@xylex-group/athena 2.8.0 → 2.9.0

package/dist/browser.cjs

@@ -802,7 +802,7 @@ var getCookieCache = async (request, config) => {
 
 // package.json
 var package_default = {
-  version: "2.8.0"
+  version: "2.9.0"
 };
 
 // src/sdk-version.ts
@@ -815,6 +815,7 @@ function buildSdkHeaderValue(sdkName) {
 var DEFAULT_CLIENT = "railway_direct";
 var SDK_NAME = "xylex-group/athena";
 var SDK_HEADER_VALUE = buildSdkHeaderValue(SDK_NAME);
+var NO_CACHE_HEADER_VALUE = "no-cache";
 function parseResponseBody(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -833,6 +834,9 @@ function parseResponseBody(rawText, contentType) {
 function normalizeHeaderValue(value) {
   return value ? value : void 0;
 }
+function isCacheControlHeaderName(name) {
+  return name.toLowerCase() === "cache-control";
+}
 function resolveHeaderValue(headers, candidates) {
   for (const candidate of candidates) {
     const direct = normalizeHeaderValue(headers[candidate]);
@@ -991,6 +995,7 @@ function buildRpcGetEndpoint(payload) {
 }
 function buildHeaders(config, options) {
   const mergedStripNulls = options?.stripNulls ?? true;
+  const forceNoCache = Boolean(config.forceNoCache || options?.forceNoCache);
   const extraHeaders = {
     ...config.headers ?? {},
     ...options?.headers ?? {}
@@ -1044,11 +1049,15 @@ function buildHeaders(config, options) {
   const athenaClientKeys = ["x-athena-client", "X-Athena-Client"];
   Object.entries(extraHeaders).forEach(([key, value]) => {
     if (athenaClientKeys.includes(key)) return;
+    if (forceNoCache && isCacheControlHeaderName(key)) return;
     const normalized = normalizeHeaderValue(value);
     if (normalized) {
       headers[key] = normalized;
     }
   });
+  if (forceNoCache) {
+    headers["Cache-Control"] = NO_CACHE_HEADER_VALUE;
+  }
   return headers;
 }
 function toInvalidUrlResponse(error, endpoint, method) {
@@ -1509,6 +1518,45 @@ function identifier(...segments) {
   return new SqlIdentifierPath(expandedSegments);
 }
 
+// src/auth/limits.ts
+var ATHENA_AUTH_MAX_ADMIN_JSON_BYTES = 32 * 1024;
+var ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH = 8;
+var ATHENA_AUTH_MAX_TEMPLATE_VARIABLES = 64;
+var ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH = 128;
+var ATHENA_AUTH_ADMIN_LIMITS = {
+  maxAdminJsonBytes: ATHENA_AUTH_MAX_ADMIN_JSON_BYTES,
+  maxAdminJsonDepth: ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH,
+  maxTemplateVariables: ATHENA_AUTH_MAX_TEMPLATE_VARIABLES,
+  maxTemplateVariableLength: ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH
+};
+function describeTemplateVariableTarget(target) {
+  const normalized = target?.trim();
+  return normalized && normalized.length > 0 ? normalized : "Athena auth admin email template variables";
+}
+function assertAthenaAuthTemplateVariables(variables, target) {
+  const label = describeTemplateVariableTarget(target);
+  if (!Array.isArray(variables)) {
+    throw new Error(`${label} must be an array of strings.`);
+  }
+  if (variables.length > ATHENA_AUTH_MAX_TEMPLATE_VARIABLES) {
+    throw new Error(
+      `${label} cannot contain more than ${ATHENA_AUTH_MAX_TEMPLATE_VARIABLES} entries.`
+    );
+  }
+  variables.forEach((variable, index) => {
+    if (typeof variable !== "string") {
+      throw new Error(
+        `${label} must contain only strings. Received ${typeof variable} at index ${index}.`
+      );
+    }
+    if (variable.length > ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH) {
+      throw new Error(
+        `${label} cannot contain entries longer than ${ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH} characters. Received ${variable.length} characters at index ${index}.`
+      );
+    }
+  });
+}
+
 // src/auth/react-email.ts
 var reactEmailRenderModulePromise;
 function isRecord2(value) {
@@ -1738,6 +1786,7 @@ async function resolveReactEmailPayloadFields(input, fields, options) {
 var DEFAULT_AUTH_BASE_URL = "http://localhost:3001/api/auth";
 var SDK_NAME2 = "xylex-group/athena-auth";
 var SDK_HEADER_VALUE2 = buildSdkHeaderValue(SDK_NAME2);
+var NO_CACHE_HEADER_VALUE2 = "no-cache";
 function normalizeBaseUrl(baseUrl) {
   return (baseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/$/, "");
 }
@@ -1747,6 +1796,9 @@ function isRecord3(value) {
 function normalizeHeaderValue2(value) {
   return value ? value : void 0;
 }
+function isCacheControlHeaderName2(name) {
+  return name.toLowerCase() === "cache-control";
+}
 function parseResponseBody2(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -1802,6 +1854,54 @@ function mergeCallOptions(base, override) {
     }
   };
 }
+function toSessionGuardFailure(sessionResult) {
+  if (sessionResult.status === 401 || sessionResult.data == null) {
+    return {
+      ok: false,
+      reason: "unauthorized",
+      status: 401,
+      error: sessionResult.error ?? "Unauthorized",
+      sessionResult
+    };
+  }
+  return {
+    ok: false,
+    reason: "upstream_error",
+    status: sessionResult.status,
+    error: sessionResult.error ?? "Failed to resolve current session",
+    sessionResult
+  };
+}
+function toPermissionGuardFailure(permissionResult, sessionResult) {
+  if (permissionResult.status === 401) {
+    return {
+      ok: false,
+      reason: "unauthorized",
+      status: 401,
+      error: permissionResult.error ?? "Unauthorized",
+      sessionResult,
+      permissionResult
+    };
+  }
+  if (permissionResult.status === 403) {
+    return {
+      ok: false,
+      reason: "forbidden",
+      status: 403,
+      error: permissionResult.error ?? "Forbidden",
+      sessionResult,
+      permissionResult
+    };
+  }
+  return {
+    ok: false,
+    reason: "upstream_error",
+    status: permissionResult.status,
+    error: permissionResult.error ?? "Failed to resolve permission check",
+    sessionResult,
+    permissionResult
+  };
+}
 function extractFetchOptions(input) {
   if (!input) {
     return {
@@ -1817,6 +1917,7 @@ function extractFetchOptions(input) {
   };
 }
 function buildHeaders2(config, options) {
+  const forceNoCache = Boolean(config.forceNoCache || options?.forceNoCache);
   const headers = {
     "Content-Type": "application/json",
     "X-Athena-Sdk": SDK_HEADER_VALUE2
@@ -1830,16 +1931,30 @@ function buildHeaders2(config, options) {
   if (bearerToken) {
     headers.Authorization = `Bearer ${bearerToken}`;
   }
+  const cookie = options?.cookie ?? config.cookie;
+  if (cookie) {
+    headers.Cookie = cookie;
+  }
+  const sessionToken = options?.sessionToken ?? config.sessionToken;
+  if (sessionToken) {
+    headers["X-Athena-Auth-Session-Token"] = sessionToken;
+  }
   const mergedExtraHeaders = {
     ...config.headers ?? {},
     ...options?.headers ?? {}
   };
   Object.entries(mergedExtraHeaders).forEach(([key, value]) => {
+    if (forceNoCache && isCacheControlHeaderName2(key)) {
+      return;
+    }
     const normalized = normalizeHeaderValue2(value);
     if (normalized) {
       headers[key] = normalized;
     }
   });
+  if (forceNoCache) {
+    headers["Cache-Control"] = NO_CACHE_HEADER_VALUE2;
+  }
   return headers;
 }
 function appendQueryParam(searchParams, key, value) {
@@ -2104,7 +2219,91 @@ function createAuthClient(config = {}) {
     htmlField: "htmlTemplate",
     textField: "textTemplate",
     variablesField: "variables"
-  }, withReactEmailRoute(route));
+  }, withReactEmailRoute(route)).then((payload) => {
+    if ("variables" in payload && payload.variables !== void 0 && payload.variables !== null) {
+      assertAthenaAuthTemplateVariables(
+        payload.variables,
+        `${route} variables`
+      );
+    }
+    return payload;
+  });
+  const requireSession = async (input, options) => {
+    const sessionInput = input?.fetchOptions ? { fetchOptions: input.fetchOptions } : void 0;
+    const sessionResult = await getGeneric(
+      "/get-session",
+      sessionInput,
+      options
+    );
+    if (!sessionResult.ok || sessionResult.data == null) {
+      return toSessionGuardFailure(sessionResult);
