chore: import upstream snapshot with attribution

apps/sim/app/api/tools/athena/batch-get-query-execution/route.ts

@@ -0,0 +1,78 @@
+import { BatchGetQueryExecutionCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaBatchGetQueryExecutionContract } from '@/lib/api/contracts/tools/aws/athena-batch-get-query-execution'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaBatchGetQueryExecution')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaBatchGetQueryExecutionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    try {
+      const command = new BatchGetQueryExecutionCommand({
+        QueryExecutionIds: data.queryExecutionIds,
+      })
+
+      const response = await client.send(command)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          queryExecutions: (response.QueryExecutions ?? []).map((execution) => ({
+            queryExecutionId: execution.QueryExecutionId ?? '',
+            query: execution.Query ?? null,
+            state: execution.Status?.State ?? null,
+            stateChangeReason: execution.Status?.StateChangeReason ?? null,
+            statementType: execution.StatementType ?? null,
+            database: execution.QueryExecutionContext?.Database ?? null,
+            catalog: execution.QueryExecutionContext?.Catalog ?? null,
+            workGroup: execution.WorkGroup ?? null,
+            submissionDateTime: execution.Status?.SubmissionDateTime?.getTime() ?? null,
+            completionDateTime: execution.Status?.CompletionDateTime?.getTime() ?? null,
+            dataScannedInBytes: execution.Statistics?.DataScannedInBytes ?? null,
+            engineExecutionTimeInMillis: execution.Statistics?.EngineExecutionTimeInMillis ?? null,
+            queryPlanningTimeInMillis: execution.Statistics?.QueryPlanningTimeInMillis ?? null,
+            queryQueueTimeInMillis: execution.Statistics?.QueryQueueTimeInMillis ?? null,
+            totalExecutionTimeInMillis: execution.Statistics?.TotalExecutionTimeInMillis ?? null,
+            outputLocation: execution.ResultConfiguration?.OutputLocation ?? null,
+          })),
+          unprocessedQueryExecutionIds: (response.UnprocessedQueryExecutionIds ?? []).map(
+            (item) => ({
+              queryExecutionId: item.QueryExecutionId ?? null,
+              errorCode: item.ErrorCode ?? null,
+              errorMessage: item.ErrorMessage ?? null,
+            })
+          ),
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to batch get Athena query executions')
+    logger.error('BatchGetQueryExecution failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/create-named-query/route.ts

@@ -0,0 +1,58 @@
+import { CreateNamedQueryCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaCreateNamedQueryContract } from '@/lib/api/contracts/tools/aws/athena-create-named-query'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaCreateNamedQuery')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaCreateNamedQueryContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new CreateNamedQueryCommand({
+      Name: data.name,
+      Database: data.database,
+      QueryString: data.queryString,
+      ...(data.description && { Description: data.description }),
+      ...(data.workGroup && { WorkGroup: data.workGroup }),
+    })
+
+    const response = await client.send(command)
+
+    if (!response.NamedQueryId) {
+      throw new Error('No named query ID returned')
+    }
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        namedQueryId: response.NamedQueryId,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to create Athena named query')
+    logger.error('CreateNamedQuery failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/delete-named-query/route.ts

@@ -0,0 +1,54 @@
+import { DeleteNamedQueryCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaDeleteNamedQueryContract } from '@/lib/api/contracts/tools/aws/athena-delete-named-query'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaDeleteNamedQuery')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaDeleteNamedQueryContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    try {
+      const command = new DeleteNamedQueryCommand({
+        NamedQueryId: data.namedQueryId,
+      })
+
+      await client.send(command)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          success: true,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to delete Athena named query')
+    logger.error('DeleteNamedQuery failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/get-named-query/route.ts

@@ -0,0 +1,60 @@
+import { GetNamedQueryCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaGetNamedQueryContract } from '@/lib/api/contracts/tools/aws/athena-get-named-query'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaGetNamedQuery')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaGetNamedQueryContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new GetNamedQueryCommand({
+      NamedQueryId: data.namedQueryId,
+    })
+
+    const response = await client.send(command)
+    const namedQuery = response.NamedQuery
+
+    if (!namedQuery) {
+      throw new Error('No named query data returned')
+    }
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        namedQueryId: namedQuery.NamedQueryId ?? data.namedQueryId,
+        name: namedQuery.Name ?? '',
+        description: namedQuery.Description ?? null,
+        database: namedQuery.Database ?? '',
+        queryString: namedQuery.QueryString ?? '',
+        workGroup: namedQuery.WorkGroup ?? null,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to get Athena named query')
+    logger.error('GetNamedQuery failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/get-query-execution/route.ts

