@wavehouse/sdk 0.0.0-dev.h514be5522d89 → 0.0.0-dev.h7362ab3863f6

package/dist/index.d.cts

@@ -1,7 +1,15 @@
 /** User-provided database schema mapping table names to row types. */
 type Database = Record<string, Record<string, unknown>>;
 /**
- * Discriminated union for all async SDK operations. Never throws.
+ * Discriminated union for the async SDK calls that return one. Never throws for
+ * anything the server returns; a non-absolute `baseURL` and a rejecting `auth`
+ * callback do throw, while a runtime with no `fetch` at all surfaces instead as
+ * a retried `NETWORK_ERROR` result.
+ *
+ * `.stream()` and `.liveQuery()` return no `Result` and report the same three
+ * differently: a non-absolute `baseURL` reaches the subscriber's `error`
+ * callback as a terminal `SSE_CONNECT_ERROR`, a rejecting `auth` as a retryable
+ * `SSE_AUTH_ERROR`, and only a missing `fetch` throws from the call itself.
  *
  * Discriminated on `ok`: `if (result.ok)` narrows to the success arm (and tells
  * the compiler `data` is present), while `error` is always available for
@@ -47,16 +55,147 @@ interface StreamSubscriber<T = Record<string, unknown>> {
     error?: (err: WaveHouseError) => void;
 }
 interface ClientConfig<_DB extends Database = Database> {
-    /** Base URL of the WaveHouse server (e.g. "http://localhost:8080"). */
+    /**
+     * Base URL of the WaveHouse server (e.g. "http://localhost:8080"). May include
+     * a path prefix ("https://app.example.com/api/warehouse") for a WaveHouse
+     * behind a backend-for-frontend (BFF), app-server route, or path-routed
+     * ingress; request paths are appended to it. The proxy in front must strip
+     * the prefix before forwarding.
+     *
+     * Must be **absolute** — scheme and host included. The transports report a
+     * relative value such as "/api/warehouse" differently: a REST call rejects
+     * with a `TypeError` instead of returning a `Result`, while a stream reports
+     * `SSE_CONNECT_ERROR` to the subscriber's `error` callback. Build an absolute
+     * one: `` `${location.origin}/api/warehouse` ``.
+     */
     baseURL: string;
     /** Auth token provider. Omit for public/unauthenticated access. */
     auth?: () => Promise<string> | string;
     /** Additional client options. */
     options?: ClientOptions;
 }
+/**
+ * A `fetch`-compatible function.
+ *
+ * Spelled out rather than written `typeof fetch`, which resolves differently
+ * depending on whether the consumer's TypeScript `lib` includes DOM — the same
+ * signature either way, but stable across configurations.
+ *
+ * The parameter is `string` rather than `typeof fetch`'s wider union because a
+ * string URL is all the SDK ever passes. Since parameters are contravariant,
+ * narrowing it *widens* what can be assigned: the global `fetch` still fits, and
+ * so does hand-written `(url: string, init?: RequestInit) => Promise<Response>`
+ * middleware, which the wider spelling rejects at compile time.
+ *
+ * On REST the SDK reads `.ok` and `.headers` always, `.text()` on success, and
+ * `.status`, `.statusText` plus `.json()` when the response is not `ok`. A
+ * rejection becomes a `NETWORK_ERROR` result and is retried with backoff —
+ * unless the `AbortSignal` you passed has been aborted, in which case the
+ * result is `ABORTED` and nothing is retried. That is decided from the signal
+ * rather than the rejection's type, so an implementation that throws something
+ * other than a `DOMException` named `AbortError` — `AbortSignal.timeout()`,
+ * `node-fetch` — is reported the same way.
