@xylex-group/athena 2.8.2 → 2.9.0

package/dist/browser.js

@@ -800,7 +800,7 @@ var getCookieCache = async (request, config) => {
 
 // package.json
 var package_default = {
-  version: "2.8.2"
+  version: "2.9.0"
 };
 
 // src/sdk-version.ts
@@ -813,6 +813,7 @@ function buildSdkHeaderValue(sdkName) {
 var DEFAULT_CLIENT = "railway_direct";
 var SDK_NAME = "xylex-group/athena";
 var SDK_HEADER_VALUE = buildSdkHeaderValue(SDK_NAME);
+var NO_CACHE_HEADER_VALUE = "no-cache";
 function parseResponseBody(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -831,6 +832,9 @@ function parseResponseBody(rawText, contentType) {
 function normalizeHeaderValue(value) {
   return value ? value : void 0;
 }
+function isCacheControlHeaderName(name) {
+  return name.toLowerCase() === "cache-control";
+}
 function resolveHeaderValue(headers, candidates) {
   for (const candidate of candidates) {
     const direct = normalizeHeaderValue(headers[candidate]);
@@ -989,6 +993,7 @@ function buildRpcGetEndpoint(payload) {
 }
 function buildHeaders(config, options) {
   const mergedStripNulls = options?.stripNulls ?? true;
+  const forceNoCache = Boolean(config.forceNoCache || options?.forceNoCache);
   const extraHeaders = {
     ...config.headers ?? {},
     ...options?.headers ?? {}
@@ -1042,11 +1047,15 @@ function buildHeaders(config, options) {
   const athenaClientKeys = ["x-athena-client", "X-Athena-Client"];
   Object.entries(extraHeaders).forEach(([key, value]) => {
     if (athenaClientKeys.includes(key)) return;
+    if (forceNoCache && isCacheControlHeaderName(key)) return;
     const normalized = normalizeHeaderValue(value);
     if (normalized) {
       headers[key] = normalized;
     }
   });
+  if (forceNoCache) {
+    headers["Cache-Control"] = NO_CACHE_HEADER_VALUE;
+  }
   return headers;
 }
 function toInvalidUrlResponse(error, endpoint, method) {
@@ -1507,6 +1516,45 @@ function identifier(...segments) {
   return new SqlIdentifierPath(expandedSegments);
 }
 
+// src/auth/limits.ts
+var ATHENA_AUTH_MAX_ADMIN_JSON_BYTES = 32 * 1024;
+var ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH = 8;
+var ATHENA_AUTH_MAX_TEMPLATE_VARIABLES = 64;
+var ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH = 128;
+var ATHENA_AUTH_ADMIN_LIMITS = {
+  maxAdminJsonBytes: ATHENA_AUTH_MAX_ADMIN_JSON_BYTES,
+  maxAdminJsonDepth: ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH,
+  maxTemplateVariables: ATHENA_AUTH_MAX_TEMPLATE_VARIABLES,
+  maxTemplateVariableLength: ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH
+};
+function describeTemplateVariableTarget(target) {
+  const normalized = target?.trim();
+  return normalized && normalized.length > 0 ? normalized : "Athena auth admin email template variables";
+}
+function assertAthenaAuthTemplateVariables(variables, target) {
+  const label = describeTemplateVariableTarget(target);
+  if (!Array.isArray(variables)) {
+    throw new Error(`${label} must be an array of strings.`);
+  }
+  if (variables.length > ATHENA_AUTH_MAX_TEMPLATE_VARIABLES) {
+    throw new Error(
+      `${label} cannot contain more than ${ATHENA_AUTH_MAX_TEMPLATE_VARIABLES} entries.`
+    );
+  }
+  variables.forEach((variable, index) => {
+    if (typeof variable !== "string") {
+      throw new Error(
+        `${label} must contain only strings. Received ${typeof variable} at index ${index}.`
+      );
+    }
+    if (variable.length > ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH) {
+      throw new Error(
+        `${label} cannot contain entries longer than ${ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH} characters. Received ${variable.length} characters at index ${index}.`
+      );
+    }
+  });
+}
+
 // src/auth/react-email.ts
 var reactEmailRenderModulePromise;
 function isRecord2(value) {
@@ -1736,6 +1784,7 @@ async function resolveReactEmailPayloadFields(input, fields, options) {
 var DEFAULT_AUTH_BASE_URL = "http://localhost:3001/api/auth";
 var SDK_NAME2 = "xylex-group/athena-auth";
 var SDK_HEADER_VALUE2 = buildSdkHeaderValue(SDK_NAME2);
+var NO_CACHE_HEADER_VALUE2 = "no-cache";
 function normalizeBaseUrl(baseUrl) {
   return (baseUrl ?? DEFAULT_AUTH_BASE_URL).replace(/\/$/, "");
 }
@@ -1745,6 +1794,9 @@ function isRecord3(value) {
 function normalizeHeaderValue2(value) {
   return value ? value : void 0;
 }
+function isCacheControlHeaderName2(name) {
+  return name.toLowerCase() === "cache-control";
+}
 function parseResponseBody2(rawText, contentType) {
   if (!rawText) {
     return { parsed: null, parseFailed: false };
@@ -1800,6 +1852,54 @@ function mergeCallOptions(base, override) {