+    }
+    return {
+      ok: true,
+      session: sessionResult.data
+    };
+  };
+  const getUser = async (input, options) => {
+    const sessionResult = await getGeneric(
+      "/get-session",
+      input,
+      options
+    );
+    if (!sessionResult.ok) {
+      return {
+        ...sessionResult,
+        data: null
+      };
+    }
+    return {
+      ...sessionResult,
+      data: {
+        user: sessionResult.data?.user ?? null
+      }
+    };
+  };
+  const requirePermission = async (endpoint, input, options) => {
+    const sessionGuard = await requireSession(
+      input?.fetchOptions ? { fetchOptions: input.fetchOptions } : void 0,
+      options
+    );
+    if (!sessionGuard.ok) {
+      return sessionGuard;
+    }
+    const permissionResult = await postGeneric(
+      endpoint,
+      input,
+      options
+    );
+    if (!permissionResult.ok) {
+      return toPermissionGuardFailure(permissionResult, {
+        ok: true,
+        status: 200,
+        data: sessionGuard.session,
+        error: null,
+        errorDetails: null,
+        raw: sessionGuard.session
+      });
+    }
+    if (!permissionResult.data?.success) {
+      return {
+        ok: false,
+        reason: "forbidden",
+        status: 403,
+        error: permissionResult.data?.error ?? "Forbidden",
+        sessionResult: {
+          ok: true,
+          status: 200,
+          data: sessionGuard.session,
+          error: null,
+          errorDetails: null,
+          raw: sessionGuard.session
+        },
+        permissionResult
+      };
+    }
+    return sessionGuard;
+  };
   const listUserEmailsWithFallback = async (input, options) => {
     const primary = await getWithQuery(
       "/email/list",
@@ -2266,6 +2465,7 @@ function createAuthClient(config = {}) {
       input,
       options
     ),
+    requirePermission: (input, options) => requirePermission("/organization/has-permission", input, options),
     invitation: {
       cancel: (input, options) => executePostWithCompatibleInput(
         resolvedConfig,
@@ -2461,6 +2661,8 @@ function createAuthClient(config = {}) {
   };
   const auth = {
     getSession: (input, options) => getGeneric("/get-session", input, options),
+    getUser,
+    requireSession,
     signOut,
     forgetPassword: (input, options) => postGeneric("/forget-password", input, options),
     resetPassword: authResetPassword,
@@ -2555,6 +2757,7 @@ function createAuthClient(config = {}) {
         }
       },
       hasPermission: (input, options) => postGeneric("/admin/has-permission", input, options),
+      requirePermission: (input, options) => requirePermission("/admin/has-permission", input, options),
       apiKey: {
         create: (input, options) => postGeneric("/admin/api-key/create", input, options)
       },
@@ -2706,6 +2909,8 @@ function createAuthClient(config = {}) {
       input,
       options
     ),
+    getUser,
+    requireSession,
     listSessions: (input, options) => executeGetWithCompatibleInput(
       resolvedConfig,
       { endpoint: "/list-sessions", method: "GET" },
@@ -3398,7 +3603,12 @@ function createStorageFileModule(base, config = {}) {
           content_type: input.content_type ?? source.contentType,
           size_bytes: source.sizeBytes,
           public: input.public,
-          metadata: input.metadata
+          metadata: input.metadata,
+          server_side_encryption: input.server_side_encryption,
+          sse: input.sse,
+          ssekms_key_id: input.ssekms_key_id,
+          kms_key_id: input.kms_key_id,
+          bucket_key_enabled: input.bucket_key_enabled
         }
       };
     });
@@ -3409,10 +3619,17 @@ function createStorageFileModule(base, config = {}) {
     for (let index = 0; index < uploadRequests.length; index += 1) {
       const request = uploadRequests[index];
       const uploadUrl = uploadUrls[index];
-      const response = await putUploadBody(uploadUrl.upload.url, request.source, input, options, (progress) => {
-        aggregateLoaded[index] = progress.loaded;
-        input.onProgress?.(createProgressSnapshot("uploading", sources, index, progress.loaded, sum(aggregateLoaded)));
-      });
+      const response = await putUploadBody(
+        uploadUrl.upload.url,
+        uploadUrl.upload.headers ?? {},
+        request.source,
+        input,
+        options,
+        (progress) => {
+          aggregateLoaded[index] = progress.loaded;
+          input.onProgress?.(createProgressSnapshot("uploading", sources, index, progress.loaded, sum(aggregateLoaded)));
+        }
+      );
       uploaded.push({
         file: uploadUrl.file,
         upload: uploadUrl.upload,
@@ -3515,8 +3732,9 @@ function validateUploadConstraints(sources, input) {
     }
   }
 }
-async function putUploadBody(url, source, input, options, onProgress) {
-  const headers = new Headers(input.uploadHeaders);
+async function putUploadBody(url, uploadHeaders, source, input, options, onProgress) {
+  const headers = new Headers(uploadHeaders);
+  new Headers(input.uploadHeaders).forEach((value, key) => headers.set(key, value));
   if (source.contentType && !headers.has("Content-Type")) {
     headers.set("Content-Type", source.contentType);
   }
@@ -3803,59 +4021,554 @@ var storageSdkManifest = {
       pathParams: ["file_id"],
       queryParams: ["purpose"],
       responseEnvelope: "athena",
-      responseType: "PresignedFileUrlResponse"
+      responseType: "PresignedFileUrlResponse"
+    },
+    {
+      name: "getStorageFileProxy",
+      method: "GET",
+      path: "/storage/files/{file_id}/proxy",
+      pathParams: ["file_id"],
+      queryParams: ["purpose"],
+      responseEnvelope: "raw",
+      responseType: "Response",
+      binary: true
+    },
+    {
+      name: "updateStorageFile",
+      method: "PATCH",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      requestType: "UpdateStorageFileRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "deleteStorageFile",
+      method: "DELETE",
+      path: "/storage/files/{file_id}",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "setStorageFileVisibility",
+      method: "PATCH",
+      path: "/storage/files/{file_id}/visibility",
+      pathParams: ["file_id"],
+      requestType: "SetStorageFileVisibilityRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "postStorageFileVisibility",
+      method: "POST",
+      path: "/storage/files/{file_id}/visibility",
+      pathParams: ["file_id"],
+      requestType: "SetStorageFileVisibilityRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "setManyStorageFileVisibility",
+      method: "POST",
+      path: "/storage/files/visibility-many",
+      requestType: "SetManyStorageFileVisibilityRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationManyResponse"
+    },
+    {
+      name: "deleteStorageFolder",
+      method: "POST",
+      path: "/storage/folders/delete",
+      requestType: "DeleteStorageFolderRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFolderMutationResponse"
+    },
+    {
+      name: "moveStorageFolder",
+      method: "POST",
+      path: "/storage/folders/move",
+      requestType: "MoveStorageFolderRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFolderMutationResponse"
+    },
+    {
+      name: "searchStorageFiles",
+      method: "POST",
+      path: "/storage/files/search",
+      requestType: "SearchStorageFilesRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageListFilesResponse"
+    },
+    {
+      name: "confirmStorageUpload",
+      method: "POST",
+      path: "/storage/files/{file_id}/confirm-upload",
+      pathParams: ["file_id"],
+      requestType: "ConfirmStorageUploadRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "uploadStorageFileBinary",
+      method: "PUT",
+      path: "/storage/files/{file_id}/upload",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse",
+      binary: true
+    },
+    {
+      name: "copyStorageFile",
+      method: "POST",
