@xylex-group/athena 2.8.2 → 2.9.0

package/dist/index.cjs

@@ -806,7 +806,7 @@ var getCookieCache = async (request, config) => {
 
 // package.json
 var package_default = {
-  version: "2.8.2"
+  version: "2.9.0"
 };
 
 // src/sdk-version.ts
@@ -819,6 +819,7 @@ function buildSdkHeaderValue(sdkName) {
 var DEFAULT_CLIENT = "railway_direct";
 var SDK_NAME = "xylex-group/athena";
 var SDK_HEADER_VALUE = buildSdkHeaderValue(SDK_NAME);
+var NO_CACHE_HEADER_VALUE = "no-cache";
 function parseResponseBody(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -837,6 +838,9 @@ function parseResponseBody(rawText, contentType) {
 function normalizeHeaderValue(value) {
   return value ? value : void 0;
 }
+function isCacheControlHeaderName(name) {
+  return name.toLowerCase() === "cache-control";
+}
 function resolveHeaderValue(headers, candidates) {
   for (const candidate of candidates) {
     const direct = normalizeHeaderValue(headers[candidate]);
@@ -995,6 +999,7 @@ function buildRpcGetEndpoint(payload) {
 }
 function buildHeaders(config, options) {
   const mergedStripNulls = options?.stripNulls ?? true;
+  const forceNoCache = Boolean(config.forceNoCache || options?.forceNoCache);
   const extraHeaders = {
     ...config.headers ?? {},
     ...options?.headers ?? {}
@@ -1048,11 +1053,15 @@ function buildHeaders(config, options) {
   const athenaClientKeys = ["x-athena-client", "X-Athena-Client"];
   Object.entries(extraHeaders).forEach(([key, value]) => {
     if (athenaClientKeys.includes(key)) return;
+    if (forceNoCache && isCacheControlHeaderName(key)) return;
     const normalized = normalizeHeaderValue(value);
     if (normalized) {
       headers[key] = normalized;
     }
   });
+  if (forceNoCache) {
+    headers["Cache-Control"] = NO_CACHE_HEADER_VALUE;
+  }
   return headers;
 }
 function toInvalidUrlResponse(error, endpoint, method) {
@@ -1513,6 +1522,45 @@ function identifier(...segments) {
   return new SqlIdentifierPath(expandedSegments);
 }
 
+// src/auth/limits.ts
+var ATHENA_AUTH_MAX_ADMIN_JSON_BYTES = 32 * 1024;
+var ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH = 8;
+var ATHENA_AUTH_MAX_TEMPLATE_VARIABLES = 64;
+var ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH = 128;
+var ATHENA_AUTH_ADMIN_LIMITS = {
+  maxAdminJsonBytes: ATHENA_AUTH_MAX_ADMIN_JSON_BYTES,
+  maxAdminJsonDepth: ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH,
+  maxTemplateVariables: ATHENA_AUTH_MAX_TEMPLATE_VARIABLES,
+  maxTemplateVariableLength: ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH
+};
+function describeTemplateVariableTarget(target) {
+  const normalized = target?.trim();
+  return normalized && normalized.length > 0 ? normalized : "Athena auth admin email template variables";
+}
+function assertAthenaAuthTemplateVariables(variables, target) {
+  const label = describeTemplateVariableTarget(target);
+  if (!Array.isArray(variables)) {
+    throw new Error(`${label} must be an array of strings.`);
+  }
+  if (variables.length > ATHENA_AUTH_MAX_TEMPLATE_VARIABLES) {
+    throw new Error(
+      `${label} cannot contain more than ${ATHENA_AUTH_MAX_TEMPLATE_VARIABLES} entries.`
+    );
+  }
+  variables.forEach((variable, index) => {
+    if (typeof variable !== "string") {
+      throw new Error(
+        `${label} must contain only strings. Received ${typeof variable} at index ${index}.`
+      );
+    }
+    if (variable.length > ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH) {
+      throw new Error(
+        `${label} cannot contain entries longer than ${ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH} characters. Received ${variable.length} characters at index ${index}.`
+      );
+    }
+  });
+}
+
 // src/auth/react-email.ts
 var reactEmailRenderModulePromise;
 function isRecord2(value) {
@@ -1742,6 +1790,7 @@ async function resolveReactEmailPayloadFields(input, fields, options) {
 var DEFAULT_AUTH_BASE_URL = "http://localhost:3001/api/auth";
 var SDK_NAME2 = "xylex-group/athena-auth";
 var SDK_HEADER_VALUE2 = buildSdkHeaderValue(SDK_NAME2);
+var NO_CACHE_HEADER_VALUE2 = "no-cache";
 function normalizeBaseUrl(baseUrl) {
   return (baseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/$/, "");
 }
@@ -1751,6 +1800,9 @@ function isRecord3(value) {
 function normalizeHeaderValue2(value) {
   return value ? value : void 0;
 }
+function isCacheControlHeaderName2(name) {
+  return name.toLowerCase() === "cache-control";
+}
 function parseResponseBody2(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -1806,6 +1858,54 @@ function mergeCallOptions(base, override) {
     }
   };
 }
+function toSessionGuardFailure(sessionResult) {
+  if (sessionResult.status === 401 || sessionResult.data == null) {
+    return {
+      ok: false,
+      reason: "unauthorized",
+      status: 401,
+      error: sessionResult.error ?? "Unauthorized",
+      sessionResult
+    };
+  }
+  return {
+    ok: false,
+    reason: "upstream_error",
+    status: sessionResult.status,
+    error: sessionResult.error ?? "Failed to resolve current session",
+    sessionResult
+  };
+}
+function toPermissionGuardFailure(permissionResult, sessionResult) {
+  if (permissionResult.status === 401) {
+    return {
+      ok: false,
+      reason: "unauthorized",
+      status: 401,
+      error: permissionResult.error ?? "Unauthorized",
+      sessionResult,
+      permissionResult
+    };
+  }
+  if (permissionResult.status === 403) {
+    return {
+      ok: false,
+      reason: "forbidden",
+      status: 403,
+      error: permissionResult.error ?? "Forbidden",
+      sessionResult,
+      permissionResult
+    };
+  }
+  return {
+    ok: false,
+    reason: "upstream_error",
+    status: permissionResult.status,
+    error: permissionResult.error ?? "Failed to resolve permission check",
+    sessionResult,
+    permissionResult
+  };
+}
 function extractFetchOptions(input) {
   if (!input) {
     return {
@@ -1821,6 +1921,7 @@ function extractFetchOptions(input) {
   };
 }
 function buildHeaders2(config, options) {
+  const forceNoCache = Boolean(config.forceNoCache || options?.forceNoCache);
   const headers = {
     "Content-Type": "application/json",
     "X-Athena-Sdk": SDK_HEADER_VALUE2
@@ -1834,16 +1935,30 @@ function buildHeaders2(config, options) {