+ *
+ * **Streaming needs more.** `.stream()` and `.liveQuery()` read the response as
+ * it arrives, via `.body.getReader()`, so an implementation used with them must
+ * return a response carrying a live `ReadableStream` — something the type cannot
+ * enforce, since `Response.body` is legitimately nullable. A response handed
+ * back with an absent or already-consumed body fails fast with
+ * `SSE_NO_STREAM_BODY`. What the SDK *cannot* rescue is an implementation that
+ * awaits the body before returning — `await res.text()`, or the
+ * `res.clone().text()` a logging wrapper reaches for — because on a stream that
+ * never ends, that never resolves and your function never returns. Both satisfy
+ * every REST call, which is what makes the trap easy to walk into.
+ *
+ * Implementations shipping their own request/response declarations (undici,
+ * `node-fetch`) need casts on the init and the return value, since those types
+ * are separate from the ones behind your global `fetch`; the narrow runtime
+ * contract above is what makes them safe.
+ */
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 interface ClientOptions {
     /** Maximum retry attempts for failed requests. Default: 2. */
     maxRetries?: number;
+    /**
+     * HTTP implementation used for every request, REST and streaming alike.
+     * Defaults to the global `fetch`.
+     *
+     * Provide one to route through a proxy, attach client certificates, add
+     * middleware (logging, tracing, circuit breaking), or bypass a transport bug
+     * in the runtime's bundled HTTP stack by routing through an implementation
+     * you install yourself — e.g. an undici new enough to be free of
+     * {@link https://github.com/nodejs/undici/issues/5600 | undici #5600}:
+     *
+     * ```ts
+     * import { Agent, fetch as undiciFetch } from "undici"; // npm install undici — 8.10.0+
+     * // Pass the dispatcher explicitly: undici's pool lives on a shared
+     * // globalThis symbol claimed by whichever copy loaded first, so an implied
+     * // dispatcher can still be the runtime's affected one.
+     * const dispatcher = new Agent();
+     * createClient({
+     *   baseURL,
+     *   options: {
+     *     fetch: (url, init) =>
+     *       undiciFetch(url, { ...init, dispatcher } as never) as unknown as Promise<Response>,
+     *   },
+     * });
+     * ```
+     *
+     * `.stream()` and `.liveQuery()` go through it too, which imposes the extra
+     * streaming requirement described on {@link FetchLike} — read that before
+     * supplying a wrapper that touches the response body.
+     */
+    fetch?: FetchLike;
+    /**
+     * Headers added to every request, REST and streaming alike — for a
+     * header-gated proxy in front of WaveHouse, such as a Cloudflare Access
+     * service token.
+     *
+     * Matched case-insensitively, as HTTP headers are. Applied underneath the
+     * SDK's own headers: `auth` still owns `Authorization`, and the
+     * `Content-Type` and `Accept` a given request needs are not overridable
+     * here — a global `Content-Type` that outranked the request's own is a
+     * documented way to break uploads.
+     *
+     * In a browser these are subject to CORS: a header outside the safelist adds
+     * it to the preflight, which the origin must allow. WaveHouse's own CORS
+     * advertises a fixed set, so custom headers reach it cross-origin only when
+     * a proxy in front terminates the preflight — which is the deployment they
+     * exist for. Server-side callers never preflight.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Extra `RequestInit` fields merged into every request — `credentials` for a
+     * cookie-authenticated origin, `mode`, `cache`, `keepalive`, or a
+     * runtime-specific extension such as Next.js's `next: { tags }`.
+     *
+     * Fields the SDK controls (`method`, `headers`, `body`, `signal`) always
+     * win, so this cannot corrupt the request itself. Non-standard fields may
+     * need a cast, since `RequestInit` only declares the standard ones.
+     *
+     * The streaming transport additionally owns `cache` and `redirect`, where the
+     * values are load-bearing rather than preference: a `Cache-Control` header
+     * would fail cross-origin preflight, and following a redirect would strip the
+     * `Authorization` header on a cross-origin hop and silently downgrade the
+     * stream to the default role instead of failing. So a request carrying an
+     * `auth` token, or configured `headers` that may hold a proxy secret, refuses
+     * redirects (`SSE_REDIRECT`); without either it follows them, so CDN
+     * canonicalization and an http→https upgrade still work. Note the test is
+     * that concrete pair, not "is this authenticated" — **cookies are invisible
+     * to it**. A cookie is re-derived from the cookie store at each hop rather
+     * than carried, so under the default `same-origin` credentials mode a
+     * redirect keeps the stream authenticated only while the hop stays inside
+     * both the request's origin and the cookie's `Path`; a hop outside either
+     * arrives with no cookie and gets a `default_role` view rather than an error.