     }
   };
 }
+function toSessionGuardFailure(sessionResult) {
+  if (sessionResult.status === 401 || sessionResult.data == null) {
+    return {
+      ok: false,
+      reason: "unauthorized",
+      status: 401,
+      error: sessionResult.error ?? "Unauthorized",
+      sessionResult
+    };
+  }
+  return {
+    ok: false,
+    reason: "upstream_error",
+    status: sessionResult.status,
+    error: sessionResult.error ?? "Failed to resolve current session",
+    sessionResult
+  };
+}
+function toPermissionGuardFailure(permissionResult, sessionResult) {
+  if (permissionResult.status === 401) {
+    return {
+      ok: false,
+      reason: "unauthorized",
+      status: 401,
+      error: permissionResult.error ?? "Unauthorized",
+      sessionResult,
+      permissionResult
+    };
+  }
+  if (permissionResult.status === 403) {
+    return {
+      ok: false,
+      reason: "forbidden",
+      status: 403,
+      error: permissionResult.error ?? "Forbidden",
+      sessionResult,
+      permissionResult
+    };
+  }
+  return {
+    ok: false,
+    reason: "upstream_error",
+    status: permissionResult.status,
+    error: permissionResult.error ?? "Failed to resolve permission check",
+    sessionResult,
+    permissionResult
+  };
+}
 function extractFetchOptions(input) {
   if (!input) {
     return {
@@ -1815,6 +1915,7 @@ function extractFetchOptions(input) {
   };
 }
 function buildHeaders2(config, options) {
+  const forceNoCache = Boolean(config.forceNoCache || options?.forceNoCache);
   const headers = {
     "Content-Type": "application/json",
     "X-Athena-Sdk": SDK_HEADER_VALUE2
@@ -1828,16 +1929,30 @@ function buildHeaders2(config, options) {
   if (bearerToken) {
     headers.Authorization = `Bearer ${bearerToken}`;
   }
+  const cookie = options?.cookie ?? config.cookie;
+  if (cookie) {
+    headers.Cookie = cookie;
+  }
+  const sessionToken = options?.sessionToken ?? config.sessionToken;
+  if (sessionToken) {
+    headers["X-Athena-Auth-Session-Token"] = sessionToken;
+  }
   const mergedExtraHeaders = {
     ...config.headers ?? {},
     ...options?.headers ?? {}
   };
   Object.entries(mergedExtraHeaders).forEach(([key, value]) => {
+    if (forceNoCache && isCacheControlHeaderName2(key)) {
+      return;
+    }
     const normalized = normalizeHeaderValue2(value);
     if (normalized) {
       headers[key] = normalized;
     }
   });
+  if (forceNoCache) {
+    headers["Cache-Control"] = NO_CACHE_HEADER_VALUE2;
+  }
   return headers;
 }
 function appendQueryParam(searchParams, key, value) {
@@ -2102,7 +2217,91 @@ function createAuthClient(config = {}) {
     htmlField: "htmlTemplate",
     textField: "textTemplate",
     variablesField: "variables"
-  }, withReactEmailRoute(route));
+  }, withReactEmailRoute(route)).then((payload) => {
+    if ("variables" in payload && payload.variables !== void 0 && payload.variables !== null) {
+      assertAthenaAuthTemplateVariables(
+        payload.variables,
+        `${route} variables`
+      );
+    }
+    return payload;
+  });
+  const requireSession = async (input, options) => {
+    const sessionInput = input?.fetchOptions ? { fetchOptions: input.fetchOptions } : void 0;
+    const sessionResult = await getGeneric(
+      "/get-session",
+      sessionInput,
+      options
+    );
+    if (!sessionResult.ok || sessionResult.data == null) {
+      return toSessionGuardFailure(sessionResult);
+    }
+    return {
+      ok: true,
+      session: sessionResult.data
+    };
+  };
+  const getUser = async (input, options) => {
+    const sessionResult = await getGeneric(
+      "/get-session",
+      input,
+      options
+    );
+    if (!sessionResult.ok) {
+      return {
+        ...sessionResult,
+        data: null
+      };
+    }
+    return {
+      ...sessionResult,
+      data: {
+        user: sessionResult.data?.user ?? null
+      }
+    };
+  };
+  const requirePermission = async (endpoint, input, options) => {
+    const sessionGuard = await requireSession(
+      input?.fetchOptions ? { fetchOptions: input.fetchOptions } : void 0,
+      options
+    );
+    if (!sessionGuard.ok) {
+      return sessionGuard;
+    }
+    const permissionResult = await postGeneric(
+      endpoint,
+      input,
+      options
+    );
+    if (!permissionResult.ok) {
+      return toPermissionGuardFailure(permissionResult, {
+        ok: true,
+        status: 200,
+        data: sessionGuard.session,
+        error: null,
+        errorDetails: null,
+        raw: sessionGuard.session
+      });
+    }
+    if (!permissionResult.data?.success) {
