@xylex-group/athena 3.0.3 → 3.3.0

package/dist/next/server.d.cts

@@ -1,12 +1,15 @@
-import { ad as AthenaAuthSessionResponse } from '../types-AOY-GLu8.cjs';
+import { ad as AthenaAuthSessionResponse } from '../types-BVKpQmfY.cjs';
 import { r as AthenaClientModelsInput } from '../types-CgCv5o6R.cjs';
-import { ax as AthenaRequestContext, ah as AthenaClientConfig, ag as AthenaClient } from '../v3-client-CWfZHcKL.cjs';
+import { ax as AthenaRequestContext, ah as AthenaClientConfig, ag as AthenaClient } from '../v3-client-G1SLeHRa.cjs';
+import { OrganizationLike } from '../organization.cjs';
+export { ActiveOrganizationSessionLike, EnsureActiveOrganizationOptions, EnsureActiveOrganizationResult, ensureActiveOrganization } from '../organization.cjs';
 import { g as AthenaAuthSessionBridgeOptions, h as AthenaAuthSessionBridgePathOptions } from '../payload-DWI1rw-e.cjs';
 export { A as ATHENA_AUTH_SESSION_BRIDGE_ROUTE, a as ATHENA_AUTH_SESSION_COOKIE_NAME, b as ATHENA_AUTH_SESSION_COOKIE_NAMES, c as AthenaAuthSessionBridgeClientOptions, d as AthenaAuthSessionBridgePayload, e as AthenaAuthSessionBridgeSource, f as clearAthenaAuthSessionOnAppHost, p as persistAthenaAuthSessionOnAppHost, r as resolveSessionBridgePayload } from '../payload-DWI1rw-e.cjs';
 export { S as SESSION_COOKIE_PATTERNS, h as hasAuthSessionCookie } from '../session-cookie-detection-BqOp9mO6.cjs';
-export { A as ATHENA_AUTH_COOKIE_PREFIXES, a as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, b as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, c as ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, d as ATHENA_AUTH_GET_SESSION_PATH, e as ATHENA_AUTH_PATH, f as ATHENA_AUTH_UPSTREAM_ENV_KEYS, g as ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, h as ATHENA_AUTH_VERIFY_EMAIL_PATH, i as ATHENA_SESSION_DATA_HEADER, j as AUTHENTICATED_REDIRECT_MODE_SET, k as AUTHENTICATED_REDIRECT_VIEW_SET, l as AUTH_DEFAULT_VIEW, m as AUTH_MODE_REDIRECTS, n as AUTH_MODE_SET, o as AUTH_ROUTES, p as AUTH_SESSION_PATH, q as AUTH_TWO_FACTOR_SEGMENT, r as AUTH_VIEW_BY_SEGMENT, s as AthenaAuthClientBaseUrlOptions, t as AthenaAuthUpstreamEnv, u as AthenaAuthUpstreamEnvKey, v as AthenaRequestHeaderOverrideFields, w as AthenaRequestHeaderProfile, x as AuthMode, y as AuthModeRedirects, z as AuthRoutes, B as AuthView, C as BuildAthenaRequestHeadersInput, D as ClearAuthCookiesOptions, E as DEFAULT_ATHENA_AUTH_ORIGIN, F as DEFAULT_ATHENA_AUTH_UPSTREAM_URL, G as DISABLE_COOKIE_CACHE_QUERY_PARAM, H as DISABLE_COOKIE_CACHE_QUERY_VALUE, I as EnvLike, L as LOCAL_DEV_ORIGIN, a4 as ResolvedRequestHeaderOverrides, S as SESSION_DATA_HEADER, a5 as applyAthenaApiKeyHeaders, a6 as applyAthenaAuthContextHeaders, a7 as applyAthenaPgUriHeaders, J as asNonEmptyString, K as asString, M as buildAthenaGatewayHeaders, N as buildAthenaRequestHeaders, a8 as buildServiceRequestHeaders, O as clearAuthCookies, P as createAuthModeRedirects, Q as createAuthRoutes, R as createFreshSessionLookupUrl, a9 as hasHeaderIgnoreCase, T as isAbsoluteUrl, U as isAuthMode, V as normalizeAthenaAuthBaseUrl, W as readAthenaAuthUpstreamUrlFromEnv, X as readTrimmedString, Y as resolveAthenaAuthClientBaseUrl, Z as resolveAthenaAuthRequestUrl, _ as resolveAthenaAuthUpstreamUrl, $ as resolveAuthModeRedirect, a0 as resolveAuthViewFromSegment, a1 as resolveEmailVerificationCallbackUrl, aa as resolveHeaderValue, ab as resolveRequestHeaderOverrides, a2 as shouldRedirectAuthenticatedAuthMode, a3 as shouldRedirectAuthenticatedAuthView } from '../athena-request-headers-DujFFyMU.cjs';
-export { G as GetOriginFromHeadersOptions, g as getOriginFromHeaders, i as isDynamicServerUsageError, p as proxyRequestHeaders, r as readEnv, a as requireEnv } from '../proxy-request-headers-DGxdoyA0.cjs';
