@keboola/api-client-react 20.0.0 → 21.0.0

package/README.md

@@ -14,39 +14,40 @@ Peer dependencies: `react ^19.0.0`, `@keboola/api-client`.
 
 ## Quick Start
 
-Wrap your tree with `ApiClientProvider`, then read the client with `useApiClient` anywhere below it. The provider initialises the SDK once on mount and renders `fallback` until init resolves.
+A keboola client is `{ api, session }`. Mount the auth provider (it drives the `session` to ready and renders `fallback` until then) with `ApiClientProvider` inside it (it propagates `api` to `useApiClient`). Legacy (SAPI) shown here; bearer uses `createKeboola` + `AuthProvider`.
 
 ```tsx
-import { createApiClient } from '@keboola/api-client';
-import { ApiClientProvider, useApiClient } from '@keboola/api-client-react';
+import { createLegacyKeboola } from '@keboola/api-client';
+import { ApiClientProvider, LegacyAuthProvider, useApiClient } from '@keboola/api-client-react';
 
-const client = createApiClient();
+const { api, session } = createLegacyKeboola();
 
 export const App = () => (
-  <ApiClientProvider
-    client={client}
+  <LegacyAuthProvider
+    session={session}
     baseUrl="https://connection.keboola.com"
-    token={{ storageApi: 'your-storage-token' }}
-    metastoreBaseUrl="https://metastore.keboola.com"
-    onError={(error) => console.error('API Error:', error)}
+    storageToken="your-storage-token"
     fallback={<div>Loading…</div>}
   >
-    <Tables />
-  </ApiClientProvider>
+    <ApiClientProvider api={api}>
+      <Tables />
+    </ApiClientProvider>
+  </LegacyAuthProvider>
 );
 
 const Tables = () => {
   const api = useApiClient();
-  // api.storage.tables.list(), api.queue.searchJobs(), etc.
+  // api.storage.tables.getTables(), api.queue.searchJobs(), etc.
   return null;
 };
 ```
 
 ## Exported hooks
 
-- `useApiClient()` — returns the initialised `ApiClient`.
-- `useProject()` — returns `client.context.project` (project features + backend availability).
-- `useStack()` — returns `client.context.stack` (service discovery + feature flags).
+- `useApiClient()` — returns the `api` (product surface: `auth` + `management` + product namespaces).
+- `useProject()` — returns `api.context.project` (project features + backend availability).
+- `useStack()` — returns `api.context.stack` (service discovery + feature flags).
+- `useLegacyAuth()` / `useAuth()` — the flow-specific `session` (legacy / bearer).
 
 ## Ownership
 

package/dist/index.cjs

@@ -7,35 +7,128 @@ var jsxRuntime = require('react/jsx-runtime');
 var MISSING_API_CLIENT_ERROR = "useApiClient must be used within <ApiClientProvider />";
 var MISSING_PROJECT_ERROR = "useProject must be used within <ApiClientProvider />";
 var MISSING_STACK_ERROR = "useStack must be used within <ApiClientProvider />";
-var Context = react.createContext(null);
-var Provider = Context;
+var MISSING_AUTH_ERROR = "useAuth must be used within <AuthProvider />";
+var MISSING_LEGACY_AUTH_ERROR = "useLegacyAuth must be used within <LegacyAuthProvider />";
+var ApiContext = react.createContext(null);
+var ApiProvider = ApiContext;
+var AuthContext = react.createContext(null);
+var AuthContextProvider = AuthContext;
+var LegacyAuthContext = react.createContext(null);
+var LegacyAuthContextProvider = LegacyAuthContext;
 var useApiClient = () => {
-  const client = react.use(Context);
-  if (client === null) throw new Error(MISSING_API_CLIENT_ERROR);
-  return client;
+  const api = react.use(ApiContext);
+  if (api === null) throw new Error(MISSING_API_CLIENT_ERROR);
+  return api;
 };
 var useProject = () => {
-  const client = react.use(Context);
-  if (client === null) throw new Error(MISSING_PROJECT_ERROR);
-  return client.context.project;
+  const api = react.use(ApiContext);
+  if (api === null) throw new Error(MISSING_PROJECT_ERROR);
+  return api.context.project;
 };
 var useStack = () => {
-  const client = react.use(Context);
-  if (client === null) throw new Error(MISSING_STACK_ERROR);
-  return client.context.stack;
+  const api = react.use(ApiContext);
+  if (api === null) throw new Error(MISSING_STACK_ERROR);
+  return api.context.stack;
 };
-var ApiClientProvider = ({ client, children, fallback = null, ...rest }) => {
-  const [isInitializing, setIsInitializing] = react.useState(true);
+var useAuth = () => {
+  const session = react.use(AuthContext);
+  if (session === null) throw new Error(MISSING_AUTH_ERROR);
+  return session;
+};
+var useLegacyAuth = () => {
+  const session = react.use(LegacyAuthContext);
+  if (session === null) throw new Error(MISSING_LEGACY_AUTH_ERROR);
+  return session;
+};
+var ApiClientProvider = ({ api, children }) => /* @__PURE__ */ jsxRuntime.jsx(ApiProvider, { value: api, children });
+var AuthProvider = ({
+  session,
+  baseUrl,
+  credential,
+  projectId,
+  onAccessTokenChange,
+  loadingFallback = null,
+  errorFallback = null,
+  anonymousFallback = null,
+  children
+}) => {
+  const [snapshot, setSnapshot] = react.useState(() => session.debug());
+  const [isRestoring, setIsRestoring] = react.useState(() => session.hasPersistedValue());
+  const [restoreStatus, setRestoreStatus] = react.useState(null);
+  const restoreStartedRef = react.useRef(false);
+  react.useEffect(() => session.subscribe(setSnapshot), [session]);
+  react.useEffect(() => {
+    if (baseUrl === void 0) return;
+    if (snapshot.config.baseUrl !== null) return;
+    session.setBaseUrl(baseUrl);
+  }, [session, baseUrl, snapshot.config.baseUrl]);
+  react.useEffect(() => {
+    if (restoreStartedRef.current) return;
+    restoreStartedRef.current = true;
+    session.restore().then((result) => setRestoreStatus(result.status)).catch((error) => {
+      console.error("Keboola bearer session restore failed", error);
+      setRestoreStatus("empty");
+    }).finally(() => setIsRestoring(false));
+  }, [session]);
+  react.useEffect(() => {
+    if (restoreStatus === null || restoreStatus === "restored") return;
+    if (credential === void 0) return;
+    if (snapshot.config.status !== "anonymous") return;
+    session.authenticate(credential);
+  }, [session, restoreStatus, credential, snapshot.config.status]);
+  react.useEffect(() => {
+    if (restoreStatus === null || restoreStatus === "restored") return;
+    if (projectId === void 0) return;
+    if (snapshot.config.status !== "authenticated") return;
+    session.setProject(projectId);
+  }, [session, restoreStatus, projectId, snapshot.config.status]);
+  const accessToken = snapshot.config.status === "anonymous" ? void 0 : snapshot.config.credential.accessToken;
+  react.useEffect(() => {
+    if (accessToken !== void 0) onAccessTokenChange?.(accessToken);
+  }, [accessToken, onAccessTokenChange]);
+  const isProgrammatic = credential !== void 0 && projectId !== void 0;
+  const content = (() => {
+    if (snapshot.storage === "ready") {
+      if (typeof children !== "function") return children;
+      if (snapshot.config.status !== "scoped") return null;
+      const { projectId: scopedProjectId, baseUrl: scopedBaseUrl } = snapshot.config;
+      return children({ projectId: scopedProjectId, baseUrl: scopedBaseUrl });
+    }
+    if (snapshot.storage === "errored") return errorFallback;
+    if (isRestoring || snapshot.storage === "pending" || isProgrammatic) return loadingFallback;
+    return anonymousFallback;
+  })();
+  return /* @__PURE__ */ jsxRuntime.jsx(AuthContextProvider, { value: session, children: content });
+};
+var LegacyAuthProvider = ({
+  session,
+  baseUrl,
+  storageToken,
+  managementToken,
+  fallback = null,
+  children
+}) => {
+  const [isReady, setIsReady] = react.useState(() => session.isStorageReady());
+  const startedRef = react.useRef(false);
   react.useEffect(() => {
-    client.init(rest).finally(() => {
-      setIsInitializing(false);
-    });
+    const unsubscribe = session.subscribe(() => setIsReady(session.isStorageReady()));
+    if (!startedRef.current) {
+      startedRef.current = true;
+      session.setBaseUrl(baseUrl);
+      if (managementToken) session.authenticateManagement(managementToken);
+      void session.authenticateStorageAsync(storageToken).catch((error) => console.error("Keboola session bootstrap failed", error));
+    }
+    return unsubscribe;
   }, []);
-  return isInitializing ? fallback : /* @__PURE__ */ jsxRuntime.jsx(Provider, { value: client, children });
+  return /* @__PURE__ */ jsxRuntime.jsx(LegacyAuthContextProvider, { value: session, children: isReady ? children : fallback });
 };
 
