@xylex-group/athena 3.0.3 → 3.3.0

package/dist/next/server.js

@@ -1799,7 +1799,7 @@ function buildAthenaGatewayUrl(baseUrl, path) {
 
 // package.json
 var package_default = {
-  version: "3.0.3"
+  version: "3.3.0"
 };
 
 // src/sdk-version.ts
@@ -3901,6 +3901,14 @@ function createAuthModule(config = {}, runtimeOptions = {}) {
     changeEmailVerify: (input, options) => getWithQuery("/change-email/verify", input, options),
     deleteUserVerify: (input, options) => getWithQuery("/delete-user/verify", input, options),
     changePassword: (input, options) => postGeneric("/change-password", input, options),
+    // Better Auth UI flat method aliases (also nested under session/account/social/user).
+    listSessions: (input, options) => getGeneric("/list-sessions", input, options),
+    revokeSession: sessionRevokeBinding,
+    revokeOtherSessions,
+    listAccounts: (input, options) => getGeneric("/list-accounts", input, options),
+    unlinkAccount: (input, options) => postGeneric("/unlink-account", input, options),
+    linkSocial: (input, options) => postGeneric("/link-social", input, options),
+    updateUser: (input, options) => postGeneric("/update-user", input, options),
     user: {
       update: (input, options) => postGeneric("/update-user", input, options),
       delete: (input, options) => postGeneric("/delete-user", input, options),
@@ -9550,6 +9558,82 @@ var AthenaConfigurationError = class extends Error {
   }
 };
 
+// src/diagnostics.ts
+function readProcessEnv2() {
+  try {
+    return globalThis.process?.env ?? {};
+  } catch {
+    return {};
+  }
+}
+function isTruthyEnv(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
+}
+function isQuietAthenaDiagnosticsEnvironment(env = readProcessEnv2()) {
+  const nodeEnv = env.NODE_ENV?.trim().toLowerCase();
+  if (nodeEnv === "production") {
+    return true;
+  }
+  if (isTruthyEnv(env.OPENNEXT_BUILD)) {
+    return true;
+  }
+  const nextPhase = env.NEXT_PHASE?.trim();
+  if (nextPhase === "phase-production-build") {
+    return true;
+  }
+  if (isTruthyEnv(env.CI) && nodeEnv !== "test") {
+    if (nodeEnv === "production" || isTruthyEnv(env.OPENNEXT_BUILD)) {
+      return true;
+    }
+  }
+  return false;
+}
+function resolveBooleanFlag(explicit, mode, quiet) {
+  if (typeof explicit === "boolean") {
+    return explicit;
+  }
+  if (mode === true) {
+    return true;
+  }
+  if (mode === false) {
+    return false;
+  }
+  if (mode === "auto") {
+    return false;
+  }
+  return false;
+}
+function resolveAthenaClientDiagnostics(input) {
+  const env = input.env ?? readProcessEnv2();
+  const quiet = isQuietAthenaDiagnosticsEnvironment(env);
+  const mode = input.diagnostics;
+  const effectiveMode = mode === "auto" && quiet ? false : mode;
+  const debugAst = resolveBooleanFlag(input.debugAst, effectiveMode);
+  const findManyAst = resolveBooleanFlag(input.findManyAst, effectiveMode);
+  let traceQueries;
+  if (input.traceQueries !== void 0) {
+    if (typeof input.traceQueries === "boolean") {
+      traceQueries = input.traceQueries;
+    } else if (effectiveMode === false || mode === "auto" && quiet) {
+      const enabled = input.traceQueries.enabled;
+      traceQueries = typeof enabled === "boolean" ? enabled ? input.traceQueries : false : false;
+    } else {
+      traceQueries = input.traceQueries;
+    }
+  } else if (effectiveMode === true) {
+    traceQueries = true;
+  } else {
+    traceQueries = false;
+  }
+  return {
+    debugAst,
+    findManyAst,
+    traceQueries
+  };
+}
+
 // src/v3-client.ts
 var ENV_URL_KEYS = ["ATHENA_URL", "NEXT_PUBLIC_ATHENA_URL"];
 var ENV_DB_URL_KEYS = ["ATHENA_DB_URL", "ATHENA_GATEWAY_URL", "NEXT_PUBLIC_ATHENA_DB_API_URL"];
@@ -9558,7 +9642,13 @@ var ENV_CHAT_URL_KEYS = ["ATHENA_CHAT_URL", "NEXT_PUBLIC_ATHENA_CHAT_URL"];
 var ENV_CHAT_WS_URL_KEYS = ["ATHENA_CHAT_WS_URL", "NEXT_PUBLIC_ATHENA_CHAT_WS_URL"];
 var ENV_STORAGE_URL_KEYS = ["ATHENA_STORAGE_URL", "NEXT_PUBLIC_ATHENA_STORAGE_URL"];
 var ENV_KEY_KEYS = ["ATHENA_API_KEY", "NEXT_PUBLIC_ATHENA_API_KEY", "ATHENA_GATEWAY_API_KEY", "X_API_KEY"];
-var ENV_CLIENT_KEYS = ["ATHENA_CLIENT", "NEXT_PUBLIC_ATHENA_CLIENT"];
+var ENV_CLIENT_KEYS = [
+  "ATHENA_CLIENT",
+  "ATHENA_GATEWAY_CLIENT",
+  "ATHENA_GENERATOR_CLIENT",
+  "NEXT_PUBLIC_ATHENA_CLIENT",
+  "NEXT_PUBLIC_ATHENA_GATEWAY_CLIENT"
+];
 var MISSING_DB_SENTINEL = "https://athena.invalid/db";
 function readFirstEnv(env, keys) {
   for (const key of keys) {
@@ -9633,6 +9723,13 @@ function createInternalConfig(core) {
   const { config, urls } = core;
   const { url: _authUrl, ...authOptions } = config.auth ?? {};
   const { url: _storageUrl, directUpload, ...storageOptions } = config.storage ?? {};
+  const diagnostics = resolveAthenaClientDiagnostics({
+    diagnostics: config.diagnostics,
+    debugAst: config.debugAst,
+    findManyAst: config.findManyAst,
+    traceQueries: config.traceQueries,
+    env: config.env
+  });
   return {
     baseUrl: urls.db ?? MISSING_DB_SENTINEL,
     apiKey: core.key,
@@ -9649,9 +9746,9 @@ function createInternalConfig(core) {
     models: config.models,
     behavior: {
       retryReads: config.retryReads,
-      traceQueries: config.traceQueries,
-      debugAst: config.debugAst,
-      findManyAst: config.findManyAst
+      traceQueries: diagnostics.traceQueries,
+      debugAst: diagnostics.debugAst,
+      findManyAst: diagnostics.findManyAst
     },
     storage: {
       ...storageOptions,
@@ -9725,11 +9822,30 @@ function createClientView(core, viewContext) {
       return resolved.verifyConnection(options);
     },
     withContext(context) {
+      warnIfEmptyRequestContext(context);
       return createClientView(core, mergeAthenaRequestContexts(viewContext, context));
     }
   };
   return Object.freeze(client);
 }
+function isEmptyAthenaRequestContext(context) {
+  if (!context) return true;
+  const hasHeaders = context.headers != null && Object.keys(context.headers).length > 0;
+  return context.userId == null && context.organizationId == null && !normalizeOptionalContextString(context.cookie) && !normalizeOptionalContextString(context.bearerToken) && !normalizeOptionalContextString(context.sessionToken) && !context.forceNoCache && !hasHeaders;
+}
+function normalizeOptionalContextString(value) {
+  const trimmed = value?.trim();
+  return trimmed || void 0;
+}
+function warnIfEmptyRequestContext(context) {
+  if (!isEmptyAthenaRequestContext(context)) return;
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") {
+    return;
+  }
+  console.warn(
+    "[athena] withContext({}) has no userId, organizationId, cookie, bearerToken, sessionToken, headers, or forceNoCache. Gateway scope headers will not change. Pass identity fields, or use createAthenaServerClient({ session, scope })."
