@xylex-group/athena 1.9.0 → 2.0.0

package/dist/cli/index.cjs

@@ -292,6 +292,76 @@ function resolvePostgresColumnType(column) {
   return wrapArrayType(baseType, column.arrayDimensions);
 }
 
+// src/gateway/errors.ts
+var AthenaGatewayError = class _AthenaGatewayError extends Error {
+  code;
+  status;
+  endpoint;
+  method;
+  requestId;
+  hint;
+  causeDetail;
+  constructor(input) {
+    super(input.message);
+    this.name = "AthenaGatewayError";
+    this.code = input.code;
+    this.status = input.status ?? 0;
+    this.endpoint = input.endpoint;
+    this.method = input.method;
+    this.requestId = input.requestId;
+    this.hint = input.hint;
+    this.causeDetail = input.cause;
+  }
+  toDetails() {
+    return {
+      code: this.code,
+      message: this.message,
+      status: this.status,
+      endpoint: this.endpoint,
+      method: this.method,
+      requestId: this.requestId,
+      hint: this.hint,
+      cause: this.causeDetail
+    };
+  }
+  static fromResponse(response, fallback) {
+    const details = response.errorDetails;
+    if (details) {
+      return new _AthenaGatewayError({
+        code: details.code,
+        message: details.message,
+        status: details.status,
+        endpoint: details.endpoint ?? fallback.endpoint,
+        method: details.method ?? fallback.method,
+        requestId: details.requestId ?? fallback.requestId,
+        hint: details.hint,
+        cause: details.cause
+      });
+    }
+    return new _AthenaGatewayError({
+      code: "HTTP_ERROR",
+      message: response.error ?? "Gateway request failed",
+      status: response.status,
+      endpoint: fallback.endpoint,
+      method: fallback.method,
+      requestId: fallback.requestId
+    });
+  }
+};
+
+// src/auxiliaries.ts
+function parseBooleanFlag(rawValue, fallback) {
+  if (!rawValue) return fallback;
+  const normalized = rawValue.trim().toLowerCase();
+  if (normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on") {
+    return true;
+  }
+  if (normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off") {
+    return false;
+  }
+  return fallback;
+}
+
 // src/generator/schema-selection.ts
 var DEFAULT_POSTGRES_SCHEMAS = ["public"];
 function collectSchemaNames(input) {
@@ -351,6 +421,39 @@ var DEFAULT_EXPERIMENTAL_FLAGS = {
   postgresGatewayIntrospection: false,
   scyllaProviderContracts: true
 };
+function normalizeBooleanFlag(rawValue, fallback) {
+  if (typeof rawValue === "boolean") {
+    return rawValue;
+  }
+  if (typeof rawValue === "string") {
+    return parseBooleanFlag(rawValue, fallback);
+  }
+  return fallback;
+}
+function normalizeFeatureFlags(input) {
+  return {
+    emitRelations: normalizeBooleanFlag(
+      input?.emitRelations,
+      DEFAULT_FEATURES.emitRelations
+    ),
+    emitRegistry: normalizeBooleanFlag(
+      input?.emitRegistry,
+      DEFAULT_FEATURES.emitRegistry
+    )
+  };
+}
+function normalizeExperimentalFlags(input) {
+  return {
+    postgresGatewayIntrospection: normalizeBooleanFlag(
+      input?.postgresGatewayIntrospection,
+      DEFAULT_EXPERIMENTAL_FLAGS.postgresGatewayIntrospection
+    ),
+    scyllaProviderContracts: normalizeBooleanFlag(
+      input?.scyllaProviderContracts,
+      DEFAULT_EXPERIMENTAL_FLAGS.scyllaProviderContracts
+    )
+  };
+}
 function normalizeOutputConfig(output) {
   return {
     targets: {
@@ -386,14 +489,8 @@ function normalizeGeneratorConfig(input) {
       ...DEFAULT_NAMING,
       ...input.naming ?? {}
     },
-    features: {
-      ...DEFAULT_FEATURES,
-      ...input.features ?? {}
-    },
-    experimental: {
-      ...DEFAULT_EXPERIMENTAL_FLAGS,
-      ...input.experimental ?? {}
-    }
+    features: normalizeFeatureFlags(input.features),
+    experimental: normalizeExperimentalFlags(input.experimental)
   };
 }
 function findGeneratorConfigPath(cwd = process.cwd()) {
@@ -722,63 +819,6 @@ function generateArtifactsFromSnapshot(snapshot, config) {
   return new ArtifactComposer(snapshot, normalizedConfig).compose();
 }
 
-// src/gateway/errors.ts
-var AthenaGatewayError = class _AthenaGatewayError extends Error {
-  code;
-  status;
-  endpoint;
-  method;
-  requestId;
-  hint;
-  causeDetail;
-  constructor(input) {
-    super(input.message);
-    this.name = "AthenaGatewayError";
-    this.code = input.code;
-    this.status = input.status ?? 0;
-    this.endpoint = input.endpoint;
-    this.method = input.method;
-    this.requestId = input.requestId;
-    this.hint = input.hint;
-    this.causeDetail = input.cause;
-  }
-  toDetails() {
-    return {
-      code: this.code,
-      message: this.message,
-      status: this.status,
-      endpoint: this.endpoint,
-      method: this.method,
-      requestId: this.requestId,
-      hint: this.hint,
-      cause: this.causeDetail
-    };
-  }