+      path: "/storage/files/{file_id}/copy",
+      pathParams: ["file_id"],
+      requestType: "CopyStorageFileRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "deleteManyStorageFiles",
+      method: "POST",
+      path: "/storage/files/delete-many",
+      requestType: "DeleteManyStorageFilesRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationManyResponse"
+    },
+    {
+      name: "updateManyStorageFiles",
+      method: "POST",
+      path: "/storage/files/update-many",
+      requestType: "UpdateManyStorageFilesRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationManyResponse"
+    },
+    {
+      name: "restoreStorageFile",
+      method: "POST",
+      path: "/storage/files/{file_id}/restore",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "purgeStorageFile",
+      method: "DELETE",
+      path: "/storage/files/{file_id}/purge",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "StorageFileMutationResponse"
+    },
+    {
+      name: "getStorageFilePublicUrl",
+      method: "GET",
+      path: "/storage/files/{file_id}/public-url",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageFileProxyUrl",
+      method: "GET",
+      path: "/storage/files/{file_id}/proxy-url",
+      pathParams: ["file_id"],
+      queryParams: ["purpose"],
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "listStorageFileVersions",
+      method: "GET",
+      path: "/storage/files/{file_id}/versions",
+      pathParams: ["file_id"],
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "restoreStorageFileVersion",
+      method: "POST",
+      path: "/storage/files/{file_id}/versions/{version_id}/restore",
+      pathParams: ["file_id", "version_id"],
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageFileVersion",
+      method: "DELETE",
+      path: "/storage/files/{file_id}/versions/{version_id}",
+      pathParams: ["file_id", "version_id"],
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageFileRetention",
+      method: "GET",
+      path: "/storage/files/{file_id}/retention",
+      pathParams: ["file_id"],
+      queryParams: ["version_id"],
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "setStorageFileRetention",
+      method: "POST",
+      path: "/storage/files/{file_id}/retention",
+      pathParams: ["file_id"],
+      requestType: "StorageFileRetentionRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "listStorageFolders",
+      method: "POST",
+      path: "/storage/folders/list",
+      requestType: "ListStorageFoldersRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "treeStorageFolders",
+      method: "POST",
+      path: "/storage/folders/tree",
+      requestType: "TreeStorageFoldersRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "listStoragePermissions",
+      method: "POST",
+      path: "/storage/permissions/list",
+      requestType: "StoragePermissionListRequest",
+      responseEnvelope: "athena",
+      responseType: "StoragePermissionListResponse"
+    },
+    {
+      name: "grantStoragePermission",
+      method: "POST",
+      path: "/storage/permissions/grant",
+      requestType: "StoragePermissionGrantRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "revokeStoragePermission",
+      method: "POST",
+      path: "/storage/permissions/revoke",
+      requestType: "StoragePermissionRevokeRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "checkStoragePermission",
+      method: "POST",
+      path: "/storage/permissions/check",
+      requestType: "StoragePermissionCheckRequest",
+      responseEnvelope: "athena",
+      responseType: "StoragePermissionCheckResponse"
+    },
+    {
+      name: "listStorageObjects",
+      method: "POST",
+      path: "/storage/objects",
+      requestType: "StorageListObjectsRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "headStorageObject",
+      method: "POST",
+      path: "/storage/objects/head",
+      requestType: "StorageObjectRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "existsStorageObject",
+      method: "POST",
+      path: "/storage/objects/exists",
+      requestType: "StorageObjectRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "validateStorageObject",
+      method: "POST",
+      path: "/storage/objects/validate",
+      requestType: "StorageObjectValidateRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "updateStorageObject",
+      method: "POST",
+      path: "/storage/objects/update",
+      requestType: "StorageUpdateObjectRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "copyStorageObject",
+      method: "POST",
+      path: "/storage/objects/copy",
+      requestType: "StorageObjectCopyRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageObjectUrl",
+      method: "POST",
+      path: "/storage/objects/url",
+      requestType: "StorageObjectRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageObjectPublicUrl",
+      method: "POST",
+      path: "/storage/objects/public-url",
+      requestType: "StorageObjectPublicUrlRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageObject",
+      method: "POST",
+      path: "/storage/objects/delete",
+      requestType: "StorageObjectRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "createStorageObjectUploadUrl",
+      method: "POST",
+      path: "/storage/objects/upload-url",
+      requestType: "StoragePresignUploadRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "createStorageObjectPostPolicy",
+      method: "POST",
+      path: "/storage/objects/post-policy",
+      requestType: "StorageSignedPostPolicyRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "listStorageObjectVersions",
+      method: "POST",
+      path: "/storage/objects/versions",
+      requestType: "StorageObjectVersionListRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "restoreStorageObjectVersion",
+      method: "POST",
+      path: "/storage/objects/versions/restore",
+      requestType: "StorageObjectVersionMutationRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageObjectVersion",
+      method: "POST",
+      path: "/storage/objects/versions/delete",
+      requestType: "StorageObjectVersionMutationRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "createStorageObjectFolder",
+      method: "POST",
+      path: "/storage/objects/folder",
+      requestType: "StorageObjectFolderCreateRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageObjectFolder",
+      method: "POST",
+      path: "/storage/objects/folder/delete",
+      requestType: "StorageObjectFolderDeleteRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "renameStorageObjectFolder",
+      method: "POST",
+      path: "/storage/objects/folder/rename",
+      requestType: "StorageObjectFolderRenameRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "listStorageBuckets",
+      method: "POST",
+      path: "/storage/buckets/list",
+      requestType: "Omit<StorageObjectBaseRequest, 'bucket'>",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "createStorageBucket",
+      method: "POST",
+      path: "/storage/buckets/create",
+      requestType: "StorageObjectBaseRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageBucket",
+      method: "POST",
+      path: "/storage/buckets/delete",
+      requestType: "StorageObjectBaseRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageBucketLifecycle",
+      method: "POST",
+      path: "/storage/buckets/lifecycle",
+      requestType: "StorageBucketLifecycleRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "setStorageBucketLifecycle",
+      method: "POST",
+      path: "/storage/buckets/lifecycle/set",
+      requestType: "StorageSetBucketLifecycleRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageBucketLifecycle",
+      method: "POST",
+      path: "/storage/buckets/lifecycle/delete",
+      requestType: "StorageBucketLifecycleRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageBucketPolicy",
+      method: "POST",
+      path: "/storage/buckets/policy",