@@ -0,0 +1,70 @@
+import { GetQueryExecutionCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaGetQueryExecutionContract } from '@/lib/api/contracts/tools/aws/athena-get-query-execution'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaGetQueryExecution')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaGetQueryExecutionContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new GetQueryExecutionCommand({
+      QueryExecutionId: data.queryExecutionId,
+    })
+
+    const response = await client.send(command)
+    const execution = response.QueryExecution
+
+    if (!execution) {
+      throw new Error('No query execution data returned')
+    }
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        queryExecutionId: execution.QueryExecutionId ?? data.queryExecutionId,
+        query: execution.Query ?? '',
+        state: execution.Status?.State ?? 'UNKNOWN',
+        stateChangeReason: execution.Status?.StateChangeReason ?? null,
+        statementType: execution.StatementType ?? null,
+        database: execution.QueryExecutionContext?.Database ?? null,
+        catalog: execution.QueryExecutionContext?.Catalog ?? null,
+        workGroup: execution.WorkGroup ?? null,
+        submissionDateTime: execution.Status?.SubmissionDateTime?.getTime() ?? null,
+        completionDateTime: execution.Status?.CompletionDateTime?.getTime() ?? null,
+        dataScannedInBytes: execution.Statistics?.DataScannedInBytes ?? null,
+        engineExecutionTimeInMillis: execution.Statistics?.EngineExecutionTimeInMillis ?? null,
+        queryPlanningTimeInMillis: execution.Statistics?.QueryPlanningTimeInMillis ?? null,
+        queryQueueTimeInMillis: execution.Statistics?.QueryQueueTimeInMillis ?? null,
+        totalExecutionTimeInMillis: execution.Statistics?.TotalExecutionTimeInMillis ?? null,
+        outputLocation: execution.ResultConfiguration?.OutputLocation ?? null,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to get Athena query execution')
+    logger.error('GetQueryExecution failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/get-query-results/route.ts

@@ -0,0 +1,76 @@
+import { GetQueryResultsCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaGetQueryResultsContract } from '@/lib/api/contracts/tools/aws/athena-get-query-results'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaGetQueryResults')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaGetQueryResultsContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const isFirstPage = !data.nextToken
+    const adjustedMaxResults =
+      data.maxResults !== undefined && isFirstPage ? data.maxResults + 1 : data.maxResults
+
+    const command = new GetQueryResultsCommand({
+      QueryExecutionId: data.queryExecutionId,
+      ...(adjustedMaxResults !== undefined && { MaxResults: adjustedMaxResults }),
+      ...(data.nextToken && { NextToken: data.nextToken }),
+    })
+
+    const response = await client.send(command)
+
+    const columnInfo = response.ResultSet?.ResultSetMetadata?.ColumnInfo ?? []
+    const columns = columnInfo.map((col) => ({
+      name: col.Name ?? '',
+      type: col.Type ?? 'varchar',
+    }))
+
+    const rawRows = response.ResultSet?.Rows ?? []
+    const dataRows = data.nextToken ? rawRows : rawRows.slice(1)
+    const rows = dataRows.map((row) => {
+      const record: Record<string, string> = {}
+      const rowData = row.Data ?? []
+      for (let i = 0; i < columns.length; i++) {
+        record[columns[i].name] = rowData[i]?.VarCharValue ?? ''
+      }
+      return record
+    })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        columns,
+        rows,
+        nextToken: response.NextToken ?? null,
+        updateCount: response.UpdateCount ?? null,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to get Athena query results')
+    logger.error('GetQueryResults failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/list-databases/route.ts

@@ -0,0 +1,61 @@
+import { ListDatabasesCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaListDatabasesContract } from '@/lib/api/contracts/tools/aws/athena-list-databases'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaListDatabases')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaListDatabasesContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    try {
+      const command = new ListDatabasesCommand({
+        CatalogName: data.catalogName,
+        ...(data.workGroup && { WorkGroup: data.workGroup }),
+        ...(data.maxResults !== undefined && { MaxResults: data.maxResults }),
+        ...(data.nextToken && { NextToken: data.nextToken }),
+      })
+
+      const response = await client.send(command)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          databases: (response.DatabaseList ?? []).map((db) => ({
+            name: db.Name ?? '',
+            description: db.Description ?? null,
+          })),
+          nextToken: response.NextToken ?? null,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to list Athena databases')
+    logger.error('ListDatabases failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/list-named-queries/route.ts

@@ -0,0 +1,53 @@
+import { ListNamedQueriesCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaListNamedQueriesContract } from '@/lib/api/contracts/tools/aws/athena-list-named-queries'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaListNamedQueries')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaListNamedQueriesContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new ListNamedQueriesCommand({
+      ...(data.workGroup && { WorkGroup: data.workGroup }),
+      ...(data.maxResults !== undefined && { MaxResults: data.maxResults }),
+      ...(data.nextToken && { NextToken: data.nextToken }),
+    })
+
+    const response = await client.send(command)
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        namedQueryIds: response.NamedQueryIds ?? [],
+        nextToken: response.NextToken ?? null,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to list Athena named queries')
+    logger.error('ListNamedQueries failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/list-query-executions/route.ts