-  static fromResponse(response, fallback) {
-    const details = response.errorDetails;
-    if (details) {
-      return new _AthenaGatewayError({
-        code: details.code,
-        message: details.message,
-        status: details.status,
-        endpoint: details.endpoint ?? fallback.endpoint,
-        method: details.method ?? fallback.method,
-        requestId: details.requestId ?? fallback.requestId,
-        hint: details.hint,
-        cause: details.cause
-      });
-    }
-    return new _AthenaGatewayError({
-      code: "HTTP_ERROR",
-      message: response.error ?? "Gateway request failed",
-      status: response.status,
-      endpoint: fallback.endpoint,
-      method: fallback.method,
-      requestId: fallback.requestId
-    });
-  }
-};
-
 // src/gateway/client.ts
 var DEFAULT_BASE_URL = "https://athena-db.com";
 var DEFAULT_CLIENT = "railway_direct";
@@ -1200,6 +1240,1044 @@ function quoteSelectColumnsExpression(columns) {
   return tokens.map(quoteSelectToken).join(", ");
 }
 
+// src/auth/client.ts
+var DEFAULT_AUTH_BASE_URL = "http://localhost:3001/api/auth";
+var FALLBACK_SDK_VERSION2 = "1.0.0";
+var SDK_NAME2 = "xylex-group/athena-auth";
+var SDK_VERSION2 = typeof process !== "undefined" && process?.env?.npm_package_version ? process.env.npm_package_version : FALLBACK_SDK_VERSION2;
+var SDK_HEADER_VALUE2 = `${SDK_NAME2} ${SDK_VERSION2}`;
+function normalizeBaseUrl(baseUrl) {
+  return (baseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/$/, "");
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeHeaderValue2(value) {
+  return value ? value : void 0;
+}
+function parseResponseBody2(rawText, contentType) {
+  if (!rawText) {
+    return { parsed: null, parseFailed: false };
+  }
+  const contentTypeSuggestsJson = contentType?.toLowerCase().includes("application/json") ?? false;
+  const looksJson = contentTypeSuggestsJson || rawText.startsWith("{") || rawText.startsWith("[");
+  if (!looksJson) {
+    return { parsed: rawText, parseFailed: false };
+  }
+  try {
+    return { parsed: JSON.parse(rawText), parseFailed: false };
+  } catch {
+    return { parsed: rawText, parseFailed: true };
+  }
+}
+function resolveRequestId2(headers) {
+  return headers.get("x-request-id") ?? headers.get("x-correlation-id") ?? headers.get("x-athena-request-id") ?? void 0;
+}
+function resolveErrorMessage2(payload, fallback) {
+  if (isRecord2(payload)) {
+    const messageCandidates = [payload.error, payload.message, payload.details];
+    for (const candidate of messageCandidates) {
+      if (typeof candidate === "string" && candidate.trim().length > 0) {
+        return candidate.trim();
+      }
+    }
+  }
+  if (typeof payload === "string" && payload.trim().length > 0) {
+    return payload.trim();
+  }
+  return fallback;
+}
+function toErrorDetails(input) {
+  return {
+    code: input.code,
+    message: input.message,
+    status: input.status,
+    endpoint: input.endpoint,
+    method: input.method,
+    requestId: input.requestId,
+    hint: input.hint,
+    cause: input.cause
+  };
+}
+function mergeCallOptions(base, override) {
+  if (!base && !override) return void 0;
+  return {
+    ...base,
+    ...override,
+    headers: {
+      ...base?.headers ?? {},
+      ...override?.headers ?? {}
+    }
+  };
+}
+function extractFetchOptions(input) {
+  if (!input) {
+    return {
+      payload: void 0,
+      fetchOptions: void 0
+    };
+  }
+  const { fetchOptions, ...rest } = input;
+  const hasPayloadKeys = Object.keys(rest).length > 0;
+  return {
+    payload: hasPayloadKeys ? rest : void 0,
+    fetchOptions
+  };
+}
+function buildHeaders2(config, options) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Athena-Sdk": SDK_HEADER_VALUE2
+  };
+  const apiKey = options?.apiKey ?? config.apiKey;
+  if (apiKey) {
+    headers.apikey = apiKey;
+    headers["x-api-key"] = apiKey;
+  }
+  const bearerToken = options?.bearerToken ?? config.bearerToken;
+  if (bearerToken) {
+    headers.Authorization = `Bearer ${bearerToken}`;
+  }
+  const mergedExtraHeaders = {
+    ...config.headers ?? {},
+    ...options?.headers ?? {}
+  };
+  Object.entries(mergedExtraHeaders).forEach(([key, value]) => {
+    const normalized = normalizeHeaderValue2(value);
+    if (normalized) {
+      headers[key] = normalized;
+    }
+  });
+  return headers;
+}
+function appendQueryParam(searchParams, key, value) {
+  if (value === void 0 || value === null) return;
+  if (Array.isArray(value)) {
+    value.forEach((item) => {
+      searchParams.append(key, String(item));
+    });
+    return;
+  }
+  searchParams.append(key, String(value));
+}
+function buildRequestUrl(baseUrl, endpoint, query) {
+  const url = `${baseUrl}${endpoint}`;
+  if (!query || Object.keys(query).length === 0) return url;