+     * With `credentials: "include"` the origin half is replaced rather than
+     * lifted: ordinary cookie scoping decides, so the cookie crosses a
+     * CORS-allowed cross-origin hop only if its own `Domain` covers the target —
+     * a host-only cookie, the default, still stops at its host. Spelled out
+     * under "Supplying your own `fetch`" in the SDK guide; see #478.
+     * `credentials` itself is honored in browsers and dropped elsewhere, since
+     * some runtimes throw if it is set.
+     */
+    fetchOptions?: RequestInit;
 }
 interface StructuredQuery {
     /**
@@ -172,8 +311,22 @@ interface RolePermissions {
     check?: Record<string, PolicyFilter>;
     allowed_aggregations?: string[];
     denied_aggregations?: string[];
+    /** Caps the query result LIMIT. 0 = no limit. */
     max_rows?: number;
-    max_execution_time_ms?: number;
+    /**
+     * Max query execution time, enforced server-side by ClickHouse. Set it as a
+     * duration string ("5s", "500ms") or a number of milliseconds; reads always
+     * return the number of milliseconds.
+     */
+    max_execution_time?: number | string;
+    /** Max rows scanned from storage, enforced server-side by ClickHouse. 0 = no limit. */
+    max_rows_to_read?: number;
+    /**
+     * Max peak query memory, enforced server-side by ClickHouse. Set it as a size
+     * string ("4GiB", "512MiB") or a number of bytes; reads always return the
+     * number of bytes.
+     */
+    max_memory_usage?: number | string;
 }
 interface PolicyFilter {
     _eq?: string;
@@ -185,10 +338,32 @@ interface PolicyFilter {
 interface ValidationResult {
     valid: boolean;
 }
-interface FetchOptions {
+/**
+ * Options for a single call, passed to `.fetch()`.
+ *
+ * Note that `await`ing a builder directly (`await wh.from("t").select("*")`)
+ * takes no options — use the explicit `.fetch({ … })` form for those.
+ */
+interface RequestOptions {
     signal?: AbortSignal;
     limit?: number;
 }
+/**
+ * Options for a single `PipeRef.fetch()` call.
+ *
+ * `limit` is declared `never` rather than simply left out. Omitting it would
+ * still admit a `RequestOptions` value that carries one — excess-property
+ * checking only rejects fresh object literals, so a variable would pass and the
+ * limit would be silently dropped, which is the whole defect this prevents.
+ *
+ * A pipe's row cap belongs in its SQL as a `{{limit}}` parameter, supplied via
+ * `wh.pipe(name, { limit })`.
+ */
+interface PipeRequestOptions {
+    signal?: AbortSignal;
+    /** Not supported on pipes — pass `limit` as a pipe parameter instead. */
+    limit?: never;
+}
 interface StreamOptions {
     since?: string;
     signal?: AbortSignal;
@@ -199,6 +374,9 @@ interface HttpContext {
     auth?: () => Promise<string> | string;
     options: {
         maxRetries: number;
+        fetch?: FetchLike;
+        headers?: Record<string, string>;
+        fetchOptions?: RequestInit;
     };
 }
 
@@ -275,8 +453,15 @@ declare class PipeRef<Row = Record<string, unknown>> implements PromiseLike<Resu
     private readonly _params?;
     private readonly _createStream;
     constructor(ctx: HttpContext, name: string, params: Record<string, unknown> | undefined, createStream: CreateStreamFn$2<Row>);
-    /** Execute the pipe and return results. */
-    fetch(opts?: FetchOptions): Promise<Result<Row[]>>;
+    /**
+     * Execute the pipe and return results.