   if (bearerToken) {
     headers.Authorization = `Bearer ${bearerToken}`;
   }
+  const cookie = options?.cookie ?? config.cookie;
+  if (cookie) {
+    headers.Cookie = cookie;
+  }
+  const sessionToken = options?.sessionToken ?? config.sessionToken;
+  if (sessionToken) {
+    headers["X-Athena-Auth-Session-Token"] = sessionToken;
+  }
   const mergedExtraHeaders = {
     ...config.headers ?? {},
     ...options?.headers ?? {}
   };
   Object.entries(mergedExtraHeaders).forEach(([key, value]) => {
+    if (forceNoCache && isCacheControlHeaderName2(key)) {
+      return;
+    }
     const normalized = normalizeHeaderValue2(value);
     if (normalized) {
       headers[key] = normalized;
     }
   });
+  if (forceNoCache) {
+    headers["Cache-Control"] = NO_CACHE_HEADER_VALUE2;
+  }
   return headers;
 }
 function appendQueryParam(searchParams, key, value) {
@@ -2108,7 +2223,91 @@ function createAuthClient(config = {}) {
     htmlField: "htmlTemplate",
     textField: "textTemplate",
     variablesField: "variables"
-  }, withReactEmailRoute(route));
+  }, withReactEmailRoute(route)).then((payload) => {
+    if ("variables" in payload && payload.variables !== void 0 && payload.variables !== null) {
+      assertAthenaAuthTemplateVariables(
+        payload.variables,
+        `${route} variables`
+      );
+    }
+    return payload;
+  });
+  const requireSession = async (input, options) => {
+    const sessionInput = input?.fetchOptions ? { fetchOptions: input.fetchOptions } : void 0;
+    const sessionResult = await getGeneric(
+      "/get-session",
+      sessionInput,
+      options
+    );
+    if (!sessionResult.ok || sessionResult.data == null) {
+      return toSessionGuardFailure(sessionResult);
+    }
+    return {
+      ok: true,
+      session: sessionResult.data
+    };
+  };
+  const getUser = async (input, options) => {
+    const sessionResult = await getGeneric(
+      "/get-session",
+      input,
+      options
+    );
+    if (!sessionResult.ok) {
+      return {
+        ...sessionResult,
+        data: null
+      };
+    }
+    return {
+      ...sessionResult,
+      data: {
+        user: sessionResult.data?.user ?? null
+      }
+    };
+  };
+  const requirePermission = async (endpoint, input, options) => {
+    const sessionGuard = await requireSession(
+      input?.fetchOptions ? { fetchOptions: input.fetchOptions } : void 0,
+      options
+    );
+    if (!sessionGuard.ok) {
+      return sessionGuard;
+    }
+    const permissionResult = await postGeneric(
+      endpoint,
+      input,
+      options
+    );
+    if (!permissionResult.ok) {
+      return toPermissionGuardFailure(permissionResult, {
+        ok: true,
+        status: 200,
+        data: sessionGuard.session,
+        error: null,
+        errorDetails: null,
+        raw: sessionGuard.session
+      });
+    }
+    if (!permissionResult.data?.success) {
+      return {
+        ok: false,
+        reason: "forbidden",
+        status: 403,
+        error: permissionResult.data?.error ?? "Forbidden",
+        sessionResult: {
+          ok: true,
+          status: 200,
+          data: sessionGuard.session,
+          error: null,
+          errorDetails: null,
+          raw: sessionGuard.session
+        },
+        permissionResult
+      };
+    }
+    return sessionGuard;
+  };
   const listUserEmailsWithFallback = async (input, options) => {
     const primary = await getWithQuery(
       "/email/list",
@@ -2270,6 +2469,7 @@ function createAuthClient(config = {}) {
       input,
       options
     ),
+    requirePermission: (input, options) => requirePermission("/organization/has-permission", input, options),
     invitation: {
       cancel: (input, options) => executePostWithCompatibleInput(
         resolvedConfig,
@@ -2465,6 +2665,8 @@ function createAuthClient(config = {}) {
   };
   const auth = {
     getSession: (input, options) => getGeneric("/get-session", input, options),
+    getUser,
+    requireSession,
     signOut,
     forgetPassword: (input, options) => postGeneric("/forget-password", input, options),
     resetPassword: authResetPassword,
@@ -2559,6 +2761,7 @@ function createAuthClient(config = {}) {
         }
       },
       hasPermission: (input, options) => postGeneric("/admin/has-permission", input, options),
+      requirePermission: (input, options) => requirePermission("/admin/has-permission", input, options),
       apiKey: {
         create: (input, options) => postGeneric("/admin/api-key/create", input, options)
       },
@@ -2710,6 +2913,8 @@ function createAuthClient(config = {}) {
       input,
       options
     ),
+    getUser,
+    requireSession,
     listSessions: (input, options) => executeGetWithCompatibleInput(
       resolvedConfig,
       { endpoint: "/list-sessions", method: "GET" },
@@ -5465,6 +5670,9 @@ var AthenaClientBuilderImpl = class {
   apiKey;
   backendConfig = DEFAULT_BACKEND;
   clientName;
+  defaultUserId;
+  defaultOrganizationId;
+  forceNoCacheEnabled = false;
   defaultHeaders;
   authConfig;
   dbUrlOverride;
@@ -5513,6 +5721,15 @@ var AthenaClientBuilderImpl = class {
     if (options.client !== void 0) {
       this.clientName = options.client;
     }
+    if (options.userId !== void 0) {
+      this.defaultUserId = options.userId;
+    }
+    if (options.organizationId !== void 0) {
+      this.defaultOrganizationId = options.organizationId;
+    }
+    if (options.forceNoCache !== void 0) {
+      this.forceNoCacheEnabled = options.forceNoCache;
+    }
     if (options.backend !== void 0) {
       this.backendConfig = toBackendConfig(options.backend);
     }
@@ -5567,6 +5784,9 @@ var AthenaClientBuilderImpl = class {
       url: this.rootUrl,
       key: this.apiKey,
       client: this.clientName,
+      userId: this.defaultUserId,
+      organizationId: this.defaultOrganizationId,
+      forceNoCache: this.forceNoCacheEnabled,
       backend: this.backendConfig,
       headers: this.defaultHeaders,
       db: this.dbUrlOverride ? { url: this.dbUrlOverride } : void 0,
@@ -8109,6 +8329,83 @@ function createQueryBuilder(client, formatGatewayResult, experimental, tracer) {
     );
   };
 }
+var ATHENA_ENV_URL_KEYS = ["ATHENA_URL", "NEXT_PUBLIC_ATHENA_URL"];