+      return {
+        ok: false,
+        reason: "forbidden",
+        status: 403,
+        error: permissionResult.data?.error ?? "Forbidden",
+        sessionResult: {
+          ok: true,
+          status: 200,
+          data: sessionGuard.session,
+          error: null,
+          errorDetails: null,
+          raw: sessionGuard.session
+        },
+        permissionResult
+      };
+    }
+    return sessionGuard;
+  };
   const listUserEmailsWithFallback = async (input, options) => {
     const primary = await getWithQuery(
       "/email/list",
@@ -2264,6 +2463,7 @@ function createAuthClient(config = {}) {
       input,
       options
     ),
+    requirePermission: (input, options) => requirePermission("/organization/has-permission", input, options),
     invitation: {
       cancel: (input, options) => executePostWithCompatibleInput(
         resolvedConfig,
@@ -2459,6 +2659,8 @@ function createAuthClient(config = {}) {
   };
   const auth = {
     getSession: (input, options) => getGeneric("/get-session", input, options),
+    getUser,
+    requireSession,
     signOut,
     forgetPassword: (input, options) => postGeneric("/forget-password", input, options),
     resetPassword: authResetPassword,
@@ -2553,6 +2755,7 @@ function createAuthClient(config = {}) {
         }
       },
       hasPermission: (input, options) => postGeneric("/admin/has-permission", input, options),
+      requirePermission: (input, options) => requirePermission("/admin/has-permission", input, options),
       apiKey: {
         create: (input, options) => postGeneric("/admin/api-key/create", input, options)
       },
@@ -2704,6 +2907,8 @@ function createAuthClient(config = {}) {
       input,
       options
     ),
+    getUser,
+    requireSession,
     listSessions: (input, options) => executeGetWithCompatibleInput(
       resolvedConfig,
       { endpoint: "/list-sessions", method: "GET" },
@@ -5459,6 +5664,9 @@ var AthenaClientBuilderImpl = class {
   apiKey;
   backendConfig = DEFAULT_BACKEND;
   clientName;
+  defaultUserId;
+  defaultOrganizationId;
+  forceNoCacheEnabled = false;
   defaultHeaders;
   authConfig;
   dbUrlOverride;
@@ -5507,6 +5715,15 @@ var AthenaClientBuilderImpl = class {
     if (options.client !== void 0) {
       this.clientName = options.client;
     }
+    if (options.userId !== void 0) {
+      this.defaultUserId = options.userId;
+    }
+    if (options.organizationId !== void 0) {
+      this.defaultOrganizationId = options.organizationId;
+    }
+    if (options.forceNoCache !== void 0) {
+      this.forceNoCacheEnabled = options.forceNoCache;
+    }
     if (options.backend !== void 0) {
       this.backendConfig = toBackendConfig(options.backend);
     }
@@ -5561,6 +5778,9 @@ var AthenaClientBuilderImpl = class {
       url: this.rootUrl,
       key: this.apiKey,
       client: this.clientName,
+      userId: this.defaultUserId,
+      organizationId: this.defaultOrganizationId,
+      forceNoCache: this.forceNoCacheEnabled,
       backend: this.backendConfig,
       headers: this.defaultHeaders,
       db: this.dbUrlOverride ? { url: this.dbUrlOverride } : void 0,
@@ -8103,6 +8323,83 @@ function createQueryBuilder(client, formatGatewayResult, experimental, tracer) {
     );
   };
 }
+var ATHENA_ENV_URL_KEYS = ["ATHENA_URL", "NEXT_PUBLIC_ATHENA_URL"];
+var ATHENA_ENV_GATEWAY_URL_KEYS = [
+  "ATHENA_DB_URL",
+  "ATHENA_GATEWAY_URL",
+  "NEXT_PUBLIC_ATHENA_DB_API_URL"
+];
+var ATHENA_ENV_AUTH_URL_KEYS = ["ATHENA_AUTH_URL", "NEXT_PUBLIC_ATHENA_AUTH_URL"];
+var ATHENA_ENV_STORAGE_URL_KEYS = ["ATHENA_STORAGE_URL", "NEXT_PUBLIC_ATHENA_STORAGE_URL"];
+var ATHENA_ENV_KEY_KEYS = [
+  "ATHENA_API_KEY",
+  "NEXT_PUBLIC_ATHENA_API_KEY",
+  "ATHENA_GATEWAY_API_KEY",
+  "X_API_KEY"
+];
+var ATHENA_ENV_CLIENT_KEYS = ["ATHENA_CLIENT", "NEXT_PUBLIC_ATHENA_CLIENT"];
+function normalizeOptionalString(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function readFirstEnvValue(env, keys) {
+  for (const key of keys) {
+    const value = normalizeOptionalString(env[key]);
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function readHeaderBagValue(headers, targetKey) {
+  if (!headers) {
+    return void 0;
+  }
+  if (typeof headers.get === "function") {
+    return normalizeOptionalString(headers.get(targetKey));
+  }
+  const normalizedTargetKey = targetKey.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== normalizedTargetKey) {
+      continue;
+    }
+    if (typeof value === "string") {
+      return normalizeOptionalString(value);