+     *
+     * Takes only `signal` — deliberately narrower than the `RequestOptions` the
+     * query builder accepts. The pipes endpoint binds the body as the pipe's
+     * parameters, so there is no row cap to forward; give the pipe a `{{limit}}`
+     * parameter in its SQL and pass it via `wh.pipe(name, { limit })`.
+     */
+    fetch(opts?: PipeRequestOptions): Promise<Result<Row[]>>;
     /** Subscribe to live events from the pipe's underlying query. */
     stream(opts?: StreamOptions): StreamController<Row>;
     then<TResult1 = Result<Row[]>, TResult2 = never>(onfulfilled?: ((value: Result<Row[]>) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): Promise<TResult1 | TResult2>;
@@ -423,7 +608,7 @@ declare class QueryBuilder<Row = Record<string, unknown>> implements PromiseLike
     cacheTTL(seconds: number): QueryBuilder<Row>;
     /** Default row limit when none is specified — deliberately tighter than the backend's DefaultMaxRows (10000) safety cap. */
     static readonly DEFAULT_LIMIT = 1000;
-    fetch(opts?: FetchOptions): Promise<Result<Row[]>>;
+    fetch(opts?: RequestOptions): Promise<Result<Row[]>>;
     stream(opts?: StreamOptions): StreamController<Row>;
     /**
      * Start a live query: fetches historical data, then streams live updates.
@@ -459,7 +644,7 @@ declare class TableRef<Row = Record<string, unknown>> {
     private readonly _createStream;
     constructor(ctx: HttpContext, table: string, createStream: CreateStreamFn<Row>);
     /** SELECT * shortcut — fetches rows with optional pagination. */
-    fetch(opts?: FetchOptions): Promise<Result<Row[]>>;
+    fetch(opts?: RequestOptions): Promise<Result<Row[]>>;
     /** Start building a typed query. Returns an immutable, PromiseLike QueryBuilder. */
     select(...columns: string[]): QueryBuilder<Row>;
     /**
@@ -549,4 +734,4 @@ declare class WaveHouseClient<DB extends Database = Database> {
 /** Create a new WaveHouse client instance. */
 declare function createClient<DB extends Database = Database>(config: ClientConfig<DB>): WaveHouseClient<DB>;
 
-export { type Aggregation, type ClientConfig, type ClientOptions, type Column, DLQNamespace, type DLQStats, type Database, type FetchOptions, type FilterOp, type InsertRecordResult, type InsertResult, LiveQuery, type NDJSONSource, type OrderClause, type ParamDef, type Pipe, PipeRef, PipesNamespace, type Policy, type PolicyFilter, PolicyNamespace, QueryBuilder, type QueryFilter, type Result, type RolePermissions, SchemaNamespace, type Schemas, StreamController, type StreamEvent, type StreamOptions, type StreamStatus, type StreamSubscriber, type StructuredQuery, SysNamespace, type TablePolicy, TableRef, type TableSchema, type TimeRange, type ValidationResult, WaveHouseClient, type WaveHouseError, createClient };
+export { type Aggregation, type ClientConfig, type ClientOptions, type Column, DLQNamespace, type DLQStats, type Database, type FetchLike, type FilterOp, type InsertRecordResult, type InsertResult, LiveQuery, type NDJSONSource, type OrderClause, type ParamDef, type Pipe, PipeRef, type PipeRequestOptions, PipesNamespace, type Policy, type PolicyFilter, PolicyNamespace, QueryBuilder, type QueryFilter, type RequestOptions, type Result, type RolePermissions, SchemaNamespace, type Schemas, StreamController, type StreamEvent, type StreamOptions, type StreamStatus, type StreamSubscriber, type StructuredQuery, SysNamespace, type TablePolicy, TableRef, type TableSchema, type TimeRange, type ValidationResult, WaveHouseClient, type WaveHouseError, createClient };

package/dist/index.d.ts

@@ -1,7 +1,15 @@
 /** User-provided database schema mapping table names to row types. */
 type Database = Record<string, Record<string, unknown>>;
 /**
- * Discriminated union for all async SDK operations. Never throws.