+var ATHENA_ENV_GATEWAY_URL_KEYS = [
+  "ATHENA_DB_URL",
+  "ATHENA_GATEWAY_URL",
+  "NEXT_PUBLIC_ATHENA_DB_API_URL"
+];
+var ATHENA_ENV_AUTH_URL_KEYS = ["ATHENA_AUTH_URL", "NEXT_PUBLIC_ATHENA_AUTH_URL"];
+var ATHENA_ENV_STORAGE_URL_KEYS = ["ATHENA_STORAGE_URL", "NEXT_PUBLIC_ATHENA_STORAGE_URL"];
+var ATHENA_ENV_KEY_KEYS = [
+  "ATHENA_API_KEY",
+  "NEXT_PUBLIC_ATHENA_API_KEY",
+  "ATHENA_GATEWAY_API_KEY",
+  "X_API_KEY"
+];
+var ATHENA_ENV_CLIENT_KEYS = ["ATHENA_CLIENT", "NEXT_PUBLIC_ATHENA_CLIENT"];
+function normalizeOptionalString(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function readFirstEnvValue(env, keys) {
+  for (const key of keys) {
+    const value = normalizeOptionalString(env[key]);
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function readHeaderBagValue(headers, targetKey) {
+  if (!headers) {
+    return void 0;
+  }
+  if (typeof headers.get === "function") {
+    return normalizeOptionalString(headers.get(targetKey));
+  }
+  const normalizedTargetKey = targetKey.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== normalizedTargetKey) {
+      continue;
+    }
+    if (typeof value === "string") {
+      return normalizeOptionalString(value);
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function resolveSessionContextOptions(session, options) {
+  const sessionToken = normalizeOptionalString(session?.session?.token);
+  const requestCookie = readHeaderBagValue(options?.requestHeaders, "cookie") ?? readHeaderBagValue(options?.headers, "cookie");
+  const authInput = options?.auth;
+  const resolvedUserId = options?.userId !== void 0 ? options.userId : session?.user?.id;
+  const resolvedOrganizationId = options?.organizationId !== void 0 ? options.organizationId : session?.session?.activeOrganizationId;
+  const resolvedBearerToken = authInput?.bearerToken !== void 0 ? authInput.bearerToken : sessionToken;
+  const resolvedSessionToken = authInput?.sessionToken !== void 0 ? authInput.sessionToken : sessionToken;
+  const resolvedCookie = authInput?.cookie !== void 0 ? authInput.cookie : requestCookie;
+  const auth = authInput !== void 0 || resolvedBearerToken !== void 0 || resolvedSessionToken !== void 0 || resolvedCookie !== void 0 ? {
+    ...authInput ?? {},
+    ...resolvedBearerToken !== void 0 ? { bearerToken: resolvedBearerToken } : {},
+    ...resolvedSessionToken !== void 0 ? { sessionToken: resolvedSessionToken } : {},
+    ...resolvedCookie !== void 0 ? { cookie: resolvedCookie } : {},
+    headers: authInput?.headers ? { ...authInput.headers } : void 0
+  } : void 0;
+  if (resolvedUserId === void 0 && resolvedOrganizationId === void 0 && options?.forceNoCache === void 0 && !options?.headers && !auth) {
+    return void 0;
+  }
+  return {
+    userId: resolvedUserId,
+    organizationId: resolvedOrganizationId,
+    forceNoCache: options?.forceNoCache,
+    headers: options?.headers ? { ...options.headers } : void 0,
+    auth
+  };
+}
 function resolveClientServiceBaseUrl(value, label) {
   if (value === void 0 || value === null) {
     return void 0;
@@ -8151,6 +8448,87 @@ function resolveRequiredClientApiKey(value) {
   }
   return normalizedValue;
 }
+function hasHeaderIgnoreCase(headers, targetKey) {
+  const normalizedTargetKey = targetKey.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === normalizedTargetKey);
+}
+function mergeClientHeaders(current, next) {
+  if (!current && !next) {
+    return void 0;
+  }
+  return {
+    ...current ?? {},
+    ...next ?? {}
+  };
+}
+function mergeDefinedObject(current, next) {
+  if (!current && !next) {
+    return void 0;
+  }
+  const merged = {
+    ...current ?? {}
+  };
+  const mutableMerged = merged;
+  for (const [key, value] of Object.entries(next ?? {})) {
+    if (value !== void 0) {
+      mutableMerged[key] = value;
+    }
+  }
+  return merged;
+}
+function mergeAuthClientOptions(current, next) {
+  const merged = mergeDefinedObject(current, next);
+  if (!merged) {
+    return void 0;
+  }
+  const mergedHeaders = mergeClientHeaders(current?.headers, next?.headers);
+  if (mergedHeaders) {
+    merged.headers = mergedHeaders;
+  }
+  return merged;
+}
+function mergeServiceUrlOverrides(current, next) {
+  return mergeDefinedObject(current, next);
+}
+function toClientContextOverrides(context) {
+  if (!context) {
+    return void 0;
+  }
+  return {
+    userId: context.userId,
+    organizationId: context.organizationId,
+    forceNoCache: context.forceNoCache,
+    headers: context.headers,
+    auth: context.auth ? {
+      ...context.auth,
+      headers: context.auth.headers ? { ...context.auth.headers } : void 0
+    } : void 0
+  };
+}
+function mergeClientOverrideOptions(base, overrides) {
+  if (!overrides) {
+    return {
+      ...base,
+      headers: base.headers ? { ...base.headers } : void 0,
+      auth: base.auth ? {
+        ...base.auth,
+        headers: base.auth.headers ? { ...base.auth.headers } : void 0
+      } : void 0,
+      db: base.db ? { ...base.db } : void 0,
+      gateway: base.gateway ? { ...base.gateway } : void 0,
+      storage: base.storage ? { ...base.storage } : void 0
+    };
+  }
+  const merged = mergeDefinedObject(base, overrides) ?? { ...base };
+  return {
+    ...merged,
+    headers: mergeClientHeaders(base.headers, overrides.headers),
+    auth: mergeAuthClientOptions(base.auth, overrides.auth),
+    db: mergeServiceUrlOverrides(base.db, overrides.db),
+    gateway: mergeServiceUrlOverrides(base.gateway, overrides.gateway),
+    storage: mergeServiceUrlOverrides(base.storage, overrides.storage)
+  };
+}
 function normalizeAuthClientConfig(auth, defaultBaseUrl) {
   if (!auth && defaultBaseUrl === void 0) {
     return void 0;
@@ -8160,6 +8538,8 @@ function normalizeAuthClientConfig(auth, defaultBaseUrl) {
     baseUrl,
     apiKey,
     bearerToken,
+    cookie,
+    sessionToken,
     ...rest
   } = auth ?? {};
   const normalized = {
@@ -8178,6 +8558,12 @@ function normalizeAuthClientConfig(auth, defaultBaseUrl) {
   if (typeof bearerToken === "string") {
     normalized.bearerToken = bearerToken;
   }
+  if (typeof cookie === "string") {
+    normalized.cookie = cookie;
+  }
+  if (typeof sessionToken === "string") {
