@xylex-group/athena 2.12.0 → 2.13.0

package/dist/utils.d.ts

@@ -1,4 +1,7 @@
-import { I as BackendOption } from './types-CwJCPpLD.js';
+import { E as EnvLike } from './athena-auth-url-oLux_57a.js';
+export { A as ATHENA_AUTH_COOKIE_PREFIXES, o as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, p as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, q as ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, t as ATHENA_AUTH_GET_SESSION_PATH, a as ATHENA_AUTH_PATH, b as ATHENA_AUTH_UPSTREAM_ENV_KEYS, c as ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, u as ATHENA_AUTH_VERIFY_EMAIL_PATH, v as ATHENA_SESSION_DATA_HEADER, w as AUTHENTICATED_REDIRECT_MODE_SET, x as AUTHENTICATED_REDIRECT_VIEW_SET, d as AUTH_DEFAULT_VIEW, y as AUTH_MODE_REDIRECTS, z as AUTH_MODE_SET, e as AUTH_ROUTES, B as AUTH_SESSION_PATH, F as AUTH_TWO_FACTOR_SEGMENT, f as AUTH_VIEW_BY_SEGMENT, G as AthenaAuthClientBaseUrlOptions, H as AthenaAuthUpstreamEnv, I as AthenaAuthUpstreamEnvKey, J as AuthMode, K as AuthModeRedirects, L as AuthRoutes, g as AuthView, C as ClearAuthCookiesOptions, D as DEFAULT_ATHENA_AUTH_ORIGIN, M as DEFAULT_ATHENA_AUTH_UPSTREAM_URL, N as DEFAULT_AUTH_COOKIE_PREFIXES, O as DISABLE_COOKIE_CACHE_QUERY_PARAM, P as DISABLE_COOKIE_CACHE_QUERY_VALUE, Q as LOCAL_DEV_ORIGIN, S as SESSION_DATA_HEADER, h as clearAuthCookies, R as createAuthModeRedirects, T as createAuthRoutes, U as createFreshSessionLookupUrl, i as isAbsoluteUrl, V as isAuthMode, n as normalizeAthenaAuthBaseUrl, W as readAthenaAuthUpstreamUrlFromEnv, r as resolveAthenaAuthClientBaseUrl, j as resolveAthenaAuthRequestUrl, k as resolveAthenaAuthUpstreamUrl, X as resolveAuthModeRedirect, l as resolveAuthViewFromSegment, m as resolveEmailVerificationCallbackUrl, Y as shouldRedirectAuthenticatedAuthMode, s as shouldRedirectAuthenticatedAuthView } from './athena-auth-url-oLux_57a.js';
+export { S as SESSION_COOKIE_PATTERNS, h as hasAuthSessionCookie } from './session-cookie-detection-BqOp9mO6.js';
+import { z as BackendOption } from './types-CH78O90i.js';
 
 declare function slugify(input: string): string;
 
@@ -11,24 +14,74 @@ declare function asRecord(value: unknown): Record<string, unknown> | null;
 declare function asIdentifier(value: unknown): string | null;
 declare function firstString(record: Record<string, unknown> | null | undefined, keys: readonly string[]): string | null;
 declare function readTrimmedString(value: unknown): string | null;
+/**
+ * Trim a string value; return `undefined` when not a non-empty string.
+ *
+ * Unlike {@link asString}, does not coerce numbers/bigints.
+ * Unlike {@link readTrimmedString}, returns `undefined` instead of `null`
+ * (handy for optional fields and `??` defaults).
+ */
+declare function asNonEmptyString(value: unknown): string | undefined;
 declare function asNumber(value: unknown): number | null;
 declare function asStringArray(value: unknown): string[];
 
 declare function parseBooleanFlag(rawValue: string | undefined, fallback: boolean): boolean;
 