 exports.ApiClientProvider = ApiClientProvider;
+exports.AuthProvider = AuthProvider;
+exports.LegacyAuthProvider = LegacyAuthProvider;
 exports.useApiClient = useApiClient;
+exports.useAuth = useAuth;
+exports.useLegacyAuth = useLegacyAuth;
 exports.useProject = useProject;
 exports.useStack = useStack;
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/context.ts","../src/ApiClientProvider.tsx"],"names":["createContext","use","useState","useEffect","jsx"],"mappings":";;;;;;AAIA,IAAM,wBAAA,GAA2B,wDAAA;AACjC,IAAM,qBAAA,GAAwB,sDAAA;AAC9B,IAAM,mBAAA,GAAsB,oDAAA;AAE5B,IAAM,OAAA,GAAUA,oBAAgC,IAAI,CAAA;AAE7C,IAAM,QAAA,GAAW,OAAA;AAEjB,IAAM,eAAe,MAAM;AAChC,EAAA,MAAM,MAAA,GAASC,UAAI,OAAO,CAAA;AAC1B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAC7D,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,aAAa,MAAM;AAC9B,EAAA,MAAM,MAAA,GAASA,UAAI,OAAO,CAAA;AAC1B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,MAAM,IAAI,MAAM,qBAAqB,CAAA;AAC1D,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAA;AACxB;AAEO,IAAM,WAAW,MAAM;AAC5B,EAAA,MAAM,MAAA,GAASA,UAAI,OAAO,CAAA;AAC1B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACxD,EAAA,OAAO,OAAO,OAAA,CAAQ,KAAA;AACxB;ACfO,IAAM,iBAAA,GAAoB,CAAC,EAAE,MAAA,EAAQ,UAAU,QAAA,GAAW,IAAA,EAAM,GAAG,IAAA,EAAK,KAAa;AAC1F,EAAA,MAAM,CAAC,cAAA,EAAgB,iBAAiB,CAAA,GAAIC,eAAkB,IAAI,CAAA;AAElE,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,OAAA,CAAQ,MAAM;AAC9B,MAAA,iBAAA,CAAkB,KAAK,CAAA;AAAA,IACzB,CAAC,CAAA;AAAA,EAGH,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,OAAO,iBAAiB,QAAA,mBAAWC,cAAA,CAAC,QAAA,EAAA,EAAS,KAAA,EAAO,QAAS,QAAA,EAAS,CAAA;AACxE","file":"index.cjs","sourcesContent":["import { createContext, use } from 'react';\n\nimport type { ApiClient } from '@keboola/api-client';\n\nconst MISSING_API_CLIENT_ERROR = 'useApiClient must be used within <ApiClientProvider />';\nconst MISSING_PROJECT_ERROR = 'useProject must be used within <ApiClientProvider />';\nconst MISSING_STACK_ERROR = 'useStack must be used within <ApiClientProvider />';\n\nconst Context = createContext<ApiClient | null>(null);\n\nexport const Provider = Context;\n\nexport const useApiClient = () => {\n  const client = use(Context);\n  if (client === null) throw new Error(MISSING_API_CLIENT_ERROR);\n  return client;\n};\n\nexport const useProject = () => {\n  const client = use(Context);\n  if (client === null) throw new Error(MISSING_PROJECT_ERROR);\n  return client.context.project;\n};\n\nexport const useStack = () => {\n  const client = use(Context);\n  if (client === null) throw new Error(MISSING_STACK_ERROR);\n  return client.context.stack;\n};\n","import { useEffect, useState } from 'react';\nimport type { ReactNode } from 'react';\n\nimport type { ApiClient, ApiClientOptions } from '@keboola/api-client';\n\nimport { Provider } from './context';\n\ntype Props = {\n  client: ApiClient;\n  children: ReactNode;\n  fallback?: ReactNode;\n} & ApiClientOptions;\n\nexport const ApiClientProvider = ({ client, children, fallback = null, ...rest }: Props) => {\n  const [isInitializing, setIsInitializing] = useState<boolean>(true);\n\n  useEffect(() => {\n    client.init(rest).finally(() => {\n      setIsInitializing(false);\n    });\n    // we want to init only on initial mount\n    // oxlint-disable-next-line react/exhaustive-deps\n  }, []);\n\n  return isInitializing ? fallback : <Provider value={client}>{children}</Provider>;\n};\n"]}
+{"version":3,"sources":["../src/context.ts","../src/ApiClientProvider.tsx","../src/AuthProvider.tsx","../src/LegacyAuthProvider.tsx"],"names":["createContext","use","jsx","useState","useRef","useEffect"],"mappings":";;;;;;AAIA,IAAM,wBAAA,GAA2B,wDAAA;AACjC,IAAM,qBAAA,GAAwB,sDAAA;AAC9B,IAAM,mBAAA,GAAsB,oDAAA;AAC5B,IAAM,kBAAA,GAAqB,8CAAA;AAC3B,IAAM,yBAAA,GAA4B,0DAAA;AAIlC,IAAM,UAAA,GAAaA,oBAAiC,IAAI,CAAA;AACjD,IAAM,WAAA,GAAc,UAAA;AAI3B,IAAM,WAAA,GAAcA,oBAAoC,IAAI,CAAA;AACrD,IAAM,mBAAA,GAAsB,WAAA;AAEnC,IAAM,iBAAA,GAAoBA,oBAAoC,IAAI,CAAA;AAC3D,IAAM,yBAAA,GAA4B,iBAAA;AAElC,IAAM,eAAe,MAAM;AAChC,EAAA,MAAM,GAAA,GAAMC,UAAI,UAAU,CAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,aAAa,MAAM;AAC9B,EAAA,MAAM,GAAA,GAAMA,UAAI,UAAU,CAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,MAAM,qBAAqB,CAAA;AACvD,EAAA,OAAO,IAAI,OAAA,CAAQ,OAAA;AACrB;AAEO,IAAM,WAAW,MAAM;AAC5B,EAAA,MAAM,GAAA,GAAMA,UAAI,UAAU,CAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACrD,EAAA,OAAO,IAAI,OAAA,CAAQ,KAAA;AACrB;AAGO,IAAM,UAAU,MAAM;AAC3B,EAAA,MAAM,OAAA,GAAUA,UAAI,WAAW,CAAA;AAC/B,EAAA,IAAI,OAAA,KAAY,IAAA,EAAM,MAAM,IAAI,MAAM,kBAAkB,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAGO,IAAM,gBAAgB,MAAM;AACjC,EAAA,MAAM,OAAA,GAAUA,UAAI,iBAAiB,CAAA;AACrC,EAAA,IAAI,OAAA,KAAY,IAAA,EAAM,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAC/D,EAAA,OAAO,OAAA;AACT;ACpCO,IAAM,iBAAA,GAAoB,CAAC,EAAE,GAAA,EAAK,QAAA,uBACvCC,cAAA,CAAC,WAAA,EAAA,EAAY,KAAA,EAAO,GAAA,EAAM,QAAA,EAAS;ACkC9B,IAAM,eAAe,CAAC;AAAA,EAC3B,OAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA,GAAkB,IAAA;AAAA,EAClB,aAAA,GAAgB,IAAA;AAAA,EAChB,iBAAA,GAAoB,IAAA;AAAA,EACpB;AACF,CAAA,KAAa;AACX,EAAA,MAAM,CAAC,UAAU,WAAW,CAAA,GAAIC,eAAmB,MAAM,OAAA,CAAQ,OAAO,CAAA;AACxE,EAAA,MAAM,CAAC,aAAa,cAAc,CAAA,GAAIA,eAAS,MAAM,OAAA,CAAQ,mBAAmB,CAAA;AAChF,EAAA,MAAM,CAAC,aAAA,EAAe,gBAAgB,CAAA,GAAIA,eAA+B,IAAI,CAAA;AAC7E,EAAA,MAAM,iBAAA,GAAoBC,aAAO,KAAK,CAAA;AAEtC,EAAAC,eAAA,CAAU,MAAM,OAAA,CAAQ,SAAA,CAAU,WAAW,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAIzD,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,OAAA,KAAY,IAAA,EAAM;AACtC,IAAA,OAAA,CAAQ,WAAW,OAAO,CAAA;AAAA,EAC5B,GAAG,CAAC,OAAA,EAAS,SAAS,QAAA,CAAS,MAAA,CAAO,OAAO,CAAC,CAAA;AAM9C,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,kBAAkB,OAAA,EAAS;AAC/B,IAAA,iBAAA,CAAkB,OAAA,GAAU,IAAA;AAC5B,IAAA,OAAA,CACG,OAAA,EAAQ,CACR,IAAA,CAAK,CAAC,MAAA,KAAW,gBAAA,CAAiB,MAAA,CAAO,MAAM,CAAC,CAAA,CAChD,KAAA,CAAM,CAAC,KAAA,KAAU;AAChB,MAAA,OAAA,CAAQ,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,MAAA,gBAAA,CAAiB,OAAO,CAAA;AAAA,IAC1B,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM,cAAA,CAAe,KAAK,CAAC,CAAA;AAAA,EACxC,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAEZ,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,aAAA,KAAkB,UAAA,EAAY;AAC5D,IAAA,IAAI,eAAe,MAAA,EAAW;AAC9B,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAA,KAAW,WAAA,EAAa;AAC5C,IAAA,OAAA,CAAQ,aAAa,UAAU,CAAA;AAAA,EACjC,CAAA,EAAG,CAAC,OAAA,EAAS,aAAA,EAAe,YAAY,QAAA,CAAS,MAAA,CAAO,MAAM,CAAC,CAAA;AAE/D,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,aAAA,KAAkB,UAAA,EAAY;AAC5D,IAAA,IAAI,cAAc,MAAA,EAAW;AAC7B,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAA,KAAW,eAAA,EAAiB;AAChD,IAAA,OAAA,CAAQ,WAAW,SAAS,CAAA;AAAA,EAC9B,CAAA,EAAG,CAAC,OAAA,EAAS,aAAA,EAAe,WAAW,QAAA,CAAS,MAAA,CAAO,MAAM,CAAC,CAAA;AAE9D,EAAA,MAAM,WAAA,GACJ,SAAS,MAAA,CAAO,MAAA,KAAW,cAAc,MAAA,GAAY,QAAA,CAAS,OAAO,UAAA,CAAW,WAAA;AAElF,EAAAA,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,mBAAA,GAAsB,WAAW,CAAA;AAAA,EAClE,CAAA,EAAG,CAAC,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAGrC,EAAA,MAAM,cAAA,GAAiB,UAAA,KAAe,MAAA,IAAa,SAAA,KAAc,MAAA;AAEjE,EAAA,MAAM,WAAW,MAAM;AACrB,IAAA,IAAI,QAAA,CAAS,YAAY,OAAA,EAAS;AAChC,MAAA,IAAI,OAAO,QAAA,KAAa,UAAA,EAAY,OAAO,QAAA;AAE3C,MAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU,OAAO,IAAA;AAChD,MAAA,MAAM,EAAE,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,aAAA,KAAkB,QAAA,CAAS,MAAA;AACxE,MAAA,OAAO,SAAS,EAAE,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,eAAe,CAAA;AAAA,IACxE;AACA,IAAA,IAAI,QAAA,CAAS,OAAA,KAAY,SAAA,EAAW,OAAO,aAAA;AAC3C,IAAA,IAAI,WAAA,IAAe,QAAA,CAAS,OAAA,KAAY,SAAA,IAAa,gBAAgB,OAAO,eAAA;AAC5E,IAAA,OAAO,iBAAA;AAAA,EACT,CAAA,GAAG;AAEH,EAAA,uBAAOH,cAAAA,CAAC,mBAAA,EAAA,EAAoB,KAAA,EAAO,SAAU,QAAA,EAAA,OAAA,EAAQ,CAAA;AACvD;AC3GO,IAAM,qBAAqB,CAAC;AAAA,EACjC,OAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,QAAA,GAAW,IAAA;AAAA,EACX;AACF,CAAA,KAAa;AACX,EAAA,MAAM,CAAC,SAAS,UAAU,CAAA,GAAIC,eAAkB,MAAM,OAAA,CAAQ,gBAAgB,CAAA;AAE9E,EAAA,MAAM,UAAA,GAAaC,aAAgB,KAAK,CAAA;AAExC,EAAAC,gBAAU,MAAM;AACd,IAAA,MAAM,WAAA,GAAc,QAAQ,SAAA,CAAU,MAAM,WAAW,OAAA,CAAQ,cAAA,EAAgB,CAAC,CAAA;AAEhF,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACvB,MAAA,UAAA,CAAW,OAAA,GAAU,IAAA;AACrB,MAAA,OAAA,CAAQ,WAAW,OAAO,CAAA;AAC1B,MAAA,IAAI,eAAA,EAAiB,OAAA,CAAQ,sBAAA,CAAuB,eAAe,CAAA;AAGnE,MAAA,KAAK,OAAA,CACF,wBAAA,CAAyB,YAAY,CAAA,CACrC,KAAA,CAAM,CAAC,KAAA,KAAU,OAAA,CAAQ,KAAA,CAAM,kCAAA,EAAoC,KAAK,CAAC,CAAA;AAAA,IAC9E;AAEA,IAAA,OAAO,WAAA;AAAA,EAGT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,uBACEH,cAAAA,CAAC,yBAAA,EAAA,EAA0B,OAAO,OAAA,EAC/B,QAAA,EAAA,OAAA,GAAU,WAAW,QAAA,EACxB,CAAA;AAEJ","file":"index.cjs","sourcesContent":["import { createContext, use } from 'react';\n\nimport type { BearerSession, KeboolaApi, LegacySession } from '@keboola/api-client';\n\nconst MISSING_API_CLIENT_ERROR = 'useApiClient must be used within <ApiClientProvider />';\nconst MISSING_PROJECT_ERROR = 'useProject must be used within <ApiClientProvider />';\nconst MISSING_STACK_ERROR = 'useStack must be used within <ApiClientProvider />';\nconst MISSING_AUTH_ERROR = 'useAuth must be used within <AuthProvider />';\nconst MISSING_LEGACY_AUTH_ERROR = 'useLegacyAuth must be used within <LegacyAuthProvider />';\n\n// The product API (`auth` + `management` + every product namespace), flow-agnostic. Both the\n// bearer and legacy flows produce the same `KeboolaApi` surface, so consumers never branch on flow.\nconst ApiContext = createContext<KeboolaApi | null>(null);\nexport const ApiProvider = ApiContext;\n\n// The lifecycle sessions live in their own, flow-specific contexts so the auth surface a component\n// reaches for is explicit. Only the matching provider is mounted per flow.\nconst AuthContext = createContext<BearerSession | null>(null);\nexport const AuthContextProvider = AuthContext;\n\nconst LegacyAuthContext = createContext<LegacySession | null>(null);\nexport const LegacyAuthContextProvider = LegacyAuthContext;\n\nexport const useApiClient = () => {\n  const api = use(ApiContext);\n  if (api === null) throw new Error(MISSING_API_CLIENT_ERROR);\n  return api;\n};\n\nexport const useProject = () => {\n  const api = use(ApiContext);\n  if (api === null) throw new Error(MISSING_PROJECT_ERROR);\n  return api.context.project;\n};\n\nexport const useStack = () => {\n  const api = use(ApiContext);\n  if (api === null) throw new Error(MISSING_STACK_ERROR);\n  return api.context.stack;\n};\n\n/** The bearer (OAuth) lifecycle session. Throws outside `<AuthProvider />`. */\nexport const useAuth = () => {\n  const session = use(AuthContext);\n  if (session === null) throw new Error(MISSING_AUTH_ERROR);\n  return session;\n};\n\n/** The legacy (SAPI) lifecycle session. Throws outside `<LegacyAuthProvider />`. */\nexport const useLegacyAuth = () => {\n  const session = use(LegacyAuthContext);\n  if (session === null) throw new Error(MISSING_LEGACY_AUTH_ERROR);\n  return session;\n};\n","import type { ReactNode } from 'react';\n\nimport type { KeboolaApi } from '@keboola/api-client';\n\nimport { ApiProvider } from './context';\n\ntype Props = {\n  /** The flow-agnostic product API — the `api` half of a keboola client. */\n  api: KeboolaApi;\n  children: ReactNode;\n};\n\n/**\n * Provides the product API to `useApiClient()`. A pure pass-through: the auth lifecycle (driving\n * to ready, gating on a fallback) belongs to `AuthProvider` / `LegacyAuthProvider`, which mount\n * this provider once their session is ready.\n */\nexport const ApiClientProvider = ({ api, children }: Props) => (\n  <ApiProvider value={api}>{children}</ApiProvider>\n);\n","import { useEffect, useRef, useState } from 'react';\nimport type { ReactNode } from 'react';\n\nimport type { BearerSession } from '@keboola/api-client';\n\nimport { AuthContextProvider } from './context';\n\ntype BearerCredential = Parameters<BearerSession['authenticate']>[0];\ntype Snapshot = ReturnType<BearerSession['debug']>;\ntype RestoreStatus = Awaited<ReturnType<BearerSession['restore']>>['status'];\n\n/** The session state guaranteed to exist once the storage build is ready. */\ntype ScopedState = { projectId: number; baseUrl: string };\n\ntype BaseProps = {\n  session: BearerSession;\n  onAccessTokenChange?: (accessToken: string) => void;\n  /** Rendered while a persisted session is being restored, or the bootstrap is in flight. */\n  loadingFallback?: ReactNode;\n  /** Rendered when the storage build fails. */\n  errorFallback?: ReactNode;\n  /**\n   * Rendered only once the session is scoped and the storage build is ready. Pass a function to\n   * receive the scoped state (the project the session settled on) without re-narrowing it yourself.\n   */\n  children: ReactNode | ((scoped: ScopedState) => ReactNode);\n};\n\n/**\n * Two mutually exclusive bootstrap modes, discriminated by whether a credential is supplied:\n * - **programmatic** — `credential` + `projectId` given, so `baseUrl` is **required**: a credential\n *   is bound to the stack that issued it and `authenticate` refuses an unconfigured session.