+      requestType: "StorageBucketPolicyRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "setStorageBucketPolicy",
+      method: "POST",
+      path: "/storage/buckets/policy/set",
+      requestType: "StorageSetBucketPolicyRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageBucketPolicy",
+      method: "POST",
+      path: "/storage/buckets/policy/delete",
+      requestType: "StorageBucketPolicyRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageBucketPublicAccess",
+      method: "POST",
+      path: "/storage/buckets/public-access",
+      requestType: "StoragePublicAccessBlockRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "setStorageBucketPublicAccess",
+      method: "POST",
+      path: "/storage/buckets/public-access/set",
+      requestType: "StorageSetPublicAccessBlockRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "deleteStorageBucketPublicAccess",
+      method: "POST",
+      path: "/storage/buckets/public-access/delete",
+      requestType: "StoragePublicAccessBlockRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "getStorageBucketCors",
+      method: "POST",
+      path: "/storage/buckets/cors",
+      requestType: "StorageBucketCorsRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "setStorageBucketCors",
+      method: "POST",
+      path: "/storage/buckets/cors/set",
+      requestType: "StorageSetBucketCorsRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
     },
     {
-      name: "getStorageFileProxy",
-      method: "GET",
-      path: "/storage/files/{file_id}/proxy",
-      pathParams: ["file_id"],
-      queryParams: ["purpose"],
-      responseEnvelope: "raw",
-      responseType: "Response",
-      binary: true
+      name: "deleteStorageBucketCors",
+      method: "POST",
+      path: "/storage/buckets/cors/delete",
+      requestType: "StorageBucketCorsRequest",
+      responseEnvelope: "athena",
+      responseType: "Record<string, unknown>"
     },
     {
-      name: "updateStorageFile",
-      method: "PATCH",
-      path: "/storage/files/{file_id}",
-      pathParams: ["file_id"],
-      requestType: "UpdateStorageFileRequest",
+      name: "createStorageMultipartUpload",
+      method: "POST",
+      path: "/storage/multipart/create",
+      requestType: "StorageMultipartCreateRequest",
       responseEnvelope: "athena",
-      responseType: "StorageFileMutationResponse"
+      responseType: "Record<string, unknown>"
     },
     {
-      name: "deleteStorageFile",
-      method: "DELETE",
-      path: "/storage/files/{file_id}",
-      pathParams: ["file_id"],
+      name: "signStorageMultipartPart",
+      method: "POST",
+      path: "/storage/multipart/sign-part",
+      requestType: "StorageMultipartSignPartRequest",
       responseEnvelope: "athena",
-      responseType: "StorageFileMutationResponse"
+      responseType: "Record<string, unknown>"
     },
     {
-      name: "setStorageFileVisibility",
-      method: "PATCH",
-      path: "/storage/files/{file_id}/visibility",
-      pathParams: ["file_id"],
-      requestType: "SetStorageFileVisibilityRequest",
+      name: "completeStorageMultipartUpload",
+      method: "POST",
+      path: "/storage/multipart/complete",
+      requestType: "StorageMultipartCompleteRequest",
       responseEnvelope: "athena",
       responseType: "StorageFileMutationResponse"
     },
     {
-      name: "deleteStorageFolder",
+      name: "abortStorageMultipartUpload",
       method: "POST",
-      path: "/storage/folders/delete",
-      requestType: "DeleteStorageFolderRequest",
+      path: "/storage/multipart/abort",
+      requestType: "StorageMultipartAbortRequest",
       responseEnvelope: "athena",
-      responseType: "StorageFolderMutationResponse"
+      responseType: "Record<string, unknown>"
     },
     {
-      name: "moveStorageFolder",
+      name: "listStorageMultipartParts",
       method: "POST",
-      path: "/storage/folders/move",
-      requestType: "MoveStorageFolderRequest",
+      path: "/storage/multipart/list-parts",
+      requestType: "StorageMultipartListPartsRequest",
       responseEnvelope: "athena",
-      responseType: "StorageFolderMutationResponse"
+      responseType: "Record<string, unknown>"
+    },
+    {
+      name: "listStorageAuditEvents",
+      method: "POST",
+      path: "/storage/audit/list",
+      requestType: "StorageAuditQueryRequest",
+      responseEnvelope: "athena",
+      responseType: "StorageAuditListResponse"
     }
   ]
 };
@@ -4316,7 +5029,7 @@ async function putPresignedUploadBody(uploadUrl, uploadHeaders, body, options) {
   return fetch(uploadUrl, init);
 }
 function attachManagedUpload(upload) {
-  const headers = {};
+  const headers = { ...upload.headers ?? {} };
   return {
     ...upload,
     method: "PUT",
@@ -4362,7 +5075,12 @@ function normalizeUploadUrlRequest(input) {
     file_id: input.file_id ?? input.fileId,
     public: input.public,
     visibility: input.visibility,
-    metadata: input.metadata
+    metadata: input.metadata,
+    server_side_encryption: input.server_side_encryption,
+    sse: input.sse,
+    ssekms_key_id: input.ssekms_key_id,
+    kms_key_id: input.kms_key_id,
+    bucket_key_enabled: input.bucket_key_enabled
   };
 }
 async function callStorageUploadBinaryEndpoint(gateway, endpoint, body, options, runtimeOptions) {
@@ -4513,6 +5231,12 @@ function createStorageModule(gateway, runtimeOptions) {
     options,
     resolvedRuntimeOptions
   );
+  const callStorageFileVisibility = (fileId, method, input, options) => callAthena2(
+    withPathParam("/storage/files/{file_id}/visibility", "file_id", fileId),
+    method,
+    input,
+    options
+  );
   const base = {
     listStorageCatalogs(options) {
       return callRaw("/storage/catalogs", "GET", void 0, options);
@@ -4562,7 +5286,7 @@ function createStorageModule(gateway, runtimeOptions) {
       return callAthena2(withPathParam("/storage/files/{file_id}", "file_id", fileId), "DELETE", void 0, options);
     },
     setStorageFileVisibility(fileId, input, options) {
-      return callAthena2(withPathParam("/storage/files/{file_id}/visibility", "file_id", fileId), "PATCH", input, options);
+      return callStorageFileVisibility(fileId, "PATCH", input, options);
     },
     deleteStorageFolder(input, options) {
       return callAthena2("/storage/folders/delete", "POST", input, options);
@@ -4634,13 +5358,62 @@ function createStorageModule(gateway, runtimeOptions) {
     publicUrl(fileId, options) {
       return callAthena2(withPathParam("/storage/files/{file_id}/public-url", "file_id", fileId), "GET", void 0, options);
     },
+    proxyUrl(fileId, query, options) {
+      const path = appendQuery(
+        withPathParam("/storage/files/{file_id}/proxy-url", "file_id", fileId),
+        query
+      );
+      return callAthena2(path, "GET", void 0, options);
+    },
     proxy(fileId, query, options) {
       return base.getStorageFileProxy(fileId, query, options);
     },
-    visibility: {
+    versions(fileId, options) {
+      return callAthena2(withPathParam("/storage/files/{file_id}/versions", "file_id", fileId), "GET", void 0, options);
+    },
+    restoreVersion(fileId, versionId, options) {
+      return callAthena2(
+        withPathParam(
+          withPathParam("/storage/files/{file_id}/versions/{version_id}/restore", "file_id", fileId),
+          "version_id",
+          versionId
+        ),
+        "POST",
+        {},
+        options
+      );
+    },
+    deleteVersion(fileId, versionId, options) {
+      return callAthena2(
+        withPathParam(
+          withPathParam("/storage/files/{file_id}/versions/{version_id}", "file_id", fileId),
+          "version_id",
+          versionId
+        ),
+        "DELETE",
+        void 0,
+        options
+      );
+    },
+    retention: {
+      get(fileId, query, options) {
+        const path = appendQuery(
+          withPathParam("/storage/files/{file_id}/retention", "file_id", fileId),
+          query
+        );
+        return callAthena2(path, "GET", void 0, options);