+ * Discriminated union for the async SDK calls that return one. Never throws for
+ * anything the server returns; a non-absolute `baseURL` and a rejecting `auth`
+ * callback do throw, while a runtime with no `fetch` at all surfaces instead as
+ * a retried `NETWORK_ERROR` result.
+ *
+ * `.stream()` and `.liveQuery()` return no `Result` and report the same three
+ * differently: a non-absolute `baseURL` reaches the subscriber's `error`
+ * callback as a terminal `SSE_CONNECT_ERROR`, a rejecting `auth` as a retryable
+ * `SSE_AUTH_ERROR`, and only a missing `fetch` throws from the call itself.
  *
  * Discriminated on `ok`: `if (result.ok)` narrows to the success arm (and tells
  * the compiler `data` is present), while `error` is always available for
@@ -47,16 +55,147 @@ interface StreamSubscriber<T = Record<string, unknown>> {
     error?: (err: WaveHouseError) => void;
 }
 interface ClientConfig<_DB extends Database = Database> {
-    /** Base URL of the WaveHouse server (e.g. "http://localhost:8080"). */
+    /**
+     * Base URL of the WaveHouse server (e.g. "http://localhost:8080"). May include
+     * a path prefix ("https://app.example.com/api/warehouse") for a WaveHouse
+     * behind a backend-for-frontend (BFF), app-server route, or path-routed
+     * ingress; request paths are appended to it. The proxy in front must strip
+     * the prefix before forwarding.
+     *
+     * Must be **absolute** — scheme and host included. The transports report a
+     * relative value such as "/api/warehouse" differently: a REST call rejects
+     * with a `TypeError` instead of returning a `Result`, while a stream reports
+     * `SSE_CONNECT_ERROR` to the subscriber's `error` callback. Build an absolute
+     * one: `` `${location.origin}/api/warehouse` ``.
+     */
     baseURL: string;
     /** Auth token provider. Omit for public/unauthenticated access. */
     auth?: () => Promise<string> | string;
     /** Additional client options. */
     options?: ClientOptions;
 }
+/**
+ * A `fetch`-compatible function.
+ *
+ * Spelled out rather than written `typeof fetch`, which resolves differently
+ * depending on whether the consumer's TypeScript `lib` includes DOM — the same
+ * signature either way, but stable across configurations.
+ *
+ * The parameter is `string` rather than `typeof fetch`'s wider union because a
+ * string URL is all the SDK ever passes. Since parameters are contravariant,
+ * narrowing it *widens* what can be assigned: the global `fetch` still fits, and
+ * so does hand-written `(url: string, init?: RequestInit) => Promise<Response>`
+ * middleware, which the wider spelling rejects at compile time.
+ *
+ * On REST the SDK reads `.ok` and `.headers` always, `.text()` on success, and
+ * `.status`, `.statusText` plus `.json()` when the response is not `ok`. A
+ * rejection becomes a `NETWORK_ERROR` result and is retried with backoff —
+ * unless the `AbortSignal` you passed has been aborted, in which case the
+ * result is `ABORTED` and nothing is retried. That is decided from the signal
+ * rather than the rejection's type, so an implementation that throws something
+ * other than a `DOMException` named `AbortError` — `AbortSignal.timeout()`,
+ * `node-fetch` — is reported the same way.