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function resolveSessionContextOptions(session, options) {
+  const sessionToken = normalizeOptionalString(session?.session?.token);
+  const requestCookie = readHeaderBagValue(options?.requestHeaders, "cookie") ?? readHeaderBagValue(options?.headers, "cookie");
+  const authInput = options?.auth;
+  const resolvedUserId = options?.userId !== void 0 ? options.userId : session?.user?.id;
+  const resolvedOrganizationId = options?.organizationId !== void 0 ? options.organizationId : session?.session?.activeOrganizationId;
+  const resolvedBearerToken = authInput?.bearerToken !== void 0 ? authInput.bearerToken : sessionToken;
+  const resolvedSessionToken = authInput?.sessionToken !== void 0 ? authInput.sessionToken : sessionToken;
+  const resolvedCookie = authInput?.cookie !== void 0 ? authInput.cookie : requestCookie;
+  const auth = authInput !== void 0 || resolvedBearerToken !== void 0 || resolvedSessionToken !== void 0 || resolvedCookie !== void 0 ? {
+    ...authInput ?? {},
+    ...resolvedBearerToken !== void 0 ? { bearerToken: resolvedBearerToken } : {},
+    ...resolvedSessionToken !== void 0 ? { sessionToken: resolvedSessionToken } : {},
+    ...resolvedCookie !== void 0 ? { cookie: resolvedCookie } : {},
+    headers: authInput?.headers ? { ...authInput.headers } : void 0
+  } : void 0;
+  if (resolvedUserId === void 0 && resolvedOrganizationId === void 0 && options?.forceNoCache === void 0 && !options?.headers && !auth) {
+    return void 0;
+  }
+  return {
+    userId: resolvedUserId,
+    organizationId: resolvedOrganizationId,
+    forceNoCache: options?.forceNoCache,
+    headers: options?.headers ? { ...options.headers } : void 0,
+    auth
+  };
+}
 function resolveClientServiceBaseUrl(value, label) {
   if (value === void 0 || value === null) {
     return void 0;
@@ -8145,6 +8442,87 @@ function resolveRequiredClientApiKey(value) {
   }
   return normalizedValue;
 }
+function hasHeaderIgnoreCase(headers, targetKey) {
+  const normalizedTargetKey = targetKey.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === normalizedTargetKey);
+}
+function mergeClientHeaders(current, next) {
+  if (!current && !next) {
+    return void 0;
+  }
+  return {
+    ...current ?? {},
+    ...next ?? {}
+  };
+}
+function mergeDefinedObject(current, next) {
+  if (!current && !next) {
+    return void 0;
+  }
+  const merged = {
+    ...current ?? {}
+  };
+  const mutableMerged = merged;
+  for (const [key, value] of Object.entries(next ?? {})) {
+    if (value !== void 0) {
+      mutableMerged[key] = value;
+    }
+  }
+  return merged;
+}
+function mergeAuthClientOptions(current, next) {
+  const merged = mergeDefinedObject(current, next);
+  if (!merged) {
+    return void 0;
+  }
+  const mergedHeaders = mergeClientHeaders(current?.headers, next?.headers);
+  if (mergedHeaders) {
+    merged.headers = mergedHeaders;
+  }
+  return merged;
+}
+function mergeServiceUrlOverrides(current, next) {
+  return mergeDefinedObject(current, next);
+}
+function toClientContextOverrides(context) {
+  if (!context) {
+    return void 0;
+  }
+  return {
+    userId: context.userId,
+    organizationId: context.organizationId,
+    forceNoCache: context.forceNoCache,
+    headers: context.headers,
+    auth: context.auth ? {
+      ...context.auth,
+      headers: context.auth.headers ? { ...context.auth.headers } : void 0
+    } : void 0
+  };
+}
+function mergeClientOverrideOptions(base, overrides) {
+  if (!overrides) {
+    return {
+      ...base,
+      headers: base.headers ? { ...base.headers } : void 0,
+      auth: base.auth ? {
+        ...base.auth,
+        headers: base.auth.headers ? { ...base.auth.headers } : void 0
+      } : void 0,
+      db: base.db ? { ...base.db } : void 0,
+      gateway: base.gateway ? { ...base.gateway } : void 0,
+      storage: base.storage ? { ...base.storage } : void 0
+    };
+  }
+  const merged = mergeDefinedObject(base, overrides) ?? { ...base };
+  return {
+    ...merged,
+    headers: mergeClientHeaders(base.headers, overrides.headers),
+    auth: mergeAuthClientOptions(base.auth, overrides.auth),
+    db: mergeServiceUrlOverrides(base.db, overrides.db),
+    gateway: mergeServiceUrlOverrides(base.gateway, overrides.gateway),
+    storage: mergeServiceUrlOverrides(base.storage, overrides.storage)
+  };
+}
 function normalizeAuthClientConfig(auth, defaultBaseUrl) {
   if (!auth && defaultBaseUrl === void 0) {
     return void 0;
@@ -8154,6 +8532,8 @@ function normalizeAuthClientConfig(auth, defaultBaseUrl) {
     baseUrl,
     apiKey,
     bearerToken,
+    cookie,
+    sessionToken,