+      },
       set(fileId, input, options) {
+        return callAthena2(withPathParam("/storage/files/{file_id}/retention", "file_id", fileId), "POST", input, options);
+      }
+    },
+    visibility: {
+      update(fileId, input, options) {
         return base.setStorageFileVisibility(fileId, input, options);
       },
+      set(fileId, input, options) {
+        return callStorageFileVisibility(fileId, "POST", input, options);
+      },
       setMany(input, options) {
         return callAthena2("/storage/files/visibility-many", "POST", input, options);
       }
@@ -4735,6 +5508,18 @@ function createStorageModule(gateway, runtimeOptions) {
     uploadUrl(input, options) {
       return callAthena2("/storage/objects/upload-url", "POST", input, options);
     },
+    versions(input, options) {
+      return callAthena2("/storage/objects/versions", "POST", input, options);
+    },
+    restoreVersion(input, options) {
+      return callAthena2("/storage/objects/versions/restore", "POST", input, options);
+    },
+    deleteVersion(input, options) {
+      return callAthena2("/storage/objects/versions/delete", "POST", input, options);
+    },
+    postPolicy(input, options) {
+      return callAthena2("/storage/objects/post-policy", "POST", input, options);
+    },
     folder: objectFolder
   };
   const bucket = {
@@ -4747,6 +5532,39 @@ function createStorageModule(gateway, runtimeOptions) {
     delete(input, options) {
       return callAthena2("/storage/buckets/delete", "POST", input, options);
     },
+    lifecycle: {
+      get(input, options) {
+        return callAthena2("/storage/buckets/lifecycle", "POST", input, options);
+      },
+      set(input, options) {
+        return callAthena2("/storage/buckets/lifecycle/set", "POST", input, options);
+      },
+      delete(input, options) {
+        return callAthena2("/storage/buckets/lifecycle/delete", "POST", input, options);
+      }
+    },
+    policy: {
+      get(input, options) {
+        return callAthena2("/storage/buckets/policy", "POST", input, options);
+      },
+      set(input, options) {
+        return callAthena2("/storage/buckets/policy/set", "POST", input, options);
+      },
+      delete(input, options) {
+        return callAthena2("/storage/buckets/policy/delete", "POST", input, options);
+      }
+    },
+    publicAccess: {
+      get(input, options) {
+        return callAthena2("/storage/buckets/public-access", "POST", input, options);
+      },
+      set(input, options) {
+        return callAthena2("/storage/buckets/public-access/set", "POST", input, options);
+      },
+      delete(input, options) {
+        return callAthena2("/storage/buckets/public-access/delete", "POST", input, options);
+      }
+    },
     cors: {
       get(input, options) {
         return callAthena2("/storage/buckets/cors", "POST", input, options);
@@ -4848,6 +5666,9 @@ var AthenaClientBuilderImpl = class {
   apiKey;
   backendConfig = DEFAULT_BACKEND;
   clientName;
+  defaultUserId;
+  defaultOrganizationId;
+  forceNoCacheEnabled = false;
   defaultHeaders;
   authConfig;
   dbUrlOverride;
@@ -4896,6 +5717,15 @@ var AthenaClientBuilderImpl = class {
     if (options.client !== void 0) {
       this.clientName = options.client;
     }
+    if (options.userId !== void 0) {
+      this.defaultUserId = options.userId;
+    }
+    if (options.organizationId !== void 0) {
+      this.defaultOrganizationId = options.organizationId;
+    }
+    if (options.forceNoCache !== void 0) {
+      this.forceNoCacheEnabled = options.forceNoCache;
+    }
     if (options.backend !== void 0) {
       this.backendConfig = toBackendConfig(options.backend);
     }
@@ -4950,6 +5780,9 @@ var AthenaClientBuilderImpl = class {
       url: this.rootUrl,
       key: this.apiKey,
       client: this.clientName,
+      userId: this.defaultUserId,
+      organizationId: this.defaultOrganizationId,
+      forceNoCache: this.forceNoCacheEnabled,
       backend: this.backendConfig,
       headers: this.defaultHeaders,
       db: this.dbUrlOverride ? { url: this.dbUrlOverride } : void 0,
@@ -7492,6 +8325,83 @@ function createQueryBuilder(client, formatGatewayResult, experimental, tracer) {
     );
   };
 }
+var ATHENA_ENV_URL_KEYS = ["ATHENA_URL", "NEXT_PUBLIC_ATHENA_URL"];
+var ATHENA_ENV_GATEWAY_URL_KEYS = [
+  "ATHENA_DB_URL",
+  "ATHENA_GATEWAY_URL",
+  "NEXT_PUBLIC_ATHENA_DB_API_URL"
+];
+var ATHENA_ENV_AUTH_URL_KEYS = ["ATHENA_AUTH_URL", "NEXT_PUBLIC_ATHENA_AUTH_URL"];
+var ATHENA_ENV_STORAGE_URL_KEYS = ["ATHENA_STORAGE_URL", "NEXT_PUBLIC_ATHENA_STORAGE_URL"];
+var ATHENA_ENV_KEY_KEYS = [
+  "ATHENA_API_KEY",
+  "NEXT_PUBLIC_ATHENA_API_KEY",
+  "ATHENA_GATEWAY_API_KEY",
+  "X_API_KEY"
+];
+var ATHENA_ENV_CLIENT_KEYS = ["ATHENA_CLIENT", "NEXT_PUBLIC_ATHENA_CLIENT"];
+function normalizeOptionalString(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function readFirstEnvValue(env, keys) {
+  for (const key of keys) {
+    const value = normalizeOptionalString(env[key]);
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function readHeaderBagValue(headers, targetKey) {
+  if (!headers) {
+    return void 0;
+  }
+  if (typeof headers.get === "function") {
+    return normalizeOptionalString(headers.get(targetKey));
+  }
+  const normalizedTargetKey = targetKey.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== normalizedTargetKey) {
+      continue;
+    }
+    if (typeof value === "string") {
+      return normalizeOptionalString(value);
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function resolveSessionContextOptions(session, options) {
+  const sessionToken = normalizeOptionalString(session?.session?.token);
+  const requestCookie = readHeaderBagValue(options?.requestHeaders, "cookie") ?? readHeaderBagValue(options?.headers, "cookie");
+  const authInput = options?.auth;
+  const resolvedUserId = options?.userId !== void 0 ? options.userId : session?.user?.id;
+  const resolvedOrganizationId = options?.organizationId !== void 0 ? options.organizationId : session?.session?.activeOrganizationId;
+  const resolvedBearerToken = authInput?.bearerToken !== void 0 ? authInput.bearerToken : sessionToken;
+  const resolvedSessionToken = authInput?.sessionToken !== void 0 ? authInput.sessionToken : sessionToken;
+  const resolvedCookie = authInput?.cookie !== void 0 ? authInput.cookie : requestCookie;
+  const auth = authInput !== void 0 || resolvedBearerToken !== void 0 || resolvedSessionToken !== void 0 || resolvedCookie !== void 0 ? {
+    ...authInput ?? {},
+    ...resolvedBearerToken !== void 0 ? { bearerToken: resolvedBearerToken } : {},
+    ...resolvedSessionToken !== void 0 ? { sessionToken: resolvedSessionToken } : {},
+    ...resolvedCookie !== void 0 ? { cookie: resolvedCookie } : {},
+    headers: authInput?.headers ? { ...authInput.headers } : void 0
+  } : void 0;
+  if (resolvedUserId === void 0 && resolvedOrganizationId === void 0 && options?.forceNoCache === void 0 && !options?.headers && !auth) {
+    return void 0;
+  }
+  return {
+    userId: resolvedUserId,
+    organizationId: resolvedOrganizationId,
+    forceNoCache: options?.forceNoCache,
+    headers: options?.headers ? { ...options.headers } : void 0,
+    auth
+  };
+}
 function resolveClientServiceBaseUrl(value, label) {
   if (value === void 0 || value === null) {
     return void 0;
@@ -7513,21 +8423,143 @@ function resolveServiceUrls(config) {
     storageUrl: resolveServiceUrlOverride(config.storage?.url, "Athena storage base URL") ?? resolveServiceUrlOverride(config.storageUrl, "Athena storage base URL") ?? (baseUrl ? appendServicePath(baseUrl, "storage") : void 0)
   };
 }
+function resolveOptionalClientName(value) {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function resolveRequiredClientApiKey(value) {
+  if (value === void 0 || value === null) {
+    throw new Error(
+      "Athena API key is required. Pass createClient(url, key) with a real API key, or set key in the config object."