+  );
+}
 function createClient(config) {
   return createClientView(resolveCore(config));
 }
@@ -9799,303 +9915,139 @@ async function resolveNextRequestContext(options = {}) {
   };
 }
 
-// src/next/session-bridge/constants.ts
-var ATHENA_AUTH_SESSION_BRIDGE_ROUTE = "/api/athena-auth/session";
-var ATHENA_AUTH_SESSION_COOKIE_NAME = "athena-auth.session-token";
-var ATHENA_AUTH_SESSION_COOKIE_NAMES = [
-  ATHENA_AUTH_SESSION_COOKIE_NAME,
-  "athena-auth.session_token"
-];
-
-// src/next/session-bridge/client.ts
-var JSON_CONTENT_TYPE = "application/json";
-function isBrowserRuntime() {
-  return typeof globalThis !== "undefined" && "window" in globalThis;
-}
-async function persistAthenaAuthSessionOnAppHost(payload, options) {
-  if (!(payload && isBrowserRuntime())) {
-    return;
+// src/organization/ensure-active-organization.ts
+function normalizeOrganizationId(value) {
+  if (typeof value !== "string") {
+    return null;
   }
-  const route = options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
-  const fetchImpl = options?.fetch ?? fetch;
-  const response = await fetchImpl(route, {
-    body: JSON.stringify(payload),
-    credentials: "same-origin",
-    headers: {
-      "Content-Type": JSON_CONTENT_TYPE
-    },
-    method: "POST"
-  });
-  if (!response.ok) {
-    throw new Error("Failed to persist the Athena Auth session on the app host");
+  const normalized = value.trim();
+  return normalized.length > 0 ? normalized : null;
+}
+function defaultSelectOrganizationId(organizations) {
+  for (const organization of organizations) {
+    const id = normalizeOrganizationId(organization.id);
+    if (id) {
+      return id;
+    }
   }
+  return null;
 }
-async function clearAthenaAuthSessionOnAppHost(options) {
-  if (!isBrowserRuntime()) {
-    return;
+async function ensureActiveOrganization(options) {
+  const currentActiveOrganizationId = normalizeOrganizationId(
+    options.session?.session?.activeOrganizationId
+  );
+  if (currentActiveOrganizationId) {
+    return {
+      activeOrganizationId: currentActiveOrganizationId,
+      didSetActiveOrganization: false
+    };
   }
-  const route = options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
-  const fetchImpl = options?.fetch ?? fetch;
-  const response = await fetchImpl(route, {
-    credentials: "same-origin",
-    method: "DELETE"
-  });
-  if (!response.ok) {
-    throw new Error("Failed to clear the Athena Auth session on the app host");
+  let organizations;
+  try {
+    organizations = await options.listOrganizations();
+  } catch (error) {
+    options.onError?.(error);
+    return {
+      activeOrganizationId: null,
+      didSetActiveOrganization: false
+    };
+  }
+  if (organizations.length === 0) {
+    return {
+      activeOrganizationId: null,
+      didSetActiveOrganization: false
+    };
+  }
+  const selectedOrganizationId = normalizeOrganizationId(
+    (options.selectOrganizationId ?? defaultSelectOrganizationId)(organizations)
+  );
+  if (!selectedOrganizationId) {
+    return {
+      activeOrganizationId: null,
+      didSetActiveOrganization: false
+    };
+  }
+  try {
+    await options.setActiveOrganization(selectedOrganizationId);
+    return {
+      activeOrganizationId: selectedOrganizationId,
+      didSetActiveOrganization: true
+    };
+  } catch (error) {
+    options.onError?.(error);
+    return {
+      activeOrganizationId: null,
+      didSetActiveOrganization: false
+    };
   }
 }
 
-// src/next/session-bridge/payload.ts
-function resolveSessionBridgePayload(payload) {
-  const token = payload?.session?.token ?? payload?.token;
-  if (typeof token !== "string") {
-    return null;
+// src/utils/athena-auth-url.ts
+var ATHENA_AUTH_PATH = "/api/auth";
+var LOCAL_DEV_ORIGIN = "http://localhost:3000";
+var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";
+var DEFAULT_ATHENA_AUTH_UPSTREAM_URL = DEFAULT_ATHENA_AUTH_ORIGIN;
+var ATHENA_AUTH_UPSTREAM_ENV_KEYS = [
+  "ATHENA_AUTH_UPSTREAM_URL",
+  "ATHENA_AUTH_URL",
+  "NEXT_PUBLIC_ATHENA_AUTH_UPSTREAM_URL",
+  "NEXT_PUBLIC_ATHENA_AUTH_URL"
+];
+var ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES = ATHENA_AUTH_UPSTREAM_ENV_KEYS;
+var LEADING_SLASHES_REGEX = /^\/+/;
+function stripTrailingSlashes(value) {
+  return value.replace(/\/+$/g, "");
+}
+function ensureLeadingSlash(value) {
+  return value.startsWith("/") ? value : `/${value}`;
+}
+function ensureAthenaAuthPath(pathname) {
+  const normalizedPath = stripTrailingSlashes(
+    ensureLeadingSlash(pathname.trim())
+  );
+  if (!normalizedPath || normalizedPath === "/") {
+    return ATHENA_AUTH_PATH;
   }
-  const normalizedToken = token.trim();
-  if (!normalizedToken) {
-    return null;
+  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
+    return normalizedPath;
   }
-  return {
-    token: normalizedToken,
-    expiresAt: typeof payload?.session?.expiresAt === "string" ? payload.session.expiresAt : void 0
-  };
+  return `${normalizedPath}${ATHENA_AUTH_PATH}`;
 }
-
-// src/next/session-bridge/cookie.ts
-var EXPIRED_AT = /* @__PURE__ */ new Date(0);
-function resolveRequestIsSecure(request2) {
-  const forwardedProto = request2.headers.get("x-forwarded-proto")?.trim();
-  if (forwardedProto) {
-    const first = forwardedProto.split(",")[0]?.trim().toLowerCase();
-    if (first === "https") return true;
-    if (first === "http") return false;
+function stripAthenaAuthPath(pathname) {
+  const normalizedPath = stripTrailingSlashes(
+    ensureLeadingSlash(pathname.trim())
+  );
+  if (!normalizedPath || normalizedPath === "/") {
+    return "/";
   }
-  return new URL(request2.url).protocol === "https:";
+  if (normalizedPath === ATHENA_AUTH_PATH) {
+    return "/";
+  }
+  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
+    const withoutAuthPath = normalizedPath.slice(0, -ATHENA_AUTH_PATH.length);
+    return withoutAuthPath ? ensureLeadingSlash(withoutAuthPath) : "/";
+  }
+  return normalizedPath;
 }
-function resolveSessionCookieExpiresAt(value) {
-  if (typeof value !== "string") {
+function readProcessEnv3() {
+  try {
+    const maybeProcess = globalThis.process;
+    return maybeProcess?.env;
+  } catch {
     return void 0;
   }
-  const expiresAt = new Date(value);
-  return Number.isNaN(expiresAt.getTime()) ? void 0 : expiresAt;
 }
-function serializeCookie(name, value, options) {
-  const parts = [
-    `${encodeURIComponent(name)}=${encodeURIComponent(value)}`,
-    `Path=${options.path}`,
-    "HttpOnly",
-    `SameSite=${options.sameSite === "none" ? "None" : options.sameSite === "strict" ? "Strict" : "Lax"}`
-  ];
-  if (options.secure) {
-    parts.push("Secure");
-  }
-  if (options.expires) {
-    parts.push(`Expires=${options.expires.toUTCString()}`);
+function getBrowserOrigin() {
+  try {
+    const origin = globalThis.window?.location?.origin;
+    return typeof origin === "string" && origin.length > 0 ? origin : void 0;
+  } catch {
+    return void 0;
   }
-  return parts.join("; ");
 }
-function resolveBridgeCookieConfig(options) {
-  return {
-    cookieName: options?.cookieName ?? ATHENA_AUTH_SESSION_COOKIE_NAME,
-    cookieNames: options?.cookieNames ?? ATHENA_AUTH_SESSION_COOKIE_NAMES,
-    cookiePath: options?.cookiePath ?? "/",
-    sameSite: options?.sameSite ?? "lax"
-  };
-}
-function appendSessionCookie(headers, request2, token, expiresAt, options) {
-  const config = resolveBridgeCookieConfig(options);
-  const secure = options?.secure ?? resolveRequestIsSecure(request2);
-  headers.append(
-    "set-cookie",
-    serializeCookie(config.cookieName, token, {
-      path: config.cookiePath,
-      sameSite: config.sameSite,