+    normalized.sessionToken = sessionToken;
+  }
   return normalized;
 }
 function resolveCreateClientConfig(config) {
@@ -8191,6 +8577,9 @@ function resolveCreateClientConfig(config) {
     baseUrl: resolvedUrls.dbUrl,
     apiKey: resolveRequiredClientApiKey(config.key),
     client: resolveOptionalClientName(config.client),
+    userId: config.userId,
+    organizationId: config.organizationId,
+    forceNoCache: config.forceNoCache,
     backend: toBackendConfig(config.backend),
     headers: config.headers,
     auth: config.auth,
@@ -8199,23 +8588,39 @@ function resolveCreateClientConfig(config) {
     experimental: config.experimental
   };
 }
-function createClientFromConfig(config) {
+function createClientFromInput(sourceConfig) {
+  return createClientFromConfig(resolveCreateClientConfig(sourceConfig), sourceConfig);
+}
+function createClientFromConfig(config, sourceConfig) {
+  const normalizedAuthConfig = normalizeAuthClientConfig(config.auth, config.authUrl);
   const gatewayHeaders = {
     ...config.headers ?? {}
   };
-  if (config.auth?.bearerToken && gatewayHeaders["X-Athena-Auth-Bearer-Token"] === void 0 && gatewayHeaders["x-athena-auth-bearer-token"] === void 0) {
-    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = config.auth.bearerToken;
+  if (normalizedAuthConfig?.bearerToken && !hasHeaderIgnoreCase(gatewayHeaders, "X-Athena-Auth-Bearer-Token")) {
+    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = normalizedAuthConfig.bearerToken;
+  }
+  if (normalizedAuthConfig?.cookie && !hasHeaderIgnoreCase(gatewayHeaders, "Cookie")) {
+    gatewayHeaders.Cookie = normalizedAuthConfig.cookie;
+  }
+  if (normalizedAuthConfig?.sessionToken && !hasHeaderIgnoreCase(gatewayHeaders, "X-Athena-Auth-Session-Token")) {
+    gatewayHeaders["X-Athena-Auth-Session-Token"] = normalizedAuthConfig.sessionToken;
   }
   const gateway = createAthenaGatewayClient({
     baseUrl: config.baseUrl,
     apiKey: config.apiKey,
     client: config.client,
+    userId: config.userId,
+    organizationId: config.organizationId,
+    forceNoCache: config.forceNoCache,
     backend: config.backend,
     headers: gatewayHeaders
   });
   const formatGatewayResult = createResultFormatter(config.experimental);
   const queryTracer = createQueryTracer(config.experimental);
-  const auth = createAuthClient(normalizeAuthClientConfig(config.auth, config.authUrl));
+  const auth = createAuthClient({
+    ...normalizedAuthConfig ?? {},
+    ...config.forceNoCache ? { forceNoCache: true } : {}
+  });
   function from(tableOrModel, options) {
     if (isAthenaModelTarget(tableOrModel)) {
       if (options?.schema !== void 0) {
@@ -8263,17 +8668,45 @@ function createClientFromConfig(config) {
     queryTracer
   );
   const db = createDbModule({ from, rpc, query });
+  const withContext = (context) => createClientFromInput(
+    mergeClientOverrideOptions(sourceConfig, toClientContextOverrides(context))
+  );
+  const withSession = (session, options) => createClientFromInput(
+    mergeClientOverrideOptions(
+      sourceConfig,
+      toClientContextOverrides(resolveSessionContextOptions(session, options))
+    )
+  );
+  const authWithOptions = (options) => createClientFromInput(mergeClientOverrideOptions(sourceConfig, options));
   const sdkClient = {
     from,
     db,
     rpc,
     query,
     verifyConnection: gateway.verifyConnection,
-    auth: auth.auth
+    auth: auth.auth,
+    withContext,
+    withSession,
+    withOptions: authWithOptions
   };
   if (config.experimental?.athenaStorageBackend) {
+    const storageWithContext = (context) => createClientFromInput(
+      mergeClientOverrideOptions(sourceConfig, toClientContextOverrides(context))
+    );
+    const storageWithSession = (session, options) => createClientFromInput(
+      mergeClientOverrideOptions(
+        sourceConfig,
+        toClientContextOverrides(resolveSessionContextOptions(session, options))
+      )
+    );
+    const storageWithOptions = (options) => createClientFromInput(
+      mergeClientOverrideOptions(sourceConfig, options)
+    );
     const storageClient = {
       ...sdkClient,
+      withContext: storageWithContext,
+      withSession: storageWithSession,
+      withOptions: storageWithOptions,
       storage: createStorageModule(gateway, {
         ...config.experimental.storage,
         ...config.storageUrl ? {
@@ -8289,38 +8722,42 @@ function createClientFromConfig(config) {
 var AthenaClient = class {
   /** Create a fluent builder for a strongly-typed Athena SDK client. */
   static builder() {
-    return createAthenaClientBuilder((config) => createClientFromConfig(resolveCreateClientConfig(config)));
-  }
-  /** Build a client from process environment variables. */
-  static fromEnvironment() {
-    const url = process.env.ATHENA_URL;
-    const gatewayUrl = process.env.ATHENA_DB_URL ?? process.env.ATHENA_GATEWAY_URL;
-    const authUrl = process.env.ATHENA_AUTH_URL;
-    const storageUrl = process.env.ATHENA_STORAGE_URL;
-    const key = process.env.ATHENA_API_KEY ?? process.env.ATHENA_GATEWAY_API_KEY;
+    return createAthenaClientBuilder((config) => createClientFromInput(config));
+  }
+  static fromEnvironment(options = {}) {
+    const env = options.env ?? process.env;
+    const url = options.url ?? readFirstEnvValue(env, ATHENA_ENV_URL_KEYS);
+    const gatewayUrl = options.gatewayUrl ?? readFirstEnvValue(env, ATHENA_ENV_GATEWAY_URL_KEYS);
+    const authUrl = options.authUrl ?? readFirstEnvValue(env, ATHENA_ENV_AUTH_URL_KEYS);
+    const storageUrl = options.storageUrl ?? readFirstEnvValue(env, ATHENA_ENV_STORAGE_URL_KEYS);
+    const key = options.key ?? readFirstEnvValue(env, ATHENA_ENV_KEY_KEYS);
+    const client = options.client ?? readFirstEnvValue(env, ATHENA_ENV_CLIENT_KEYS);
     if (!url && !gatewayUrl || !key) {
       throw new Error(
-        "ATHENA_API_KEY plus ATHENA_URL or ATHENA_GATEWAY_URL (optionally ATHENA_DB_URL, ATHENA_AUTH_URL, ATHENA_STORAGE_URL) are required"
+        "AthenaClient.fromEnvironment() requires an API key plus a public or gateway URL. Supported aliases include ATHENA_API_KEY, NEXT_PUBLIC_ATHENA_API_KEY, ATHENA_GATEWAY_API_KEY, X_API_KEY, ATHENA_URL, NEXT_PUBLIC_ATHENA_URL, ATHENA_GATEWAY_URL, and ATHENA_DB_URL."