+    );
+  }
+  const normalizedValue = value.trim();
+  if (!normalizedValue) {
+    throw new Error(
+      "Athena API key is required. Pass createClient(url, key) with a real API key, or set key in the config object."
+    );
+  }
+  return normalizedValue;
+}
+function hasHeaderIgnoreCase(headers, targetKey) {
+  const normalizedTargetKey = targetKey.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === normalizedTargetKey);
+}
+function mergeClientHeaders(current, next) {
+  if (!current && !next) {
+    return void 0;
+  }
+  return {
+    ...current ?? {},
+    ...next ?? {}
+  };
+}
+function mergeDefinedObject(current, next) {
+  if (!current && !next) {
+    return void 0;
+  }
+  const merged = {
+    ...current ?? {}
+  };
+  const mutableMerged = merged;
+  for (const [key, value] of Object.entries(next ?? {})) {
+    if (value !== void 0) {
+      mutableMerged[key] = value;
+    }
+  }
+  return merged;
+}
+function mergeAuthClientOptions(current, next) {
+  const merged = mergeDefinedObject(current, next);
+  if (!merged) {
+    return void 0;
+  }
+  const mergedHeaders = mergeClientHeaders(current?.headers, next?.headers);
+  if (mergedHeaders) {
+    merged.headers = mergedHeaders;
+  }
+  return merged;
+}
+function mergeServiceUrlOverrides(current, next) {
+  return mergeDefinedObject(current, next);
+}
+function toClientContextOverrides(context) {
+  if (!context) {
+    return void 0;
+  }
+  return {
+    userId: context.userId,
+    organizationId: context.organizationId,
+    forceNoCache: context.forceNoCache,
+    headers: context.headers,
+    auth: context.auth ? {
+      ...context.auth,
+      headers: context.auth.headers ? { ...context.auth.headers } : void 0
+    } : void 0
+  };
+}
+function mergeClientOverrideOptions(base, overrides) {
+  if (!overrides) {
+    return {
+      ...base,
+      headers: base.headers ? { ...base.headers } : void 0,
+      auth: base.auth ? {
+        ...base.auth,
+        headers: base.auth.headers ? { ...base.auth.headers } : void 0
+      } : void 0,
+      db: base.db ? { ...base.db } : void 0,
+      gateway: base.gateway ? { ...base.gateway } : void 0,
+      storage: base.storage ? { ...base.storage } : void 0
+    };
+  }
+  const merged = mergeDefinedObject(base, overrides) ?? { ...base };
+  return {
+    ...merged,
+    headers: mergeClientHeaders(base.headers, overrides.headers),
+    auth: mergeAuthClientOptions(base.auth, overrides.auth),
+    db: mergeServiceUrlOverrides(base.db, overrides.db),
+    gateway: mergeServiceUrlOverrides(base.gateway, overrides.gateway),
+    storage: mergeServiceUrlOverrides(base.storage, overrides.storage)
+  };
+}
 function normalizeAuthClientConfig(auth, defaultBaseUrl) {
   if (!auth && defaultBaseUrl === void 0) {
     return void 0;
   }
-  const { url, ...rest } = auth ?? {};
+  const {
+    url,
+    baseUrl,
+    apiKey,
+    bearerToken,
+    cookie,
+    sessionToken,
+    ...rest
+  } = auth ?? {};
   const normalized = {
     ...rest
   };
   const resolvedBaseUrl = resolveClientServiceBaseUrl(
-    url ?? rest.baseUrl ?? defaultBaseUrl,
+    url ?? baseUrl ?? defaultBaseUrl,
     "Athena auth base URL"
   );
   if (resolvedBaseUrl !== void 0) {
     normalized.baseUrl = resolvedBaseUrl;
   }
+  if (typeof apiKey === "string") {
+    normalized.apiKey = apiKey;
+  }
+  if (typeof bearerToken === "string") {
+    normalized.bearerToken = bearerToken;
+  }
+  if (typeof cookie === "string") {
+    normalized.cookie = cookie;
+  }
+  if (typeof sessionToken === "string") {
+    normalized.sessionToken = sessionToken;
+  }
   return normalized;
 }
 function resolveCreateClientConfig(config) {
@@ -7539,8 +8571,11 @@ function resolveCreateClientConfig(config) {
   }
   return {
     baseUrl: resolvedUrls.dbUrl,
-    apiKey: config.key,
-    client: config.client,
+    apiKey: resolveRequiredClientApiKey(config.key),
+    client: resolveOptionalClientName(config.client),
+    userId: config.userId,
+    organizationId: config.organizationId,
+    forceNoCache: config.forceNoCache,
     backend: toBackendConfig(config.backend),
     headers: config.headers,
     auth: config.auth,
@@ -7549,23 +8584,39 @@ function resolveCreateClientConfig(config) {
     experimental: config.experimental
   };
 }
-function createClientFromConfig(config) {
+function createClientFromInput(sourceConfig) {
+  return createClientFromConfig(resolveCreateClientConfig(sourceConfig), sourceConfig);
+}
+function createClientFromConfig(config, sourceConfig) {
+  const normalizedAuthConfig = normalizeAuthClientConfig(config.auth, config.authUrl);
   const gatewayHeaders = {
     ...config.headers ?? {}
   };
-  if (config.auth?.bearerToken && gatewayHeaders["X-Athena-Auth-Bearer-Token"] === void 0 && gatewayHeaders["x-athena-auth-bearer-token"] === void 0) {
-    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = config.auth.bearerToken;
+  if (normalizedAuthConfig?.bearerToken && !hasHeaderIgnoreCase(gatewayHeaders, "X-Athena-Auth-Bearer-Token")) {
+    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = normalizedAuthConfig.bearerToken;
+  }
+  if (normalizedAuthConfig?.cookie && !hasHeaderIgnoreCase(gatewayHeaders, "Cookie")) {
+    gatewayHeaders.Cookie = normalizedAuthConfig.cookie;
+  }
+  if (normalizedAuthConfig?.sessionToken && !hasHeaderIgnoreCase(gatewayHeaders, "X-Athena-Auth-Session-Token")) {
+    gatewayHeaders["X-Athena-Auth-Session-Token"] = normalizedAuthConfig.sessionToken;
   }
   const gateway = createAthenaGatewayClient({
     baseUrl: config.baseUrl,
     apiKey: config.apiKey,
     client: config.client,
+    userId: config.userId,
+    organizationId: config.organizationId,
+    forceNoCache: config.forceNoCache,
     backend: config.backend,
     headers: gatewayHeaders
   });
   const formatGatewayResult = createResultFormatter(config.experimental);
   const queryTracer = createQueryTracer(config.experimental);
-  const auth = createAuthClient(normalizeAuthClientConfig(config.auth, config.authUrl));
+  const auth = createAuthClient({
+    ...normalizedAuthConfig ?? {},
+    ...config.forceNoCache ? { forceNoCache: true } : {}
+  });
   function from(tableOrModel, options) {
     if (isAthenaModelTarget(tableOrModel)) {
       if (options?.schema !== void 0) {
@@ -7613,17 +8664,45 @@ function createClientFromConfig(config) {
     queryTracer
   );
   const db = createDbModule({ from, rpc, query });
+  const withContext = (context) => createClientFromInput(
+    mergeClientOverrideOptions(sourceConfig, toClientContextOverrides(context))
+  );
+  const withSession = (session, options) => createClientFromInput(
+    mergeClientOverrideOptions(
+      sourceConfig,
+      toClientContextOverrides(resolveSessionContextOptions(session, options))
+    )
+  );