-export { ActiveOrganizationSessionLike, EnsureActiveOrganizationOptions, EnsureActiveOrganizationResult, OrganizationLike, ensureActiveOrganization } from '../organization.cjs';
+export { A as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, a as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, b as ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, c as ATHENA_AUTH_GET_SESSION_PATH, d as ATHENA_AUTH_PATH, e as ATHENA_AUTH_UPSTREAM_ENV_KEYS, f as ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, g as ATHENA_AUTH_VERIFY_EMAIL_PATH, h as ATHENA_SESSION_DATA_HEADER, i as AUTH_SESSION_PATH, j as AthenaAuthClientBaseUrlOptions, k as AthenaAuthUpstreamEnv, l as AthenaAuthUpstreamEnvKey, D as DEFAULT_ATHENA_AUTH_ORIGIN, m as DEFAULT_ATHENA_AUTH_UPSTREAM_URL, n as DISABLE_COOKIE_CACHE_QUERY_PARAM, o as DISABLE_COOKIE_CACHE_QUERY_VALUE, E as EnvLike, L as LOCAL_DEV_ORIGIN, S as SESSION_DATA_HEADER, p as createFreshSessionLookupUrl, q as isAbsoluteUrl, r as normalizeAthenaAuthBaseUrl, s as readAthenaAuthUpstreamUrlFromEnv, t as resolveAthenaAuthClientBaseUrl, u as resolveAthenaAuthRequestUrl, v as resolveAthenaAuthUpstreamUrl, w as resolveEmailVerificationCallbackUrl } from '../athena-auth-url-C1FbVmN6.cjs';
+export { A as ATHENA_AUTH_COOKIE_PREFIXES, a as AUTHENTICATED_REDIRECT_MODE_SET, b as AUTHENTICATED_REDIRECT_VIEW_SET, c as AUTH_DEFAULT_VIEW, d as AUTH_MODE_REDIRECTS, e as AUTH_MODE_SET, f as AUTH_ROUTES, g as AUTH_TWO_FACTOR_SEGMENT, h as AUTH_VIEW_BY_SEGMENT, i as AthenaRequestHeaderOverrideFields, j as AthenaRequestHeaderProfile, k as AuthMode, l as AuthModeRedirects, m as AuthRoutes, n as AuthView, B as BuildAthenaRequestHeadersInput, C as ClearAuthCookiesOptions, R as ResolvedRequestHeaderOverrides, E as applyAthenaApiKeyHeaders, F as applyAthenaAuthContextHeaders, G as applyAthenaPgUriHeaders, o as asNonEmptyString, p as asString, q as buildAthenaGatewayHeaders, r as buildAthenaRequestHeaders, H as buildServiceRequestHeaders, s as clearAuthCookies, t as createAuthModeRedirects, u as createAuthRoutes, I as hasHeaderIgnoreCase, v as isAuthMode, w as readTrimmedString, x as resolveAuthModeRedirect, y as resolveAuthViewFromSegment, J as resolveHeaderValue, K as resolveRequestHeaderOverrides, z as shouldRedirectAuthenticatedAuthMode, D as shouldRedirectAuthenticatedAuthView } from '../athena-request-headers-Lr_m8xCV.cjs';
+export { G as GetOriginFromHeadersOptions, g as getOriginFromHeaders, i as isDynamicServerUsageError, p as proxyRequestHeaders, r as readEnv, a as requireEnv } from '../proxy-request-headers-pIBSn1Fw.cjs';
+export { A as ATHENA_TABLE_SCHEMA_ROUTE, a as AthenaTableCatalogColumn, b as AthenaTableCatalogQueryClient, c as AthenaTableCatalogRelation, d as AthenaTableCatalogResponse, e as AthenaTableCatalogTable, f as AthenaTableSchemaConfig, g as AthenaTableSchemaHandlerOptions, h as AthenaTableShowcaseConfig, F as FetchAthenaTableCatalogOptions, T as TableCatalogColumn, i as TableCatalogRelation, j as TableCatalogResponse, k as TableCatalogTable, l as buildAthenaTableCatalogQueries, m as createAthenaTableSchemaHandlers, n as fetchAthenaTableCatalog, o as fetchTableCatalog, p as handleAthenaTableSchemaPost, q as hasAthenaTableSchemaCredentials, r as isAthenaTableSchemaConfig, s as parseAthenaTableSchemaScope } from '../schema-handlers-BtT_IQFi.cjs';
 import '../types-Bltx6iL6.cjs';
 import '../module-C_ab-MM1.cjs';
 
@@ -102,8 +105,114 @@ interface AthenaServerRequestOptions {
 }
 declare function resolveNextRequestContext(options?: AthenaServerRequestOptions): Promise<AthenaRequestContext>;
 
+interface ResolveActiveOrganizationIdArgs {
+    rawActiveOrganizationId: string | null;
+    session: AthenaAuthSessionResponse;
+    userId: string;
+}