+ *
+ * **Streaming needs more.** `.stream()` and `.liveQuery()` read the response as
+ * it arrives, via `.body.getReader()`, so an implementation used with them must
+ * return a response carrying a live `ReadableStream` — something the type cannot
+ * enforce, since `Response.body` is legitimately nullable. A response handed
+ * back with an absent or already-consumed body fails fast with
+ * `SSE_NO_STREAM_BODY`. What the SDK *cannot* rescue is an implementation that
+ * awaits the body before returning — `await res.text()`, or the
+ * `res.clone().text()` a logging wrapper reaches for — because on a stream that
+ * never ends, that never resolves and your function never returns. Both satisfy
+ * every REST call, which is what makes the trap easy to walk into.
+ *
+ * Implementations shipping their own request/response declarations (undici,
+ * `node-fetch`) need casts on the init and the return value, since those types
+ * are separate from the ones behind your global `fetch`; the narrow runtime
+ * contract above is what makes them safe.
+ */
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 interface ClientOptions {
     /** Maximum retry attempts for failed requests. Default: 2. */
     maxRetries?: number;
+    /**
+     * HTTP implementation used for every request, REST and streaming alike.
+     * Defaults to the global `fetch`.
+     *
+     * Provide one to route through a proxy, attach client certificates, add
+     * middleware (logging, tracing, circuit breaking), or bypass a transport bug
+     * in the runtime's bundled HTTP stack by routing through an implementation
+     * you install yourself — e.g. an undici new enough to be free of
+     * {@link https://github.com/nodejs/undici/issues/5600 | undici #5600}:
+     *
+     * ```ts
+     * import { Agent, fetch as undiciFetch } from "undici"; // npm install undici — 8.10.0+
+     * // Pass the dispatcher explicitly: undici's pool lives on a shared
+     * // globalThis symbol claimed by whichever copy loaded first, so an implied
+     * // dispatcher can still be the runtime's affected one.
+     * const dispatcher = new Agent();
+     * createClient({
+     *   baseURL,
+     *   options: {
+     *     fetch: (url, init) =>
+     *       undiciFetch(url, { ...init, dispatcher } as never) as unknown as Promise<Response>,
+     *   },
+     * });
+     * ```
+     *
+     * `.stream()` and `.liveQuery()` go through it too, which imposes the extra
+     * streaming requirement described on {@link FetchLike} — read that before
+     * supplying a wrapper that touches the response body.
+     */
+    fetch?: FetchLike;
+    /**
+     * Headers added to every request, REST and streaming alike — for a
+     * header-gated proxy in front of WaveHouse, such as a Cloudflare Access
+     * service token.
+     *
+     * Matched case-insensitively, as HTTP headers are. Applied underneath the
+     * SDK's own headers: `auth` still owns `Authorization`, and the
+     * `Content-Type` and `Accept` a given request needs are not overridable
+     * here — a global `Content-Type` that outranked the request's own is a
+     * documented way to break uploads.
+     *
+     * In a browser these are subject to CORS: a header outside the safelist adds
+     * it to the preflight, which the origin must allow. WaveHouse's own CORS
+     * advertises a fixed set, so custom headers reach it cross-origin only when
+     * a proxy in front terminates the preflight — which is the deployment they
+     * exist for. Server-side callers never preflight.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Extra `RequestInit` fields merged into every request — `credentials` for a
+     * cookie-authenticated origin, `mode`, `cache`, `keepalive`, or a
+     * runtime-specific extension such as Next.js's `next: { tags }`.
+     *
+     * Fields the SDK controls (`method`, `headers`, `body`, `signal`) always
+     * win, so this cannot corrupt the request itself. Non-standard fields may
+     * need a cast, since `RequestInit` only declares the standard ones.
+     *
+     * The streaming transport additionally owns `cache` and `redirect`, where the
+     * values are load-bearing rather than preference: a `Cache-Control` header
+     * would fail cross-origin preflight, and following a redirect would strip the
+     * `Authorization` header on a cross-origin hop and silently downgrade the
+     * stream to the default role instead of failing. So a request carrying an
+     * `auth` token, or configured `headers` that may hold a proxy secret, refuses
+     * redirects (`SSE_REDIRECT`); without either it follows them, so CDN
+     * canonicalization and an http→https upgrade still work. Note the test is
+     * that concrete pair, not "is this authenticated" — **cookies are invisible
+     * to it**. A cookie is re-derived from the cookie store at each hop rather
+     * than carried, so under the default `same-origin` credentials mode a
+     * redirect keeps the stream authenticated only while the hop stays inside
+     * both the request's origin and the cookie's `Path`; a hop outside either
+     * arrives with no cookie and gets a `default_role` view rather than an error.