+  const searchParams = new URLSearchParams();
+  Object.entries(query).forEach(([key, value]) => appendQueryParam(searchParams, key, value));
+  const queryText = searchParams.toString();
+  return queryText ? `${url}?${queryText}` : url;
+}
+function inferDefaultMethod(endpoint) {
+  if (endpoint.startsWith("/reset-password/")) {
+    return "GET";
+  }
+  switch (endpoint) {
+    case "/get-session":
+    case "/list-sessions":
+    case "/verify-email":
+    case "/change-email/verify":
+    case "/delete-user/verify":
+    case "/email-list":
+    case "/email/list":
+    case "/delete-user/callback":
+    case "/list-accounts":
+    case "/passkey/generate-register-options":
+    case "/passkey/list-user-passkeys":
+    case "/.well-known/webauthn":
+    case "/admin/list-users":
+    case "/admin/athena-client/list":
+    case "/admin/audit-log/list":
+    case "/admin/email/get":
+    case "/admin/email-failure/list":
+    case "/admin/email-failure/get":
+    case "/admin/email-template/get":
+    case "/admin/email-template/list":
+    case "/admin/email/list":
+    case "/api-key/get":
+    case "/api-key/list":
+    case "/organization/get-full-organization":
+    case "/organization/list":
+    case "/organization/get-invitation":
+    case "/organization/list-invitations":
+    case "/organization/list-user-invitations":
+    case "/organization/list-members":
+    case "/organization/get-active-member":
+    case "/health":
+    case "/ok":
+    case "/error":
+      return "GET";
+    default:
+      return "POST";
+  }
+}
+async function callAuthEndpoint(config, context, body, query, options) {
+  const baseUrl = normalizeBaseUrl(options?.baseUrl ?? config.baseUrl);
+  const url = buildRequestUrl(baseUrl, context.endpoint, query);
+  const headers = buildHeaders2(config, options);
+  const credentials = options?.credentials ?? config.credentials ?? "include";
+  const requestInit = {
+    method: context.method,
+    headers,
+    credentials,
+    signal: options?.signal
+  };
+  if (context.method !== "GET") {
+    requestInit.body = JSON.stringify(body ?? {});
+  }
+  const fetcher = config.fetch ?? globalThis.fetch;
+  if (!fetcher) {
+    const details = toErrorDetails({
+      code: "UNKNOWN_ERROR",
+      message: "No fetch implementation available for auth client",
+      status: 0,
+      endpoint: context.endpoint,
+      method: context.method,
+      hint: "Use Node 18+ or provide `fetch` via createClient(..., { auth: { fetch } }) or createAuthClient({ fetch })"
+    });
+    return {
+      ok: false,
+      status: 0,
+      data: null,
+      error: details.message,
+      errorDetails: details,
+      raw: null
+    };
+  }
+  try {
+    const response = await fetcher(url, requestInit);
+    const rawText = await response.text();
+    const requestId = resolveRequestId2(response.headers);
+    const parsedBody = parseResponseBody2(rawText ?? "", response.headers.get("content-type"));
+    if (parsedBody.parseFailed) {
+      const details = toErrorDetails({
+        code: "INVALID_JSON",
+        message: "Auth server returned malformed JSON",
+        status: response.status,
+        endpoint: context.endpoint,
+        method: context.method,
+        requestId,
+        hint: "Verify the auth endpoint response body is valid JSON.",
+        cause: rawText.slice(0, 300)
+      });
+      return {
+        ok: false,
+        status: response.status,
+        data: null,
+        error: details.message,
+        errorDetails: details,
+        raw: parsedBody.parsed
+      };
+    }
+    const parsed = parsedBody.parsed;
+    if (!response.ok) {
+      const details = toErrorDetails({
+        code: "HTTP_ERROR",
+        message: resolveErrorMessage2(
+          parsed,
+          `Auth endpoint ${context.method} ${context.endpoint} failed with status ${response.status}`
+        ),
+        status: response.status,
+        endpoint: context.endpoint,
+        method: context.method,
+        requestId
+      });
+      return {
+        ok: false,
+        status: response.status,
+        data: null,
+        error: details.message,
+        errorDetails: details,
+        raw: parsed
+      };
+    }
+    return {
+      ok: true,
+      status: response.status,
+      data: parsed ?? null,
+      error: null,
+      errorDetails: null,
+      raw: parsed
+    };
+  } catch (callError) {
+    const message = callError instanceof Error ? callError.message : String(callError);
+    const details = toErrorDetails({
+      code: "NETWORK_ERROR",
+      message: `Network error while calling ${context.method} ${context.endpoint}: ${message}`,
+      status: 0,
+      endpoint: context.endpoint,
+      method: context.method,
+      cause: message,
+      hint: "Check auth server URL, DNS, and network reachability."