       );
     }
+    const { env: _env, ...clientOptions } = options;
     return createClient({
+      ...clientOptions,
       url,
       gatewayUrl,
       authUrl,
       storageUrl,
-      key
+      key,
+      client
     });
   }
 };
 function createClient(configOrUrl, apiKey, options) {
   if (typeof configOrUrl === "string" || configOrUrl === null || configOrUrl === void 0) {
-    return createClientFromConfig(resolveCreateClientConfig({
+    return createClientFromInput({
       url: configOrUrl,
       key: apiKey ?? "",
       ...options
-    }));
+    });
   }
-  return createClientFromConfig(resolveCreateClientConfig(configOrUrl));
+  return createClientFromInput(configOrUrl);
 }
 
 // src/gateway/types.ts
@@ -8686,6 +9123,9 @@ function createColumnsBuilder(name, mappedName, schemaName, columns) {
       resolveTableTarget(name, mappedName, normalizedSchemaName);
       return createColumnsBuilder(name, mappedName, normalizedSchemaName, columns);
     },
+    withoutPrimaryKey() {
+      return finalizeTable(name, mappedName, schemaName, columns, []);
+    },
     primaryKey(...keys) {
       return finalizeTable(name, mappedName, schemaName, columns, keys);
     }
@@ -8737,6 +9177,59 @@ var TenantHeaderMapper = class {
     return Object.keys(headers).length > 0 ? headers : void 0;
   }
 };
+function normalizeOptionalString2(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function readHeaderBagValue2(headers, targetKey) {
+  if (!headers) {
+    return void 0;
+  }
+  if (typeof headers.get === "function") {
+    return normalizeOptionalString2(headers.get(targetKey));
+  }
+  const normalizedTargetKey = targetKey.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== normalizedTargetKey) {
+      continue;
+    }
+    if (typeof value === "string") {
+      return normalizeOptionalString2(value);
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function resolveSessionContextOptions2(session, options) {
+  const sessionToken = normalizeOptionalString2(session?.session?.token);
+  const requestCookie = readHeaderBagValue2(options?.requestHeaders, "cookie") ?? readHeaderBagValue2(options?.headers, "cookie");
+  const authInput = options?.auth;
+  const resolvedUserId = options?.userId !== void 0 ? options.userId : session?.user?.id;
+  const resolvedOrganizationId = options?.organizationId !== void 0 ? options.organizationId : session?.session?.activeOrganizationId;
+  const resolvedBearerToken = authInput?.bearerToken !== void 0 ? authInput.bearerToken : sessionToken;
+  const resolvedSessionToken = authInput?.sessionToken !== void 0 ? authInput.sessionToken : sessionToken;
+  const resolvedCookie = authInput?.cookie !== void 0 ? authInput.cookie : requestCookie;
+  const auth = authInput !== void 0 || resolvedBearerToken !== void 0 || resolvedSessionToken !== void 0 || resolvedCookie !== void 0 ? {
+    ...authInput ?? {},
+    ...resolvedBearerToken !== void 0 ? { bearerToken: resolvedBearerToken } : {},
+    ...resolvedSessionToken !== void 0 ? { sessionToken: resolvedSessionToken } : {},
+    ...resolvedCookie !== void 0 ? { cookie: resolvedCookie } : {},
+    headers: authInput?.headers ? { ...authInput.headers } : void 0
+  } : void 0;
+  if (resolvedUserId === void 0 && resolvedOrganizationId === void 0 && options?.forceNoCache === void 0 && !options?.headers && !auth) {
+    return void 0;
+  }
+  return {
+    userId: resolvedUserId,
+    organizationId: resolvedOrganizationId,
+    forceNoCache: options?.forceNoCache,
+    headers: options?.headers ? { ...options.headers } : void 0,
+    auth
+  };
+}
 var RegistryNavigator = class {
   constructor(registry) {
     this.registry = registry;
@@ -8788,12 +9281,22 @@ var TypedAthenaClientImpl = class _TypedAthenaClientImpl {
       backend: input.options?.backend,
       client: input.options?.client,
       headers: input.options?.headers,
+      forceNoCache: input.options?.forceNoCache,
+      userId: input.options?.userId,
+      organizationId: input.options?.organizationId,
+      auth: input.options?.auth,
+      tenantKeyMap,
+      tenantContext,
       experimental: input.options?.experimental
     };
     this.baseClient = createClient(this.url, this.apiKey, {
       backend: this.clientOptions.backend,
       client: this.clientOptions.client,
       headers: this.tenantHeaderMapper.apply(this.clientOptions.headers, tenantContext),
+      forceNoCache: this.clientOptions.forceNoCache,
+      userId: this.clientOptions.userId,
+      organizationId: this.clientOptions.organizationId,
+      auth: this.clientOptions.auth,
       experimental: this.clientOptions.experimental
     });
     this.db = this.baseClient.db;
@@ -8811,6 +9314,40 @@ var TypedAthenaClientImpl = class _TypedAthenaClientImpl {
   verifyConnection(options) {
     return this.baseClient.verifyConnection(options);
   }
+  withContext(context) {
+    const headers = {
+      ...this.clientOptions.headers ?? {},
+      ...context?.headers ?? {}
+    };
+    const auth = this.clientOptions.auth || context?.auth ? {
+      ...this.clientOptions.auth ?? {},
+      ...context?.auth ?? {},
+      headers: this.clientOptions.auth?.headers || context?.auth?.headers ? {
+        ...this.clientOptions.auth?.headers ?? {},
+        ...context?.auth?.headers ?? {}
+      } : void 0
+    } : void 0;
+    return new _TypedAthenaClientImpl({
+      registry: this.registry,
+      url: this.url,
+      apiKey: this.apiKey,
+      options: {
+        ...this.clientOptions,
+        headers: Object.keys(headers).length > 0 ? headers : void 0,
+        auth,
+        tenantKeyMap: this.tenantKeyMap,
+        tenantContext: {
+          ...this.tenantContext
+        },
+        ...context?.userId !== void 0 ? { userId: context.userId } : {},
+        ...context?.organizationId !== void 0 ? { organizationId: context.organizationId } : {},
+        ...context?.forceNoCache !== void 0 ? { forceNoCache: context.forceNoCache } : {}
+      }
+    });
+  }
+  withSession(session, options) {