+     * With `credentials: "include"` the origin half is replaced rather than
+     * lifted: ordinary cookie scoping decides, so the cookie crosses a
+     * CORS-allowed cross-origin hop only if its own `Domain` covers the target —
+     * a host-only cookie, the default, still stops at its host. Spelled out
+     * under "Supplying your own `fetch`" in the SDK guide; see #478.
+     * `credentials` itself is honored in browsers and dropped elsewhere, since
+     * some runtimes throw if it is set.
+     */
+    fetchOptions?: RequestInit;
 }
 interface StructuredQuery {
     /**
@@ -172,8 +311,22 @@ interface RolePermissions {
     check?: Record<string, PolicyFilter>;
     allowed_aggregations?: string[];
     denied_aggregations?: string[];
+    /** Caps the query result LIMIT. 0 = no limit. */
     max_rows?: number;
-    max_execution_time_ms?: number;
+    /**
+     * Max query execution time, enforced server-side by ClickHouse. Set it as a
+     * duration string ("5s", "500ms") or a number of milliseconds; reads always
+     * return the number of milliseconds.
+     */
+    max_execution_time?: number | string;
+    /** Max rows scanned from storage, enforced server-side by ClickHouse. 0 = no limit. */
+    max_rows_to_read?: number;
+    /**
+     * Max peak query memory, enforced server-side by ClickHouse. Set it as a size
+     * string ("4GiB", "512MiB") or a number of bytes; reads always return the
+     * number of bytes.
+     */
+    max_memory_usage?: number | string;
 }
 interface PolicyFilter {
     _eq?: string;
@@ -185,10 +338,32 @@ interface PolicyFilter {
 interface ValidationResult {
     valid: boolean;
 }
-interface FetchOptions {
+/**
+ * Options for a single call, passed to `.fetch()`.
+ *
+ * Note that `await`ing a builder directly (`await wh.from("t").select("*")`)
+ * takes no options — use the explicit `.fetch({ … })` form for those.
+ */
+interface RequestOptions {
     signal?: AbortSignal;
     limit?: number;
 }
+/**
+ * Options for a single `PipeRef.fetch()` call.
+ *
+ * `limit` is declared `never` rather than simply left out. Omitting it would
+ * still admit a `RequestOptions` value that carries one — excess-property
+ * checking only rejects fresh object literals, so a variable would pass and the
+ * limit would be silently dropped, which is the whole defect this prevents.
+ *
+ * A pipe's row cap belongs in its SQL as a `{{limit}}` parameter, supplied via
+ * `wh.pipe(name, { limit })`.
+ */
+interface PipeRequestOptions {
+    signal?: AbortSignal;
+    /** Not supported on pipes — pass `limit` as a pipe parameter instead. */
+    limit?: never;
+}
 interface StreamOptions {
     since?: string;
     signal?: AbortSignal;
@@ -199,6 +374,9 @@ interface HttpContext {
     auth?: () => Promise<string> | string;
     options: {
         maxRetries: number;
+        fetch?: FetchLike;
+        headers?: Record<string, string>;
+        fetchOptions?: RequestInit;
     };
 }
 
@@ -275,8 +453,15 @@ declare class PipeRef<Row = Record<string, unknown>> implements PromiseLike<Resu
     private readonly _params?;
     private readonly _createStream;
     constructor(ctx: HttpContext, name: string, params: Record<string, unknown> | undefined, createStream: CreateStreamFn$2<Row>);
-    /** Execute the pipe and return results. */
-    fetch(opts?: FetchOptions): Promise<Result<Row[]>>;
+    /**
+     * Execute the pipe and return results.
