}
+function isDynamicBaseURLConfig2(baseURL) {
+  return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts);
+}
+function getRequestUrl(request) {
+  try {
+    return new URL(request.url);
+  } catch {
+    return new URL("http://localhost");
+  }
+}
+function getRequestHost(request, url) {
+  const forwardedHost = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const host = forwardedHost || request.headers.get("host") || url.host;
+  return host || null;
+}
+function getRequestProtocol(request, configuredProtocol, url) {
+  if (configuredProtocol === "http" || configuredProtocol === "https") {
+    return configuredProtocol;
+  }
+  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  if (forwardedProto === "http" || forwardedProto === "https") {
+    return forwardedProto;
+  }
+  if (url.protocol === "http:" || url.protocol === "https:") {
+    return url.protocol.slice(0, -1);
+  }
+  return "http";
+}
+function resolveRequestBaseURL(baseURL, request) {
+  if (typeof baseURL === "string") {
+    return normalizeBaseURL(baseURL);
+  }
+  const requestUrl = getRequestUrl(request);
+  const host = getRequestHost(request, requestUrl);
+  if (!host) {
+    return null;
+  }
+  if (isDynamicBaseURLConfig2(baseURL)) {
+    const allowedHosts = baseURL.allowedHosts ?? [];
+    if (allowedHosts.length > 0 && !allowedHosts.includes(host)) {
+      return null;
+    }
+  }
+  const protocol = typeof baseURL === "object" && baseURL !== null ? getRequestProtocol(request, baseURL.protocol, requestUrl) : getRequestProtocol(request, void 0, requestUrl);
+  return `${protocol}://${host}`;
+}
+function getOrigin(baseURL) {
+  if (!baseURL) {
+    return void 0;
+  }
+  try {
+    return new URL(baseURL).origin;
+  } catch {
+    return void 0;
+  }
+}
+async function resolveTrustedOrigins(config, baseURL, request) {
+  const resolved = typeof config.trustedOrigins === "function" ? await config.trustedOrigins(request) : config.trustedOrigins ?? [];
+  const values = [
+    getOrigin(baseURL),
+    ...resolved
+  ];
+  return Array.from(new Set(values.filter((value) => typeof value === "string" && value.length > 0)));
+}
+async function resolveTrustedProviders(config, request) {
+  const configured = typeof config.trustedProviders === "function" ? await config.trustedProviders(request) : config.trustedProviders ?? [];
+  const values = [
+    ...Object.keys(config.socialProviders ?? {}),
+    ...configured
+  ];
+  return Array.from(new Set(values.filter((value) => typeof value === "string" && value.length > 0)));
+}
+function createJsonResponse(payload, init) {
+  const headers = new Headers(init?.headers);
+  if (!headers.has("content-type")) {
+    headers.set("content-type", "application/json; charset=utf-8");
+  }
+  return new Response(JSON.stringify(payload), {
+    ...init,
+    headers
+  });
+}
+function mergeResponseHeaders(response, headers) {
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function defineAthenaAuthConfig(config) {
+  return config;
+}
+function athenaAuth(config) {
+  const normalizedBasePath = normalizeBasePath(config.basePath);
+  const staticBaseURL = typeof config.baseURL === "string" ? normalizeBaseURL(config.baseURL) : void 0;
+  const runtime = {
+    baseURL: staticBaseURL,
+    basePath: normalizedBasePath,
+    secret: config.secret,
+    cookies: {
+      session: config.session,
+      advanced: config.advanced
+    }
+  };
+  const resolvedDatabase = typeof config.database === "function" ? config.database(runtime) : config.database;
+  const cookies = getCookies({
+    baseURL: staticBaseURL ?? config.baseURL,
+    session: config.session,
+    advanced: config.advanced
+  });
+  const auth = {};
+  const createCookieContext = (input = {}) => {
+    const responseHeaders = input.responseHeaders ?? new Headers();
+    const runtimeHeaders = input.headers;
+    const authCookies = input.cookies ?? auth.cookies;
+    const setCookie = input.setCookie ?? ((name, value, attributes) => {
+      responseHeaders.append(
+        "set-cookie",
+        serializeSetCookieValue(name, value, attributes)
+      );
+    });
+    return {
+      headers: runtimeHeaders,