+/**
+ * Read the first non-empty trimmed environment variable from a name list.
+ *
+ * @param names - Candidate env keys in priority order
+ * @param env - Optional env map (defaults to `process.env`)
+ * @returns Trimmed value of the first key that is set and non-empty
+ * @throws {Error} When none of the keys yield a non-empty value
+ *
+ * @example
+ * ```ts
+ * import { requireEnv } from "@xylex-group/athena/utils"
+ *
+ * const authUrl = requireEnv([
+ *   "ATHENA_AUTH_UPSTREAM_URL",
+ *   "ATHENA_AUTH_URL",
+ *   "NEXT_PUBLIC_ATHENA_AUTH_URL",
+ * ])
+ * ```
+ */
+declare function requireEnv(names: readonly string[], env?: EnvLike): string;
+/**
+ * Like {@link requireEnv}, but returns `undefined` instead of throwing when
+ * none of the keys are set.
+ */
+declare function readEnv(names: readonly string[], env?: EnvLike): string | undefined;
+
 declare function isLocalHostname(hostname: string): boolean;
 
-interface ClearAuthCookiesOptions {
-    prefixes?: string[];
-    hostname?: string;
-    path?: string;
-    cookieHeader?: string;
+/**
+ * Request header / Next.js helpers used by middleware and RSC session loaders.
+ * Framework-agnostic (no Next imports).
+ */
+/**
+ * True when Next.js threw because the route used dynamic APIs during static
+ * generation (`DYNAMIC_SERVER_USAGE` digest or matching message).
+ *
+ * Catch and rethrow (or handle) so Next can mark the route dynamic.
+ */
+declare function isDynamicServerUsageError(error: unknown): boolean;
+interface GetOriginFromHeadersOptions {
+    /**
+     * When `x-forwarded-proto` / scheme is missing, use `http` if true else `https`.
+     * Typical: `process.env.NODE_ENV !== "production"`.
+     */
+    preferHttpWhenMissingProto?: boolean;
 }
 /**
- * Clears Athena/Better Auth browser cookies by prefix.
- * Returns the cookie names that matched and were targeted for deletion.
+ * Reconstruct public origin from request headers (Origin, or Host + proto).
+ *
+ * Prefers `Origin`, then `x-forwarded-host` / `host` with
+ * `x-forwarded-proto` (first value when comma-separated).
  */
-declare function clearAuthCookies(options?: ClearAuthCookiesOptions): string[];
+declare function getOriginFromHeaders(headersList: {
+    get: (name: string) => string | null;
+}, options?: GetOriginFromHeadersOptions): string | null;
 
 declare function proxyRequestHeaders(request: Request): Headers;
 
@@ -37,7 +90,7 @@ interface BuildAthenaRequestHeadersInput {
     profile: AthenaRequestHeaderProfile;
     sdkHeaderValue: string;
     apiKey?: string | null;
-    /** Overrides `X-Athena-Key` while leaving `apikey` / `x-api-key` on `apiKey`. */
+    /** Overrides the canonical `X-Athena-Key` header value. */
     athenaKey?: string | null;
     client?: string | null;
     userId?: string | null;
@@ -85,6 +138,18 @@ declare function buildServiceRequestHeaders(profile: Exclude<AthenaRequestHeader
 declare function applyAthenaApiKeyHeaders(headers: Record<string, string>, apiKey?: string | null, athenaKey?: string | null): void;
 declare function applyAthenaAuthContextHeaders(headers: Record<string, string>, input: Pick<BuildAthenaRequestHeadersInput, 'bearerToken' | 'cookie' | 'sessionToken' | 'profile' | 'configHeaders' | 'callHeaders'>): void;
 declare function applyAthenaPgUriHeaders(headers: Record<string, string>, input: Pick<BuildAthenaRequestHeadersInput, 'pgUri' | 'jdbcUrl' | 'configHeaders' | 'callHeaders'>): void;
+/**
+ * Minimal gateway/data request headers used by many apps before they adopt
+ * the full {@link buildAthenaRequestHeaders} profile model.
+ *
+ * Additive convenience — does not replace client-built headers. Prefer
+ * `createClient({ client, key })` so the SDK sets these on every call.
+ */
+declare function buildAthenaGatewayHeaders(input: {
+    clientName?: string | null;
+    gatewayKey?: string | null;
+    headers?: Record<string, string | null | undefined>;
+}): Record<string, string>;
 declare function buildAthenaRequestHeaders(input: BuildAthenaRequestHeadersInput): Record<string, string>;
 
 /**
@@ -118,4 +183,4 @@ declare function sqlJsonbLiteral(value: unknown): string;
  */
 declare function sqlBigInt(value: bigint | number): string;
 