\n * - **interactive** — none of the three given; the stack comes from the session instead — `restore()`\n *   adopts the persisted one, otherwise the login UI sets it. `anonymousFallback` is **required**\n *   here (a missing login UI would leave the app on a permanently blank screen).\n */\ntype Props = BaseProps &\n  (\n    | {\n        credential: BearerCredential;\n        projectId: number;\n        baseUrl: string;\n        anonymousFallback?: never;\n      }\n    | {\n        credential?: undefined;\n        projectId?: undefined;\n        baseUrl?: never;\n        anonymousFallback: ReactNode;\n      }\n  );\n\nexport const AuthProvider = ({\n  session,\n  baseUrl,\n  credential,\n  projectId,\n  onAccessTokenChange,\n  loadingFallback = null,\n  errorFallback = null,\n  anonymousFallback = null,\n  children,\n}: Props) => {\n  const [snapshot, setSnapshot] = useState<Snapshot>(() => session.debug());\n  const [isRestoring, setIsRestoring] = useState(() => session.hasPersistedValue());\n  const [restoreStatus, setRestoreStatus] = useState<RestoreStatus | null>(null);\n  const restoreStartedRef = useRef(false);\n\n  useEffect(() => session.subscribe(setSnapshot), [session]);\n\n  // Programmatic only. Interactive leaves the stack unset: `restore()` adopts the persisted one, and\n  // failing that the login UI picks it — so there is nothing to configure up front.\n  useEffect(() => {\n    if (baseUrl === undefined) return;\n    if (snapshot.config.baseUrl !== null) return;\n    session.setBaseUrl(baseUrl);\n  }, [session, baseUrl, snapshot.config.baseUrl]);\n\n  // Runs regardless of whether a stack is configured — with none, `restore()` adopts the stack the\n  // persisted session belongs to. (Declared after the effect above, so programmatic mode has already\n  // configured its stack by the time this runs.) The ref guards StrictMode's double-invoked effect:\n  // `restoreStatus` only lands asynchronously, so it cannot prevent a second synchronous call.\n  useEffect(() => {\n    if (restoreStartedRef.current) return;\n    restoreStartedRef.current = true;\n    session\n      .restore()\n      .then((result) => setRestoreStatus(result.status))\n      .catch((error) => {\n        console.error('Keboola bearer session restore failed', error);\n        setRestoreStatus('empty');\n      })\n      .finally(() => setIsRestoring(false));\n  }, [session]);\n\n  useEffect(() => {\n    if (restoreStatus === null || restoreStatus === 'restored') return;\n    if (credential === undefined) return;\n    if (snapshot.config.status !== 'anonymous') return;\n    session.authenticate(credential);\n  }, [session, restoreStatus, credential, snapshot.config.status]);\n\n  useEffect(() => {\n    if (restoreStatus === null || restoreStatus === 'restored') return;\n    if (projectId === undefined) return;\n    if (snapshot.config.status !== 'authenticated') return;\n    session.setProject(projectId);\n  }, [session, restoreStatus, projectId, snapshot.config.status]);\n\n  const accessToken =\n    snapshot.config.status === 'anonymous' ? undefined : snapshot.config.credential.accessToken;\n\n  useEffect(() => {\n    if (accessToken !== undefined) onAccessTokenChange?.(accessToken);\n  }, [accessToken, onAccessTokenChange]);\n\n  // Programmatic mode drives itself to ready, so it must never fall through to `anonymousFallback`.\n  const isProgrammatic = credential !== undefined && projectId !== undefined;\n\n  const content = (() => {\n    if (snapshot.storage === 'ready') {\n      if (typeof children !== 'function') return children;\n      // A ready storage build implies a scoped session; narrowing here is for the type checker.\n      if (snapshot.config.status !== 'scoped') return null;\n      const { projectId: scopedProjectId, baseUrl: scopedBaseUrl } = snapshot.config;\n      return children({ projectId: scopedProjectId, baseUrl: scopedBaseUrl });\n    }\n    if (snapshot.storage === 'errored') return errorFallback;\n    if (isRestoring || snapshot.storage === 'pending' || isProgrammatic) return loadingFallback;\n    return anonymousFallback;\n  })();\n\n  return <AuthContextProvider value={session}>{content}</AuthContextProvider>;\n};\n","import { useEffect, useRef, useState } from 'react';\nimport type { ReactNode } from 'react';\n\nimport type { LegacySession } from '@keboola/api-client';\n\nimport { LegacyAuthContextProvider } from './context';\n\ntype Props = {\n  session: LegacySession;\n  /** Stack base URL. */\n  baseUrl: string;\n  /** SAPI token — drives the storage build to ready. */\n  storageToken: string;\n  /** Optional manage-api token — unlocks `api.management`. */\n  managementToken?: string;\n  /** Rendered until the storage build reaches ready. */\n  fallback?: ReactNode;\n  children: ReactNode;\n};\n\n/**\n * Owns the legacy (SAPI) lifecycle: on mount it configures the stack and drives the session to\n * ready, rendering `fallback` until the storage build resolves. The backend-injected SAPI token is\n * known up front, so this drives itself (unlike the interactive bearer `AuthProvider`). Exposes the\n * session via `useLegacyAuth()` and gates `children` behind readiness.\n */\nexport const LegacyAuthProvider = ({\n  session,\n  baseUrl,\n  storageToken,\n  managementToken,\n  fallback = null,\n  children,\n}: Props) => {\n  const [isReady, setIsReady] = useState<boolean>(() => session.isStorageReady());\n  // Guards the once-only drive against React StrictMode's double-mounted effect.\n  const startedRef = useRef<boolean>(false);\n\n  useEffect(() => {\n    const unsubscribe = session.subscribe(() => setIsReady(session.isStorageReady()));\n\n    if (!startedRef.current) {\n      startedRef.current = true;\n      session.setBaseUrl(baseUrl);\n      if (managementToken) session.authenticateManagement(managementToken);\n      // Fire-and-forget: `subscribe` flips `isReady` once the build resolves. A failure leaves the\n      // fallback in place; log it so the bootstrap error isn't silent.\n      void session\n        .authenticateStorageAsync(storageToken)\n        .catch((error) => console.error('Keboola session bootstrap failed', error));\n    }\n\n    return unsubscribe;\n    // drive to ready only on initial mount\n    // oxlint-disable-next-line react/exhaustive-deps\n  }, []);\n\n  return (\n    <LegacyAuthContextProvider value={session}>\n      {isReady ? children : fallback}\n    </LegacyAuthContextProvider>\n  );\n};\n"]}