+      getCookie: input.getCookie ?? ((name) => readCookieFromHeaders(runtimeHeaders, name)),
+      setCookie,
+      logger: input.logger,
+      setSignedCookie: input.setSignedCookie,
+      getSignedCookie: input.getSignedCookie,
+      context: {
+        secret: runtime.secret,
+        authCookies,
+        sessionConfig: {
+          expiresIn: config.session?.expiresIn
+        },
+        options: {
+          session: {
+            cookieCache: config.session?.cookieCache
+          },
+          account: {
+            storeAccountCookie: true
+          }
+        },
+        setNewSession: input.setNewSession
+      }
+    };
+  };
+  const setSession = async (input, session, dontRememberMe, overrides) => {
+    const cookieContext = createCookieContext(input);
+    await setSessionCookie(cookieContext, session, dontRememberMe, overrides);
+  };
+  const clearSession = (input, skipDontRememberMe) => {
+    const cookieContext = createCookieContext(input);
+    deleteSessionCookie(cookieContext, skipDontRememberMe);
+  };
+  const applyResponseCookies = async (ctx) => {
+    const responseHeaders = resolveResponseHeaders(ctx);
+    const session = ctx.context.setSession ?? inferSessionPair(ctx.context.returned);
+    if (ctx.context.clearSession) {
+      clearSession({
+        headers: ctx.headers,
+        responseHeaders
+      });
+    }
+    if (session) {
+      await setSession(
+        {
+          headers: ctx.headers,
+          responseHeaders
+        },
+        session,
+        ctx.context.dontRememberMe,
+        ctx.context.cookieOverrides
+      );
+    }
+    return responseHeaders;
+  };
+  const runAfterHooks = async (ctx) => {
+    for (const plugin of auth.plugins) {
+      for (const hook of plugin.hooks?.after ?? []) {
+        if (!hook.matcher(ctx)) {
+          continue;
+        }
+        await hook.handler({
+          ...ctx,
+          auth
+        });
+      }
+    }
+    return ctx;
+  };
+  const resolveRequestContext = async (request) => {
+    const requestUrl = getRequestUrl(request);
+    const resolvedBaseURL = resolveRequestBaseURL(config.baseURL, request);
+    if (!resolvedBaseURL) {
+      throw new Error(
+        isDynamicBaseURLConfig2(config.baseURL) ? "Could not resolve base URL from request. Check allowedHosts/baseURL." : "Could not resolve base URL from request."
+      );
+    }
+    const requestCookies = getCookies({
+      baseURL: resolvedBaseURL,
+      session: config.session,
+      advanced: config.advanced
+    });
+    const trustedOrigins = await resolveTrustedOrigins(config, resolvedBaseURL, request);
+    const trustedProviders = await resolveTrustedProviders(config, request);
+    return {
+      auth,
+      request,
+      url: requestUrl,
+      path: requestUrl.pathname,
+      basePath: normalizedBasePath,
+      baseURL: resolvedBaseURL,
+      origin: getOrigin(resolvedBaseURL) ?? resolvedBaseURL,
+      headers: request.headers,
+      cookies: requestCookies,
+      trustedOrigins,
+      trustedProviders,
+      options: config,
+      runtime: {
+        ...runtime,
+        baseURL: resolvedBaseURL
+      },
+      database: auth.database,
+      socialProviders: auth.socialProviders
+    };
+  };
+  const handler = async (request) => {
+    const requestContext = await resolveRequestContext(request);
+    if (typeof config.handler !== "function") {
+      return createJsonResponse(
+        {
+          ok: false,
+          code: ATHENA_AUTH_BASE_ERROR_CODES.HANDLER_NOT_CONFIGURED,
+          error: "No native auth handler was configured for this Athena auth instance.",
+          path: requestContext.path,
+          basePath: requestContext.basePath
+        },
+        { status: 501 }
+      );
+    }
+    const result = await config.handler(requestContext);
+    if (result instanceof Response) {
+      return result;
+    }
+    const response = result.response ?? (result.returned !== void 0 ? createJsonResponse(result.returned) : new Response(null, { status: 204 }));
+    const responseHeaders = new Headers(response.headers);
+    await runAfterHooks({
+      path: requestContext.path,
+      headers: request.headers,