+    });
+    return {
+      ok: false,
+      status: 0,
+      data: null,
+      error: details.message,
+      errorDetails: details,
+      raw: null
+    };
+  }
+}
+function executePostWithCompatibleInput(config, context, input, options) {
+  const { payload, fetchOptions } = extractFetchOptions(input);
+  const mergedOptions = mergeCallOptions(fetchOptions, options);
+  return callAuthEndpoint(config, context, payload ?? {}, void 0, mergedOptions);
+}
+function executePostWithOptionalInput(config, context, input, options) {
+  const { fetchOptions } = extractFetchOptions(input);
+  const mergedOptions = mergeCallOptions(fetchOptions, options);
+  return callAuthEndpoint(config, context, {}, void 0, mergedOptions);
+}
+function executeGetWithCompatibleInput(config, context, input, options) {
+  const { fetchOptions } = extractFetchOptions(input);
+  const mergedOptions = mergeCallOptions(fetchOptions, options);
+  return callAuthEndpoint(config, context, void 0, void 0, mergedOptions);
+}
+function executeGetWithQueryCompatibleInput(config, context, input, options) {
+  const { payload, fetchOptions } = extractFetchOptions(input);
+  const mergedOptions = mergeCallOptions(fetchOptions, options);
+  const query = payload?.query;
+  return callAuthEndpoint(
+    config,
+    context,
+    void 0,
+    query,
+    mergedOptions
+  );
+}
+function createAuthClient(config = {}) {
+  const normalizedBaseUrl = normalizeBaseUrl(config.baseUrl);
+  const resolvedConfig = {
+    ...config,
+    baseUrl: normalizedBaseUrl
+  };
+  const request = (input, options) => {
+    const method = input.method ?? (input.body !== void 0 ? "POST" : inferDefaultMethod(input.endpoint));
+    const mergedOptions = mergeCallOptions(input.fetchOptions, options);
+    return callAuthEndpoint(
+      resolvedConfig,
+      { endpoint: input.endpoint, method },
+      input.body,
+      input.query,
+      mergedOptions
+    );
+  };
+  const postGeneric = (endpoint, input, options) => {
+    const { payload, fetchOptions } = extractFetchOptions(input);
+    return request(
+      {
+        endpoint,
+        method: "POST",
+        body: payload ?? {},
+        fetchOptions
+      },
+      options
+    );
+  };
+  const getGeneric = (endpoint, input, options) => {
+    const { fetchOptions } = extractFetchOptions(input);
+    return request(
+      {
+        endpoint,
+        method: "GET",
+        fetchOptions
+      },
+      options
+    );
+  };
+  const getWithQuery = (endpoint, input, options) => {
+    const { payload, fetchOptions } = extractFetchOptions(input);
+    const query = payload?.query;
+    return request(
+      {
+        endpoint,
+        method: "GET",
+        query,
+        fetchOptions
+      },
+      options
+    );
+  };
+  const listUserEmailsWithFallback = async (input, options) => {
+    const primary = await getWithQuery(
+      "/email/list",
+      input,
+      options
+    );
+    if (primary.ok || primary.status !== 404 || primary.errorDetails?.code !== "HTTP_ERROR") {
+      return primary;
+    }
+    return getWithQuery(
+      "/email-list",
+      input,
+      options
+    );
+  };
+  const healthWithFallback = async (input, options) => {
+    const primary = await getGeneric("/health", input, options);
+    if (primary.ok || primary.status !== 404 || primary.errorDetails?.code !== "HTTP_ERROR") {
+      return primary;
+    }
+    const fallback = await getGeneric("/ok", input, options);
+    if (!fallback.ok) {
+      return {
+        ...fallback,
+        data: null
+      };
+    }
+    const fallbackStatus = isRecord2(fallback.data) && typeof fallback.data.ok === "boolean" ? fallback.data.ok ? "ok" : "error" : "ok";
+    return {
+      ...fallback,
+      data: {
+        status: fallbackStatus
+      }
+    };
+  };
+  const signOut = (input, options) => executePostWithOptionalInput(
+    resolvedConfig,
+    { endpoint: "/sign-out", method: "POST" },
+    input,
+    options
+  );
+  const revokeSessions = (input, options) => executePostWithOptionalInput(
+    resolvedConfig,
+    { endpoint: "/revoke-sessions", method: "POST" },
+    input,
+    options
+  );
+  const revokeOtherSessions = (input, options) => executePostWithOptionalInput(
+    resolvedConfig,
+    { endpoint: "/revoke-other-sessions", method: "POST" },
+    input,
+    options
+  );
+  const revokeSession = (input, options) => executePostWithCompatibleInput(
+    resolvedConfig,
+    { endpoint: "/revoke-session", method: "POST" },
+    input,
+    options
+  );
+  const deleteUser = (input, options) => {
+    const { payload, fetchOptions } = extractFetchOptions(input);
+    const mergedOptions = mergeCallOptions(fetchOptions, options);
+    return callAuthEndpoint(
+      resolvedConfig,
+      { endpoint: "/delete-user", method: "POST" },
+      payload ?? {},
+      void 0,
+      mergedOptions
+    );
+  };
+  const deleteUserCallback = (input, options) => {
+    const { payload, fetchOptions } = extractFetchOptions(input);
+    const mergedOptions = mergeCallOptions(fetchOptions, options);
+    const query = payload ?? {};
+    return callAuthEndpoint(
+      resolvedConfig,
+      { endpoint: "/delete-user/callback", method: "GET" },
+      void 0,
+      {
+        token: query.token,
+        callbackURL: query.callbackURL
+      },
+      mergedOptions
+    );
+  };
+  const resolveResetPasswordToken = (input, options) => {