-export { type AthenaRequestHeaderOverrideFields, type AthenaRequestHeaderProfile, type BuildAthenaRequestHeadersInput, type ClearAuthCookiesOptions, type ResolvedRequestHeaderOverrides, applyAthenaApiKeyHeaders, applyAthenaAuthContextHeaders, applyAthenaPgUriHeaders, asBoolean, asBooleanOrNull, asIdentifier, asNumber, asRecord, asString, asStringArray, buildAthenaRequestHeaders, buildServiceRequestHeaders, clearAuthCookies, escapeLikePatternValue, firstString, hasHeaderIgnoreCase, isLocalHostname, parseBooleanFlag, proxyRequestHeaders, quoteSqlStringLiteral, readTrimmedString, resolveHeaderValue, resolveRequestHeaderOverrides, slugify, sqlBigInt, sqlJsonbLiteral, sqlNullableText, sqlText, trimTrailingSlashes };
+export { type AthenaRequestHeaderOverrideFields, type AthenaRequestHeaderProfile, type BuildAthenaRequestHeadersInput, EnvLike, type GetOriginFromHeadersOptions, type ResolvedRequestHeaderOverrides, applyAthenaApiKeyHeaders, applyAthenaAuthContextHeaders, applyAthenaPgUriHeaders, asBoolean, asBooleanOrNull, asIdentifier, asNonEmptyString, asNumber, asRecord, asString, asStringArray, buildAthenaGatewayHeaders, buildAthenaRequestHeaders, buildServiceRequestHeaders, escapeLikePatternValue, firstString, getOriginFromHeaders, hasHeaderIgnoreCase, isDynamicServerUsageError, isLocalHostname, parseBooleanFlag, proxyRequestHeaders, quoteSqlStringLiteral, readEnv, readTrimmedString, requireEnv, resolveHeaderValue, resolveRequestHeaderOverrides, slugify, sqlBigInt, sqlJsonbLiteral, sqlNullableText, sqlText, trimTrailingSlashes };

package/dist/utils.js

@@ -68,6 +68,13 @@ function readTrimmedString(value) {
   const trimmed = value.trim();
   return trimmed.length > 0 ? trimmed : null;
 }
+function asNonEmptyString(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalized = value.trim();
+  return normalized.length > 0 ? normalized : void 0;
+}
 function asNumber(value) {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim().length > 0) {
@@ -94,6 +101,46 @@ function parseBooleanFlag(rawValue, fallback) {
   return fallback;
 }
 
+// src/utils/require-env.ts
+function requireEnv(names, env) {
+  if (!names.length) {
+    throw new Error(
+      "requireEnv() requires at least one environment variable name."
+    );
+  }
+  const source = env ?? readProcessEnv();
+  for (const name of names) {
+    const value = source[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  throw new Error(
+    `Missing required environment variable. Expected one of: ${names.join(", ")}`
+  );
+}
+function readEnv(names, env) {
+  if (!names.length) {
+    return void 0;
+  }
+  const source = env ?? readProcessEnv();
+  for (const name of names) {
+    const value = source[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function readProcessEnv() {
+  try {
+    const processEnv = globalThis.process?.env;
+    return processEnv ?? {};
+  } catch {
+    return {};
+  }
+}
+
 // src/utils/hostname.ts
 var LOCAL_IPV4_PATTERN = /^127(?:\.\d{1,3}){3}$/;
 function isLocalHostname(hostname) {
@@ -110,13 +157,41 @@ function isLocalHostname(hostname) {
   return false;
 }
 