+      context: {
+        responseHeaders,
+        returned: result.returned,
+        setSession: result.setSession,
+        clearSession: result.clearSession,
+        dontRememberMe: result.dontRememberMe,
+        cookieOverrides: result.cookieOverrides
+      }
+    });
+    return mergeResponseHeaders(response, responseHeaders);
+  };
+  const api = Object.assign(
+    {
+      applyResponseCookies,
+      clearSession,
+      createCookieContext,
+      getCookieCache,
+      getSessionCookie,
+      resolveRequestContext,
+      runAfterHooks,
+      setSession
+    },
+    config.api ?? {}
+  );
+  const $ERROR_CODES = {
+    ...auth.plugins?.reduce((acc, plugin) => {
+      if (plugin.$ERROR_CODES) {
+        return {
+          ...acc,
+          ...plugin.$ERROR_CODES
+        };
+      }
+      return acc;
+    }, {}),
+    ...config.errorCodes ?? {},
+    ...ATHENA_AUTH_BASE_ERROR_CODES
+  };
+  Object.assign(auth, {
+    config,
+    options: config,
+    runtime,
+    database: resolvedDatabase,
+    socialProviders: config.socialProviders ?? {},
+    plugins: [...config.plugins ?? []],
+    cookies,
+    api,
+    $ERROR_CODES,
+    createCookieContext,
+    setSession,
+    clearSession,
+    applyResponseCookies,
+    runAfterHooks,
+    resolveRequestContext,
+    handler
+  });
+  auth.$context = Promise.all([
+    resolveTrustedOrigins(config, staticBaseURL),
+    resolveTrustedProviders(config)
+  ]).then(([trustedOrigins, trustedProviders]) => ({
+    auth,
+    options: config,
+    runtime,
+    basePath: normalizedBasePath,
+    baseURL: staticBaseURL,
+    origin: getOrigin(staticBaseURL),
+    database: auth.database,
+    socialProviders: auth.socialProviders,
+    plugins: auth.plugins,
+    cookies: auth.cookies,
+    trustedOrigins,
+    trustedProviders
+  }));
+  return auth;
+}
+
 // src/browser.ts
 function throwBrowserUnsupported(apiName) {
   throw new Error(
@@ -5454,6 +8032,6 @@ async function runSchemaGenerator(options = {}) {
   return throwBrowserUnsupported("runSchemaGenerator");
 }
 
-export { AthenaClient, AthenaError, AthenaErrorCategory, AthenaErrorCode, AthenaErrorKind, AthenaGatewayError, Backend, DEFAULT_POSTGRES_SCHEMAS, assertInt, coerceInt, createAuthClient, createAuthReactEmailInput, createClient, createModelFormAdapter, createPostgresIntrospectionProvider, createTypedClient, defineAuthEmailTemplate, defineDatabase, defineGeneratorConfig, defineModel, defineRegistry, defineSchema, findGeneratorConfigPath, generateArtifactsFromSnapshot, identifier, isAthenaGatewayError, isOk, loadGeneratorConfig, normalizeAthenaError, normalizeAthenaGatewayBaseUrl, normalizeGeneratorConfig, normalizeSchemaSelection, parseBooleanFlag2 as parseBooleanFlag, renderAthenaReactEmail, requireAffected, requireSuccess, resolveGeneratorProvider, resolvePostgresColumnType, resolveProviderSchemas, runSchemaGenerator, toModelFormDefaults, toModelPayload, unwrap, unwrapOne, unwrapRows, verifyAthenaGatewayUrl, withRetry };
+export { ATHENA_AUTH_BASE_ERROR_CODES, AthenaClient, AthenaError, AthenaErrorCategory, AthenaErrorCode, AthenaErrorKind, AthenaGatewayError, AthenaStorageError, AthenaStorageErrorCode, Backend, DEFAULT_POSTGRES_SCHEMAS, assertInt, athenaAuth, coerceInt, createAthenaStorageError, createAuthClient, createAuthReactEmailInput, createClient, createModelFormAdapter, createPostgresIntrospectionProvider, createTypedClient, defineAthenaAuthConfig, defineAuthEmailTemplate, defineDatabase, defineGeneratorConfig, defineModel, defineRegistry, defineSchema, findGeneratorConfigPath, generateArtifactsFromSnapshot, generatorEnv, identifier, isAthenaGatewayError, isOk, loadGeneratorConfig, normalizeAthenaError, normalizeAthenaGatewayBaseUrl, normalizeGeneratorConfig, normalizeSchemaSelection, parseBooleanFlag2 as parseBooleanFlag, renderAthenaReactEmail, requireAffected, requireSuccess, resolveGeneratorProvider, resolvePostgresColumnType, resolveProviderSchemas, runSchemaGenerator, storageSdkManifest, toModelFormDefaults, toModelPayload, unwrap, unwrapOne, unwrapRows, verifyAthenaGatewayUrl, withRetry };
 //# sourceMappingURL=browser.js.map
 //# sourceMappingURL=browser.js.map