+    const { payload, fetchOptions } = extractFetchOptions(input);
+    const mergedOptions = mergeCallOptions(fetchOptions, options);
+    const query = payload;
+    const token = query?.token?.trim();
+    if (!token) {
+      throw new Error("resolveResetPasswordToken requires a non-empty token");
+    }
+    const endpoint = `/reset-password/${encodeURIComponent(token)}`;
+    return callAuthEndpoint(
+      resolvedConfig,
+      { endpoint, method: "GET" },
+      void 0,
+      query?.callbackURL ? { callbackURL: query.callbackURL } : void 0,
+      mergedOptions
+    );
+  };
+  const organization = {
+    create: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/create", method: "POST" },
+      input,
+      options
+    ),
+    update: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/update", method: "POST" },
+      input,
+      options
+    ),
+    delete: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/delete", method: "POST" },
+      input,
+      options
+    ),
+    setActive: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/set-active", method: "POST" },
+      input,
+      options
+    ),
+    list: (input, options) => getGeneric(
+      "/organization/list",
+      input,
+      options
+    ),
+    getFull: (input, options) => executeGetWithQueryCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/get-full-organization", method: "GET" },
+      input,
+      options
+    ),
+    checkSlug: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/check-slug", method: "POST" },
+      input,
+      options
+    ),
+    leave: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/leave", method: "POST" },
+      input,
+      options
+    ),
+    listUserInvitations: (input, options) => executeGetWithQueryCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/organization/list-user-invitations", method: "GET" },
+      input,
+      options
+    ),
+    hasPermission: (input, options) => postGeneric(
+      "/organization/has-permission",
+      input,
+      options
+    ),
+    invitation: {
+      cancel: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/cancel-invitation", method: "POST" },
+        input,
+        options
+      ),
+      accept: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/accept-invitation", method: "POST" },
+        input,
+        options
+      ),
+      get: (input, options) => executeGetWithQueryCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/get-invitation", method: "GET" },
+        input,
+        options
+      ),
+      reject: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/reject-invitation", method: "POST" },
+        input,
+        options
+      ),
+      list: (input, options) => executeGetWithQueryCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/list-invitations", method: "GET" },
+        input,
+        options
+      )
+    },
+    member: {
+      remove: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/remove-member", method: "POST" },
+        input,
+        options
+      ),
+      updateRole: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/update-member-role", method: "POST" },
+        input,
+        options
+      ),
+      invite: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/invite-member", method: "POST" },
+        input,
+        options
+      ),
+      getActive: (input, options) => executeGetWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/get-active-member", method: "GET" },
+        input,
+        options
+      ),
+      list: (input, options) => executeGetWithQueryCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/organization/list-members", method: "GET" },
+        input,
+        options
+      )
+    }
+  };
+  const authResetPassword = Object.assign(
+    (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/reset-password", method: "POST" },
+      input,
+      options
+    ),
+    {
+      token: resolveResetPasswordToken
+    }
+  );
+  const sessionRevokeBinding = (input, options) => {
+    if (Array.isArray(input)) {
+      if (input.length === 0) {
+        throw new Error("session.revoke requires at least one session token");
+      }
+      if (input.length === 1) {
+        return revokeSession(input[0], options);
+      }
+      return revokeSessions(void 0, options);
+    }
+    const parsed = input;
+    const tokens = Array.isArray(parsed.tokens) ? parsed.tokens.filter((token2) => token2.trim().length > 0) : void 0;
+    if (tokens && tokens.length > 1) {
+      return revokeSessions(
+        parsed.fetchOptions ? { fetchOptions: parsed.fetchOptions } : void 0,
+        options
+      );
+    }
+    if (tokens && tokens.length === 1) {
+      return revokeSession(
+        { token: tokens[0], fetchOptions: parsed.fetchOptions },
+        options
+      );
+    }
+    const token = parsed.token?.trim();
+    if (!token) {
+      throw new Error("session.revoke requires a non-empty token or a non-empty token list");
+    }
+    return revokeSession(
+      {
+        token,
+        fetchOptions: parsed.fetchOptions
+      },
+      options
+    );
+  };
+  const adminUserSessionRevokeBinding = (input, options) => {
+    const requireUserId = (userId) => {
+      const trimmed = String(userId ?? "").trim();
+      if (!trimmed) {
+        throw new Error("admin.user.session.revoke requires a non-empty userId");
+      }
+      return trimmed;
+    };
+    const requireSinglePluralUserId = (sessions2) => {