+interface GetServerSessionEnsureActiveOptions<TOrganization extends OrganizationLike = OrganizationLike> {
+    listOrganizations: () => Promise<readonly TOrganization[]>;
+    onError?: (error: unknown) => void;
+    selectOrganizationId?: (organizations: readonly TOrganization[]) => string | null;
+    setActiveOrganization: (organizationId: string) => Promise<unknown>;
+}
+interface GetServerSessionOptions extends AthenaServerRequestOptions {
+    /**
+     * Absolute get-session URL. When omitted, built from `appOrigin` via
+     * {@link createFreshSessionLookupUrl}.
+     */
+    authSessionUrl?: string | URL;
+    /**
+     * App origin used to build `/api/auth/get-session?disableCookieCache=true`
+     * when `authSessionUrl` is not set.
+     */
+    appOrigin?: string | URL;
+    /**
+     * Raw middleware-forwarded session JSON (or omit to read
+     * {@link ATHENA_SESSION_DATA_HEADER} from `requestHeaders`).
+     */
+    sessionDataHeader?: string | null;
+    /** Custom fetch (tests / edge). Defaults to `globalThis.fetch`. */
+    fetchImpl?: typeof fetch;
+    /**
+     * When true (default), skip the network get-session call if cookies and
+     * bearer token are both absent.
+     */
+    skipFetchWithoutCredentials?: boolean;
+    /**
+     * Product org policy. Runs after the raw session is loaded and before
+     * optional ensure-active. Does not replace membership checks in the app.
+     */
+    resolveActiveOrganizationId?: (args: ResolveActiveOrganizationIdArgs) => string | null | Promise<string | null>;
+    /**
+     * Optional bootstrap when the session has no active org. Inject list/set
+     * from your auth client; the package does not own org transport here.
+     */
+    ensureActiveOrganization?: GetServerSessionEnsureActiveOptions;
+}
+interface GetServerSessionResult {
+    session: AthenaAuthSessionResponse | null;
+    userId: string | null;
+    /** Active org id from the auth session payload before product resolution. */
+    rawActiveOrganizationId: string | null;
+    /**
+     * Product-resolved organization id after `resolveActiveOrganizationId` and
+     * optional ensure-active. Prefer this for data client `scope.organizationId`.
+     */
+    organizationId: string | null;
+    didEnsureActiveOrganization: boolean;
+    /** True when the session came from the middleware header without a fetch. */
+    fromSessionDataHeader: boolean;
+}
+/**
+ * Parse a middleware-forwarded session JSON string into a session response.
+ * Returns null for missing, invalid, or incomplete payloads.
+ */
+declare function parseAthenaSessionDataHeader(raw: string | null | undefined): AthenaAuthSessionResponse | null;
+/**
+ * Load the current Athena Auth session for Next.js RSC / route handlers.
+ *
+ * Composition (not a full product policy module):
+ * 1. Optional middleware header (`x-session-data` / {@link ATHENA_SESSION_DATA_HEADER})
+ * 2. Else fetch get-session with request cookies/bearer
+ * 3. Optional product `resolveActiveOrganizationId`
+ * 4. Optional `ensureActiveOrganization` injectables
+ *
+ * Wrap with React `cache()` in the app if you need per-request dedupe:
+ *
+ * ```ts
+ * import { cache } from 'react'
+ * import { getServerSession } from '@xylex-group/athena/next/server'
+ *
+ * export const getSession = cache(() =>
+ *   getServerSession({
+ *     appOrigin: process.env.NEXT_PUBLIC_APP_URL!,
+ *     resolveActiveOrganizationId: ({ userId, rawActiveOrganizationId }) =>
+ *       resolveFormationsOrganizationId(userId, rawActiveOrganizationId),
+ *   }),
+ * )
+ * ```
+ */
+declare function getServerSession(options?: GetServerSessionOptions): Promise<GetServerSessionResult>;
+
+/**
+ * Explicit gateway identity for request-scoped server clients.