-      secure,
-      expires: expiresAt
-    })
-  );
-}
-function appendClearSessionCookies(headers, request2, options) {
-  const config = resolveBridgeCookieConfig(options);
-  const secure = options?.secure ?? resolveRequestIsSecure(request2);
-  const names = /* @__PURE__ */ new Set([config.cookieName, ...config.cookieNames]);
-  for (const name of names) {
-    headers.append(
-      "set-cookie",
-      serializeCookie(name, "", {
-        path: config.cookiePath,
-        sameSite: config.sameSite,
-        secure,
-        expires: EXPIRED_AT
-      })
-    );
-  }
-}
-
-// src/next/session-bridge/handlers.ts
-function json(body, init) {
-  const headers = init?.headers ?? new Headers();
-  if (!headers.has("content-type")) {
-    headers.set("content-type", "application/json; charset=utf-8");
-  }
-  return new Response(JSON.stringify(body), {
-    status: init?.status ?? 200,
-    headers
-  });
-}
-function resolveRoute(options) {
-  return options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
-}
-async function handleAthenaAuthSessionBridgePost(request2, options) {
-  const payload = await request2.json().catch(() => null);
-  const token = typeof payload?.token === "string" ? payload.token.trim() : "";
-  if (!token) {
-    return json(
-      {
-        error: "Missing Athena Auth session token"
-      },
-      { status: 400 }
-    );
-  }
-  const headers = new Headers();
-  appendSessionCookie(
-    headers,
-    request2,
-    token,
-    resolveSessionCookieExpiresAt(payload?.expiresAt),
-    options
-  );
-  return json(
-    {
-      ok: true,
-      route: resolveRoute(options)
-    },
-    { headers }
-  );
-}
-function handleAthenaAuthSessionBridgeDelete(request2, options) {
-  const headers = new Headers();
-  appendClearSessionCookies(headers, request2, options);
-  return json(
-    {
-      ok: true,
-      route: resolveRoute(options)
-    },
-    { headers }
-  );
-}
-function createAthenaAuthSessionBridgeHandlers(options) {
-  return {
-    POST: (request2) => handleAthenaAuthSessionBridgePost(request2, options),
-    DELETE: (request2) => handleAthenaAuthSessionBridgeDelete(request2, options)
-  };
-}
-function normalizePathname(pathname) {
-  if (pathname.length > 1 && pathname.endsWith("/")) {
-    return pathname.slice(0, -1);
-  }
-  return pathname || "/";
-}
-function isAthenaAuthSessionBridgePath(request2, options) {
-  const pathname = normalizePathname(new URL(request2.url).pathname);
-  const route = normalizePathname(resolveRoute(options));
-  if (pathname === route) {
-    return true;
-  }
-  const matchPaths = options?.matchPaths ?? ["session"];
-  const segments = pathname.split("/").filter(Boolean);
-  const tail = segments[segments.length - 1];
-  return typeof tail === "string" && matchPaths.includes(tail);
-}
-function createAthenaAuthSessionBridgePathHandlers(options) {
-  const notFound = () => json(
-    {
-      error: "Not found"
-    },
-    { status: 404 }
-  );
-  return {
-    POST: async (request2) => {
-      if (!isAthenaAuthSessionBridgePath(request2, options)) {
-        return notFound();
-      }
-      return handleAthenaAuthSessionBridgePost(request2, options);
-    },
-    DELETE: (request2) => {
-      if (!isAthenaAuthSessionBridgePath(request2, options)) {
-        return notFound();
-      }
-      return handleAthenaAuthSessionBridgeDelete(request2, options);
-    }
-  };
-}
-
-// src/utils/athena-auth-url.ts
-var ATHENA_AUTH_PATH = "/api/auth";
-var LOCAL_DEV_ORIGIN = "http://localhost:3000";
-var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";
-var DEFAULT_ATHENA_AUTH_UPSTREAM_URL = DEFAULT_ATHENA_AUTH_ORIGIN;
-var ATHENA_AUTH_UPSTREAM_ENV_KEYS = [
-  "ATHENA_AUTH_UPSTREAM_URL",
-  "ATHENA_AUTH_URL",
-  "NEXT_PUBLIC_ATHENA_AUTH_UPSTREAM_URL",
-  "NEXT_PUBLIC_ATHENA_AUTH_URL"
-];
-var ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES = ATHENA_AUTH_UPSTREAM_ENV_KEYS;
-var LEADING_SLASHES_REGEX = /^\/+/;
-function stripTrailingSlashes(value) {
-  return value.replace(/\/+$/g, "");
-}
-function ensureLeadingSlash(value) {
-  return value.startsWith("/") ? value : `/${value}`;
-}
-function ensureAthenaAuthPath(pathname) {
-  const normalizedPath = stripTrailingSlashes(
-    ensureLeadingSlash(pathname.trim())
-  );
-  if (!normalizedPath || normalizedPath === "/") {
-    return ATHENA_AUTH_PATH;
-  }
-  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
-    return normalizedPath;
-  }
-  return `${normalizedPath}${ATHENA_AUTH_PATH}`;
-}
-function stripAthenaAuthPath(pathname) {
-  const normalizedPath = stripTrailingSlashes(
-    ensureLeadingSlash(pathname.trim())
-  );
-  if (!normalizedPath || normalizedPath === "/") {
-    return "/";
-  }
-  if (normalizedPath === ATHENA_AUTH_PATH) {
-    return "/";
-  }
-  if (normalizedPath.endsWith(ATHENA_AUTH_PATH)) {
-    const withoutAuthPath = normalizedPath.slice(0, -ATHENA_AUTH_PATH.length);
-    return withoutAuthPath ? ensureLeadingSlash(withoutAuthPath) : "/";
-  }
-  return normalizedPath;
-}
-function readProcessEnv2() {
-  try {
-    const maybeProcess = globalThis.process;
-    return maybeProcess?.env;
-  } catch {
-    return void 0;
-  }
-}
-function getBrowserOrigin() {
-  try {
-    const origin = globalThis.window?.location?.origin;
-    return typeof origin === "string" && origin.length > 0 ? origin : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function isAbsoluteUrl(value) {
-  const trimmed = value.trim();
-  return trimmed.startsWith("http://") || trimmed.startsWith("https://");
+function isAbsoluteUrl(value) {
+  const trimmed = value.trim();
+  return trimmed.startsWith("http://") || trimmed.startsWith("https://");
 }
 function readAthenaAuthUpstreamUrlFromEnv(env) {
   for (const key of ATHENA_AUTH_UPSTREAM_ENV_KEYS) {
@@ -10114,7 +10066,7 @@ function resolveConfiguredAthenaAuthUpstreamUrl(rawUpstreamUrl) {
   if (rawUpstreamUrl) {
     return readAthenaAuthUpstreamUrlFromEnv(rawUpstreamUrl);
   }
-  const processEnv = readProcessEnv2();
+  const processEnv = readProcessEnv3();
   return processEnv ? readAthenaAuthUpstreamUrlFromEnv(processEnv) : void 0;
 }
 function normalizeAthenaAuthBaseUrl(urlOrPath) {
@@ -10201,31 +10153,442 @@ function resolveAthenaAuthClientBaseUrl(configuredAuthBaseUrl, rawUpstreamUrl, o
     new URL(normalizedConfiguredBaseUrl, LOCAL_DEV_ORIGIN).toString()
   );
 }
-function resolveAthenaAuthRequestUrl(path, rawBaseUrl) {
-  const normalizedPath = path.replace(LEADING_SLASHES_REGEX, "");
-  const base = resolveAthenaAuthClientBaseUrl(rawBaseUrl);
-  return new URL(normalizedPath, `${base}/`).toString();
+function resolveAthenaAuthRequestUrl(path, rawBaseUrl) {
+  const normalizedPath = path.replace(LEADING_SLASHES_REGEX, "");
+  const base = resolveAthenaAuthClientBaseUrl(rawBaseUrl);
+  return new URL(normalizedPath, `${base}/`).toString();
+}
+var ATHENA_AUTH_VERIFY_EMAIL_PATH = "verify-email";
+var ATHENA_AUTH_GET_SESSION_PATH = "get-session";
+var ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH = `${ATHENA_AUTH_PATH}/get-session`;
+var AUTH_SESSION_PATH = ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH;
+var ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM = "disableCookieCache";
+var DISABLE_COOKIE_CACHE_QUERY_PARAM = ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM;
+var ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE = "true";
+var DISABLE_COOKIE_CACHE_QUERY_VALUE = ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE;
+var ATHENA_SESSION_DATA_HEADER = "x-session-data";
+var SESSION_DATA_HEADER = ATHENA_SESSION_DATA_HEADER;
+function resolveEmailVerificationCallbackUrl(rawBaseUrl) {