     ...rest
   } = auth ?? {};
   const normalized = {
@@ -8172,6 +8552,12 @@ function normalizeAuthClientConfig(auth, defaultBaseUrl) {
   if (typeof bearerToken === "string") {
     normalized.bearerToken = bearerToken;
   }
+  if (typeof cookie === "string") {
+    normalized.cookie = cookie;
+  }
+  if (typeof sessionToken === "string") {
+    normalized.sessionToken = sessionToken;
+  }
   return normalized;
 }
 function resolveCreateClientConfig(config) {
@@ -8185,6 +8571,9 @@ function resolveCreateClientConfig(config) {
     baseUrl: resolvedUrls.dbUrl,
     apiKey: resolveRequiredClientApiKey(config.key),
     client: resolveOptionalClientName(config.client),
+    userId: config.userId,
+    organizationId: config.organizationId,
+    forceNoCache: config.forceNoCache,
     backend: toBackendConfig(config.backend),
     headers: config.headers,
     auth: config.auth,
@@ -8193,23 +8582,39 @@ function resolveCreateClientConfig(config) {
     experimental: config.experimental
   };
 }
-function createClientFromConfig(config) {
+function createClientFromInput(sourceConfig) {
+  return createClientFromConfig(resolveCreateClientConfig(sourceConfig), sourceConfig);
+}
+function createClientFromConfig(config, sourceConfig) {
+  const normalizedAuthConfig = normalizeAuthClientConfig(config.auth, config.authUrl);
   const gatewayHeaders = {
     ...config.headers ?? {}
   };
-  if (config.auth?.bearerToken && gatewayHeaders["X-Athena-Auth-Bearer-Token"] === void 0 && gatewayHeaders["x-athena-auth-bearer-token"] === void 0) {
-    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = config.auth.bearerToken;
+  if (normalizedAuthConfig?.bearerToken && !hasHeaderIgnoreCase(gatewayHeaders, "X-Athena-Auth-Bearer-Token")) {
+    gatewayHeaders["X-Athena-Auth-Bearer-Token"] = normalizedAuthConfig.bearerToken;
+  }
+  if (normalizedAuthConfig?.cookie && !hasHeaderIgnoreCase(gatewayHeaders, "Cookie")) {
+    gatewayHeaders.Cookie = normalizedAuthConfig.cookie;
+  }
+  if (normalizedAuthConfig?.sessionToken && !hasHeaderIgnoreCase(gatewayHeaders, "X-Athena-Auth-Session-Token")) {
+    gatewayHeaders["X-Athena-Auth-Session-Token"] = normalizedAuthConfig.sessionToken;
   }
   const gateway = createAthenaGatewayClient({
     baseUrl: config.baseUrl,
     apiKey: config.apiKey,
     client: config.client,
+    userId: config.userId,
+    organizationId: config.organizationId,
+    forceNoCache: config.forceNoCache,
     backend: config.backend,
     headers: gatewayHeaders
   });
   const formatGatewayResult = createResultFormatter(config.experimental);
   const queryTracer = createQueryTracer(config.experimental);
-  const auth = createAuthClient(normalizeAuthClientConfig(config.auth, config.authUrl));
+  const auth = createAuthClient({
+    ...normalizedAuthConfig ?? {},
+    ...config.forceNoCache ? { forceNoCache: true } : {}
+  });
   function from(tableOrModel, options) {
     if (isAthenaModelTarget(tableOrModel)) {
       if (options?.schema !== void 0) {
@@ -8257,17 +8662,45 @@ function createClientFromConfig(config) {
     queryTracer
   );
   const db = createDbModule({ from, rpc, query });
+  const withContext = (context) => createClientFromInput(
+    mergeClientOverrideOptions(sourceConfig, toClientContextOverrides(context))
+  );
+  const withSession = (session, options) => createClientFromInput(
+    mergeClientOverrideOptions(
+      sourceConfig,
+      toClientContextOverrides(resolveSessionContextOptions(session, options))
+    )
+  );
+  const authWithOptions = (options) => createClientFromInput(mergeClientOverrideOptions(sourceConfig, options));
   const sdkClient = {
     from,
     db,
     rpc,
     query,
     verifyConnection: gateway.verifyConnection,
-    auth: auth.auth
+    auth: auth.auth,
+    withContext,
+    withSession,
+    withOptions: authWithOptions
   };
   if (config.experimental?.athenaStorageBackend) {
+    const storageWithContext = (context) => createClientFromInput(
+      mergeClientOverrideOptions(sourceConfig, toClientContextOverrides(context))
+    );
+    const storageWithSession = (session, options) => createClientFromInput(
+      mergeClientOverrideOptions(
+        sourceConfig,
+        toClientContextOverrides(resolveSessionContextOptions(session, options))
+      )
+    );
+    const storageWithOptions = (options) => createClientFromInput(
+      mergeClientOverrideOptions(sourceConfig, options)
+    );
     const storageClient = {
       ...sdkClient,
+      withContext: storageWithContext,
+      withSession: storageWithSession,
+      withOptions: storageWithOptions,