package/dist/index.d.cts

@@ -1,10 +1,10 @@
 import * as _keboola_api_client_storage_types from '@keboola/api-client/storage/types';
-import { ApiClient, ApiClientOptions } from '@keboola/api-client';
+import * as _keboola_api_client from '@keboola/api-client';
+import { KeboolaApi, BearerSession, LegacySession } from '@keboola/api-client';
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import * as react from 'react';
 import { ReactNode } from 'react';
 
-declare const useApiClient: () => ApiClient;
+declare const useApiClient: () => KeboolaApi;
 declare const useProject: () => {
     hasFeature: (...feature: string[]) => boolean;
     hasAdminFeature: (...feature: string[]) => boolean;
@@ -30,12 +30,187 @@ declare const useStack: () => {
     };
     version: string;
 };
+/** The bearer (OAuth) lifecycle session. Throws outside `<AuthProvider />`. */
+declare const useAuth: () => {
+    hasPersistedValue: () => boolean;
+    setBaseUrl: (baseUrl: string) => void;
+    isStorageReady: () => boolean;
+    authenticate: (tokens: {
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+    }) => void;
+    setProject: (projectId: number) => void;
+    setProjectAsync: (projectId: number) => Promise<void>;
+    reset: () => void;
+    debugForceRefresh: () => void;
+    restore: () => Promise<{
+        status: "empty" | "restored" | "expired";
+    }>;
+    subscribe: (listener: (snapshot: {
+        type: "Bearer";
+        config: {
+            status: "anonymous";
+            baseUrl: string | null;
+        } | {
+            status: "authenticated";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+        } | {
+            status: "scoped";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+            projectId: number;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    }) => void) => () => void;
+    debug: () => {
+        type: "Bearer";
+        config: {
+            status: "anonymous";
+            baseUrl: string | null;
+        } | {
+            status: "authenticated";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+        } | {
+            status: "scoped";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+            projectId: number;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    };
+};
+/** The legacy (SAPI) lifecycle session. Throws outside `<LegacyAuthProvider />`. */
+declare const useLegacyAuth: () => {
+    setBaseUrl: (baseUrl: string) => void;
+    isStorageReady: () => boolean;
+    authenticateStorage: (sapiToken: string) => void;
+    authenticateStorageAsync: (sapiToken: string) => Promise<void>;
+    authenticateManagement: (managementToken: string) => void;
+    subscribe: (listener: (snapshot: {
+        type: "Sapi";
+        config: {
+            baseUrl: string | null;
+            sapiToken: string | null;
+            managementToken: string | null;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    }) => void) => () => void;
+    debug: () => {
+        type: "Sapi";
+        config: {
+            baseUrl: string | null;
+            sapiToken: string | null;
+            managementToken: string | null;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    };
+};
 
-type Props = {
-    client: ApiClient;
+type Props$2 = {
+    /** The flow-agnostic product API — the `api` half of a keboola client. */
+    api: KeboolaApi;
     children: ReactNode;
+};
+/**
+ * Provides the product API to `useApiClient()`. A pure pass-through: the auth lifecycle (driving
+ * to ready, gating on a fallback) belongs to `AuthProvider` / `LegacyAuthProvider`, which mount
+ * this provider once their session is ready.
+ */
+declare const ApiClientProvider: ({ api, children }: Props$2) => react_jsx_runtime.JSX.Element;
+
+type BearerCredential = Parameters<BearerSession['authenticate']>[0];
+/** The session state guaranteed to exist once the storage build is ready. */
+type ScopedState = {
+    projectId: number;
+    baseUrl: string;
+};
+type BaseProps = {
+    session: BearerSession;
+    onAccessTokenChange?: (accessToken: string) => void;
+    /** Rendered while a persisted session is being restored, or the bootstrap is in flight. */
+    loadingFallback?: ReactNode;
+    /** Rendered when the storage build fails. */
+    errorFallback?: ReactNode;
+    /**
+     * Rendered only once the session is scoped and the storage build is ready. Pass a function to
+     * receive the scoped state (the project the session settled on) without re-narrowing it yourself.
+     */
+    children: ReactNode | ((scoped: ScopedState) => ReactNode);
+};
+/**
+ * Two mutually exclusive bootstrap modes, discriminated by whether a credential is supplied:
+ * - **programmatic** — `credential` + `projectId` given, so `baseUrl` is **required**: a credential
+ *   is bound to the stack that issued it and `authenticate` refuses an unconfigured session.
+ * - **interactive** — none of the three given; the stack comes from the session instead — `restore()`
+ *   adopts the persisted one, otherwise the login UI sets it. `anonymousFallback` is **required**
+ *   here (a missing login UI would leave the app on a permanently blank screen).
+ */
+type Props$1 = BaseProps & ({
+    credential: BearerCredential;
+    projectId: number;
+    baseUrl: string;
+    anonymousFallback?: never;
+} | {
+    credential?: undefined;
+    projectId?: undefined;
+    baseUrl?: never;
+    anonymousFallback: ReactNode;
+});
+declare const AuthProvider: ({ session, baseUrl, credential, projectId, onAccessTokenChange, loadingFallback, errorFallback, anonymousFallback, children, }: Props$1) => react_jsx_runtime.JSX.Element;
+
+type Props = {
+    session: LegacySession;
+    /** Stack base URL. */
+    baseUrl: string;
+    /** SAPI token — drives the storage build to ready. */
+    storageToken: string;
+    /** Optional manage-api token — unlocks `api.management`. */
+    managementToken?: string;
+    /** Rendered until the storage build reaches ready. */
     fallback?: ReactNode;
-} & ApiClientOptions;
-declare const ApiClientProvider: ({ client, children, fallback, ...rest }: Props) => string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | react.ReactPortal | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null;
+    children: ReactNode;
+};
+/**
+ * Owns the legacy (SAPI) lifecycle: on mount it configures the stack and drives the session to
+ * ready, rendering `fallback` until the storage build resolves. The backend-injected SAPI token is
+ * known up front, so this drives itself (unlike the interactive bearer `AuthProvider`). Exposes the
+ * session via `useLegacyAuth()` and gates `children` behind readiness.
+ */
+declare const LegacyAuthProvider: ({ session, baseUrl, storageToken, managementToken, fallback, children, }: Props) => react_jsx_runtime.JSX.Element;
 
-export { ApiClientProvider, useApiClient, useProject, useStack };
+export { ApiClientProvider, AuthProvider, LegacyAuthProvider, useApiClient, useAuth, useLegacyAuth, useProject, useStack };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import * as _keboola_api_client_storage_types from '@keboola/api-client/storage/types';
-import { ApiClient, ApiClientOptions } from '@keboola/api-client';
+import * as _keboola_api_client from '@keboola/api-client';
+import { KeboolaApi, BearerSession, LegacySession } from '@keboola/api-client';
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import * as react from 'react';
 import { ReactNode } from 'react';
 