+  return resolveAthenaAuthRequestUrl(ATHENA_AUTH_VERIFY_EMAIL_PATH, rawBaseUrl);
+}
+function createFreshSessionLookupUrl(baseUrl) {
+  const url = new URL(ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, baseUrl);
+  url.searchParams.set(
+    ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM,
+    ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE
+  );
+  return url;
+}
+
+// src/next/get-server-session.ts
+function normalizeId(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readHeader2(headers, target) {
+  if (!headers) return void 0;
+  if (typeof headers.get === "function") {
+    const value = headers.get(target);
+    return value?.trim() || void 0;
+  }
+  const normalizedTarget = target.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === normalizedTarget) {
+      const normalized = value?.trim();
+      return normalized || void 0;
+    }
+  }
+  return void 0;
+}
+function parseAthenaSessionDataHeader(raw) {
+  if (!raw?.trim()) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return coerceSessionResponse(parsed);
+  } catch {
+    return null;
+  }
+}
+function coerceSessionResponse(value) {
+  if (!value || typeof value !== "object") return null;
+  const record = value;
+  const payload = record.session && record.user ? record : record.data && typeof record.data === "object" ? record.data : null;
+  if (!payload) return null;
+  const user = payload.user;
+  const session = payload.session;
+  if (!user || typeof user !== "object" || !session || typeof session !== "object") {
+    return null;
+  }
+  const userRecord = user;
+  const sessionRecord = session;
+  const userId = normalizeId(
+    typeof userRecord.id === "string" ? userRecord.id : void 0
+  );
+  const sessionId = normalizeId(
+    typeof sessionRecord.id === "string" ? sessionRecord.id : void 0
+  );
+  if (!userId || !sessionId) return null;
+  return {
+    user: {
+      id: userId,
+      email: typeof userRecord.email === "string" ? userRecord.email : "",
+      name: typeof userRecord.name === "string" ? userRecord.name : null,
+      image: typeof userRecord.image === "string" ? userRecord.image : null,
+      emailVerified: typeof userRecord.emailVerified === "boolean" ? userRecord.emailVerified : void 0,
+      role: typeof userRecord.role === "string" ? userRecord.role : null,
+      username: typeof userRecord.username === "string" ? userRecord.username : null
+    },
+    session: {
+      id: sessionId,
+      userId: typeof sessionRecord.userId === "string" ? sessionRecord.userId : userId,
+      token: typeof sessionRecord.token === "string" ? sessionRecord.token : void 0,
+      expiresAt: typeof sessionRecord.expiresAt === "string" ? sessionRecord.expiresAt : void 0,
+      activeOrganizationId: normalizeId(
+        typeof sessionRecord.activeOrganizationId === "string" ? sessionRecord.activeOrganizationId : null
+      )
+    }
+  };
+}
+async function fetchSessionFromAuth(options) {
+  const headers = {
+    accept: "application/json"
+  };
+  if (options.cookie) headers.cookie = options.cookie;
+  if (options.bearerToken) headers.authorization = `Bearer ${options.bearerToken}`;
+  try {
+    const response = await options.fetchImpl(options.url, {
+      method: "GET",
+      headers,
+      cache: "no-store"
+    });
+    if (!response.ok) return null;
+    const json3 = await response.json();
+    return coerceSessionResponse(json3);
+  } catch {
+    return null;
+  }
+}
+function resolveSessionLookupUrl(options) {
+  if (options.authSessionUrl) {
+    return String(options.authSessionUrl);
+  }
+  if (options.appOrigin) {
+    return createFreshSessionLookupUrl(options.appOrigin).toString();
+  }
+  return null;
+}
+async function getServerSession(options = {}) {
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+  const skipWithoutCredentials = options.skipFetchWithoutCredentials !== false;
+  const hasExplicitRequestInputs = options.requestHeaders !== void 0 || options.requestCookies !== void 0 || options.sessionDataHeader !== void 0;
+  const requestHeaders = options.requestHeaders ?? (hasExplicitRequestInputs ? {} : void 0);
+  const requestCookies = options.requestCookies ?? (hasExplicitRequestInputs ? "" : void 0);
+  const request2 = await resolveNextRequestContext({
+    requestHeaders,
+    requestCookies,
+    forceNoCache: options.forceNoCache,
+    headers: options.headers
+  });
+  const headerRaw = options.sessionDataHeader !== void 0 ? options.sessionDataHeader : readHeader2(requestHeaders, ATHENA_SESSION_DATA_HEADER) ?? readHeader2(requestHeaders, "x-session-data");
+  let fromSessionDataHeader = false;
+  let session = parseAthenaSessionDataHeader(headerRaw);
+  if (session) {
+    fromSessionDataHeader = true;
+  } else {
+    const hasCredentials = Boolean(request2.cookie || request2.bearerToken);
+    if (!skipWithoutCredentials || hasCredentials) {
+      const lookupUrl = resolveSessionLookupUrl(options);
+      if (lookupUrl) {
+        session = await fetchSessionFromAuth({
+          url: lookupUrl,
+          cookie: request2.cookie,
+          bearerToken: request2.bearerToken,
+          fetchImpl
+        });
+      }
+    }
+  }
+  if (!session) {
+    return {
+      session: null,
+      userId: null,
+      rawActiveOrganizationId: null,
+      organizationId: null,
+      didEnsureActiveOrganization: false,
+      fromSessionDataHeader: false
+    };
+  }
+  const userId = normalizeId(session.user?.id);
+  const rawActiveOrganizationId = normalizeId(session.session?.activeOrganizationId);
+  let organizationId = rawActiveOrganizationId;
+  if (userId && options.resolveActiveOrganizationId) {
+    organizationId = normalizeId(
+      await options.resolveActiveOrganizationId({
+        userId,
+        rawActiveOrganizationId,
+        session
+      })
+    );
+  }
+  let didEnsureActiveOrganization = false;
+  if (options.ensureActiveOrganization && userId) {
+    const sessionForEnsure = {
+      session: {
+        activeOrganizationId: organizationId
+      }
+    };
+    const ensured = await ensureActiveOrganization({
+      session: sessionForEnsure,
+      listOrganizations: options.ensureActiveOrganization.listOrganizations,
+      setActiveOrganization: options.ensureActiveOrganization.setActiveOrganization,
+      selectOrganizationId: options.ensureActiveOrganization.selectOrganizationId,
+      onError: options.ensureActiveOrganization.onError
+    });
+    didEnsureActiveOrganization = ensured.didSetActiveOrganization;
+    if (ensured.activeOrganizationId) {
+      organizationId = ensured.activeOrganizationId;
+    }
+  }
+  return {
+    session,
+    userId,
+    rawActiveOrganizationId,
+    organizationId,
+    didEnsureActiveOrganization,
+    fromSessionDataHeader
+  };
+}
+
+// src/next/session-bridge/constants.ts
+var ATHENA_AUTH_SESSION_BRIDGE_ROUTE = "/api/athena-auth/session";
+var ATHENA_AUTH_SESSION_COOKIE_NAME = "athena-auth.session-token";
+var ATHENA_AUTH_SESSION_COOKIE_NAMES = [
+  ATHENA_AUTH_SESSION_COOKIE_NAME,
+  "athena-auth.session_token"
+];
+
+// src/next/session-bridge/client.ts
+var JSON_CONTENT_TYPE = "application/json";
+function isBrowserRuntime() {
+  return typeof globalThis !== "undefined" && "window" in globalThis;
+}
+async function persistAthenaAuthSessionOnAppHost(payload, options) {
+  if (!(payload && isBrowserRuntime())) {
+    return;
+  }
+  const route = options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
+  const fetchImpl = options?.fetch ?? fetch;
+  const response = await fetchImpl(route, {
+    body: JSON.stringify(payload),