+ *
+ * Maps to `X-User-Id` / `X-Organization-Id` via {@link AthenaRequestContext}.
+ * When both `session` and `scope` are provided, any field present on `scope`
+ * overrides the session-derived value (including explicit `null` to clear).
+ */
+interface AthenaServerScope {
+    userId?: string | null;
+    organizationId?: string | null;
+}
 interface AthenaServerContextOptions extends AthenaServerRequestOptions {
     session?: AthenaAuthSessionResponse | null;
+    /**
+     * First-class identity scope. Prefer this over a second `withContext(...)`
+     * call when you already know user/org for the request.
+     */
+    scope?: AthenaServerScope;
 }
 interface AthenaResolvedServerContext {
     request: AthenaRequestContext;
@@ -114,6 +223,7 @@ interface AthenaResolvedServerContext {
 declare function resolveAthenaServerContext(options?: AthenaServerContextOptions): Promise<AthenaResolvedServerContext>;
 type AthenaBaseServerOptions = AthenaServerRequestOptions & {
     session?: AthenaAuthSessionResponse | null;
+    scope?: AthenaServerScope;
 };
 /**
  * Explicit server config: require url + key at the call site.
@@ -136,13 +246,16 @@ type AthenaServerClientConfig<TModels extends AthenaClientModelsInput | undefine
 /**
  * Request-scoped Next server façade over {@link createClient}.
  *
- * Resolves cookies, bearer tokens, optional session identity, and cache policy
- * on every invocation, merges with any application-level context, then
+ * Resolves cookies, bearer tokens, optional session/`scope` identity, and cache
+ * policy on every invocation, merges with any application-level context, then
  * materializes the client through the singular `createClient` primitive.
  *
  * Does not cache clients. Call once per Server Component / Server Action /
  * Route Handler request (or pass explicit requestHeaders/requestCookies).
+ *
+ * Prefer `session` and/or `scope` for identity headers instead of a follow-up
+ * `withContext({})` that drops org/user fields.
  */
 declare function createAthenaServerClient<const TModels extends AthenaClientModelsInput | undefined = undefined>(options: AthenaServerClientConfig<TModels>): Promise<AthenaClient<TModels>>;
 
-export { AthenaAuthSessionBridgeOptions, AthenaAuthSessionBridgePathOptions, type AthenaEnvironmentServerConfig, type AthenaExplicitServerConfig, type AthenaRequestCookiesBag, type AthenaRequestCookiesInput, type AthenaRequestHeadersBag, type AthenaRequestHeadersInput, type AthenaResolvedServerContext, type AthenaServerClientConfig, type AthenaServerContextOptions, type AthenaServerRequestOptions, createAthenaAuthSessionBridgeHandlers, createAthenaAuthSessionBridgePathHandlers, createAthenaServerClient, handleAthenaAuthSessionBridgeDelete, handleAthenaAuthSessionBridgePost, isAthenaAuthSessionBridgePath, resolveAthenaServerContext, resolveNextRequestContext };
+export { AthenaAuthSessionBridgeOptions, AthenaAuthSessionBridgePathOptions, type AthenaEnvironmentServerConfig, type AthenaExplicitServerConfig, type AthenaRequestCookiesBag, type AthenaRequestCookiesInput, type AthenaRequestHeadersBag, type AthenaRequestHeadersInput, type AthenaResolvedServerContext, type AthenaServerClientConfig, type AthenaServerContextOptions, type AthenaServerRequestOptions, type AthenaServerScope, type GetServerSessionEnsureActiveOptions, type GetServerSessionOptions, type GetServerSessionResult, OrganizationLike, type ResolveActiveOrganizationIdArgs, createAthenaAuthSessionBridgeHandlers, createAthenaAuthSessionBridgePathHandlers, createAthenaServerClient, getServerSession, handleAthenaAuthSessionBridgeDelete, handleAthenaAuthSessionBridgePost, isAthenaAuthSessionBridgePath, parseAthenaSessionDataHeader, resolveAthenaServerContext, resolveNextRequestContext };