-declare const useApiClient: () => ApiClient;
+declare const useApiClient: () => KeboolaApi;
 declare const useProject: () => {
     hasFeature: (...feature: string[]) => boolean;
     hasAdminFeature: (...feature: string[]) => boolean;
@@ -30,12 +30,187 @@ declare const useStack: () => {
     };
     version: string;
 };
+/** The bearer (OAuth) lifecycle session. Throws outside `<AuthProvider />`. */
+declare const useAuth: () => {
+    hasPersistedValue: () => boolean;
+    setBaseUrl: (baseUrl: string) => void;
+    isStorageReady: () => boolean;
+    authenticate: (tokens: {
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+    }) => void;
+    setProject: (projectId: number) => void;
+    setProjectAsync: (projectId: number) => Promise<void>;
+    reset: () => void;
+    debugForceRefresh: () => void;
+    restore: () => Promise<{
+        status: "empty" | "restored" | "expired";
+    }>;
+    subscribe: (listener: (snapshot: {
+        type: "Bearer";
+        config: {
+            status: "anonymous";
+            baseUrl: string | null;
+        } | {
+            status: "authenticated";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+        } | {
+            status: "scoped";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+            projectId: number;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    }) => void) => () => void;
+    debug: () => {
+        type: "Bearer";
+        config: {
+            status: "anonymous";
+            baseUrl: string | null;
+        } | {
+            status: "authenticated";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+        } | {
+            status: "scoped";
+            baseUrl: string;
+            credential: {
+                accessToken: string;
+                refreshToken: string;
+                expiresIn: number;
+            } & {
+                issuedAt: number;
+            };
+            projectId: number;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    };
+};
+/** The legacy (SAPI) lifecycle session. Throws outside `<LegacyAuthProvider />`. */
+declare const useLegacyAuth: () => {
+    setBaseUrl: (baseUrl: string) => void;
+    isStorageReady: () => boolean;
+    authenticateStorage: (sapiToken: string) => void;
+    authenticateStorageAsync: (sapiToken: string) => Promise<void>;
+    authenticateManagement: (managementToken: string) => void;
+    subscribe: (listener: (snapshot: {
+        type: "Sapi";
+        config: {
+            baseUrl: string | null;
+            sapiToken: string | null;
+            managementToken: string | null;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    }) => void) => () => void;
+    debug: () => {
+        type: "Sapi";
+        config: {
+            baseUrl: string | null;
+            sapiToken: string | null;
+            managementToken: string | null;
+        };
+        authReady: boolean;
+        managementReady: boolean;
+        storage: _keboola_api_client.AsyncState<unknown>["state"];
+    };
+};
 
-type Props = {
-    client: ApiClient;
+type Props$2 = {
+    /** The flow-agnostic product API — the `api` half of a keboola client. */
+    api: KeboolaApi;
     children: ReactNode;
+};
+/**
+ * Provides the product API to `useApiClient()`. A pure pass-through: the auth lifecycle (driving
+ * to ready, gating on a fallback) belongs to `AuthProvider` / `LegacyAuthProvider`, which mount
+ * this provider once their session is ready.
+ */
+declare const ApiClientProvider: ({ api, children }: Props$2) => react_jsx_runtime.JSX.Element;
+
+type BearerCredential = Parameters<BearerSession['authenticate']>[0];
+/** The session state guaranteed to exist once the storage build is ready. */
+type ScopedState = {
+    projectId: number;
+    baseUrl: string;
+};
+type BaseProps = {
+    session: BearerSession;
+    onAccessTokenChange?: (accessToken: string) => void;
+    /** Rendered while a persisted session is being restored, or the bootstrap is in flight. */
+    loadingFallback?: ReactNode;
+    /** Rendered when the storage build fails. */
+    errorFallback?: ReactNode;
+    /**
+     * Rendered only once the session is scoped and the storage build is ready. Pass a function to
+     * receive the scoped state (the project the session settled on) without re-narrowing it yourself.
+     */
+    children: ReactNode | ((scoped: ScopedState) => ReactNode);
+};
+/**
+ * Two mutually exclusive bootstrap modes, discriminated by whether a credential is supplied:
+ * - **programmatic** — `credential` + `projectId` given, so `baseUrl` is **required**: a credential
+ *   is bound to the stack that issued it and `authenticate` refuses an unconfigured session.
+ * - **interactive** — none of the three given; the stack comes from the session instead — `restore()`
+ *   adopts the persisted one, otherwise the login UI sets it. `anonymousFallback` is **required**
+ *   here (a missing login UI would leave the app on a permanently blank screen).
+ */
+type Props$1 = BaseProps & ({
+    credential: BearerCredential;
+    projectId: number;
+    baseUrl: string;
+    anonymousFallback?: never;
+} | {
+    credential?: undefined;
+    projectId?: undefined;
+    baseUrl?: never;
+    anonymousFallback: ReactNode;
+});
+declare const AuthProvider: ({ session, baseUrl, credential, projectId, onAccessTokenChange, loadingFallback, errorFallback, anonymousFallback, children, }: Props$1) => react_jsx_runtime.JSX.Element;
+
+type Props = {
+    session: LegacySession;
+    /** Stack base URL. */
+    baseUrl: string;
+    /** SAPI token — drives the storage build to ready. */
+    storageToken: string;
+    /** Optional manage-api token — unlocks `api.management`. */
+    managementToken?: string;
+    /** Rendered until the storage build reaches ready. */
     fallback?: ReactNode;
-} & ApiClientOptions;
-declare const ApiClientProvider: ({ client, children, fallback, ...rest }: Props) => string | number | bigint | boolean | Iterable<ReactNode> | Promise<string | number | bigint | boolean | react.ReactPortal | react.ReactElement<unknown, string | react.JSXElementConstructor<any>> | Iterable<ReactNode> | null | undefined> | react_jsx_runtime.JSX.Element | null;
+    children: ReactNode;
+};
+/**
+ * Owns the legacy (SAPI) lifecycle: on mount it configures the stack and drives the session to
+ * ready, rendering `fallback` until the storage build resolves. The backend-injected SAPI token is
+ * known up front, so this drives itself (unlike the interactive bearer `AuthProvider`). Exposes the
+ * session via `useLegacyAuth()` and gates `children` behind readiness.
+ */
+declare const LegacyAuthProvider: ({ session, baseUrl, storageToken, managementToken, fallback, children, }: Props) => react_jsx_runtime.JSX.Element;
 
-export { ApiClientProvider, useApiClient, useProject, useStack };
+export { ApiClientProvider, AuthProvider, LegacyAuthProvider, useApiClient, useAuth, useLegacyAuth, useProject, useStack };

package/dist/index.js

@@ -1,37 +1,126 @@
-import { createContext, use, useState, useEffect } from 'react';
+import { createContext, use, useState, useRef, useEffect } from 'react';
 import { jsx } from 'react/jsx-runtime';
 