@@ -0,0 +1,53 @@
+import { ListQueryExecutionsCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaListQueryExecutionsContract } from '@/lib/api/contracts/tools/aws/athena-list-query-executions'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaListQueryExecutions')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaListQueryExecutionsContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new ListQueryExecutionsCommand({
+      ...(data.workGroup && { WorkGroup: data.workGroup }),
+      ...(data.maxResults !== undefined && { MaxResults: data.maxResults }),
+      ...(data.nextToken && { NextToken: data.nextToken }),
+    })
+
+    const response = await client.send(command)
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        queryExecutionIds: response.QueryExecutionIds ?? [],
+        nextToken: response.NextToken ?? null,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to list Athena query executions')
+    logger.error('ListQueryExecutions failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/list-table-metadata/route.ts

@@ -0,0 +1,75 @@
+import { ListTableMetadataCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaListTableMetadataContract } from '@/lib/api/contracts/tools/aws/athena-list-table-metadata'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaListTableMetadata')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaListTableMetadataContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    try {
+      const command = new ListTableMetadataCommand({
+        CatalogName: data.catalogName,
+        DatabaseName: data.databaseName,
+        ...(data.expression && { Expression: data.expression }),
+        ...(data.workGroup && { WorkGroup: data.workGroup }),
+        ...(data.maxResults !== undefined && { MaxResults: data.maxResults }),
+        ...(data.nextToken && { NextToken: data.nextToken }),
+      })
+
+      const response = await client.send(command)
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          tables: (response.TableMetadataList ?? []).map((table) => ({
+            name: table.Name ?? '',
+            tableType: table.TableType ?? null,
+            createTime: table.CreateTime?.getTime() ?? null,
+            lastAccessTime: table.LastAccessTime?.getTime() ?? null,
+            columns: (table.Columns ?? []).map((col) => ({
+              name: col.Name ?? '',
+              type: col.Type ?? null,
+              comment: col.Comment ?? null,
+            })),
+            partitionKeys: (table.PartitionKeys ?? []).map((col) => ({
+              name: col.Name ?? '',
+              type: col.Type ?? null,
+              comment: col.Comment ?? null,
+            })),
+          })),
+          nextToken: response.NextToken ?? null,
+        },
+      })
+    } finally {
+      client.destroy()
+    }
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to list Athena table metadata')
+    logger.error('ListTableMetadata failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/start-query/route.ts

@@ -0,0 +1,70 @@
+import { StartQueryExecutionCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaStartQueryContract } from '@/lib/api/contracts/tools/aws/athena-start-query'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaStartQuery')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaStartQueryContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new StartQueryExecutionCommand({
+      QueryString: data.queryString,
+      ...(data.database || data.catalog
+        ? {
+            QueryExecutionContext: {
+              ...(data.database && { Database: data.database }),
+              ...(data.catalog && { Catalog: data.catalog }),
+            },
+          }
+        : {}),
+      ...(data.outputLocation
+        ? {
+            ResultConfiguration: {
+              OutputLocation: data.outputLocation,
+            },
+          }
+        : {}),
+      ...(data.workGroup && { WorkGroup: data.workGroup }),
+    })
+
+    const response = await client.send(command)
+
+    if (!response.QueryExecutionId) {
+      throw new Error('No query execution ID returned')
+    }
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        queryExecutionId: response.QueryExecutionId,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to start Athena query')
+    logger.error('StartQuery failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/stop-query/route.ts

@@ -0,0 +1,50 @@
+import { StopQueryExecutionCommand } from '@aws-sdk/client-athena'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { awsAthenaStopQueryContract } from '@/lib/api/contracts/tools/aws/athena-stop-query'
+import { parseToolRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { createAthenaClient } from '@/app/api/tools/athena/utils'
+
+const logger = createLogger('AthenaStopQuery')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  try {
+    const auth = await checkInternalAuth(request)
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: auth.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseToolRequest(awsAthenaStopQueryContract, request, {
+      errorFormat: 'details',
+      logger,
+    })
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    const client = createAthenaClient({
+      region: data.region,
+      accessKeyId: data.accessKeyId,
+      secretAccessKey: data.secretAccessKey,
+    })
+
+    const command = new StopQueryExecutionCommand({
+      QueryExecutionId: data.queryExecutionId,
+    })
+
+    await client.send(command)
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        success: true,
+      },
+    })
+  } catch (error) {
+    const errorMessage = getErrorMessage(error, 'Failed to stop Athena query')
+    logger.error('StopQuery failed', { error: errorMessage })
+    return NextResponse.json({ error: errorMessage }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/athena/utils.ts

@@ -0,0 +1,17 @@
+import { AthenaClient } from '@aws-sdk/client-athena'
+
+interface AwsCredentials {
+  region: string
+  accessKeyId: string
+  secretAccessKey: string
+}
+
+export function createAthenaClient(config: AwsCredentials): AthenaClient {
+  return new AthenaClient({
+    region: config.region,
+    credentials: {
+      accessKeyId: config.accessKeyId,
+      secretAccessKey: config.secretAccessKey,
+    },
+  })
+}