+// src/utils/request-origin.ts
+function isDynamicServerUsageError(error) {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const err = error;
+  if (err.digest === "DYNAMIC_SERVER_USAGE") {
+    return true;
+  }
+  return typeof err.message === "string" && err.message.includes("Dynamic server usage:");
+}
+function getOriginFromHeaders(headersList, options = {}) {
+  const origin = headersList.get("origin")?.trim();
+  if (origin) {
+    return origin;
+  }
+  const hostRaw = headersList.get("x-forwarded-host") ?? headersList.get("host");
+  const host = hostRaw?.split(",")[0]?.trim();
+  if (!host) {
+    return null;
+  }
+  const protoRaw = headersList.get("x-forwarded-proto");
+  const protoFirst = protoRaw?.split(",")[0]?.trim().toLowerCase();
+  const proto = protoFirst === "http" || protoFirst === "https" ? protoFirst : options.preferHttpWhenMissingProto ? "http" : "https";
+  return `${proto}://${host}`;
+}
+
 // src/utils/auth-cookies.ts
-var DEFAULT_AUTH_COOKIE_PREFIXES = [
+var ATHENA_AUTH_COOKIE_PREFIXES = [
   "athena-auth",
   "__Secure-athena-auth",
   "better-auth",
   "__Secure-better-auth"
 ];
+var DEFAULT_AUTH_COOKIE_PREFIXES = ATHENA_AUTH_COOKIE_PREFIXES;
 function extractCookieNames(cookieHeader) {
   const names = /* @__PURE__ */ new Set();
   for (const rawCookie of cookieHeader.split(";")) {
@@ -178,9 +253,11 @@ function clearAuthCookies(options = {}) {
   if (!cookieHeader?.trim()) {
     return [];
   }
-  const prefixes = options.prefixes?.length ? options.prefixes : [...DEFAULT_AUTH_COOKIE_PREFIXES];
+  const prefixes = options.prefixes?.length ? options.prefixes : [...ATHENA_AUTH_COOKIE_PREFIXES];
   const cookieNames = extractCookieNames(cookieHeader);
-  const namesToClear = cookieNames.filter((name) => prefixes.some((prefix) => name.startsWith(prefix)));
+  const namesToClear = cookieNames.filter(
+    (name) => prefixes.some((prefix) => name.startsWith(prefix))
+  );
   if (namesToClear.length === 0) {
     return [];
   }
@@ -196,6 +273,295 @@ function clearAuthCookies(options = {}) {
   return namesToClear;
 }
 