+      const uniqueUserIds = [...new Set(sessions2.map((session) => requireUserId(session.userId)))];
+      if (uniqueUserIds.length !== 1) {
+        throw new Error("admin.user.session.revoke requires the same userId across plural payloads");
+      }
+      return { userId: uniqueUserIds[0] };
+    };
+    if (Array.isArray(input)) {
+      if (input.length === 0) {
+        throw new Error("admin.user.session.revoke requires at least one payload item");
+      }
+      if (input.length === 1) {
+        return postGeneric(
+          "/admin/revoke-user-session",
+          {
+            ...input[0],
+            userId: requireUserId(input[0].userId)
+          },
+          options
+        );
+      }
+      return postGeneric(
+        "/admin/revoke-user-sessions",
+        requireSinglePluralUserId(input),
+        options
+      );
+    }
+    const parsed = input;
+    const sessions = parsed.sessions;
+    if (sessions && sessions.length === 0) {
+      throw new Error("admin.user.session.revoke requires at least one payload item");
+    }
+    if (sessions && sessions.length === 1) {
+      return postGeneric(
+        "/admin/revoke-user-session",
+        {
+          ...sessions[0],
+          userId: requireUserId(sessions[0].userId),
+          fetchOptions: parsed.fetchOptions
+        },
+        options
+      );
+    }
+    if (sessions && sessions.length > 1) {
+      return postGeneric(
+        "/admin/revoke-user-sessions",
+        {
+          ...requireSinglePluralUserId(sessions),
+          fetchOptions: parsed.fetchOptions
+        },
+        options
+      );
+    }
+    const normalizedUserId = requireUserId(parsed.userId);
+    if (!parsed.sessionToken) {
+      return postGeneric(
+        "/admin/revoke-user-sessions",
+        {
+          userId: normalizedUserId,
+          fetchOptions: parsed.fetchOptions
+        },
+        options
+      );
+    }
+    return postGeneric(
+      "/admin/revoke-user-session",
+      {
+        ...parsed,
+        userId: normalizedUserId
+      },
+      options
+    );
+  };
+  const auth = {
+    getSession: (input, options) => getGeneric("/get-session", input, options),
+    signOut,
+    forgetPassword: (input, options) => postGeneric("/forget-password", input, options),
+    resetPassword: authResetPassword,
+    setPassword: (input, options) => postGeneric("/set-password", input, options),
+    verifyEmail: (input, options) => {
+      const queryInput = {
+        query: {
+          token: input.token,
+          callbackURL: input.callbackURL
+        },
+        fetchOptions: input.fetchOptions
+      };
+      return getWithQuery(
+        "/verify-email",
+        queryInput,
+        options
+      );
+    },
+    sendVerificationEmail: (input, options) => postGeneric("/send-verification-email", input, options),
+    changeEmail: (input, options) => postGeneric("/change-email", input, options),
+    changeEmailVerify: (input, options) => getWithQuery("/change-email/verify", input, options),
+    deleteUserVerify: (input, options) => getWithQuery("/delete-user/verify", input, options),
+    changePassword: (input, options) => postGeneric("/change-password", input, options),
+    user: {
+      update: (input, options) => postGeneric("/update-user", input, options),
+      delete: (input, options) => postGeneric("/delete-user", input, options),
+      email: {
+        list: listUserEmailsWithFallback
+      }
+    },
+    session: {
+      list: (input, options) => getGeneric("/list-sessions", input, options),
+      revoke: sessionRevokeBinding,
+      revokeOther: revokeOtherSessions
+    },
+    social: {
+      link: (input, options) => postGeneric("/link-social", input, options)
+    },
+    account: {
+      list: (input, options) => getGeneric("/list-accounts", input, options),
+      unlink: (input, options) => postGeneric("/unlink-account", input, options)
+    },
+    deleteUser: {
+      callback: deleteUserCallback
+    },
+    refreshToken: (input, options) => postGeneric("/refresh-token", input, options),
+    getAccessToken: (input, options) => postGeneric("/get-access-token", input, options),
+    health: healthWithFallback,
+    ok: (input, options) => getGeneric("/ok", input, options),
+    error: (input, options) => getGeneric("/error", input, options),
+    twoFactor: {
+      getTotpUri: (input, options) => postGeneric("/two-factor/get-totp-uri", input, options),
+      verifyTotp: (input, options) => postGeneric("/two-factor/verify-totp", input, options),
+      sendOtp: (input, options) => postGeneric("/two-factor/send-otp", input, options),
+      verifyOtp: (input, options) => postGeneric("/two-factor/verify-otp", input, options),
+      verifyBackupCode: (input, options) => postGeneric("/two-factor/verify-backup-code", input, options),
+      generateBackupCodes: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/two-factor/generate-backup-codes", method: "POST" },
+        input,
+        options
+      ),
+      enable: (input, options) => postGeneric("/two-factor/enable", input, options),
+      disable: (input, options) => postGeneric("/two-factor/disable", input, options)
+    },
+    passkey: {
+      generateRegisterOptions: (input, options) => getGeneric("/passkey/generate-register-options", input, options),
+      generateAuthenticateOptions: (input, options) => postGeneric("/passkey/generate-authenticate-options", input, options),