+    credentials: "same-origin",
+    headers: {
+      "Content-Type": JSON_CONTENT_TYPE
+    },
+    method: "POST"
+  });
+  if (!response.ok) {
+    throw new Error("Failed to persist the Athena Auth session on the app host");
+  }
+}
+async function clearAthenaAuthSessionOnAppHost(options) {
+  if (!isBrowserRuntime()) {
+    return;
+  }
+  const route = options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
+  const fetchImpl = options?.fetch ?? fetch;
+  const response = await fetchImpl(route, {
+    credentials: "same-origin",
+    method: "DELETE"
+  });
+  if (!response.ok) {
+    throw new Error("Failed to clear the Athena Auth session on the app host");
+  }
+}
+
+// src/next/session-bridge/payload.ts
+function resolveSessionBridgePayload(payload) {
+  const token = payload?.session?.token ?? payload?.token;
+  if (typeof token !== "string") {
+    return null;
+  }
+  const normalizedToken = token.trim();
+  if (!normalizedToken) {
+    return null;
+  }
+  return {
+    token: normalizedToken,
+    expiresAt: typeof payload?.session?.expiresAt === "string" ? payload.session.expiresAt : void 0
+  };
+}
+
+// src/next/session-bridge/cookie.ts
+var EXPIRED_AT = /* @__PURE__ */ new Date(0);
+function resolveRequestIsSecure(request2) {
+  const forwardedProto = request2.headers.get("x-forwarded-proto")?.trim();
+  if (forwardedProto) {
+    const first = forwardedProto.split(",")[0]?.trim().toLowerCase();
+    if (first === "https") return true;
+    if (first === "http") return false;
+  }
+  return new URL(request2.url).protocol === "https:";
+}
+function resolveSessionCookieExpiresAt(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const expiresAt = new Date(value);
+  return Number.isNaN(expiresAt.getTime()) ? void 0 : expiresAt;
+}
+function serializeCookie(name, value, options) {
+  const parts = [
+    `${encodeURIComponent(name)}=${encodeURIComponent(value)}`,
+    `Path=${options.path}`,
+    "HttpOnly",
+    `SameSite=${options.sameSite === "none" ? "None" : options.sameSite === "strict" ? "Strict" : "Lax"}`
+  ];
+  if (options.secure) {
+    parts.push("Secure");
+  }
+  if (options.expires) {
+    parts.push(`Expires=${options.expires.toUTCString()}`);
+  }
+  return parts.join("; ");
+}
+function resolveBridgeCookieConfig(options) {
+  return {
+    cookieName: options?.cookieName ?? ATHENA_AUTH_SESSION_COOKIE_NAME,
+    cookieNames: options?.cookieNames ?? ATHENA_AUTH_SESSION_COOKIE_NAMES,
+    cookiePath: options?.cookiePath ?? "/",
+    sameSite: options?.sameSite ?? "lax"
+  };
+}
+function appendSessionCookie(headers, request2, token, expiresAt, options) {
+  const config = resolveBridgeCookieConfig(options);
+  const secure = options?.secure ?? resolveRequestIsSecure(request2);
+  headers.append(
+    "set-cookie",
+    serializeCookie(config.cookieName, token, {
+      path: config.cookiePath,
+      sameSite: config.sameSite,
+      secure,
+      expires: expiresAt
+    })
+  );
+}
+function appendClearSessionCookies(headers, request2, options) {
+  const config = resolveBridgeCookieConfig(options);
+  const secure = options?.secure ?? resolveRequestIsSecure(request2);
+  const names = /* @__PURE__ */ new Set([config.cookieName, ...config.cookieNames]);
+  for (const name of names) {
+    headers.append(
+      "set-cookie",
+      serializeCookie(name, "", {
+        path: config.cookiePath,
+        sameSite: config.sameSite,
+        secure,
+        expires: EXPIRED_AT
+      })
+    );
+  }
+}
+
+// src/next/session-bridge/handlers.ts
+function json(body, init) {
+  const headers = init?.headers ?? new Headers();
+  if (!headers.has("content-type")) {
+    headers.set("content-type", "application/json; charset=utf-8");
+  }
+  return new Response(JSON.stringify(body), {
+    status: init?.status ?? 200,
+    headers
+  });
+}
+function resolveRoute(options) {
+  return options?.route ?? ATHENA_AUTH_SESSION_BRIDGE_ROUTE;
+}
+async function handleAthenaAuthSessionBridgePost(request2, options) {
+  const payload = await request2.json().catch(() => null);
+  const token = typeof payload?.token === "string" ? payload.token.trim() : "";
+  if (!token) {
+    return json(
+      {
+        error: "Missing Athena Auth session token"
+      },
+      { status: 400 }
+    );
+  }
+  const headers = new Headers();
+  appendSessionCookie(
+    headers,
+    request2,
+    token,
+    resolveSessionCookieExpiresAt(payload?.expiresAt),
+    options
+  );
+  return json(
+    {
+      ok: true,
+      route: resolveRoute(options)
+    },
+    { headers }
+  );
+}
+function handleAthenaAuthSessionBridgeDelete(request2, options) {
+  const headers = new Headers();
+  appendClearSessionCookies(headers, request2, options);
+  return json(
+    {
+      ok: true,
+      route: resolveRoute(options)
+    },
+    { headers }
+  );
 }
-var ATHENA_AUTH_VERIFY_EMAIL_PATH = "verify-email";
-var ATHENA_AUTH_GET_SESSION_PATH = "get-session";
-var ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH = `${ATHENA_AUTH_PATH}/get-session`;
-var AUTH_SESSION_PATH = ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH;
-var ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM = "disableCookieCache";
-var DISABLE_COOKIE_CACHE_QUERY_PARAM = ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM;
-var ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE = "true";
-var DISABLE_COOKIE_CACHE_QUERY_VALUE = ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE;
-var ATHENA_SESSION_DATA_HEADER = "x-session-data";
-var SESSION_DATA_HEADER = ATHENA_SESSION_DATA_HEADER;
-function resolveEmailVerificationCallbackUrl(rawBaseUrl) {
-  return resolveAthenaAuthRequestUrl(ATHENA_AUTH_VERIFY_EMAIL_PATH, rawBaseUrl);
+function createAthenaAuthSessionBridgeHandlers(options) {
+  return {
+    POST: (request2) => handleAthenaAuthSessionBridgePost(request2, options),
+    DELETE: (request2) => handleAthenaAuthSessionBridgeDelete(request2, options)
+  };
 }
-function createFreshSessionLookupUrl(baseUrl) {
-  const url = new URL(ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, baseUrl);
-  url.searchParams.set(
-    ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM,
-    ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE
+function normalizePathname(pathname) {
+  if (pathname.length > 1 && pathname.endsWith("/")) {
+    return pathname.slice(0, -1);
+  }
+  return pathname || "/";
+}
+function isAthenaAuthSessionBridgePath(request2, options) {
+  const pathname = normalizePathname(new URL(request2.url).pathname);
+  const route = normalizePathname(resolveRoute(options));
+  if (pathname === route) {
+    return true;
+  }
+  const matchPaths = options?.matchPaths ?? ["session"];
+  const segments = pathname.split("/").filter(Boolean);
+  const tail = segments[segments.length - 1];
+  return typeof tail === "string" && matchPaths.includes(tail);
+}
+function createAthenaAuthSessionBridgePathHandlers(options) {
+  const notFound = () => json(
+    {
+      error: "Not found"
+    },
+    { status: 404 }
   );
-  return url;
+  return {
+    POST: async (request2) => {
+      if (!isAthenaAuthSessionBridgePath(request2, options)) {
+        return notFound();
+      }
+      return handleAthenaAuthSessionBridgePost(request2, options);
+    },
+    DELETE: (request2) => {
+      if (!isAthenaAuthSessionBridgePath(request2, options)) {
+        return notFound();
+      }
+      return handleAthenaAuthSessionBridgeDelete(request2, options);
+    }
+  };
 }
 
 // src/utils/auth-routes.ts
@@ -10462,7 +10825,7 @@ function requireEnv(names, env) {
       "requireEnv() requires at least one environment variable name."