+    return this.withContext(resolveSessionContextOptions2(session, options));
+  }
   withTenantContext(context) {
     return new _TypedAthenaClientImpl({
       registry: this.registry,
@@ -9306,6 +9843,77 @@ function resolveProviderSchemas(providerConfig) {
   return [...DEFAULT_POSTGRES_SCHEMAS];
 }
 
+// src/generator/table-selection.ts
+function normalizeTableSelector(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeTableSelection(value) {
+  if (typeof value === "string") {
+    return Array.from(
+      new Set(
+        value.split(",").map(normalizeTableSelector).filter((entry) => Boolean(entry))
+      )
+    );
+  }
+  if (Array.isArray(value)) {
+    return Array.from(
+      new Set(
+        value.map((entry) => typeof entry === "string" ? normalizeTableSelector(entry) : void 0).filter((entry) => Boolean(entry))
+      )
+    );
+  }
+  return [];
+}
+function matchesTableSelector(schemaName, tableName, selector) {
+  const separatorIndex = selector.indexOf(".");
+  if (separatorIndex < 0) {
+    return tableName === selector;
+  }
+  const selectorSchema = selector.slice(0, separatorIndex).trim();
+  const selectorTable = selector.slice(separatorIndex + 1).trim();
+  return selectorSchema === schemaName && selectorTable === tableName;
+}
+function shouldKeepTable(schemaName, tableName, filter) {
+  const included = filter.includeTables.length === 0 || filter.includeTables.some((selector) => matchesTableSelector(schemaName, tableName, selector));
+  if (!included) {
+    return false;
+  }
+  return !filter.excludeTables.some((selector) => matchesTableSelector(schemaName, tableName, selector));
+}
+function hasTableFilters(filter) {
+  return filter.includeTables.length > 0 || filter.excludeTables.length > 0;
+}
+function filterIntrospectionSnapshot(snapshot, filter) {
+  if (!hasTableFilters(filter)) {
+    return snapshot;
+  }
+  const schemas = {};
+  for (const [schemaName, schema] of Object.entries(snapshot.schemas)) {
+    const tables = Object.fromEntries(
+      Object.entries(schema.tables).filter(([tableName]) => shouldKeepTable(schemaName, tableName, filter))
+    );
+    if (Object.keys(tables).length === 0) {
+      continue;
+    }
+    schemas[schemaName] = {
+      ...schema,
+      tables
+    };
+  }
+  if (Object.keys(schemas).length === 0) {
+    const includeLabel = filter.includeTables.length > 0 ? ` includeTables=${filter.includeTables.join(", ")}` : "";
+    const excludeLabel = filter.excludeTables.length > 0 ? ` excludeTables=${filter.excludeTables.join(", ")}` : "";
+    throw new Error(
+      `Generator table filters matched no tables after schema selection.${includeLabel}${excludeLabel}`
+    );
+  }
+  return {
+    ...snapshot,
+    schemas
+  };
+}
+
 // src/generator/config.ts
 var POSTGRES_PROTOCOLS = /* @__PURE__ */ new Set(["postgres:", "postgresql:"]);
 var DEFAULT_CONFIG_CANDIDATES = [
@@ -9316,13 +9924,20 @@ var DEFAULT_CONFIG_CANDIDATES = [
   ".athena.config.ts",
   ".athena.config.js"
 ];
-var DEFAULT_TARGETS = {
+var LEGACY_DEFAULT_TARGETS = {
   model: "athena/models/{schema_kebab}/{model_kebab}.ts",
   schema: "athena/schemas/{schema_kebab}.ts",
   database: "athena/relations.ts",
   registry: "athena/config.ts"
 };
-var DEFAULT_OUTPUT_FORMAT = "define-model";
+var ATHENA_DIRECT_TARGETS = {
+  model: "athena/models/{schema_kebab}/{model_kebab}.ts",
+  schema: "athena/schemas/{schema_kebab}.ts",
+  database: "athena/relations.ts",
+  registry: "athena/registry.generated.ts"
+};
+var DEFAULT_OUTPUT_FORMAT = "table-builder";
+var DEFAULT_OUTPUT_PRESET = "athena-direct";
 var DEFAULT_NAMING = {
   modelType: "pascal",
   modelConst: "camel",
@@ -9341,6 +9956,10 @@ var DEFAULT_EXPERIMENTAL_FLAGS = {
 var DEFAULT_INTERNAL_CONFIG = {
   schemaVersion: 1
 };
+var DEFAULT_FILTER_CONFIG = {
+  includeTables: [],
+  excludeTables: []
+};
 var PROJECT_ENV_FILENAMES = [".env", ".env.local"];
 var DIRECT_CONNECTION_STRING_ENV_KEYS = [
   "ATHENA_GENERATOR_PG_URL",
@@ -9359,10 +9978,13 @@ var GATEWAY_API_KEY_ENV_KEYS = [
 ];
 var GENERATOR_SCHEMA_ENV_KEYS = ["ATHENA_GENERATOR_SCHEMAS"];
 var OUTPUT_FORMAT_ENV_KEYS = ["ATHENA_GENERATOR_OUTPUT_FORMAT"];
+var OUTPUT_PRESET_ENV_KEYS = ["ATHENA_GENERATOR_OUTPUT_PRESET"];
 var MODEL_TARGET_ENV_KEYS = ["ATHENA_GENERATOR_MODEL_TARGET"];
 var SCHEMA_TARGET_ENV_KEYS = ["ATHENA_GENERATOR_SCHEMA_TARGET"];
 var DATABASE_TARGET_ENV_KEYS = ["ATHENA_GENERATOR_DATABASE_TARGET"];
 var REGISTRY_TARGET_ENV_KEYS = ["ATHENA_GENERATOR_REGISTRY_TARGET"];
+var TABLES_ENV_KEYS = ["ATHENA_GENERATOR_TABLES"];
+var EXCLUDE_TABLES_ENV_KEYS = ["ATHENA_GENERATOR_EXCLUDE_TABLES"];
 var PLACEHOLDER_MAP_ENV_KEYS = ["ATHENA_GENERATOR_PLACEHOLDER_MAP"];
 var MODEL_TYPE_ENV_KEYS = ["ATHENA_GENERATOR_MODEL_TYPE", "ATHENA_GENERATOR_MODEL_STYLE"];
 var MODEL_CONST_ENV_KEYS = ["ATHENA_GENERATOR_MODEL_CONST"];
@@ -9377,7 +9999,12 @@ var SCYLLA_PROVIDER_CONTRACTS_ENV_KEYS = ["ATHENA_GENERATOR_SCYLLA_PROVIDER_CONT
 var ENV_ONLY_CONFIG_PATH = "[environment defaults]";
 var NAMING_STYLE_VALUES = ["preserve", "camel", "pascal", "snake", "kebab"];
 var OUTPUT_FORMAT_VALUES = ["define-model", "table-builder"];
+var OUTPUT_PRESET_VALUES = ["legacy", "athena-direct"];
 var BACKEND_TYPE_VALUES = ["athena", "postgrest", "postgresql", "scylladb"];
+var OUTPUT_PRESET_TARGETS = {
+  legacy: LEGACY_DEFAULT_TARGETS,
+  "athena-direct": ATHENA_DIRECT_TARGETS
+};
 function normalizeRawEnvValue(rawValue) {
   if (rawValue.startsWith('"') && rawValue.endsWith('"') && rawValue.length >= 2) {
     const inner = rawValue.slice(1, -1);
@@ -9513,7 +10140,7 @@ function deriveDatabaseNameFromConnectionString(connectionString) {
     return void 0;
   }
 }
-function normalizeOptionalString(value, fallbackKeys) {
+function normalizeOptionalString3(value, fallbackKeys) {
   if (typeof value === "string") {
     const trimmed = value.trim();
     if (trimmed.length > 0) {
@@ -9523,7 +10150,7 @@ function normalizeOptionalString(value, fallbackKeys) {
   return resolveFallbackValue(fallbackKeys);
 }