 // src/context.ts
 var MISSING_API_CLIENT_ERROR = "useApiClient must be used within <ApiClientProvider />";
 var MISSING_PROJECT_ERROR = "useProject must be used within <ApiClientProvider />";
 var MISSING_STACK_ERROR = "useStack must be used within <ApiClientProvider />";
-var Context = createContext(null);
-var Provider = Context;
+var MISSING_AUTH_ERROR = "useAuth must be used within <AuthProvider />";
+var MISSING_LEGACY_AUTH_ERROR = "useLegacyAuth must be used within <LegacyAuthProvider />";
+var ApiContext = createContext(null);
+var ApiProvider = ApiContext;
+var AuthContext = createContext(null);
+var AuthContextProvider = AuthContext;
+var LegacyAuthContext = createContext(null);
+var LegacyAuthContextProvider = LegacyAuthContext;
 var useApiClient = () => {
-  const client = use(Context);
-  if (client === null) throw new Error(MISSING_API_CLIENT_ERROR);
-  return client;
+  const api = use(ApiContext);
+  if (api === null) throw new Error(MISSING_API_CLIENT_ERROR);
+  return api;
 };
 var useProject = () => {
-  const client = use(Context);
-  if (client === null) throw new Error(MISSING_PROJECT_ERROR);
-  return client.context.project;
+  const api = use(ApiContext);
+  if (api === null) throw new Error(MISSING_PROJECT_ERROR);
+  return api.context.project;
 };
 var useStack = () => {
-  const client = use(Context);
-  if (client === null) throw new Error(MISSING_STACK_ERROR);
-  return client.context.stack;
+  const api = use(ApiContext);
+  if (api === null) throw new Error(MISSING_STACK_ERROR);
+  return api.context.stack;
 };
-var ApiClientProvider = ({ client, children, fallback = null, ...rest }) => {
-  const [isInitializing, setIsInitializing] = useState(true);
+var useAuth = () => {
+  const session = use(AuthContext);
+  if (session === null) throw new Error(MISSING_AUTH_ERROR);
+  return session;
+};
+var useLegacyAuth = () => {
+  const session = use(LegacyAuthContext);
+  if (session === null) throw new Error(MISSING_LEGACY_AUTH_ERROR);
+  return session;
+};
+var ApiClientProvider = ({ api, children }) => /* @__PURE__ */ jsx(ApiProvider, { value: api, children });
+var AuthProvider = ({
+  session,
+  baseUrl,
+  credential,
+  projectId,
+  onAccessTokenChange,
+  loadingFallback = null,
+  errorFallback = null,
+  anonymousFallback = null,
+  children
+}) => {
+  const [snapshot, setSnapshot] = useState(() => session.debug());
+  const [isRestoring, setIsRestoring] = useState(() => session.hasPersistedValue());
+  const [restoreStatus, setRestoreStatus] = useState(null);
+  const restoreStartedRef = useRef(false);
+  useEffect(() => session.subscribe(setSnapshot), [session]);
+  useEffect(() => {
+    if (baseUrl === void 0) return;
+    if (snapshot.config.baseUrl !== null) return;
+    session.setBaseUrl(baseUrl);
+  }, [session, baseUrl, snapshot.config.baseUrl]);
+  useEffect(() => {
+    if (restoreStartedRef.current) return;
+    restoreStartedRef.current = true;
+    session.restore().then((result) => setRestoreStatus(result.status)).catch((error) => {
+      console.error("Keboola bearer session restore failed", error);
+      setRestoreStatus("empty");
+    }).finally(() => setIsRestoring(false));
+  }, [session]);
+  useEffect(() => {
+    if (restoreStatus === null || restoreStatus === "restored") return;
+    if (credential === void 0) return;
+    if (snapshot.config.status !== "anonymous") return;
+    session.authenticate(credential);
+  }, [session, restoreStatus, credential, snapshot.config.status]);
+  useEffect(() => {
+    if (restoreStatus === null || restoreStatus === "restored") return;
+    if (projectId === void 0) return;
+    if (snapshot.config.status !== "authenticated") return;
+    session.setProject(projectId);
+  }, [session, restoreStatus, projectId, snapshot.config.status]);
+  const accessToken = snapshot.config.status === "anonymous" ? void 0 : snapshot.config.credential.accessToken;
+  useEffect(() => {
+    if (accessToken !== void 0) onAccessTokenChange?.(accessToken);
+  }, [accessToken, onAccessTokenChange]);
+  const isProgrammatic = credential !== void 0 && projectId !== void 0;
+  const content = (() => {
+    if (snapshot.storage === "ready") {
+      if (typeof children !== "function") return children;
+      if (snapshot.config.status !== "scoped") return null;
+      const { projectId: scopedProjectId, baseUrl: scopedBaseUrl } = snapshot.config;
+      return children({ projectId: scopedProjectId, baseUrl: scopedBaseUrl });
+    }
+    if (snapshot.storage === "errored") return errorFallback;
+    if (isRestoring || snapshot.storage === "pending" || isProgrammatic) return loadingFallback;
+    return anonymousFallback;
+  })();
+  return /* @__PURE__ */ jsx(AuthContextProvider, { value: session, children: content });
+};
+var LegacyAuthProvider = ({
+  session,
+  baseUrl,
+  storageToken,
+  managementToken,
+  fallback = null,
+  children
+}) => {
+  const [isReady, setIsReady] = useState(() => session.isStorageReady());
+  const startedRef = useRef(false);
   useEffect(() => {
-    client.init(rest).finally(() => {
-      setIsInitializing(false);
-    });
+    const unsubscribe = session.subscribe(() => setIsReady(session.isStorageReady()));
+    if (!startedRef.current) {
+      startedRef.current = true;
+      session.setBaseUrl(baseUrl);
+      if (managementToken) session.authenticateManagement(managementToken);
+      void session.authenticateStorageAsync(storageToken).catch((error) => console.error("Keboola session bootstrap failed", error));
+    }
+    return unsubscribe;
   }, []);
-  return isInitializing ? fallback : /* @__PURE__ */ jsx(Provider, { value: client, children });
+  return /* @__PURE__ */ jsx(LegacyAuthContextProvider, { value: session, children: isReady ? children : fallback });
 };
 