     );
   }
-  const source = env ?? readProcessEnv3();
+  const source = env ?? readProcessEnv4();
   for (const name of names) {
     const value = source[name]?.trim();
     if (value) {
@@ -10477,7 +10840,7 @@ function readEnv(names, env) {
   if (!names.length) {
     return void 0;
   }
-  const source = env ?? readProcessEnv3();
+  const source = env ?? readProcessEnv4();
   for (const name of names) {
     const value = source[name]?.trim();
     if (value) {
@@ -10486,7 +10849,7 @@ function readEnv(names, env) {
   }
   return void 0;
 }
-function readProcessEnv3() {
+function readProcessEnv4() {
   try {
     const processEnv = globalThis.process?.env;
     return processEnv ?? {};
@@ -10513,79 +10876,469 @@ function proxyRequestHeaders(request2) {
   return headers;
 }
 
-// src/organization/ensure-active-organization.ts
-function normalizeOrganizationId(value) {
-  if (typeof value !== "string") {
-    return null;
+// src/tables/catalog.ts
+var POSTGRES_CATALOG_SQL = {
+  columns: `
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      a.attname AS column_name,
+      format_type(a.atttypid, a.atttypmod) AS data_type,
+      NOT a.attnotnull AS is_nullable
+    FROM pg_attribute a
+    JOIN pg_class c ON c.oid = a.attrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relkind IN ('r', 'p')
+      AND a.attnum > 0
+      AND NOT a.attisdropped
+      AND n.nspname = ANY($1::text[])
+    ORDER BY n.nspname, c.relname, a.attnum;
+  `,
+  foreignKeys: `
+    SELECT
+      sn.nspname AS source_schema,
+      sc.relname AS source_table,
+      con.conname AS constraint_name,
+      ARRAY_AGG(sa.attname ORDER BY cols.ordinality) AS source_columns,
+      tn.nspname AS target_schema,
+      tc.relname AS target_table,
+      ARRAY_AGG(ta.attname ORDER BY cols.ordinality) AS target_columns,
+      EXISTS (
+        SELECT 1
+        FROM pg_constraint uq
+        WHERE uq.conrelid = con.conrelid
+          AND uq.contype IN ('p', 'u')
+          AND uq.conkey = con.conkey
+      ) AS source_is_unique
+    FROM pg_constraint con
+    JOIN pg_class sc ON sc.oid = con.conrelid
+    JOIN pg_namespace sn ON sn.oid = sc.relnamespace
+    JOIN pg_class tc ON tc.oid = con.confrelid
+    JOIN pg_namespace tn ON tn.oid = tc.relnamespace
+    JOIN unnest(con.conkey, con.confkey) WITH ORDINALITY AS cols(source_attnum, target_attnum, ordinality) ON TRUE
+    JOIN pg_attribute sa ON sa.attrelid = con.conrelid AND sa.attnum = cols.source_attnum
+    JOIN pg_attribute ta ON ta.attrelid = con.confrelid AND ta.attnum = cols.target_attnum
+    WHERE con.contype = 'f'
+      AND sn.nspname = ANY($1::text[])
+      AND tn.nspname = ANY($1::text[])
+    GROUP BY
+      sn.nspname,
+      sc.relname,
+      con.conname,
+      tn.nspname,
+      tc.relname,
+      con.conkey,
+      con.conrelid
+    ORDER BY sn.nspname, sc.relname, con.conname;
+  `,
+  primaryKeys: `
+    SELECT
+      n.nspname AS schema_name,
+      c.relname AS table_name,
+      ARRAY_AGG(a.attname ORDER BY ck.ordinality) AS columns
+    FROM pg_constraint con
+    JOIN pg_class c ON c.oid = con.conrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    JOIN unnest(con.conkey) WITH ORDINALITY AS ck(attnum, ordinality) ON TRUE
+    JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum = ck.attnum
+    WHERE con.contype = 'p'
+      AND n.nspname = ANY($1::text[])
+    GROUP BY n.nspname, c.relname
+    ORDER BY n.nspname, c.relname;
+  `
+};
+function parseAthenaTableSchemaScope(value) {
+  return value.split(",").map((entry) => entry.trim()).filter(
+    (entry, index, values) => entry.length > 0 && values.indexOf(entry) === index
+  );
+}
+function escapeSqlLiteral(value) {
+  return value.replace(/'/g, "''");
+}
+function buildSchemaArrayLiteral(schemas) {
+  const literals = schemas.map((schema) => `'${escapeSqlLiteral(schema)}'`).join(", ");
+  return `ARRAY[${literals}]`;
+}
+function inlineSchemaLiteral(sql, schemas) {
+  return sql.replace(
+    /\$1::text\[\]/g,
+    `${buildSchemaArrayLiteral(schemas)}::text[]`
+  );
+}
+function buildAthenaTableCatalogQueries(schemas) {
+  return {
+    columns: inlineSchemaLiteral(POSTGRES_CATALOG_SQL.columns, schemas),
+    foreignKeys: inlineSchemaLiteral(POSTGRES_CATALOG_SQL.foreignKeys, schemas),
+    primaryKeys: inlineSchemaLiteral(POSTGRES_CATALOG_SQL.primaryKeys, schemas)
+  };
+}
+function tableKey(schema, table) {
+  return `${schema}.${table}`;
+}
+function relationKey(...parts) {
+  const base = parts.join("_").replace(/[^A-Za-z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
+  return base.length > 0 ? base : "relation";
+}
+function parsePostgresArrayLiteral(text) {
+  const body = text.slice(1, -1).trim();
+  if (!body) {
+    return [];
   }
-  const normalized = value.trim();
-  return normalized.length > 0 ? normalized : null;
+  const values = [];
+  let current = "";
+  let inQuotes = false;
+  let escaped = false;
+  for (const char of body) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      inQuotes = !inQuotes;
+      continue;
+    }
+    if (char === "," && !inQuotes) {
+      values.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  values.push(current);
+  return values.map((value) => value.trim()).filter((value) => value.length > 0);
 }
-function defaultSelectOrganizationId(organizations) {
-  for (const organization of organizations) {
-    const id = normalizeOrganizationId(organization.id);
-    if (id) {
-      return id;
+function coerceStringArray(value) {
+  if (value == null) {
+    return [];
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => entry.trim()).filter(Boolean);
+  }
+  if (typeof value !== "string") {
+    return [];
+  }
+  const trimmedValue = value.trim();
+  if (!trimmedValue) {
+    return [];
+  }
+  if (trimmedValue.startsWith("{") && trimmedValue.endsWith("}")) {
+    return parsePostgresArrayLiteral(trimmedValue);
+  }
+  return trimmedValue.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function createTableCatalog() {
+  const tables = /* @__PURE__ */ new Map();
+  const ensureTable = (schema, name) => {
+    const id = tableKey(schema, name);
+    const existingTable = tables.get(id);
+    if (existingTable) {
+      return existingTable;
+    }
+    const nextTable = {
+      columns: [],
+      id,
+      name,
+      primaryKey: [],
+      relationMap: /* @__PURE__ */ new Map(),
+      schema
+    };
+    tables.set(id, nextTable);
+    return nextTable;
+  };
+  const upsertRelation = (table, key, relation) => {
+    table.relationMap.set(key, relation);
+  };
+  return {
+    addColumnRows(columnRows) {
+      for (const row of columnRows) {
+        const table = ensureTable(row.schema_name, row.table_name);
+        table.columns.push({
+          dataType: row.data_type,
+          isNullable: row.is_nullable,
+          isPrimaryKey: false,
+          name: row.column_name
+        });
+      }
+    },
+    addForeignKeyRows(foreignKeyRows) {
+      for (const row of foreignKeyRows) {
+        const sourceTable = ensureTable(row.source_schema, row.source_table);
+        const targetTable = ensureTable(row.target_schema, row.target_table);
+        upsertRelation(
+          sourceTable,
+          relationKey(row.constraint_name, row.target_table),
+          {
+            name: row.constraint_name,
+            targetSchema: row.target_schema,
+            targetTable: row.target_table
+          }
+        );
+        upsertRelation(targetTable, relationKey(row.source_table), {
+          name: relationKey(row.source_table, row.constraint_name),
+          targetSchema: row.source_schema,
+          targetTable: row.source_table
+        });
+      }
+    },
+    addManyToManyRows(foreignKeyRows) {
+      const foreignKeysBySourceTable = /* @__PURE__ */ new Map();
+      for (const foreignKey of foreignKeyRows) {
+        const key = tableKey(foreignKey.source_schema, foreignKey.source_table);
+        const current = foreignKeysBySourceTable.get(key) ?? {
+          foreignKeys: [],
+          schema: foreignKey.source_schema,
+          table: foreignKey.source_table
+        };
+        current.foreignKeys.push(foreignKey);
+        foreignKeysBySourceTable.set(key, current);
+      }
+      for (const candidate of foreignKeysBySourceTable.values()) {
+        const bridgeTable = tables.get(