 function normalizeRequiredString(value, fieldLabel, fallbackKeys) {
-  const resolved = normalizeOptionalString(value, fallbackKeys);
+  const resolved = normalizeOptionalString3(value, fallbackKeys);
   if (resolved) {
     return resolved;
   }
@@ -9584,11 +10211,19 @@ function normalizeExperimentalFlags(input) {
     )
   };
 }
+function normalizeFilterConfig(input) {
+  return {
+    includeTables: normalizeTableSelection(input?.includeTables),
+    excludeTables: normalizeTableSelection(input?.excludeTables)
+  };
+}
 function normalizeOutputConfig(output) {
+  const preset = output?.preset ?? DEFAULT_OUTPUT_PRESET;
   return {
     format: output?.format ?? DEFAULT_OUTPUT_FORMAT,
+    preset,
     targets: {
-      ...DEFAULT_TARGETS,
+      ...OUTPUT_PRESET_TARGETS[preset],
       ...output?.targets ?? {}
     },
     placeholderMap: {
@@ -9603,7 +10238,7 @@ function normalizeProviderConfig(provider) {
       "provider.connectionString",
       DIRECT_CONNECTION_STRING_ENV_KEYS
     );
-    const database = normalizeOptionalString(provider.database, POSTGRES_DATABASE_ENV_KEYS) ?? deriveDatabaseNameFromConnectionString(connectionString);
+    const database = normalizeOptionalString3(provider.database, POSTGRES_DATABASE_ENV_KEYS) ?? deriveDatabaseNameFromConnectionString(connectionString);
     return {
       ...provider,
       connectionString: applyPostgresPasswordFallback(connectionString),
@@ -9622,7 +10257,7 @@ function normalizeProviderConfig(provider) {
       "provider.apiKey",
       GATEWAY_API_KEY_ENV_KEYS
     );
-    const database = normalizeOptionalString(provider.database, POSTGRES_DATABASE_ENV_KEYS) ?? "postgres";
+    const database = normalizeOptionalString3(provider.database, POSTGRES_DATABASE_ENV_KEYS) ?? "postgres";
     return {
       ...provider,
       gatewayUrl,
@@ -9637,7 +10272,7 @@ function normalizeProviderConfig(provider) {
         "Generator config is missing provider.contactPoints for scylla direct mode."
       );
     }
-    const keyspace = normalizeOptionalString(provider.keyspace, []);
+    const keyspace = normalizeOptionalString3(provider.keyspace, []);
     if (!keyspace) {
       throw new Error(
         "Generator config is missing provider.keyspace for scylla direct mode."
@@ -9648,7 +10283,7 @@ function normalizeProviderConfig(provider) {
       mode: "direct",
       contactPoints: provider.contactPoints.slice(),
       keyspace,
-      datacenter: normalizeOptionalString(provider.datacenter, [])
+      datacenter: normalizeOptionalString3(provider.datacenter, [])
     };
   }
   return provider;
@@ -9668,6 +10303,10 @@ function normalizeGeneratorConfig(input) {
       ...DEFAULT_NAMING,
       ...input.naming ?? {}
     },
+    filter: {
+      ...DEFAULT_FILTER_CONFIG,
+      ...normalizeFilterConfig(input.filter)
+    },
     features: normalizeFeatureFlags(input.features),
     experimental: normalizeExperimentalFlags(input.experimental),
     internal: {
@@ -9731,16 +10370,18 @@ function importConfigModule(moduleSpecifier) {
 }
 function buildEnvironmentOutputConfig() {
   const format = resolveOptionalOneOf(OUTPUT_FORMAT_ENV_KEYS, OUTPUT_FORMAT_VALUES);
+  const preset = resolveOptionalOneOf(OUTPUT_PRESET_ENV_KEYS, OUTPUT_PRESET_VALUES);
   const modelTarget = resolveFallbackValue(MODEL_TARGET_ENV_KEYS);
   const schemaTarget = resolveFallbackValue(SCHEMA_TARGET_ENV_KEYS);
   const databaseTarget = resolveFallbackValue(DATABASE_TARGET_ENV_KEYS);
   const registryTarget = resolveFallbackValue(REGISTRY_TARGET_ENV_KEYS);
   const placeholderMap = resolveOptionalJson(PLACEHOLDER_MAP_ENV_KEYS);
-  if (format === void 0 && modelTarget === void 0 && schemaTarget === void 0 && databaseTarget === void 0 && registryTarget === void 0 && placeholderMap === void 0) {
+  if (format === void 0 && preset === void 0 && modelTarget === void 0 && schemaTarget === void 0 && databaseTarget === void 0 && registryTarget === void 0 && placeholderMap === void 0) {
     return void 0;
   }
   return {
     format,
+    preset,
     targets: {
       ...modelTarget ? { model: modelTarget } : {},
       ...schemaTarget ? { schema: schemaTarget } : {},
@@ -9750,6 +10391,17 @@ function buildEnvironmentOutputConfig() {
     placeholderMap
   };
 }
+function buildEnvironmentFilterConfig() {
+  const includeTables = resolveFallbackValue(TABLES_ENV_KEYS);
+  const excludeTables = resolveFallbackValue(EXCLUDE_TABLES_ENV_KEYS);
+  if (includeTables === void 0 && excludeTables === void 0) {
+    return void 0;
+  }
+  return {
+    ...includeTables !== void 0 ? { includeTables } : {},
+    ...excludeTables !== void 0 ? { excludeTables } : {}
+  };
+}
 function buildEnvironmentNamingConfig() {
   const modelType = resolveOptionalOneOf(MODEL_TYPE_ENV_KEYS, NAMING_STYLE_VALUES);
   const modelConst = resolveOptionalOneOf(MODEL_CONST_ENV_KEYS, NAMING_STYLE_VALUES);
@@ -9796,7 +10448,7 @@ function buildEnvironmentProviderConfig() {
       kind: "postgres",
       mode: "direct",
       connectionString: directConnectionString,
-      database: normalizeOptionalString(void 0, POSTGRES_DATABASE_ENV_KEYS),
+      database: normalizeOptionalString3(void 0, POSTGRES_DATABASE_ENV_KEYS),
       schemas: normalizeSchemaSelection(resolveFallbackValue(GENERATOR_SCHEMA_ENV_KEYS))
     };
   }
@@ -9809,7 +10461,7 @@ function buildEnvironmentProviderConfig() {
       mode: "gateway",
       gatewayUrl,
       apiKey,
-      database: normalizeOptionalString(void 0, POSTGRES_DATABASE_ENV_KEYS),
+      database: normalizeOptionalString3(void 0, POSTGRES_DATABASE_ENV_KEYS),
       schemas: normalizeSchemaSelection(resolveFallbackValue(GENERATOR_SCHEMA_ENV_KEYS)),
       backend
     };
@@ -9825,6 +10477,7 @@ function createEnvironmentGeneratorConfig() {
     provider,
     output: buildEnvironmentOutputConfig(),
     naming: buildEnvironmentNamingConfig(),
+    filter: buildEnvironmentFilterConfig(),
     features: buildEnvironmentFeatureFlags(),
     experimental: buildEnvironmentExperimentalFlags()
   };
@@ -10310,7 +10963,7 @@ ${schemaEntries}
     content