+      verifyRegistration: (input, options) => postGeneric("/passkey/verify-registration", input, options),
+      verifyAuthentication: (input, options) => postGeneric("/passkey/verify-authentication", input, options),
+      listUserPasskeys: (input, options) => getGeneric("/passkey/list-user-passkeys", input, options),
+      deletePasskey: (input, options) => postGeneric("/passkey/delete-passkey", input, options),
+      updatePasskey: (input, options) => postGeneric("/passkey/update-passkey", input, options),
+      getRelatedOrigins: (input, options) => getGeneric("/.well-known/webauthn", input, options)
+    },
+    admin: {
+      role: {
+        set: (input, options) => postGeneric("/admin/set-role", input, options)
+      },
+      user: {
+        list: (input, options) => getWithQuery("/admin/list-users", input, options),
+        create: (input, options) => postGeneric("/admin/create-user", input, options),
+        unban: (input, options) => postGeneric("/admin/unban-user", input, options),
+        ban: (input, options) => postGeneric("/admin/ban-user", input, options),
+        impersonate: (input, options) => postGeneric("/admin/impersonate-user", input, options),
+        stopImpersonating: (input, options) => postGeneric("/admin/stop-impersonating", input, options),
+        remove: (input, options) => postGeneric("/admin/remove-user", input, options),
+        setPassword: (input, options) => postGeneric("/admin/set-user-password", input, options),
+        session: {
+          list: (input, options) => postGeneric("/admin/list-user-sessions", input, options),
+          revoke: adminUserSessionRevokeBinding
+        }
+      },
+      hasPermission: (input, options) => postGeneric("/admin/has-permission", input, options),
+      apiKey: {
+        create: (input, options) => postGeneric("/admin/api-key/create", input, options)
+      },
+      athenaClient: {
+        create: (input, options) => postGeneric("/admin/athena-client/create", input, options),
+        list: (input, options) => getWithQuery("/admin/athena-client/list", input, options)
+      },
+      auditLog: {
+        list: (input, options) => getWithQuery("/admin/audit-log/list", input, options)
+      },
+      email: {
+        list: (input, options) => getWithQuery("/admin/email/list", input, options),
+        get: (input, options) => getWithQuery("/admin/email/get", input, options),
+        create: (input, options) => postGeneric("/admin/email/create", input, options),
+        update: (input, options) => postGeneric("/admin/email/update", input, options),
+        delete: (input, options) => postGeneric("/admin/email/delete", input, options),
+        failure: {
+          list: (input, options) => getWithQuery("/admin/email-failure/list", input, options),
+          get: (input, options) => getWithQuery("/admin/email-failure/get", input, options),
+          create: (input, options) => postGeneric("/admin/email-failure/create", input, options),
+          update: (input, options) => postGeneric("/admin/email-failure/update", input, options),
+          delete: (input, options) => postGeneric("/admin/email-failure/delete", input, options)
+        },
+        template: {
+          list: (input, options) => getWithQuery("/admin/email-template/list", input, options),
+          get: (input, options) => getWithQuery("/admin/email-template/get", input, options),
+          create: (input, options) => postGeneric("/admin/email-template/create", input, options),
+          update: (input, options) => postGeneric("/admin/email-template/update", input, options),
+          delete: (input, options) => postGeneric("/admin/email-template/delete", input, options)
+        }
+      },
+      emailTemplate: {
+        get: (input, options) => getWithQuery("/admin/email-template/get", input, options),
+        create: (input, options) => postGeneric("/admin/email-template/create", input, options),
+        delete: (input, options) => postGeneric("/admin/email-template/delete", input, options),
+        list: (input, options) => getWithQuery("/admin/email-template/list", input, options),
+        update: (input, options) => postGeneric("/admin/email-template/update", input, options)
+      }
+    },
+    apiKey: {
+      create: (input, options) => postGeneric("/api-key/create", input, options),
+      get: (input, options) => getWithQuery("/api-key/get", input, options),
+      update: (input, options) => postGeneric("/api-key/update", input, options),
+      delete: (input, options) => postGeneric("/api-key/delete", input, options),
+      list: (input, options) => getWithQuery("/api-key/list", input, options),
+      verify: (input, options) => postGeneric("/api-key/verify", input, options),
+      deleteAllExpired: (input, options) => executePostWithOptionalInput(
+        resolvedConfig,
+        { endpoint: "/api-key/delete-all-expired-api-keys", method: "POST" },
+        input,
+        options
+      )
+    },
+    signIn: {
+      email: (input, options) => postGeneric("/sign-in/email", input, options),
+      username: (input, options) => postGeneric("/sign-in/username", input, options),
+      social: (input, options) => postGeneric("/sign-in/social", input, options)
+    },
+    signUp: {
+      email: (input, options) => postGeneric("/sign-up/email", input, options)
+    },
+    organization,
+    callback: {
+      provider: (input, options) => {
+        const { payload, fetchOptions } = extractFetchOptions(input);