package/dist/next/server.d.ts

@@ -1,12 +1,15 @@
-import { ad as AthenaAuthSessionResponse } from '../types-AOY-GLu8.js';
+import { ad as AthenaAuthSessionResponse } from '../types-BVKpQmfY.js';
 import { r as AthenaClientModelsInput } from '../types-B75PdABb.js';
-import { ax as AthenaRequestContext, ah as AthenaClientConfig, ag as AthenaClient } from '../v3-client-DZp2NEhK.js';
+import { ax as AthenaRequestContext, ah as AthenaClientConfig, ag as AthenaClient } from '../v3-client-ao8BWQ8v.js';
+import { OrganizationLike } from '../organization.js';
+export { ActiveOrganizationSessionLike, EnsureActiveOrganizationOptions, EnsureActiveOrganizationResult, ensureActiveOrganization } from '../organization.js';
 import { g as AthenaAuthSessionBridgeOptions, h as AthenaAuthSessionBridgePathOptions } from '../payload-DWI1rw-e.js';
 export { A as ATHENA_AUTH_SESSION_BRIDGE_ROUTE, a as ATHENA_AUTH_SESSION_COOKIE_NAME, b as ATHENA_AUTH_SESSION_COOKIE_NAMES, c as AthenaAuthSessionBridgeClientOptions, d as AthenaAuthSessionBridgePayload, e as AthenaAuthSessionBridgeSource, f as clearAthenaAuthSessionOnAppHost, p as persistAthenaAuthSessionOnAppHost, r as resolveSessionBridgePayload } from '../payload-DWI1rw-e.js';
 export { S as SESSION_COOKIE_PATTERNS, h as hasAuthSessionCookie } from '../session-cookie-detection-BqOp9mO6.js';
-export { A as ATHENA_AUTH_COOKIE_PREFIXES, a as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, b as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, c as ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, d as ATHENA_AUTH_GET_SESSION_PATH, e as ATHENA_AUTH_PATH, f as ATHENA_AUTH_UPSTREAM_ENV_KEYS, g as ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, h as ATHENA_AUTH_VERIFY_EMAIL_PATH, i as ATHENA_SESSION_DATA_HEADER, j as AUTHENTICATED_REDIRECT_MODE_SET, k as AUTHENTICATED_REDIRECT_VIEW_SET, l as AUTH_DEFAULT_VIEW, m as AUTH_MODE_REDIRECTS, n as AUTH_MODE_SET, o as AUTH_ROUTES, p as AUTH_SESSION_PATH, q as AUTH_TWO_FACTOR_SEGMENT, r as AUTH_VIEW_BY_SEGMENT, s as AthenaAuthClientBaseUrlOptions, t as AthenaAuthUpstreamEnv, u as AthenaAuthUpstreamEnvKey, v as AthenaRequestHeaderOverrideFields, w as AthenaRequestHeaderProfile, x as AuthMode, y as AuthModeRedirects, z as AuthRoutes, B as AuthView, C as BuildAthenaRequestHeadersInput, D as ClearAuthCookiesOptions, E as DEFAULT_ATHENA_AUTH_ORIGIN, F as DEFAULT_ATHENA_AUTH_UPSTREAM_URL, G as DISABLE_COOKIE_CACHE_QUERY_PARAM, H as DISABLE_COOKIE_CACHE_QUERY_VALUE, I as EnvLike, L as LOCAL_DEV_ORIGIN, a4 as ResolvedRequestHeaderOverrides, S as SESSION_DATA_HEADER, a5 as applyAthenaApiKeyHeaders, a6 as applyAthenaAuthContextHeaders, a7 as applyAthenaPgUriHeaders, J as asNonEmptyString, K as asString, M as buildAthenaGatewayHeaders, N as buildAthenaRequestHeaders, a8 as buildServiceRequestHeaders, O as clearAuthCookies, P as createAuthModeRedirects, Q as createAuthRoutes, R as createFreshSessionLookupUrl, a9 as hasHeaderIgnoreCase, T as isAbsoluteUrl, U as isAuthMode, V as normalizeAthenaAuthBaseUrl, W as readAthenaAuthUpstreamUrlFromEnv, X as readTrimmedString, Y as resolveAthenaAuthClientBaseUrl, Z as resolveAthenaAuthRequestUrl, _ as resolveAthenaAuthUpstreamUrl, $ as resolveAuthModeRedirect, a0 as resolveAuthViewFromSegment, a1 as resolveEmailVerificationCallbackUrl, aa as resolveHeaderValue, ab as resolveRequestHeaderOverrides, a2 as shouldRedirectAuthenticatedAuthMode, a3 as shouldRedirectAuthenticatedAuthView } from '../athena-request-headers-C7Jy-c_D.js';
-export { G as GetOriginFromHeadersOptions, g as getOriginFromHeaders, i as isDynamicServerUsageError, p as proxyRequestHeaders, r as readEnv, a as requireEnv } from '../proxy-request-headers-m4D2Tduy.js';