+// src/cookies/session-cookie-detection.ts
+var SESSION_COOKIE_PATTERNS = [
+  /(?:^|;\s*)(?:__Secure-)?better-auth\.session_token=/,
+  /(?:^|;\s*)(?:__Secure-)?better-auth-session_token=/,
+  /(?:^|;\s*)(?:__Secure-)?athena-auth\.session-token=/,
+  /(?:^|;\s*)(?:__Secure-)?athena-auth-session-token=/,
+  /(?:^|;\s*)(?:__Secure-)?athena-auth\.session_token=/,
+  /(?:^|;\s*)(?:__Secure-)?athena-auth-session_token=/
+];
+function hasAuthSessionCookie(cookieHeader) {
+  if (!cookieHeader) {
+    return false;
+  }
+  return SESSION_COOKIE_PATTERNS.some((pattern) => pattern.test(cookieHeader));
+}
+
+// src/utils/athena-auth-url.ts
+var ATHENA_AUTH_PATH = "/api/auth";
+var LOCAL_DEV_ORIGIN = "http://localhost:3000";
+var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";
+var DEFAULT_ATHENA_AUTH_UPSTREAM_URL = DEFAULT_ATHENA_AUTH_ORIGIN;
+var ATHENA_AUTH_UPSTREAM_ENV_KEYS = [
+  "ATHENA_AUTH_UPSTREAM_URL",
+  "ATHENA_AUTH_URL",
+  "NEXT_PUBLIC_ATHENA_AUTH_UPSTREAM_URL",
+  "NEXT_PUBLIC_ATHENA_AUTH_URL"
+];
+var ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES = ATHENA_AUTH_UPSTREAM_ENV_KEYS;
+var LEADING_SLASHES_REGEX = /^\/+/;
+function stripTrailingSlashes(value) {
+  return value.replace(/\/+$/g, "");
+}
+function ensureLeadingSlash(value) {
+  return value.startsWith("/") ? value : `/${value}`;
+}
+function ensureAthenaAuthPath(pathname) {
+  const normalizedPath = stripTrailingSlashes(
+    ensureLeadingSlash(pathname.trim())
+  );
+  if (!normalizedPath || normalizedPath === "/") {
+    return ATHENA_AUTH_PATH;
+  }
+  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
+    return normalizedPath;
+  }
+  return `${normalizedPath}${ATHENA_AUTH_PATH}`;
+}
+function stripAthenaAuthPath(pathname) {
+  const normalizedPath = stripTrailingSlashes(
+    ensureLeadingSlash(pathname.trim())
+  );
+  if (!normalizedPath || normalizedPath === "/") {
+    return "/";
+  }
+  if (normalizedPath === ATHENA_AUTH_PATH) {
+    return "/";
+  }
+  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
+    const withoutAuthPath = normalizedPath.slice(0, -ATHENA_AUTH_PATH.length);
+    return withoutAuthPath ? ensureLeadingSlash(withoutAuthPath) : "/";
+  }
+  return normalizedPath;
+}
+function readProcessEnv2() {
+  try {
+    const maybeProcess = globalThis.process;
+    return maybeProcess?.env;
+  } catch {
+    return void 0;
+  }
+}
+function getBrowserOrigin() {
+  try {
+    const origin = globalThis.window?.location?.origin;
+    return typeof origin === "string" && origin.length > 0 ? origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isAbsoluteUrl(value) {
+  const trimmed = value.trim();
+  return trimmed.startsWith("http://") || trimmed.startsWith("https://");
+}
+function readAthenaAuthUpstreamUrlFromEnv(env) {
+  for (const key of ATHENA_AUTH_UPSTREAM_ENV_KEYS) {
+    const value = env[key]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl) {
+  if (typeof rawUpstreamUrl === "string") {
+    const trimmed = rawUpstreamUrl.trim();
+    return trimmed || void 0;
+  }
+  if (rawUpstreamUrl) {
+    return readAthenaAuthUpstreamUrlFromEnv(rawUpstreamUrl);
+  }
+  const processEnv = readProcessEnv2();
+  return processEnv ? readAthenaAuthUpstreamUrlFromEnv(processEnv) : void 0;
+}
+function normalizeAthenaAuthBaseUrl(urlOrPath) {
+  const trimmed = urlOrPath.trim();
+  if (!trimmed) {
+    return ATHENA_AUTH_PATH;
+  }
+  if (isAbsoluteUrl(trimmed)) {
+    const url = new URL(trimmed);
+    url.pathname = ensureAthenaAuthPath(url.pathname);
+    url.search = "";
+    url.hash = "";
+    return stripTrailingSlashes(url.toString());
+  }
+  return ensureAthenaAuthPath(trimmed);
+}
+function resolveAthenaAuthUpstreamUrl(rawUpstreamUrl) {
+  const configuredUpstream = resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl) || DEFAULT_ATHENA_AUTH_ORIGIN;
+  if (isAbsoluteUrl(configuredUpstream)) {
+    const upstreamUrl = new URL(configuredUpstream);
+    upstreamUrl.pathname = stripAthenaAuthPath(upstreamUrl.pathname);
+    upstreamUrl.search = "";
+    upstreamUrl.hash = "";
+    return stripTrailingSlashes(upstreamUrl.toString());
+  }
+  const normalizedPath = stripAthenaAuthPath(configuredUpstream);
+  return stripTrailingSlashes(
+    new URL(normalizedPath, LOCAL_DEV_ORIGIN).toString()
+  );
+}
+function resolveBrowserFacingOrigin(rawUpstreamUrl) {
+  if (resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl)) {
+    return `${resolveAthenaAuthUpstreamUrl(rawUpstreamUrl)}/`;
+  }
+  const browserOrigin = getBrowserOrigin();
+  if (browserOrigin) {
+    return `${browserOrigin}/`;
+  }
+  return `${LOCAL_DEV_ORIGIN}/`;
+}
+function resolvePreservedAthenaAuthBaseUrl(configuredAuthBaseUrl, rawUpstreamUrl) {
+  const trimmed = configuredAuthBaseUrl.trim();
+  const preservedConfiguredBaseUrl = trimmed || ATHENA_AUTH_PATH;
+  if (isAbsoluteUrl(preservedConfiguredBaseUrl)) {
+    return stripTrailingSlashes(preservedConfiguredBaseUrl);
+  }
+  return stripTrailingSlashes(
+    new URL(
+      ensureLeadingSlash(preservedConfiguredBaseUrl),
+      resolveBrowserFacingOrigin(rawUpstreamUrl)
+    ).toString()