       storage: createStorageModule(gateway, {
         ...config.experimental.storage,
         ...config.storageUrl ? {
@@ -8283,38 +8716,42 @@ function createClientFromConfig(config) {
 var AthenaClient = class {
   /** Create a fluent builder for a strongly-typed Athena SDK client. */
   static builder() {
-    return createAthenaClientBuilder((config) => createClientFromConfig(resolveCreateClientConfig(config)));
-  }
-  /** Build a client from process environment variables. */
-  static fromEnvironment() {
-    const url = process.env.ATHENA_URL;
-    const gatewayUrl = process.env.ATHENA_DB_URL ?? process.env.ATHENA_GATEWAY_URL;
-    const authUrl = process.env.ATHENA_AUTH_URL;
-    const storageUrl = process.env.ATHENA_STORAGE_URL;
-    const key = process.env.ATHENA_API_KEY ?? process.env.ATHENA_GATEWAY_API_KEY;
+    return createAthenaClientBuilder((config) => createClientFromInput(config));
+  }
+  static fromEnvironment(options = {}) {
+    const env = options.env ?? process.env;
+    const url = options.url ?? readFirstEnvValue(env, ATHENA_ENV_URL_KEYS);
+    const gatewayUrl = options.gatewayUrl ?? readFirstEnvValue(env, ATHENA_ENV_GATEWAY_URL_KEYS);
+    const authUrl = options.authUrl ?? readFirstEnvValue(env, ATHENA_ENV_AUTH_URL_KEYS);
+    const storageUrl = options.storageUrl ?? readFirstEnvValue(env, ATHENA_ENV_STORAGE_URL_KEYS);
+    const key = options.key ?? readFirstEnvValue(env, ATHENA_ENV_KEY_KEYS);
+    const client = options.client ?? readFirstEnvValue(env, ATHENA_ENV_CLIENT_KEYS);
     if (!url && !gatewayUrl || !key) {
       throw new Error(
-        "ATHENA_API_KEY plus ATHENA_URL or ATHENA_GATEWAY_URL (optionally ATHENA_DB_URL, ATHENA_AUTH_URL, ATHENA_STORAGE_URL) are required"
+        "AthenaClient.fromEnvironment() requires an API key plus a public or gateway URL. Supported aliases include ATHENA_API_KEY, NEXT_PUBLIC_ATHENA_API_KEY, ATHENA_GATEWAY_API_KEY, X_API_KEY, ATHENA_URL, NEXT_PUBLIC_ATHENA_URL, ATHENA_GATEWAY_URL, and ATHENA_DB_URL."
       );
     }
+    const { env: _env, ...clientOptions } = options;
     return createClient({
+      ...clientOptions,
       url,
       gatewayUrl,
       authUrl,
       storageUrl,
-      key
+      key,
+      client
     });
   }
 };
 function createClient(configOrUrl, apiKey, options) {
   if (typeof configOrUrl === "string" || configOrUrl === null || configOrUrl === void 0) {
-    return createClientFromConfig(resolveCreateClientConfig({
+    return createClientFromInput({
       url: configOrUrl,
       key: apiKey ?? "",
       ...options
-    }));
+    });
   }
-  return createClientFromConfig(resolveCreateClientConfig(configOrUrl));
+  return createClientFromInput(configOrUrl);
 }
 
 // src/gateway/types.ts
@@ -8680,6 +9117,9 @@ function createColumnsBuilder(name, mappedName, schemaName, columns) {
       resolveTableTarget(name, mappedName, normalizedSchemaName);
       return createColumnsBuilder(name, mappedName, normalizedSchemaName, columns);
     },
+    withoutPrimaryKey() {
+      return finalizeTable(name, mappedName, schemaName, columns, []);
+    },
     primaryKey(...keys) {
       return finalizeTable(name, mappedName, schemaName, columns, keys);
     }
@@ -8731,6 +9171,59 @@ var TenantHeaderMapper = class {
     return Object.keys(headers).length > 0 ? headers : void 0;
   }
 };
+function normalizeOptionalString2(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const normalizedValue = value.trim();
+  return normalizedValue ? normalizedValue : void 0;
+}
+function readHeaderBagValue2(headers, targetKey) {
+  if (!headers) {
+    return void 0;
+  }
+  if (typeof headers.get === "function") {
+    return normalizeOptionalString2(headers.get(targetKey));
+  }
+  const normalizedTargetKey = targetKey.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== normalizedTargetKey) {
+      continue;
+    }
+    if (typeof value === "string") {
+      return normalizeOptionalString2(value);
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function resolveSessionContextOptions2(session, options) {
+  const sessionToken = normalizeOptionalString2(session?.session?.token);
+  const requestCookie = readHeaderBagValue2(options?.requestHeaders, "cookie") ?? readHeaderBagValue2(options?.headers, "cookie");
+  const authInput = options?.auth;
+  const resolvedUserId = options?.userId !== void 0 ? options.userId : session?.user?.id;
+  const resolvedOrganizationId = options?.organizationId !== void 0 ? options.organizationId : session?.session?.activeOrganizationId;
+  const resolvedBearerToken = authInput?.bearerToken !== void 0 ? authInput.bearerToken : sessionToken;