-export { ActiveOrganizationSessionLike, EnsureActiveOrganizationOptions, EnsureActiveOrganizationResult, OrganizationLike, ensureActiveOrganization } from '../organization.js';
+export { A as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, a as ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, b as ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, c as ATHENA_AUTH_GET_SESSION_PATH, d as ATHENA_AUTH_PATH, e as ATHENA_AUTH_UPSTREAM_ENV_KEYS, f as ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, g as ATHENA_AUTH_VERIFY_EMAIL_PATH, h as ATHENA_SESSION_DATA_HEADER, i as AUTH_SESSION_PATH, j as AthenaAuthClientBaseUrlOptions, k as AthenaAuthUpstreamEnv, l as AthenaAuthUpstreamEnvKey, D as DEFAULT_ATHENA_AUTH_ORIGIN, m as DEFAULT_ATHENA_AUTH_UPSTREAM_URL, n as DISABLE_COOKIE_CACHE_QUERY_PARAM, o as DISABLE_COOKIE_CACHE_QUERY_VALUE, E as EnvLike, L as LOCAL_DEV_ORIGIN, S as SESSION_DATA_HEADER, p as createFreshSessionLookupUrl, q as isAbsoluteUrl, r as normalizeAthenaAuthBaseUrl, s as readAthenaAuthUpstreamUrlFromEnv, t as resolveAthenaAuthClientBaseUrl, u as resolveAthenaAuthRequestUrl, v as resolveAthenaAuthUpstreamUrl, w as resolveEmailVerificationCallbackUrl } from '../athena-auth-url-C1FbVmN6.js';
+export { A as ATHENA_AUTH_COOKIE_PREFIXES, a as AUTHENTICATED_REDIRECT_MODE_SET, b as AUTHENTICATED_REDIRECT_VIEW_SET, c as AUTH_DEFAULT_VIEW, d as AUTH_MODE_REDIRECTS, e as AUTH_MODE_SET, f as AUTH_ROUTES, g as AUTH_TWO_FACTOR_SEGMENT, h as AUTH_VIEW_BY_SEGMENT, i as AthenaRequestHeaderOverrideFields, j as AthenaRequestHeaderProfile, k as AuthMode, l as AuthModeRedirects, m as AuthRoutes, n as AuthView, B as BuildAthenaRequestHeadersInput, C as ClearAuthCookiesOptions, R as ResolvedRequestHeaderOverrides, E as applyAthenaApiKeyHeaders, F as applyAthenaAuthContextHeaders, G as applyAthenaPgUriHeaders, o as asNonEmptyString, p as asString, q as buildAthenaGatewayHeaders, r as buildAthenaRequestHeaders, H as buildServiceRequestHeaders, s as clearAuthCookies, t as createAuthModeRedirects, u as createAuthRoutes, I as hasHeaderIgnoreCase, v as isAuthMode, w as readTrimmedString, x as resolveAuthModeRedirect, y as resolveAuthViewFromSegment, J as resolveHeaderValue, K as resolveRequestHeaderOverrides, z as shouldRedirectAuthenticatedAuthMode, D as shouldRedirectAuthenticatedAuthView } from '../athena-request-headers-DzimbvOA.js';
+export { G as GetOriginFromHeadersOptions, g as getOriginFromHeaders, i as isDynamicServerUsageError, p as proxyRequestHeaders, r as readEnv, a as requireEnv } from '../proxy-request-headers-CttlcuRb.js';
+export { A as ATHENA_TABLE_SCHEMA_ROUTE, a as AthenaTableCatalogColumn, b as AthenaTableCatalogQueryClient, c as AthenaTableCatalogRelation, d as AthenaTableCatalogResponse, e as AthenaTableCatalogTable, f as AthenaTableSchemaConfig, g as AthenaTableSchemaHandlerOptions, h as AthenaTableShowcaseConfig, F as FetchAthenaTableCatalogOptions, T as TableCatalogColumn, i as TableCatalogRelation, j as TableCatalogResponse, k as TableCatalogTable, l as buildAthenaTableCatalogQueries, m as createAthenaTableSchemaHandlers, n as fetchAthenaTableCatalog, o as fetchTableCatalog, p as handleAthenaTableSchemaPost, q as hasAthenaTableSchemaCredentials, r as isAthenaTableSchemaConfig, s as parseAthenaTableSchemaScope } from '../schema-handlers-VjFDhIMw.js';
 import '../types-Bltx6iL6.js';
 import '../module-C_ab-MM1.js';
 
@@ -102,8 +105,114 @@ interface AthenaServerRequestOptions {
 }
 declare function resolveNextRequestContext(options?: AthenaServerRequestOptions): Promise<AthenaRequestContext>;
 
+interface ResolveActiveOrganizationIdArgs {
+    rawActiveOrganizationId: string | null;
+    session: AthenaAuthSessionResponse;
+    userId: string;
+}