   };
 }
-function renderRegistryArtifact(registryPath, databasePath, databaseConstName, registryConstName, databaseName, generatedAt, outputFormat, schemaVersion) {
+function renderRegistryArtifact(registryPath, databasePath, databaseConstName, registryConstName, databaseName, generatedAt, outputPreset, outputFormat, schemaVersion) {
   const databaseImportPath = toModuleImportPath(registryPath, databasePath);
   const content = `import { defineRegistry } from '@xylex-group/athena'
 import { ${databaseConstName} } from '${databaseImportPath}'
@@ -10319,6 +10972,7 @@ export const __athena_schema_meta = {
   schemaVersion: ${schemaVersion},
   generatedAt: ${escapeStringLiteral(generatedAt)},
   database: ${escapeStringLiteral(databaseName)},
+  outputPreset: ${escapeStringLiteral(outputPreset)},
   outputFormat: ${escapeStringLiteral(outputFormat)},
 } as const
 
@@ -10488,6 +11142,7 @@ function composeGeneratorArtifacts(input) {
         toSafeIdentifier("registry", config.naming.registryConst, "registry"),
         databaseName,
         snapshot.generatedAt,
+        config.output.preset,
         config.output.format,
         config.internal.schemaVersion
       )
@@ -10593,7 +11248,7 @@ export const ${descriptor.tableConstName} = table(${escapeStringLiteral(descript
   .columns({
 ${columnLines}
   })
-  .primaryKey(${descriptor.table.primaryKey.map((value) => escapeStringLiteral(value)).join(", ")})
+  ${descriptor.table.primaryKey.length > 0 ? `.primaryKey(${descriptor.table.primaryKey.map((value) => escapeStringLiteral(value)).join(", ")})` : ".withoutPrimaryKey()"}
 ${relationsAssignment ? `${relationsAssignment}` : ""}
 export type ${descriptor.rowTypeName} = RowOf<typeof ${descriptor.tableConstName}>
 export type ${descriptor.insertTypeName} = InsertOf<typeof ${descriptor.tableConstName}>
@@ -10690,11 +11345,12 @@ ${nullableLines}
 }
 function generateArtifactsFromSnapshot(snapshot, config) {
   const normalizedConfig = "internal" in config ? config : normalizeGeneratorConfig(config);
+  const filteredSnapshot = filterIntrospectionSnapshot(snapshot, normalizedConfig.filter);
   if (normalizedConfig.output.format === "table-builder") {
-    return generateTableBuilderArtifactsFromSnapshot(snapshot, normalizedConfig);
+    return generateTableBuilderArtifactsFromSnapshot(filteredSnapshot, normalizedConfig);
   }
   return composeGeneratorArtifacts({
-    snapshot,
+    snapshot: filteredSnapshot,
     config: normalizedConfig,
     createModelDescriptor({ providerName, databaseName, schemaName, tableName, table: table2 }) {
       const modelConstName = toSafeIdentifier(
@@ -10724,7 +11380,7 @@ function generateArtifactsFromSnapshot(snapshot, config) {
         table: table2
       };
     },
-    renderModelArtifact: (descriptor) => renderModelArtifact2(snapshot.database, descriptor, normalizedConfig)
+    renderModelArtifact: (descriptor) => renderModelArtifact2(filteredSnapshot.database, descriptor, normalizedConfig)
   });
 }
 
@@ -10844,16 +11500,25 @@ async function fileExists(path) {
 }
 async function writeArtifacts(files, cwd) {
   const writtenFiles = [];
+  const skippedFiles = [];
   for (const file of files) {
     const absolutePath = path.resolve(cwd, file.path);
     if (!canOverwriteArtifact(file) && await fileExists(absolutePath)) {
+      skippedFiles.push({
+        kind: file.kind,
+        path: file.path,
+        reason: "protected-existing-file"
+      });
       continue;
     }
     await promises.mkdir(path.dirname(absolutePath), { recursive: true });
     await promises.writeFile(absolutePath, file.content, "utf8");
     writtenFiles.push(file.path);
   }
-  return writtenFiles;
+  return {
+    writtenFiles,
+    skippedFiles
+  };
 }
 async function runSchemaGenerator(options = {}) {
   const cwd = options.cwd ?? process.cwd();
@@ -10867,12 +11532,13 @@ async function runSchemaGenerator(options = {}) {
     schemas: resolveProviderSchemas(config.provider)
   });
   const generated = generateArtifactsFromSnapshot(snapshot, config);
-  const writtenFiles = options.dryRun ? [] : await writeArtifacts(generated.files, cwd);
+  const writeResult = options.dryRun ? { writtenFiles: [], skippedFiles: [] } : await writeArtifacts(generated.files, cwd);
   return {
     ...generated,
     configPath,
     config,
-    writtenFiles
+    writtenFiles: writeResult.writtenFiles,
+    skippedFiles: writeResult.skippedFiles
   };
 }
 
@@ -11303,7 +11969,12 @@ function athenaAuth(config) {
   return auth;
 }
 
+exports.ATHENA_AUTH_ADMIN_LIMITS = ATHENA_AUTH_ADMIN_LIMITS;
 exports.ATHENA_AUTH_BASE_ERROR_CODES = ATHENA_AUTH_BASE_ERROR_CODES;
+exports.ATHENA_AUTH_MAX_ADMIN_JSON_BYTES = ATHENA_AUTH_MAX_ADMIN_JSON_BYTES;
+exports.ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH = ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH;
+exports.ATHENA_AUTH_MAX_TEMPLATE_VARIABLES = ATHENA_AUTH_MAX_TEMPLATE_VARIABLES;
+exports.ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH = ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH;
 exports.AthenaClient = AthenaClient;
 exports.AthenaError = AthenaError;
 exports.AthenaErrorCategory = AthenaErrorCategory;
@@ -11333,6 +12004,7 @@ exports.defineModel = defineModel;
 exports.defineRegistry = defineRegistry;
 exports.defineSchema = defineSchema;
 exports.enumeration = enumeration;
+exports.filterIntrospectionSnapshot = filterIntrospectionSnapshot;
 exports.findGeneratorConfigPath = findGeneratorConfigPath;
 exports.generateArtifactsFromSnapshot = generateArtifactsFromSnapshot;
 exports.generatorEnv = generatorEnv;
@@ -11346,6 +12018,7 @@ exports.normalizeAthenaError = normalizeAthenaError;
 exports.normalizeAthenaGatewayBaseUrl = normalizeAthenaGatewayBaseUrl;
 exports.normalizeGeneratorConfig = normalizeGeneratorConfig;
 exports.normalizeSchemaSelection = normalizeSchemaSelection;
+exports.normalizeTableSelection = normalizeTableSelection;
 exports.number = number;
 exports.parseBooleanFlag = parseBooleanFlag2;
 exports.renderAthenaReactEmail = renderAthenaReactEmail;