+  const authWithOptions = (options) => createClientFromInput(mergeClientOverrideOptions(sourceConfig, options));
   const sdkClient = {
     from,
     db,
     rpc,
     query,
     verifyConnection: gateway.verifyConnection,
-    auth: auth.auth
+    auth: auth.auth,
+    withContext,
+    withSession,
+    withOptions: authWithOptions
   };
   if (config.experimental?.athenaStorageBackend) {
+    const storageWithContext = (context) => createClientFromInput(
+      mergeClientOverrideOptions(sourceConfig, toClientContextOverrides(context))
+    );
+    const storageWithSession = (session, options) => createClientFromInput(
+      mergeClientOverrideOptions(
+        sourceConfig,
+        toClientContextOverrides(resolveSessionContextOptions(session, options))
+      )
+    );
+    const storageWithOptions = (options) => createClientFromInput(
+      mergeClientOverrideOptions(sourceConfig, options)
+    );
     const storageClient = {
       ...sdkClient,
+      withContext: storageWithContext,
+      withSession: storageWithSession,
+      withOptions: storageWithOptions,
       storage: createStorageModule(gateway, {
         ...config.experimental.storage,
         ...config.storageUrl ? {
@@ -7639,38 +8718,42 @@ function createClientFromConfig(config) {
 var AthenaClient = class {
   /** Create a fluent builder for a strongly-typed Athena SDK client. */
   static builder() {
-    return createAthenaClientBuilder((config) => createClientFromConfig(resolveCreateClientConfig(config)));
-  }
-  /** Build a client from process environment variables. */
-  static fromEnvironment() {
-    const url = process.env.ATHENA_URL;
-    const gatewayUrl = process.env.ATHENA_DB_URL ?? process.env.ATHENA_GATEWAY_URL;
-    const authUrl = process.env.ATHENA_AUTH_URL;
-    const storageUrl = process.env.ATHENA_STORAGE_URL;
-    const key = process.env.ATHENA_API_KEY ?? process.env.ATHENA_GATEWAY_API_KEY;
+    return createAthenaClientBuilder((config) => createClientFromInput(config));
+  }
+  static fromEnvironment(options = {}) {
+    const env = options.env ?? process.env;
+    const url = options.url ?? readFirstEnvValue(env, ATHENA_ENV_URL_KEYS);
+    const gatewayUrl = options.gatewayUrl ?? readFirstEnvValue(env, ATHENA_ENV_GATEWAY_URL_KEYS);
+    const authUrl = options.authUrl ?? readFirstEnvValue(env, ATHENA_ENV_AUTH_URL_KEYS);
+    const storageUrl = options.storageUrl ?? readFirstEnvValue(env, ATHENA_ENV_STORAGE_URL_KEYS);
+    const key = options.key ?? readFirstEnvValue(env, ATHENA_ENV_KEY_KEYS);
+    const client = options.client ?? readFirstEnvValue(env, ATHENA_ENV_CLIENT_KEYS);
     if (!url && !gatewayUrl || !key) {
       throw new Error(
-        "ATHENA_API_KEY plus ATHENA_URL or ATHENA_GATEWAY_URL (optionally ATHENA_DB_URL, ATHENA_AUTH_URL, ATHENA_STORAGE_URL) are required"
+        "AthenaClient.fromEnvironment() requires an API key plus a public or gateway URL. Supported aliases include ATHENA_API_KEY, NEXT_PUBLIC_ATHENA_API_KEY, ATHENA_GATEWAY_API_KEY, X_API_KEY, ATHENA_URL, NEXT_PUBLIC_ATHENA_URL, ATHENA_GATEWAY_URL, and ATHENA_DB_URL."
       );
     }
+    const { env: _env, ...clientOptions } = options;
     return createClient({
+      ...clientOptions,
       url,
       gatewayUrl,
       authUrl,
       storageUrl,
-      key
+      key,
+      client
     });
   }
 };
 function createClient(configOrUrl, apiKey, options) {
-  if (typeof configOrUrl === "string") {
-    return createClientFromConfig(resolveCreateClientConfig({
+  if (typeof configOrUrl === "string" || configOrUrl === null || configOrUrl === void 0) {
+    return createClientFromInput({
       url: configOrUrl,
       key: apiKey ?? "",
       ...options
-    }));
+    });
   }
-  return createClientFromConfig(resolveCreateClientConfig(configOrUrl));
+  return createClientFromInput(configOrUrl);
 }
 
 // src/gateway/types.ts
@@ -8036,6 +9119,9 @@ function createColumnsBuilder(name, mappedName, schemaName, columns) {
       resolveTableTarget(name, mappedName, normalizedSchemaName);
       return createColumnsBuilder(name, mappedName, normalizedSchemaName, columns);
     },
+    withoutPrimaryKey() {
+      return finalizeTable(name, mappedName, schemaName, columns, []);
+    },
     primaryKey(...keys) {
       return finalizeTable(name, mappedName, schemaName, columns, keys);
     }
@@ -8087,6 +9173,59 @@ var TenantHeaderMapper = class {
     return Object.keys(headers).length > 0 ? headers : void 0;
   }
 };
+function normalizeOptionalString2(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function readHeaderBagValue2(headers, targetKey) {
+  if (!headers) {
+    return void 0;
+  }
+  if (typeof headers.get === "function") {
+    return normalizeOptionalString2(headers.get(targetKey));
+  }
+  const normalizedTargetKey = targetKey.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== normalizedTargetKey) {
+      continue;
+    }
+    if (typeof value === "string") {
+      return normalizeOptionalString2(value);
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function resolveSessionContextOptions2(session, options) {
+  const sessionToken = normalizeOptionalString2(session?.session?.token);
+  const requestCookie = readHeaderBagValue2(options?.requestHeaders, "cookie") ?? readHeaderBagValue2(options?.headers, "cookie");
+  const authInput = options?.auth;
+  const resolvedUserId = options?.userId !== void 0 ? options.userId : session?.user?.id;
+  const resolvedOrganizationId = options?.organizationId !== void 0 ? options.organizationId : session?.session?.activeOrganizationId;
+  const resolvedBearerToken = authInput?.bearerToken !== void 0 ? authInput.bearerToken : sessionToken;
+  const resolvedSessionToken = authInput?.sessionToken !== void 0 ? authInput.sessionToken : sessionToken;
+  const resolvedCookie = authInput?.cookie !== void 0 ? authInput.cookie : requestCookie;
+  const auth = authInput !== void 0 || resolvedBearerToken !== void 0 || resolvedSessionToken !== void 0 || resolvedCookie !== void 0 ? {
+    ...authInput ?? {},
+    ...resolvedBearerToken !== void 0 ? { bearerToken: resolvedBearerToken } : {},
+    ...resolvedSessionToken !== void 0 ? { sessionToken: resolvedSessionToken } : {},
+    ...resolvedCookie !== void 0 ? { cookie: resolvedCookie } : {},
+    headers: authInput?.headers ? { ...authInput.headers } : void 0
+  } : void 0;
+  if (resolvedUserId === void 0 && resolvedOrganizationId === void 0 && options?.forceNoCache === void 0 && !options?.headers && !auth) {
+    return void 0;
+  }
+  return {
+    userId: resolvedUserId,
+    organizationId: resolvedOrganizationId,
+    forceNoCache: options?.forceNoCache,
+    headers: options?.headers ? { ...options.headers } : void 0,
+    auth
+  };
+}
 var RegistryNavigator = class {
   constructor(registry) {
     this.registry = registry;
@@ -8138,12 +9277,22 @@ var TypedAthenaClientImpl = class _TypedAthenaClientImpl {