+  );
+}
+function resolveAthenaAuthClientBaseUrl(configuredAuthBaseUrl, rawUpstreamUrl, options = {}) {
+  let baseInput;
+  if (typeof configuredAuthBaseUrl === "string") {
+    baseInput = configuredAuthBaseUrl;
+  } else if (configuredAuthBaseUrl) {
+    baseInput = readAthenaAuthUpstreamUrlFromEnv(configuredAuthBaseUrl) ?? ATHENA_AUTH_PATH;
+  } else {
+    const fromEnv = resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl);
+    baseInput = fromEnv ?? ATHENA_AUTH_PATH;
+  }
+  if (options.appendAuthPath === false) {
+    return resolvePreservedAthenaAuthBaseUrl(baseInput, rawUpstreamUrl);
+  }
+  const normalizedConfiguredBaseUrl = normalizeAthenaAuthBaseUrl(baseInput);
+  if (isAbsoluteUrl(normalizedConfiguredBaseUrl)) {
+    return normalizedConfiguredBaseUrl;
+  }
+  const browserOrigin = getBrowserOrigin();
+  if (browserOrigin) {
+    return stripTrailingSlashes(
+      new URL(normalizedConfiguredBaseUrl, browserOrigin).toString()
+    );
+  }
+  if (resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl)) {
+    const upstream = resolveAthenaAuthUpstreamUrl(rawUpstreamUrl);
+    return stripTrailingSlashes(
+      new URL(ATHENA_AUTH_PATH, `${upstream}/`).toString()
+    );
+  }
+  return stripTrailingSlashes(
+    new URL(normalizedConfiguredBaseUrl, LOCAL_DEV_ORIGIN).toString()
+  );
+}
+function resolveAthenaAuthRequestUrl(path, rawBaseUrl) {
+  const normalizedPath = path.replace(LEADING_SLASHES_REGEX, "");
+  const base = resolveAthenaAuthClientBaseUrl(rawBaseUrl);
+  return new URL(normalizedPath, `${base}/`).toString();
+}
+var ATHENA_AUTH_VERIFY_EMAIL_PATH = "verify-email";
+var ATHENA_AUTH_GET_SESSION_PATH = "get-session";
+var ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH = `${ATHENA_AUTH_PATH}/get-session`;
+var AUTH_SESSION_PATH = ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH;
+var ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM = "disableCookieCache";
+var DISABLE_COOKIE_CACHE_QUERY_PARAM = ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM;
+var ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE = "true";
+var DISABLE_COOKIE_CACHE_QUERY_VALUE = ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE;
+var ATHENA_SESSION_DATA_HEADER = "x-session-data";
+var SESSION_DATA_HEADER = ATHENA_SESSION_DATA_HEADER;
+function resolveEmailVerificationCallbackUrl(rawBaseUrl) {
+  return resolveAthenaAuthRequestUrl(ATHENA_AUTH_VERIFY_EMAIL_PATH, rawBaseUrl);
+}
+function createFreshSessionLookupUrl(baseUrl) {
+  const url = new URL(ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, baseUrl);
+  url.searchParams.set(
+    ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM,
+    ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE
+  );
+  return url;
+}
+
+// src/utils/auth-routes.ts
+var AUTH_DEFAULT_VIEW = "sign-in";
+var AUTH_TWO_FACTOR_SEGMENT = "two-factor";
+var AUTH_VIEW_BY_SEGMENT = {
+  "accept-invitation": "accept-invitation",
+  "check-email": "check-email",
+  "forget-password": "forgot-password",
+  "forgot-password": "forgot-password",
+  logout: "logout",
+  "reset-email-sent": "reset-email-sent",
+  "reset-password": "reset-password",
+  "sign-in": "sign-in",
+  "sign-up": "sign-up"
+};
+var AUTHENTICATED_REDIRECT_VIEW_SET = /* @__PURE__ */ new Set([
+  "sign-in",
+  "sign-up",
+  "forgot-password"
+]);
+function resolveAuthViewFromSegment(segment) {
+  if (!segment) {
+    return AUTH_DEFAULT_VIEW;
+  }
+  return AUTH_VIEW_BY_SEGMENT[segment] ?? null;
+}
+function shouldRedirectAuthenticatedAuthView(view) {
+  return AUTHENTICATED_REDIRECT_VIEW_SET.has(view);
+}
+var AUTH_ROUTES = {
+  acceptInvitation: "/auth/accept-invitation",
+  appHome: "/",
+  checkEmail: "/auth/check-email",
+  forgotPassword: "/auth/forgot-password",
+  logout: "/auth/logout",
+  resetEmailSent: "/auth/reset-email-sent",
+  resetPassword: "/auth/reset-password",
+  signIn: "/auth/sign-in",
+  signUp: "/auth/sign-up",
+  socialCallback: "/auth/social-callback"
+};
+function createAuthRoutes(overrides = {}) {
+  return {
+    ...AUTH_ROUTES,
+    ...overrides
+  };
+}
+function createAuthModeRedirects(routes = AUTH_ROUTES) {
+  return {
+    "forgot-password": routes.forgotPassword,
+    login: routes.signIn,
+    logout: routes.logout,
+    "reset-password": routes.resetPassword,
+    signup: routes.signUp
+  };
+}
+var AUTH_MODE_REDIRECTS = createAuthModeRedirects();
+var AUTH_MODE_SET = new Set(Object.keys(AUTH_MODE_REDIRECTS));
+var AUTHENTICATED_REDIRECT_MODE_SET = /* @__PURE__ */ new Set([
+  "login",
+  "signup",
+  "forgot-password"
+]);
+function isAuthMode(value) {
+  return AUTH_MODE_SET.has(value);
+}
+function shouldRedirectAuthenticatedAuthMode(mode) {
+  return AUTHENTICATED_REDIRECT_MODE_SET.has(mode);
+}
+function resolveAuthModeRedirect(mode, redirects = AUTH_MODE_REDIRECTS) {
+  if (!mode || !isAuthMode(mode)) {
+    return null;
+  }
+  return redirects[mode];
+}
+
 // src/utils/proxy-request-headers.ts
 function proxyRequestHeaders(request) {
   const headers = new Headers(request.headers);
@@ -249,7 +615,7 @@ var getSessionCookie = (request, config) => {
 