+interface GetServerSessionEnsureActiveOptions<TOrganization extends OrganizationLike = OrganizationLike> {
+    listOrganizations: () => Promise<readonly TOrganization[]>;
+    onError?: (error: unknown) => void;
+    selectOrganizationId?: (organizations: readonly TOrganization[]) => string | null;
+    setActiveOrganization: (organizationId: string) => Promise<unknown>;
+}
+interface GetServerSessionOptions extends AthenaServerRequestOptions {
+    /**
+     * Absolute get-session URL. When omitted, built from `appOrigin` via
+     * {@link createFreshSessionLookupUrl}.
+     */
+    authSessionUrl?: string | URL;
+    /**
+     * App origin used to build `/api/auth/get-session?disableCookieCache=true`
+     * when `authSessionUrl` is not set.
+     */
+    appOrigin?: string | URL;
+    /**
+     * Raw middleware-forwarded session JSON (or omit to read
+     * {@link ATHENA_SESSION_DATA_HEADER} from `requestHeaders`).
+     */
+    sessionDataHeader?: string | null;
+    /** Custom fetch (tests / edge). Defaults to `globalThis.fetch`. */
+    fetchImpl?: typeof fetch;
+    /**
+     * When true (default), skip the network get-session call if cookies and
+     * bearer token are both absent.
+     */
+    skipFetchWithoutCredentials?: boolean;
+    /**
+     * Product org policy. Runs after the raw session is loaded and before
+     * optional ensure-active. Does not replace membership checks in the app.
+     */
+    resolveActiveOrganizationId?: (args: ResolveActiveOrganizationIdArgs) => string | null | Promise<string | null>;
+    /**
+     * Optional bootstrap when the session has no active org. Inject list/set
+     * from your auth client; the package does not own org transport here.
+     */
+    ensureActiveOrganization?: GetServerSessionEnsureActiveOptions;
+}
+interface GetServerSessionResult {
+    session: AthenaAuthSessionResponse | null;
+    userId: string | null;
+    /** Active org id from the auth session payload before product resolution. */
+    rawActiveOrganizationId: string | null;
+    /**
+     * Product-resolved organization id after `resolveActiveOrganizationId` and
+     * optional ensure-active. Prefer this for data client `scope.organizationId`.
+     */
+    organizationId: string | null;
+    didEnsureActiveOrganization: boolean;
+    /** True when the session came from the middleware header without a fetch. */
+    fromSessionDataHeader: boolean;
+}
+/**
+ * Parse a middleware-forwarded session JSON string into a session response.
+ * Returns null for missing, invalid, or incomplete payloads.
+ */
+declare function parseAthenaSessionDataHeader(raw: string | null | undefined): AthenaAuthSessionResponse | null;
+/**
+ * Load the current Athena Auth session for Next.js RSC / route handlers.
+ *
+ * Composition (not a full product policy module):
+ * 1. Optional middleware header (`x-session-data` / {@link ATHENA_SESSION_DATA_HEADER})
+ * 2. Else fetch get-session with request cookies/bearer
+ * 3. Optional product `resolveActiveOrganizationId`
+ * 4. Optional `ensureActiveOrganization` injectables
+ *
+ * Wrap with React `cache()` in the app if you need per-request dedupe:
+ *
+ * ```ts
+ * import { cache } from 'react'
+ * import { getServerSession } from '@xylex-group/athena/next/server'
+ *
+ * export const getSession = cache(() =>
+ *   getServerSession({
+ *     appOrigin: process.env.NEXT_PUBLIC_APP_URL!,
+ *     resolveActiveOrganizationId: ({ userId, rawActiveOrganizationId }) =>
+ *       resolveFormationsOrganizationId(userId, rawActiveOrganizationId),
+ *   }),
+ * )
+ * ```
+ */
+declare function getServerSession(options?: GetServerSessionOptions): Promise<GetServerSessionResult>;
+
+/**
+ * Explicit gateway identity for request-scoped server clients.