+          tableKey(candidate.schema, candidate.table)
+        );
+        if (!bridgeTable || candidate.foreignKeys.length !== 2) {
+          continue;
+        }
+        const combinedForeignColumns = Array.from(
+          new Set(
+            candidate.foreignKeys.flatMap(
+              (foreignKey) => coerceStringArray(foreignKey.source_columns)
+            )
+          )
+        );
+        if (bridgeTable.primaryKey.length === 0 || combinedForeignColumns.length !== bridgeTable.primaryKey.length || !bridgeTable.primaryKey.every(
+          (column) => combinedForeignColumns.includes(column)
+        )) {
+          continue;
+        }
+        const [firstForeignKey, secondForeignKey] = candidate.foreignKeys;
+        const firstTarget = tables.get(
+          tableKey(firstForeignKey.target_schema, firstForeignKey.target_table)
+        );
+        const secondTarget = tables.get(
+          tableKey(
+            secondForeignKey.target_schema,
+            secondForeignKey.target_table
+          )
+        );
+        if (!(firstTarget && secondTarget)) {
+          continue;
+        }
+        upsertRelation(
+          firstTarget,
+          relationKey(candidate.table, secondForeignKey.target_table),
+          {
+            name: relationKey(
+              candidate.table,
+              secondForeignKey.constraint_name
+            ),
+            targetSchema: secondForeignKey.target_schema,
+            targetTable: secondForeignKey.target_table
+          }
+        );
+        upsertRelation(
+          secondTarget,
+          relationKey(candidate.table, firstForeignKey.target_table),
+          {
+            name: relationKey(candidate.table, firstForeignKey.constraint_name),
+            targetSchema: firstForeignKey.target_schema,
+            targetTable: firstForeignKey.target_table
+          }
+        );
+      }
+    },
+    addPrimaryKeyRows(primaryKeyRows) {
+      for (const row of primaryKeyRows) {
+        const table = ensureTable(row.schema_name, row.table_name);
+        const primaryKey = coerceStringArray(row.columns);
+        table.primaryKey = primaryKey;
+        for (const columnName of primaryKey) {
+          const column = table.columns.find(
+            (candidate) => candidate.name === columnName
+          );
+          if (column) {
+            column.isPrimaryKey = true;
+          }
+        }
+      }
+    },
+    toResponse(database) {
+      return {
+        database,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        tables: [...tables.values()].map((table) => ({
+          columns: [...table.columns].sort(
+            (left, right) => left.name.localeCompare(right.name)
+          ),
+          id: table.id,
+          name: table.name,
+          primaryKey: [...table.primaryKey],
+          relations: [...table.relationMap.values()].map((relation) => ({
+            columns: tables.get(
+              tableKey(relation.targetSchema, relation.targetTable)
+            )?.columns ?? [],
+            name: relation.name,
+            targetSchema: relation.targetSchema,
+            targetTable: relation.targetTable
+          })).sort(
+            (left, right) => left.name.localeCompare(right.name)
+          ),
+          schema: table.schema
+        })).sort(
+          (left, right) => left.id.localeCompare(right.id)
+        )
+      };
     }
+  };
+}
+async function queryRows(client, query) {
+  const result = await client.query(query);
+  if (result.error || result.status < 200 || result.status >= 300) {
+    const errorMessage = typeof result.error === "string" ? result.error : result.error && typeof result.error === "object" && "message" in result.error && typeof result.error.message === "string" ? result.error.message : `Athena gateway query failed with status ${result.status}.`;
+    throw new Error(errorMessage);
   }
-  return null;
+  return Array.isArray(result.data) ? result.data : [];
 }
-async function ensureActiveOrganization(options) {
-  const currentActiveOrganizationId = normalizeOrganizationId(
-    options.session?.session?.activeOrganizationId
-  );
-  if (currentActiveOrganizationId) {
+function isAthenaTableSchemaConfig(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const config = value;
+  return typeof config.gatewayUrl === "string" && typeof config.gatewayKey === "string" && typeof config.gatewayDatabase === "string" && typeof config.schemaScope === "string" && typeof config.clientName === "string";
+}
+function hasAthenaTableSchemaCredentials(config) {
+  return config.gatewayUrl.trim().length > 0 && config.gatewayKey.trim().length > 0 && config.gatewayDatabase.trim().length > 0;
+}
+async function fetchAthenaTableCatalog(config, options = {}) {
+  const schemas = parseAthenaTableSchemaScope(config.schemaScope);
+  if (schemas.length === 0) {
     return {
-      activeOrganizationId: currentActiveOrganizationId,
-      didSetActiveOrganization: false
+      database: config.gatewayDatabase,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      tables: []
     };
   }
-  let organizations;
+  const queries = buildAthenaTableCatalogQueries(schemas);
+  const client = options.client ?? createClient({
+    url: config.gatewayUrl.trim(),
+    key: config.gatewayKey.trim(),
+    client: config.clientName.trim() || void 0
+  });
+  const [columnRows, primaryKeyRows, foreignKeyRows] = await Promise.all([
+    queryRows(client, queries.columns),
+    queryRows(client, queries.primaryKeys),
+    queryRows(client, queries.foreignKeys)
+  ]);
+  const catalog = createTableCatalog();
+  catalog.addColumnRows(columnRows);
+  catalog.addPrimaryKeyRows(primaryKeyRows);
+  catalog.addForeignKeyRows(foreignKeyRows);
+  catalog.addManyToManyRows(foreignKeyRows);
+  return catalog.toResponse(config.gatewayDatabase);
+}
+var fetchTableCatalog = fetchAthenaTableCatalog;
+
+// src/tables/schema-handlers.ts
+var ATHENA_TABLE_SCHEMA_ROUTE = "/api/tables/schema";
+function json2(body, init) {
+  const headers = new Headers(init?.headers);
+  if (!headers.has("content-type")) {
+    headers.set("content-type", "application/json; charset=utf-8");
+  }
+  return new Response(JSON.stringify(body), {
+    status: init?.status ?? 200,
+    headers
+  });
+}
+async function handleAthenaTableSchemaPost(request2, options) {
+  const payload = await request2.json().catch(() => null);
+  let config = isAthenaTableSchemaConfig(
+    payload?.config
+  ) ? payload.config : null;
+  if (config && options?.resolveConfig) {
+    config = await options.resolveConfig(config, request2);
+  }
+  if (!config || !isAthenaTableSchemaConfig(config)) {
+    return json2(
+      {
+        error: "The Athena tables showcase config is invalid."
+      },
+      { status: 400 }
+    );
+  }
+  if (!hasAthenaTableSchemaCredentials(config)) {
+    return json2(
+      {
+        error: "Gateway URL, API key, and database are required for schema introspection."
+      },
+      { status: 400 }
+    );
+  }
   try {
-    organizations = await options.listOrganizations();
+    const response = await fetchAthenaTableCatalog(
+      config,
+      {
+        client: options?.client
+      }
+    );
+    return json2(response);
   } catch (error) {
-    options.onError?.(error);
-    return {
-      activeOrganizationId: null,
-      didSetActiveOrganization: false
-    };
+    return json2(
+      {
+        error: error instanceof Error ? error.message : "Athena schema introspection failed."
+      },
+      { status: 500 }
+    );
   }
-  if (organizations.length === 0) {
-    return {
-      activeOrganizationId: null,
-      didSetActiveOrganization: false
-    };
+}
+function createAthenaTableSchemaHandlers(options) {
+  return {
+    POST: (request2) => handleAthenaTableSchemaPost(request2, options)
+  };
+}
+
+// src/next/server.ts
+function warnEmptyServerScope() {
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") {
+    return;
   }
-  const selectedOrganizationId = normalizeOrganizationId(
-    (options.selectOrganizationId ?? defaultSelectOrganizationId)(organizations)
+  console.warn(
+    "[athena] createAthenaServerClient/resolveAthenaServerContext: `scope` was provided without userId or organizationId. Gateway identity headers will not be set from scope. Pass at least one field, or omit scope."