 // src/utils/athena-request-headers.ts
 var NO_CACHE_HEADER_VALUE = "no-cache";
-var API_KEY_HEADER_CANDIDATES = ["x-api-key", "apikey"];
+var API_KEY_HEADER_CANDIDATES = ["X-Athena-Key", "x-athena-key", "X-Api-Key", "x-api-key", "apikey"];
 var ATHENA_KEY_HEADER_CANDIDATES = ["X-Athena-Key", "x-athena-key"];
 var SESSION_TOKEN_HEADER_CANDIDATES = ["X-Athena-Auth-Session-Token"];
 var BEARER_MIRROR_HEADER_CANDIDATES = ["X-Athena-Auth-Bearer-Token"];
@@ -351,14 +717,6 @@ function buildServiceRequestHeaders(profile, sdkHeaderValue, config, options, ex
   });
 }
 function applyAthenaApiKeyHeaders(headers, apiKey, athenaKey) {
-  if (apiKey) {
-    if (!hasHeaderIgnoreCase(headers, "apikey")) {
-      headers.apikey = apiKey;
-    }
-    if (!hasHeaderIgnoreCase(headers, "x-api-key")) {
-      headers["x-api-key"] = apiKey;
-    }
-  }
   const resolvedAthenaKey = normalizeHeaderValue(athenaKey) ?? normalizeHeaderValue(apiKey);
   if (resolvedAthenaKey && !hasHeaderIgnoreCase(headers, "X-Athena-Key")) {
     headers["X-Athena-Key"] = resolvedAthenaKey;
@@ -418,6 +776,25 @@ function applyAthenaPgUriHeaders(headers, input) {
     }
   }
 }
+function buildAthenaGatewayHeaders(input) {
+  const trimmedClientName = input.clientName?.trim();
+  const trimmedGatewayKey = input.gatewayKey?.trim();
+  const merged = {
+    ...trimmedClientName ? {
+      "X-Athena-Client": trimmedClientName
+    } : {},
+    ...trimmedGatewayKey ? {
+      "X-Api-Key": trimmedGatewayKey,
+      "X-Athena-Key": trimmedGatewayKey
+    } : {},
+    ...input.headers
+  };
+  return Object.fromEntries(
+    Object.entries(merged).flatMap(
+      ([key, value]) => typeof value === "string" && value.trim() ? [[key, value.trim()]] : []
+    )
+  );
+}
 function buildAthenaRequestHeaders(input) {
   const forceNoCache = Boolean(input.forceNoCache);
   const mergedExtraHeaders = mergeExtraHeaders(input.configHeaders, input.callHeaders);
@@ -525,6 +902,6 @@ function sqlBigInt(value) {
   return `${BigInt(value).toString()}::bigint`;
 }
 