+ *
+ * Maps to `X-User-Id` / `X-Organization-Id` via {@link AthenaRequestContext}.
+ * When both `session` and `scope` are provided, any field present on `scope`
+ * overrides the session-derived value (including explicit `null` to clear).
+ */
+interface AthenaServerScope {
+    userId?: string | null;
+    organizationId?: string | null;
+}
 interface AthenaServerContextOptions extends AthenaServerRequestOptions {
     session?: AthenaAuthSessionResponse | null;
+    /**
+     * First-class identity scope. Prefer this over a second `withContext(...)`
+     * call when you already know user/org for the request.
+     */
+    scope?: AthenaServerScope;
 }
 interface AthenaResolvedServerContext {
     request: AthenaRequestContext;
@@ -114,6 +223,7 @@ interface AthenaResolvedServerContext {
 declare function resolveAthenaServerContext(options?: AthenaServerContextOptions): Promise<AthenaResolvedServerContext>;
 type AthenaBaseServerOptions = AthenaServerRequestOptions & {
     session?: AthenaAuthSessionResponse | null;
+    scope?: AthenaServerScope;
 };
 /**
  * Explicit server config: require url + key at the call site.
@@ -136,13 +246,16 @@ type AthenaServerClientConfig<TModels extends AthenaClientModelsInput | undefine
 /**
  * Request-scoped Next server façade over {@link createClient}.
  *
- * Resolves cookies, bearer tokens, optional session identity, and cache policy
- * on every invocation, merges with any application-level context, then
+ * Resolves cookies, bearer tokens, optional session/`scope` identity, and cache
+ * policy on every invocation, merges with any application-level context, then
  * materializes the client through the singular `createClient` primitive.
  *
  * Does not cache clients. Call once per Server Component / Server Action /
  * Route Handler request (or pass explicit requestHeaders/requestCookies).
+ *
+ * Prefer `session` and/or `scope` for identity headers instead of a follow-up
+ * `withContext({})` that drops org/user fields.
  */
 declare function createAthenaServerClient<const TModels extends AthenaClientModelsInput | undefined = undefined>(options: AthenaServerClientConfig<TModels>): Promise<AthenaClient<TModels>>;
 
-export { AthenaAuthSessionBridgeOptions, AthenaAuthSessionBridgePathOptions, type AthenaEnvironmentServerConfig, type AthenaExplicitServerConfig, type AthenaRequestCookiesBag, type AthenaRequestCookiesInput, type AthenaRequestHeadersBag, type AthenaRequestHeadersInput, type AthenaResolvedServerContext, type AthenaServerClientConfig, type AthenaServerContextOptions, type AthenaServerRequestOptions, createAthenaAuthSessionBridgeHandlers, createAthenaAuthSessionBridgePathHandlers, createAthenaServerClient, handleAthenaAuthSessionBridgeDelete, handleAthenaAuthSessionBridgePost, isAthenaAuthSessionBridgePath, resolveAthenaServerContext, resolveNextRequestContext };
+export { AthenaAuthSessionBridgeOptions, AthenaAuthSessionBridgePathOptions, type AthenaEnvironmentServerConfig, type AthenaExplicitServerConfig, type AthenaRequestCookiesBag, type AthenaRequestCookiesInput, type AthenaRequestHeadersBag, type AthenaRequestHeadersInput, type AthenaResolvedServerContext, type AthenaServerClientConfig, type AthenaServerContextOptions, type AthenaServerRequestOptions, type AthenaServerScope, type GetServerSessionEnsureActiveOptions, type GetServerSessionOptions, type GetServerSessionResult, OrganizationLike, type ResolveActiveOrganizationIdArgs, createAthenaAuthSessionBridgeHandlers, createAthenaAuthSessionBridgePathHandlers, createAthenaServerClient, getServerSession, handleAthenaAuthSessionBridgeDelete, handleAthenaAuthSessionBridgePost, isAthenaAuthSessionBridgePath, parseAthenaSessionDataHeader, resolveAthenaServerContext, resolveNextRequestContext };