+        const parsed = payload;
+        const provider = String(parsed?.provider ?? "").trim();
+        if (!provider) {
+          throw new Error("callback.provider requires a non-empty provider value");
+        }
+        const code = String(parsed?.code ?? "").trim();
+        const state = String(parsed?.state ?? "").trim();
+        if (!code || !state) {
+          throw new Error("callback.provider requires non-empty code and state values");
+        }
+        const endpoint = `/callback/${encodeURIComponent(provider)}`;
+        return request({
+          endpoint,
+          method: "GET",
+          query: {
+            code,
+            state
+          },
+          fetchOptions
+        }, options);
+      }
+    }
+  };
+  return {
+    baseUrl: normalizedBaseUrl,
+    request,
+    signIn: {
+      email: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/sign-in/email", method: "POST" },
+        input,
+        options
+      ),
+      username: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/sign-in/username", method: "POST" },
+        input,
+        options
+      ),
+      social: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/sign-in/social", method: "POST" },
+        input,
+        options
+      )
+    },
+    signUp: {
+      email: (input, options) => executePostWithCompatibleInput(
+        resolvedConfig,
+        { endpoint: "/sign-up/email", method: "POST" },
+        input,
+        options
+      )
+    },
+    signOut,
+    logout: signOut,
+    getSession: (input, options) => executeGetWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/get-session", method: "GET" },
+      input,
+      options
+    ),
+    listSessions: (input, options) => executeGetWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/list-sessions", method: "GET" },
+      input,
+      options
+    ),
+    revokeSession,
+    clearSession: revokeSession,
+    revokeSessions,
+    clearSessions: revokeSessions,
+    revokeOtherSessions,
+    clearOtherSessions: revokeOtherSessions,
+    forgetPassword: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/forget-password", method: "POST" },
+      input,
+      options
+    ),
+    resetPassword: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/reset-password", method: "POST" },
+      input,
+      options
+    ),
+    resolveResetPasswordToken,
+    verifyEmail: (input, options) => {
+      const { payload, fetchOptions } = extractFetchOptions(input);
+      const mergedOptions = mergeCallOptions(fetchOptions, options);
+      const query = payload;
+      return callAuthEndpoint(
+        resolvedConfig,
+        { endpoint: "/verify-email", method: "GET" },
+        void 0,
+        query ? {
+          token: query.token,
+          callbackURL: query.callbackURL
+        } : void 0,
+        mergedOptions
+      );
+    },
+    sendVerificationEmail: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/send-verification-email", method: "POST" },
+      input,
+      options
+    ),
+    changeEmail: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/change-email", method: "POST" },
+      input,
+      options
+    ),
+    changePassword: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/change-password", method: "POST" },
+      input,
+      options
+    ),
+    updateUser: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/update-user", method: "POST" },
+      input,
+      options
+    ),
+    deleteUser,
+    deleteUserCallback,
+    linkSocial: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/link-social", method: "POST" },
+      input,
+      options
+    ),
+    listAccounts: (input, options) => executeGetWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/list-accounts", method: "GET" },
+      input,
+      options
+    ),
+    unlinkAccount: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/unlink-account", method: "POST" },
+      input,
+      options
+    ),
+    refreshToken: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/refresh-token", method: "POST" },
+      input,
+      options
+    ),
+    getAccessToken: (input, options) => executePostWithCompatibleInput(
+      resolvedConfig,
+      { endpoint: "/get-access-token", method: "POST" },
+      input,
+      options
+    ),
+    organization,
+    auth
+  };
+}
+
 // src/client.ts
 var DEFAULT_COLUMNS = "*";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -1938,6 +3016,7 @@ function createClientFromConfig(config) {
     backend: config.backend,
     headers: config.headers
   });
+  const auth = createAuthClient(config.auth);
   return {
     from(table) {
       return createTableBuilder(table, gateway);
@@ -1954,7 +3033,8 @@ function createClientFromConfig(config) {
         gateway
       );
     },
-    query: createQueryBuilder(gateway)
+    query: createQueryBuilder(gateway),
+    auth: auth.auth
   };
 }
 var DEFAULT_BACKEND = { type: "athena" };
@@ -2028,7 +3108,11 @@ function createClient(url, apiKey, options) {
   const b = AthenaClient.builder().url(url).key(apiKey).backend(toBackendConfig(options?.backend));
   if (options?.client) b.client(options.client);
   if (options?.headers && Object.keys(options.headers).length > 0) b.headers(options.headers);
-  return b.build();
+  const client = b.build();
+  if (options?.auth) {
+    client.auth = createAuthClient(options.auth).auth;
+  }
+  return client;
 }
 
 // src/schema/postgres-introspection-core.ts