+  const resolvedSessionToken = authInput?.sessionToken !== void 0 ? authInput.sessionToken : sessionToken;
+  const resolvedCookie = authInput?.cookie !== void 0 ? authInput.cookie : requestCookie;
+  const auth = authInput !== void 0 || resolvedBearerToken !== void 0 || resolvedSessionToken !== void 0 || resolvedCookie !== void 0 ? {
+    ...authInput ?? {},
+    ...resolvedBearerToken !== void 0 ? { bearerToken: resolvedBearerToken } : {},
+    ...resolvedSessionToken !== void 0 ? { sessionToken: resolvedSessionToken } : {},
+    ...resolvedCookie !== void 0 ? { cookie: resolvedCookie } : {},
+    headers: authInput?.headers ? { ...authInput.headers } : void 0
+  } : void 0;
+  if (resolvedUserId === void 0 && resolvedOrganizationId === void 0 && options?.forceNoCache === void 0 && !options?.headers && !auth) {
+    return void 0;
+  }
+  return {
+    userId: resolvedUserId,
+    organizationId: resolvedOrganizationId,
+    forceNoCache: options?.forceNoCache,
+    headers: options?.headers ? { ...options.headers } : void 0,
+    auth
+  };
+}
 var RegistryNavigator = class {
   constructor(registry) {
     this.registry = registry;
@@ -8782,12 +9275,22 @@ var TypedAthenaClientImpl = class _TypedAthenaClientImpl {
       backend: input.options?.backend,
       client: input.options?.client,
       headers: input.options?.headers,
+      forceNoCache: input.options?.forceNoCache,
+      userId: input.options?.userId,
+      organizationId: input.options?.organizationId,
+      auth: input.options?.auth,
+      tenantKeyMap,
+      tenantContext,
       experimental: input.options?.experimental
     };
     this.baseClient = createClient(this.url, this.apiKey, {
       backend: this.clientOptions.backend,
       client: this.clientOptions.client,
       headers: this.tenantHeaderMapper.apply(this.clientOptions.headers, tenantContext),
+      forceNoCache: this.clientOptions.forceNoCache,
+      userId: this.clientOptions.userId,
+      organizationId: this.clientOptions.organizationId,
+      auth: this.clientOptions.auth,
       experimental: this.clientOptions.experimental
     });
     this.db = this.baseClient.db;
@@ -8805,6 +9308,40 @@ var TypedAthenaClientImpl = class _TypedAthenaClientImpl {
   verifyConnection(options) {
     return this.baseClient.verifyConnection(options);
   }
+  withContext(context) {
+    const headers = {
+      ...this.clientOptions.headers ?? {},
+      ...context?.headers ?? {}
+    };
+    const auth = this.clientOptions.auth || context?.auth ? {
+      ...this.clientOptions.auth ?? {},
+      ...context?.auth ?? {},
+      headers: this.clientOptions.auth?.headers || context?.auth?.headers ? {
+        ...this.clientOptions.auth?.headers ?? {},
+        ...context?.auth?.headers ?? {}
+      } : void 0
+    } : void 0;
+    return new _TypedAthenaClientImpl({
+      registry: this.registry,
+      url: this.url,
+      apiKey: this.apiKey,
+      options: {
+        ...this.clientOptions,
+        headers: Object.keys(headers).length > 0 ? headers : void 0,
+        auth,
+        tenantKeyMap: this.tenantKeyMap,
+        tenantContext: {
+          ...this.tenantContext
+        },
+        ...context?.userId !== void 0 ? { userId: context.userId } : {},
+        ...context?.organizationId !== void 0 ? { organizationId: context.organizationId } : {},
+        ...context?.forceNoCache !== void 0 ? { forceNoCache: context.forceNoCache } : {}
+      }
+    });
+  }
+  withSession(session, options) {
+    return this.withContext(resolveSessionContextOptions2(session, options));
+  }
   withTenantContext(context) {
     return new _TypedAthenaClientImpl({
       registry: this.registry,
@@ -8865,6 +9402,77 @@ function resolveProviderSchemas(providerConfig) {
   return [...DEFAULT_POSTGRES_SCHEMAS];
 }
 
+// src/generator/table-selection.ts
+function normalizeTableSelector(value) {
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function normalizeTableSelection(value) {
+  if (typeof value === "string") {
+    return Array.from(
+      new Set(
+        value.split(",").map(normalizeTableSelector).filter((entry) => Boolean(entry))
+      )
+    );
+  }
+  if (Array.isArray(value)) {
+    return Array.from(
+      new Set(
+        value.map((entry) => typeof entry === "string" ? normalizeTableSelector(entry) : void 0).filter((entry) => Boolean(entry))
+      )
+    );
+  }
+  return [];
+}
+function matchesTableSelector(schemaName, tableName, selector) {
+  const separatorIndex = selector.indexOf(".");
+  if (separatorIndex < 0) {
+    return tableName === selector;