+     *
+     * Takes only `signal` — deliberately narrower than the `RequestOptions` the
+     * query builder accepts. The pipes endpoint binds the body as the pipe's
+     * parameters, so there is no row cap to forward; give the pipe a `{{limit}}`
+     * parameter in its SQL and pass it via `wh.pipe(name, { limit })`.
+     */
+    fetch(opts?: PipeRequestOptions): Promise<Result<Row[]>>;
     /** Subscribe to live events from the pipe's underlying query. */
     stream(opts?: StreamOptions): StreamController<Row>;
     then<TResult1 = Result<Row[]>, TResult2 = never>(onfulfilled?: ((value: Result<Row[]>) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): Promise<TResult1 | TResult2>;
@@ -423,7 +608,7 @@ declare class QueryBuilder<Row = Record<string, unknown>> implements PromiseLike
     cacheTTL(seconds: number): QueryBuilder<Row>;
     /** Default row limit when none is specified — deliberately tighter than the backend's DefaultMaxRows (10000) safety cap. */
     static readonly DEFAULT_LIMIT = 1000;
-    fetch(opts?: FetchOptions): Promise<Result<Row[]>>;
+    fetch(opts?: RequestOptions): Promise<Result<Row[]>>;
     stream(opts?: StreamOptions): StreamController<Row>;
     /**
      * Start a live query: fetches historical data, then streams live updates.
@@ -459,7 +644,7 @@ declare class TableRef<Row = Record<string, unknown>> {
     private readonly _createStream;
     constructor(ctx: HttpContext, table: string, createStream: CreateStreamFn<Row>);
     /** SELECT * shortcut — fetches rows with optional pagination. */
-    fetch(opts?: FetchOptions): Promise<Result<Row[]>>;
+    fetch(opts?: RequestOptions): Promise<Result<Row[]>>;
     /** Start building a typed query. Returns an immutable, PromiseLike QueryBuilder. */
     select(...columns: string[]): QueryBuilder<Row>;
     /**
@@ -549,4 +734,4 @@ declare class WaveHouseClient<DB extends Database = Database> {
 /** Create a new WaveHouse client instance. */
 declare function createClient<DB extends Database = Database>(config: ClientConfig<DB>): WaveHouseClient<DB>;
 
-export { type Aggregation, type ClientConfig, type ClientOptions, type Column, DLQNamespace, type DLQStats, type Database, type FetchOptions, type FilterOp, type InsertRecordResult, type InsertResult, LiveQuery, type NDJSONSource, type OrderClause, type ParamDef, type Pipe, PipeRef, PipesNamespace, type Policy, type PolicyFilter, PolicyNamespace, QueryBuilder, type QueryFilter, type Result, type RolePermissions, SchemaNamespace, type Schemas, StreamController, type StreamEvent, type StreamOptions, type StreamStatus, type StreamSubscriber, type StructuredQuery, SysNamespace, type TablePolicy, TableRef, type TableSchema, type TimeRange, type ValidationResult, WaveHouseClient, type WaveHouseError, createClient };
+export { type Aggregation, type ClientConfig, type ClientOptions, type Column, DLQNamespace, type DLQStats, type Database, type FetchLike, type FilterOp, type InsertRecordResult, type InsertResult, LiveQuery, type NDJSONSource, type OrderClause, type ParamDef, type Pipe, PipeRef, type PipeRequestOptions, PipesNamespace, type Policy, type PolicyFilter, PolicyNamespace, QueryBuilder, type QueryFilter, type RequestOptions, type Result, type RolePermissions, SchemaNamespace, type Schemas, StreamController, type StreamEvent, type StreamOptions, type StreamStatus, type StreamSubscriber, type StructuredQuery, SysNamespace, type TablePolicy, TableRef, type TableSchema, type TimeRange, type ValidationResult, WaveHouseClient, type WaveHouseError, createClient };