   );
-  if (!selectedOrganizationId) {
+}
+function resolveServerIdentity(options) {
+  const session = options.session ?? null;
+  const sessionUserId = session?.user?.id ?? null;
+  const sessionOrganizationId = session?.session?.activeOrganizationId ?? null;
+  const scope = options.scope;
+  if (scope === void 0) {
     return {
-      activeOrganizationId: null,
-      didSetActiveOrganization: false
+      userId: sessionUserId,
+      organizationId: sessionOrganizationId
     };
   }
-  try {
-    await options.setActiveOrganization(selectedOrganizationId);
-    return {
-      activeOrganizationId: selectedOrganizationId,
-      didSetActiveOrganization: true
-    };
-  } catch (error) {
-    options.onError?.(error);
-    return {
-      activeOrganizationId: null,
-      didSetActiveOrganization: false
-    };
+  const scopeHasUserId = Object.hasOwn(scope, "userId");
+  const scopeHasOrganizationId = Object.hasOwn(scope, "organizationId");
+  if (!scopeHasUserId && !scopeHasOrganizationId) {
+    warnEmptyServerScope();
   }
+  return {
+    userId: scopeHasUserId ? scope.userId ?? null : sessionUserId,
+    organizationId: scopeHasOrganizationId ? scope.organizationId ?? null : sessionOrganizationId
+  };
 }
-
-// src/next/server.ts
 async function resolveAthenaServerContext(options = {}) {
   const request2 = await resolveNextRequestContext(options);
   const session = options.session ?? null;
-  const userId = session?.user?.id ?? null;
-  const organizationId = session?.session?.activeOrganizationId ?? null;
+  const { userId, organizationId } = resolveServerIdentity({
+    session,
+    scope: options.scope
+  });
   return {
     request: {
       ...request2,
@@ -10603,6 +11356,7 @@ async function createAthenaServerClient(options) {
     requestCookies,
     forceNoCache,
     session,
+    scope,
     headers: requestScopedHeaders,
     ...clientConfig
   } = options;
@@ -10611,7 +11365,8 @@ async function createAthenaServerClient(options) {
     requestCookies,
     forceNoCache,
     headers: requestScopedHeaders,
-    session
+    session,
+    scope
   });
   const configuredContext = clientConfig.context;
   return createClient({
@@ -10623,6 +11378,6 @@ async function createAthenaServerClient(options) {
   });
 }
 
-export { ATHENA_AUTH_COOKIE_PREFIXES, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, ATHENA_AUTH_GET_SESSION_PATH, ATHENA_AUTH_PATH, ATHENA_AUTH_SESSION_BRIDGE_ROUTE, ATHENA_AUTH_SESSION_COOKIE_NAME, ATHENA_AUTH_SESSION_COOKIE_NAMES, ATHENA_AUTH_UPSTREAM_ENV_KEYS, ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, ATHENA_AUTH_VERIFY_EMAIL_PATH, ATHENA_SESSION_DATA_HEADER, AUTHENTICATED_REDIRECT_MODE_SET, AUTHENTICATED_REDIRECT_VIEW_SET, AUTH_DEFAULT_VIEW, AUTH_MODE_REDIRECTS, AUTH_MODE_SET, AUTH_ROUTES, AUTH_SESSION_PATH, AUTH_TWO_FACTOR_SEGMENT, AUTH_VIEW_BY_SEGMENT, DEFAULT_ATHENA_AUTH_ORIGIN, DEFAULT_ATHENA_AUTH_UPSTREAM_URL, DISABLE_COOKIE_CACHE_QUERY_PARAM, DISABLE_COOKIE_CACHE_QUERY_VALUE, LOCAL_DEV_ORIGIN, SESSION_COOKIE_PATTERNS, SESSION_DATA_HEADER, applyAthenaApiKeyHeaders, applyAthenaAuthContextHeaders, applyAthenaPgUriHeaders, asNonEmptyString, asString, buildAthenaGatewayHeaders, buildAthenaRequestHeaders, buildServiceRequestHeaders, clearAthenaAuthSessionOnAppHost, clearAuthCookies, createAthenaAuthSessionBridgeHandlers, createAthenaAuthSessionBridgePathHandlers, createAthenaServerClient, createAuthModeRedirects, createAuthRoutes, createFreshSessionLookupUrl, ensureActiveOrganization, getOriginFromHeaders, handleAthenaAuthSessionBridgeDelete, handleAthenaAuthSessionBridgePost, hasAuthSessionCookie, hasHeaderIgnoreCase, isAbsoluteUrl, isAthenaAuthSessionBridgePath, isAuthMode, isDynamicServerUsageError, normalizeAthenaAuthBaseUrl, persistAthenaAuthSessionOnAppHost, proxyRequestHeaders, readAthenaAuthUpstreamUrlFromEnv, readEnv, readTrimmedString, requireEnv, resolveAthenaAuthClientBaseUrl, resolveAthenaAuthRequestUrl, resolveAthenaAuthUpstreamUrl, resolveAthenaServerContext, resolveAuthModeRedirect, resolveAuthViewFromSegment, resolveEmailVerificationCallbackUrl, resolveHeaderValue, resolveNextRequestContext, resolveRequestHeaderOverrides, resolveSessionBridgePayload, shouldRedirectAuthenticatedAuthMode, shouldRedirectAuthenticatedAuthView };
+export { ATHENA_AUTH_COOKIE_PREFIXES, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE, ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, ATHENA_AUTH_GET_SESSION_PATH, ATHENA_AUTH_PATH, ATHENA_AUTH_SESSION_BRIDGE_ROUTE, ATHENA_AUTH_SESSION_COOKIE_NAME, ATHENA_AUTH_SESSION_COOKIE_NAMES, ATHENA_AUTH_UPSTREAM_ENV_KEYS, ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES, ATHENA_AUTH_VERIFY_EMAIL_PATH, ATHENA_SESSION_DATA_HEADER, ATHENA_TABLE_SCHEMA_ROUTE, AUTHENTICATED_REDIRECT_MODE_SET, AUTHENTICATED_REDIRECT_VIEW_SET, AUTH_DEFAULT_VIEW, AUTH_MODE_REDIRECTS, AUTH_MODE_SET, AUTH_ROUTES, AUTH_SESSION_PATH, AUTH_TWO_FACTOR_SEGMENT, AUTH_VIEW_BY_SEGMENT, DEFAULT_ATHENA_AUTH_ORIGIN, DEFAULT_ATHENA_AUTH_UPSTREAM_URL, DISABLE_COOKIE_CACHE_QUERY_PARAM, DISABLE_COOKIE_CACHE_QUERY_VALUE, LOCAL_DEV_ORIGIN, SESSION_COOKIE_PATTERNS, SESSION_DATA_HEADER, applyAthenaApiKeyHeaders, applyAthenaAuthContextHeaders, applyAthenaPgUriHeaders, asNonEmptyString, asString, buildAthenaGatewayHeaders, buildAthenaRequestHeaders, buildAthenaTableCatalogQueries, buildServiceRequestHeaders, clearAthenaAuthSessionOnAppHost, clearAuthCookies, createAthenaAuthSessionBridgeHandlers, createAthenaAuthSessionBridgePathHandlers, createAthenaServerClient, createAthenaTableSchemaHandlers, createAuthModeRedirects, createAuthRoutes, createFreshSessionLookupUrl, ensureActiveOrganization, fetchAthenaTableCatalog, fetchTableCatalog, getOriginFromHeaders, getServerSession, handleAthenaAuthSessionBridgeDelete, handleAthenaAuthSessionBridgePost, handleAthenaTableSchemaPost, hasAthenaTableSchemaCredentials, hasAuthSessionCookie, hasHeaderIgnoreCase, isAbsoluteUrl, isAthenaAuthSessionBridgePath, isAthenaTableSchemaConfig, isAuthMode, isDynamicServerUsageError, normalizeAthenaAuthBaseUrl, parseAthenaSessionDataHeader, parseAthenaTableSchemaScope, persistAthenaAuthSessionOnAppHost, proxyRequestHeaders, readAthenaAuthUpstreamUrlFromEnv, readEnv, readTrimmedString, requireEnv, resolveAthenaAuthClientBaseUrl, resolveAthenaAuthRequestUrl, resolveAthenaAuthUpstreamUrl, resolveAthenaServerContext, resolveAuthModeRedirect, resolveAuthViewFromSegment, resolveEmailVerificationCallbackUrl, resolveHeaderValue, resolveNextRequestContext, resolveRequestHeaderOverrides, resolveSessionBridgePayload, shouldRedirectAuthenticatedAuthMode, shouldRedirectAuthenticatedAuthView };
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map