       backend: input.options?.backend,
       client: input.options?.client,
       headers: input.options?.headers,
+      forceNoCache: input.options?.forceNoCache,
+      userId: input.options?.userId,
+      organizationId: input.options?.organizationId,
+      auth: input.options?.auth,
+      tenantKeyMap,
+      tenantContext,
       experimental: input.options?.experimental
     };
     this.baseClient = createClient(this.url, this.apiKey, {
       backend: this.clientOptions.backend,
       client: this.clientOptions.client,
       headers: this.tenantHeaderMapper.apply(this.clientOptions.headers, tenantContext),
+      forceNoCache: this.clientOptions.forceNoCache,
+      userId: this.clientOptions.userId,
+      organizationId: this.clientOptions.organizationId,
+      auth: this.clientOptions.auth,
       experimental: this.clientOptions.experimental
     });
     this.db = this.baseClient.db;
@@ -8161,6 +9310,40 @@ var TypedAthenaClientImpl = class _TypedAthenaClientImpl {
   verifyConnection(options) {
     return this.baseClient.verifyConnection(options);
   }
+  withContext(context) {
+    const headers = {
+      ...this.clientOptions.headers ?? {},
+      ...context?.headers ?? {}
+    };
+    const auth = this.clientOptions.auth || context?.auth ? {
+      ...this.clientOptions.auth ?? {},
+      ...context?.auth ?? {},
+      headers: this.clientOptions.auth?.headers || context?.auth?.headers ? {
+        ...this.clientOptions.auth?.headers ?? {},
+        ...context?.auth?.headers ?? {}
+      } : void 0
+    } : void 0;
+    return new _TypedAthenaClientImpl({
+      registry: this.registry,
+      url: this.url,
+      apiKey: this.apiKey,
+      options: {
+        ...this.clientOptions,
+        headers: Object.keys(headers).length > 0 ? headers : void 0,
+        auth,
+        tenantKeyMap: this.tenantKeyMap,
+        tenantContext: {
+          ...this.tenantContext
+        },
+        ...context?.userId !== void 0 ? { userId: context.userId } : {},
+        ...context?.organizationId !== void 0 ? { organizationId: context.organizationId } : {},
+        ...context?.forceNoCache !== void 0 ? { forceNoCache: context.forceNoCache } : {}
+      }
+    });
+  }
+  withSession(session, options) {
+    return this.withContext(resolveSessionContextOptions2(session, options));
+  }
   withTenantContext(context) {
     return new _TypedAthenaClientImpl({
       registry: this.registry,
@@ -8221,6 +9404,77 @@ function resolveProviderSchemas(providerConfig) {
   return [...DEFAULT_POSTGRES_SCHEMAS];
 }
 
+// src/generator/table-selection.ts
+function normalizeTableSelector(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeTableSelection(value) {
+  if (typeof value === "string") {
+    return Array.from(
+      new Set(
+        value.split(",").map(normalizeTableSelector).filter((entry) => Boolean(entry))
+      )
+    );
+  }
+  if (Array.isArray(value)) {
+    return Array.from(
+      new Set(
+        value.map((entry) => typeof entry === "string" ? normalizeTableSelector(entry) : void 0).filter((entry) => Boolean(entry))
+      )
+    );
+  }
+  return [];
+}
+function matchesTableSelector(schemaName, tableName, selector) {
+  const separatorIndex = selector.indexOf(".");
+  if (separatorIndex < 0) {
+    return tableName === selector;
+  }
+  const selectorSchema = selector.slice(0, separatorIndex).trim();
+  const selectorTable = selector.slice(separatorIndex + 1).trim();
+  return selectorSchema === schemaName && selectorTable === tableName;
+}
+function shouldKeepTable(schemaName, tableName, filter) {
+  const included = filter.includeTables.length === 0 || filter.includeTables.some((selector) => matchesTableSelector(schemaName, tableName, selector));
+  if (!included) {
+    return false;
+  }
+  return !filter.excludeTables.some((selector) => matchesTableSelector(schemaName, tableName, selector));
+}
+function hasTableFilters(filter) {
+  return filter.includeTables.length > 0 || filter.excludeTables.length > 0;
+}
+function filterIntrospectionSnapshot(snapshot, filter) {
+  if (!hasTableFilters(filter)) {
+    return snapshot;
+  }
+  const schemas = {};
+  for (const [schemaName, schema] of Object.entries(snapshot.schemas)) {
+    const tables = Object.fromEntries(
+      Object.entries(schema.tables).filter(([tableName]) => shouldKeepTable(schemaName, tableName, filter))
+    );
+    if (Object.keys(tables).length === 0) {
+      continue;
+    }
+    schemas[schemaName] = {
+      ...schema,
+      tables
+    };
+  }
+  if (Object.keys(schemas).length === 0) {
+    const includeLabel = filter.includeTables.length > 0 ? ` includeTables=${filter.includeTables.join(", ")}` : "";
+    const excludeLabel = filter.excludeTables.length > 0 ? ` excludeTables=${filter.excludeTables.join(", ")}` : "";
+    throw new Error(
+      `Generator table filters matched no tables after schema selection.${includeLabel}${excludeLabel}`
+    );
+  }
+  return {
+    ...snapshot,
+    schemas
+  };
+}
+
 // src/generator/env.ts
 function readEnvStringValue(key) {
   if (typeof process === "undefined" || !process.env) {
@@ -8879,7 +10133,12 @@ async function runSchemaGenerator(options = {}) {
   return throwBrowserUnsupported("runSchemaGenerator");
 }
 
+exports.ATHENA_AUTH_ADMIN_LIMITS = ATHENA_AUTH_ADMIN_LIMITS;
 exports.ATHENA_AUTH_BASE_ERROR_CODES = ATHENA_AUTH_BASE_ERROR_CODES;
+exports.ATHENA_AUTH_MAX_ADMIN_JSON_BYTES = ATHENA_AUTH_MAX_ADMIN_JSON_BYTES;
+exports.ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH = ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH;
+exports.ATHENA_AUTH_MAX_TEMPLATE_VARIABLES = ATHENA_AUTH_MAX_TEMPLATE_VARIABLES;
+exports.ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH = ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH;
 exports.AthenaClient = AthenaClient;
 exports.AthenaError = AthenaError;
 exports.AthenaErrorCategory = AthenaErrorCategory;
@@ -8909,6 +10168,7 @@ exports.defineModel = defineModel;
 exports.defineRegistry = defineRegistry;
 exports.defineSchema = defineSchema;
 exports.enumeration = enumeration;
+exports.filterIntrospectionSnapshot = filterIntrospectionSnapshot;
 exports.findGeneratorConfigPath = findGeneratorConfigPath;
 exports.generateArtifactsFromSnapshot = generateArtifactsFromSnapshot;
 exports.generatorEnv = generatorEnv;
@@ -8922,6 +10182,7 @@ exports.normalizeAthenaError = normalizeAthenaError;
 exports.normalizeAthenaGatewayBaseUrl = normalizeAthenaGatewayBaseUrl;
 exports.normalizeGeneratorConfig = normalizeGeneratorConfig;
 exports.normalizeSchemaSelection = normalizeSchemaSelection;
+exports.normalizeTableSelection = normalizeTableSelection;
 exports.number = number;
 exports.parseBooleanFlag = parseBooleanFlag2;
 exports.renderAthenaReactEmail = renderAthenaReactEmail;