-export { applyAthenaApiKeyHeaders, applyAthenaAuthContextHeaders, applyAthenaPgUriHeaders, asBoolean, asBooleanOrNull, asIdentifier, asNumber, asRecord, asString, asStringArray, buildAthenaRequestHeaders, buildServiceRequestHeaders, clearAuthCookies, escapeLikePatternValue, firstString, hasHeaderIgnoreCase, isLocalHostname, parseBooleanFlag, proxyRequestHeaders, quoteSqlStringLiteral, readTrimmedString, resolveHeaderValue, resolveRequestHeaderOverrides, slugify, sqlBigInt, sqlJsonbLiteral, sqlNullableText, sqlText, trimTrailingSlashes };
+export { ATHENA_AUTH_COOKIE_PREFIXES, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, ATHENA_AUTH_GET_SESSION_PATH, ATHENA_AUTH_PATH, ATHENA_AUTH_UPSTREAM_ENV_KEYS, ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, ATHENA_AUTH_VERIFY_EMAIL_PATH, ATHENA_SESSION_DATA_HEADER, AUTHENTICATED_REDIRECT_MODE_SET, AUTHENTICATED_REDIRECT_VIEW_SET, AUTH_DEFAULT_VIEW, AUTH_MODE_REDIRECTS, AUTH_MODE_SET, AUTH_ROUTES, AUTH_SESSION_PATH, AUTH_TWO_FACTOR_SEGMENT, AUTH_VIEW_BY_SEGMENT, DEFAULT_ATHENA_AUTH_ORIGIN, DEFAULT_ATHENA_AUTH_UPSTREAM_URL, DEFAULT_AUTH_COOKIE_PREFIXES, DISABLE_COOKIE_CACHE_QUERY_PARAM, DISABLE_COOKIE_CACHE_QUERY_VALUE, LOCAL_DEV_ORIGIN, SESSION_COOKIE_PATTERNS, SESSION_DATA_HEADER, applyAthenaApiKeyHeaders, applyAthenaAuthContextHeaders, applyAthenaPgUriHeaders, asBoolean, asBooleanOrNull, asIdentifier, asNonEmptyString, asNumber, asRecord, asString, asStringArray, buildAthenaGatewayHeaders, buildAthenaRequestHeaders, buildServiceRequestHeaders, clearAuthCookies, createAuthModeRedirects, createAuthRoutes, createFreshSessionLookupUrl, escapeLikePatternValue, firstString, getOriginFromHeaders, hasAuthSessionCookie, hasHeaderIgnoreCase, isAbsoluteUrl, isAuthMode, isDynamicServerUsageError, isLocalHostname, normalizeAthenaAuthBaseUrl, parseBooleanFlag, proxyRequestHeaders, quoteSqlStringLiteral, readAthenaAuthUpstreamUrlFromEnv, readEnv, readTrimmedString, requireEnv, resolveAthenaAuthClientBaseUrl, resolveAthenaAuthRequestUrl, resolveAthenaAuthUpstreamUrl, resolveAuthModeRedirect, resolveAuthViewFromSegment, resolveEmailVerificationCallbackUrl, resolveHeaderValue, resolveRequestHeaderOverrides, shouldRedirectAuthenticatedAuthMode, shouldRedirectAuthenticatedAuthView, slugify, sqlBigInt, sqlJsonbLiteral, sqlNullableText, sqlText, trimTrailingSlashes };
 //# sourceMappingURL=utils.js.map
 //# sourceMappingURL=utils.js.map