+  }
+  const selectorSchema = selector.slice(0, separatorIndex).trim();
+  const selectorTable = selector.slice(separatorIndex + 1).trim();
+  return selectorSchema === schemaName && selectorTable === tableName;
+}
+function shouldKeepTable(schemaName, tableName, filter) {
+  const included = filter.includeTables.length === 0 || filter.includeTables.some((selector) => matchesTableSelector(schemaName, tableName, selector));
+  if (!included) {
+    return false;
+  }
+  return !filter.excludeTables.some((selector) => matchesTableSelector(schemaName, tableName, selector));
+}
+function hasTableFilters(filter) {
+  return filter.includeTables.length > 0 || filter.excludeTables.length > 0;
+}
+function filterIntrospectionSnapshot(snapshot, filter) {
+  if (!hasTableFilters(filter)) {
+    return snapshot;
+  }
+  const schemas = {};
+  for (const [schemaName, schema] of Object.entries(snapshot.schemas)) {
+    const tables = Object.fromEntries(
+      Object.entries(schema.tables).filter(([tableName]) => shouldKeepTable(schemaName, tableName, filter))
+    );
+    if (Object.keys(tables).length === 0) {
+      continue;
+    }
+    schemas[schemaName] = {
+      ...schema,
+      tables
+    };
+  }
+  if (Object.keys(schemas).length === 0) {
+    const includeLabel = filter.includeTables.length > 0 ? ` includeTables=${filter.includeTables.join(", ")}` : "";
+    const excludeLabel = filter.excludeTables.length > 0 ? ` excludeTables=${filter.excludeTables.join(", ")}` : "";
+    throw new Error(
+      `Generator table filters matched no tables after schema selection.${includeLabel}${excludeLabel}`
+    );
+  }
+  return {
+    ...snapshot,
+    schemas
+  };
+}
+
 // src/generator/env.ts
 function readEnvStringValue(key) {
   if (typeof process === "undefined" || !process.env) {
@@ -9523,6 +10131,6 @@ async function runSchemaGenerator(options = {}) {
   return throwBrowserUnsupported("runSchemaGenerator");
 }
 
-export { ATHENA_AUTH_BASE_ERROR_CODES, AthenaClient, AthenaError, AthenaErrorCategory, AthenaErrorCode, AthenaErrorKind, AthenaGatewayError, AthenaStorageError, AthenaStorageErrorCode, Backend, DEFAULT_POSTGRES_SCHEMAS, assertInt, athenaAuth, boolean, coerceInt, createAthenaStorageError, createAuthClient, createAuthReactEmailInput, createClient, createModelFormAdapter, createPostgresIntrospectionProvider, createTypedClient, defineAthenaAuthConfig, defineAuthEmailTemplate, defineDatabase, defineGeneratorConfig, defineModel, defineRegistry, defineSchema, enumeration, findGeneratorConfigPath, generateArtifactsFromSnapshot, generatorEnv, getAthenaDebugAst, identifier, isAthenaGatewayError, isOk, json, loadGeneratorConfig, normalizeAthenaError, normalizeAthenaGatewayBaseUrl, normalizeGeneratorConfig, normalizeSchemaSelection, number, parseBooleanFlag2 as parseBooleanFlag, renderAthenaReactEmail, requireAffected, requireSuccess, resolveGeneratorProvider, resolvePostgresColumnType, resolveProviderSchemas, runSchemaGenerator, storageSdkManifest, string, table, toModelFormDefaults, toModelPayload, unwrap, unwrapOne, unwrapRows, verifyAthenaGatewayUrl, withRetry };
+export { ATHENA_AUTH_ADMIN_LIMITS, ATHENA_AUTH_BASE_ERROR_CODES, ATHENA_AUTH_MAX_ADMIN_JSON_BYTES, ATHENA_AUTH_MAX_ADMIN_JSON_DEPTH, ATHENA_AUTH_MAX_TEMPLATE_VARIABLES, ATHENA_AUTH_MAX_TEMPLATE_VARIABLE_LENGTH, AthenaClient, AthenaError, AthenaErrorCategory, AthenaErrorCode, AthenaErrorKind, AthenaGatewayError, AthenaStorageError, AthenaStorageErrorCode, Backend, DEFAULT_POSTGRES_SCHEMAS, assertInt, athenaAuth, boolean, coerceInt, createAthenaStorageError, createAuthClient, createAuthReactEmailInput, createClient, createModelFormAdapter, createPostgresIntrospectionProvider, createTypedClient, defineAthenaAuthConfig, defineAuthEmailTemplate, defineDatabase, defineGeneratorConfig, defineModel, defineRegistry, defineSchema, enumeration, filterIntrospectionSnapshot, findGeneratorConfigPath, generateArtifactsFromSnapshot, generatorEnv, getAthenaDebugAst, identifier, isAthenaGatewayError, isOk, json, loadGeneratorConfig, normalizeAthenaError, normalizeAthenaGatewayBaseUrl, normalizeGeneratorConfig, normalizeSchemaSelection, normalizeTableSelection, number, parseBooleanFlag2 as parseBooleanFlag, renderAthenaReactEmail, requireAffected, requireSuccess, resolveGeneratorProvider, resolvePostgresColumnType, resolveProviderSchemas, runSchemaGenerator, storageSdkManifest, string, table, toModelFormDefaults, toModelPayload, unwrap, unwrapOne, unwrapRows, verifyAthenaGatewayUrl, withRetry };
 //# sourceMappingURL=browser.js.map
 //# sourceMappingURL=browser.js.map