-export { ApiClientProvider, useApiClient, useProject, useStack };
+export { ApiClientProvider, AuthProvider, LegacyAuthProvider, useApiClient, useAuth, useLegacyAuth, useProject, useStack };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/context.ts","../src/ApiClientProvider.tsx"],"names":[],"mappings":";;;;AAIA,IAAM,wBAAA,GAA2B,wDAAA;AACjC,IAAM,qBAAA,GAAwB,sDAAA;AAC9B,IAAM,mBAAA,GAAsB,oDAAA;AAE5B,IAAM,OAAA,GAAU,cAAgC,IAAI,CAAA;AAE7C,IAAM,QAAA,GAAW,OAAA;AAEjB,IAAM,eAAe,MAAM;AAChC,EAAA,MAAM,MAAA,GAAS,IAAI,OAAO,CAAA;AAC1B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAC7D,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,aAAa,MAAM;AAC9B,EAAA,MAAM,MAAA,GAAS,IAAI,OAAO,CAAA;AAC1B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,MAAM,IAAI,MAAM,qBAAqB,CAAA;AAC1D,EAAA,OAAO,OAAO,OAAA,CAAQ,OAAA;AACxB;AAEO,IAAM,WAAW,MAAM;AAC5B,EAAA,MAAM,MAAA,GAAS,IAAI,OAAO,CAAA;AAC1B,EAAA,IAAI,MAAA,KAAW,IAAA,EAAM,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACxD,EAAA,OAAO,OAAO,OAAA,CAAQ,KAAA;AACxB;ACfO,IAAM,iBAAA,GAAoB,CAAC,EAAE,MAAA,EAAQ,UAAU,QAAA,GAAW,IAAA,EAAM,GAAG,IAAA,EAAK,KAAa;AAC1F,EAAA,MAAM,CAAC,cAAA,EAAgB,iBAAiB,CAAA,GAAI,SAAkB,IAAI,CAAA;AAElE,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,OAAA,CAAQ,MAAM;AAC9B,MAAA,iBAAA,CAAkB,KAAK,CAAA;AAAA,IACzB,CAAC,CAAA;AAAA,EAGH,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,OAAO,iBAAiB,QAAA,mBAAW,GAAA,CAAC,QAAA,EAAA,EAAS,KAAA,EAAO,QAAS,QAAA,EAAS,CAAA;AACxE","file":"index.js","sourcesContent":["import { createContext, use } from 'react';\n\nimport type { ApiClient } from '@keboola/api-client';\n\nconst MISSING_API_CLIENT_ERROR = 'useApiClient must be used within <ApiClientProvider />';\nconst MISSING_PROJECT_ERROR = 'useProject must be used within <ApiClientProvider />';\nconst MISSING_STACK_ERROR = 'useStack must be used within <ApiClientProvider />';\n\nconst Context = createContext<ApiClient | null>(null);\n\nexport const Provider = Context;\n\nexport const useApiClient = () => {\n  const client = use(Context);\n  if (client === null) throw new Error(MISSING_API_CLIENT_ERROR);\n  return client;\n};\n\nexport const useProject = () => {\n  const client = use(Context);\n  if (client === null) throw new Error(MISSING_PROJECT_ERROR);\n  return client.context.project;\n};\n\nexport const useStack = () => {\n  const client = use(Context);\n  if (client === null) throw new Error(MISSING_STACK_ERROR);\n  return client.context.stack;\n};\n","import { useEffect, useState } from 'react';\nimport type { ReactNode } from 'react';\n\nimport type { ApiClient, ApiClientOptions } from '@keboola/api-client';\n\nimport { Provider } from './context';\n\ntype Props = {\n  client: ApiClient;\n  children: ReactNode;\n  fallback?: ReactNode;\n} & ApiClientOptions;\n\nexport const ApiClientProvider = ({ client, children, fallback = null, ...rest }: Props) => {\n  const [isInitializing, setIsInitializing] = useState<boolean>(true);\n\n  useEffect(() => {\n    client.init(rest).finally(() => {\n      setIsInitializing(false);\n    });\n    // we want to init only on initial mount\n    // oxlint-disable-next-line react/exhaustive-deps\n  }, []);\n\n  return isInitializing ? fallback : <Provider value={client}>{children}</Provider>;\n};\n"]}
+{"version":3,"sources":["../src/context.ts","../src/ApiClientProvider.tsx","../src/AuthProvider.tsx","../src/LegacyAuthProvider.tsx"],"names":["jsx","useState","useRef","useEffect"],"mappings":";;;;AAIA,IAAM,wBAAA,GAA2B,wDAAA;AACjC,IAAM,qBAAA,GAAwB,sDAAA;AAC9B,IAAM,mBAAA,GAAsB,oDAAA;AAC5B,IAAM,kBAAA,GAAqB,8CAAA;AAC3B,IAAM,yBAAA,GAA4B,0DAAA;AAIlC,IAAM,UAAA,GAAa,cAAiC,IAAI,CAAA;AACjD,IAAM,WAAA,GAAc,UAAA;AAI3B,IAAM,WAAA,GAAc,cAAoC,IAAI,CAAA;AACrD,IAAM,mBAAA,GAAsB,WAAA;AAEnC,IAAM,iBAAA,GAAoB,cAAoC,IAAI,CAAA;AAC3D,IAAM,yBAAA,GAA4B,iBAAA;AAElC,IAAM,eAAe,MAAM;AAChC,EAAA,MAAM,GAAA,GAAM,IAAI,UAAU,CAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAEO,IAAM,aAAa,MAAM;AAC9B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAU,CAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,MAAM,qBAAqB,CAAA;AACvD,EAAA,OAAO,IAAI,OAAA,CAAQ,OAAA;AACrB;AAEO,IAAM,WAAW,MAAM;AAC5B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAU,CAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACrD,EAAA,OAAO,IAAI,OAAA,CAAQ,KAAA;AACrB;AAGO,IAAM,UAAU,MAAM;AAC3B,EAAA,MAAM,OAAA,GAAU,IAAI,WAAW,CAAA;AAC/B,EAAA,IAAI,OAAA,KAAY,IAAA,EAAM,MAAM,IAAI,MAAM,kBAAkB,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAGO,IAAM,gBAAgB,MAAM;AACjC,EAAA,MAAM,OAAA,GAAU,IAAI,iBAAiB,CAAA;AACrC,EAAA,IAAI,OAAA,KAAY,IAAA,EAAM,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAC/D,EAAA,OAAO,OAAA;AACT;ACpCO,IAAM,iBAAA,GAAoB,CAAC,EAAE,GAAA,EAAK,QAAA,uBACvC,GAAA,CAAC,WAAA,EAAA,EAAY,KAAA,EAAO,GAAA,EAAM,QAAA,EAAS;ACkC9B,IAAM,eAAe,CAAC;AAAA,EAC3B,OAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA,GAAkB,IAAA;AAAA,EAClB,aAAA,GAAgB,IAAA;AAAA,EAChB,iBAAA,GAAoB,IAAA;AAAA,EACpB;AACF,CAAA,KAAa;AACX,EAAA,MAAM,CAAC,UAAU,WAAW,CAAA,GAAI,SAAmB,MAAM,OAAA,CAAQ,OAAO,CAAA;AACxE,EAAA,MAAM,CAAC,aAAa,cAAc,CAAA,GAAI,SAAS,MAAM,OAAA,CAAQ,mBAAmB,CAAA;AAChF,EAAA,MAAM,CAAC,aAAA,EAAe,gBAAgB,CAAA,GAAI,SAA+B,IAAI,CAAA;AAC7E,EAAA,MAAM,iBAAA,GAAoB,OAAO,KAAK,CAAA;AAEtC,EAAA,SAAA,CAAU,MAAM,OAAA,CAAQ,SAAA,CAAU,WAAW,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAIzD,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,OAAA,KAAY,IAAA,EAAM;AACtC,IAAA,OAAA,CAAQ,WAAW,OAAO,CAAA;AAAA,EAC5B,GAAG,CAAC,OAAA,EAAS,SAAS,QAAA,CAAS,MAAA,CAAO,OAAO,CAAC,CAAA;AAM9C,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,kBAAkB,OAAA,EAAS;AAC/B,IAAA,iBAAA,CAAkB,OAAA,GAAU,IAAA;AAC5B,IAAA,OAAA,CACG,OAAA,EAAQ,CACR,IAAA,CAAK,CAAC,MAAA,KAAW,gBAAA,CAAiB,MAAA,CAAO,MAAM,CAAC,CAAA,CAChD,KAAA,CAAM,CAAC,KAAA,KAAU;AAChB,MAAA,OAAA,CAAQ,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,MAAA,gBAAA,CAAiB,OAAO,CAAA;AAAA,IAC1B,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM,cAAA,CAAe,KAAK,CAAC,CAAA;AAAA,EACxC,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AAEZ,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,aAAA,KAAkB,UAAA,EAAY;AAC5D,IAAA,IAAI,eAAe,MAAA,EAAW;AAC9B,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAA,KAAW,WAAA,EAAa;AAC5C,IAAA,OAAA,CAAQ,aAAa,UAAU,CAAA;AAAA,EACjC,CAAA,EAAG,CAAC,OAAA,EAAS,aAAA,EAAe,YAAY,QAAA,CAAS,MAAA,CAAO,MAAM,CAAC,CAAA;AAE/D,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,aAAA,KAAkB,IAAA,IAAQ,aAAA,KAAkB,UAAA,EAAY;AAC5D,IAAA,IAAI,cAAc,MAAA,EAAW;AAC7B,IAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAA,KAAW,eAAA,EAAiB;AAChD,IAAA,OAAA,CAAQ,WAAW,SAAS,CAAA;AAAA,EAC9B,CAAA,EAAG,CAAC,OAAA,EAAS,aAAA,EAAe,WAAW,QAAA,CAAS,MAAA,CAAO,MAAM,CAAC,CAAA;AAE9D,EAAA,MAAM,WAAA,GACJ,SAAS,MAAA,CAAO,MAAA,KAAW,cAAc,MAAA,GAAY,QAAA,CAAS,OAAO,UAAA,CAAW,WAAA;AAElF,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,mBAAA,GAAsB,WAAW,CAAA;AAAA,EAClE,CAAA,EAAG,CAAC,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAGrC,EAAA,MAAM,cAAA,GAAiB,UAAA,KAAe,MAAA,IAAa,SAAA,KAAc,MAAA;AAEjE,EAAA,MAAM,WAAW,MAAM;AACrB,IAAA,IAAI,QAAA,CAAS,YAAY,OAAA,EAAS;AAChC,MAAA,IAAI,OAAO,QAAA,KAAa,UAAA,EAAY,OAAO,QAAA;AAE3C,MAAA,IAAI,QAAA,CAAS,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU,OAAO,IAAA;AAChD,MAAA,MAAM,EAAE,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,aAAA,KAAkB,QAAA,CAAS,MAAA;AACxE,MAAA,OAAO,SAAS,EAAE,SAAA,EAAW,eAAA,EAAiB,OAAA,EAAS,eAAe,CAAA;AAAA,IACxE;AACA,IAAA,IAAI,QAAA,CAAS,OAAA,KAAY,SAAA,EAAW,OAAO,aAAA;AAC3C,IAAA,IAAI,WAAA,IAAe,QAAA,CAAS,OAAA,KAAY,SAAA,IAAa,gBAAgB,OAAO,eAAA;AAC5E,IAAA,OAAO,iBAAA;AAAA,EACT,CAAA,GAAG;AAEH,EAAA,uBAAOA,GAAAA,CAAC,mBAAA,EAAA,EAAoB,KAAA,EAAO,SAAU,QAAA,EAAA,OAAA,EAAQ,CAAA;AACvD;AC3GO,IAAM,qBAAqB,CAAC;AAAA,EACjC,OAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,QAAA,GAAW,IAAA;AAAA,EACX;AACF,CAAA,KAAa;AACX,EAAA,MAAM,CAAC,SAAS,UAAU,CAAA,GAAIC,SAAkB,MAAM,OAAA,CAAQ,gBAAgB,CAAA;AAE9E,EAAA,MAAM,UAAA,GAAaC,OAAgB,KAAK,CAAA;AAExC,EAAAC,UAAU,MAAM;AACd,IAAA,MAAM,WAAA,GAAc,QAAQ,SAAA,CAAU,MAAM,WAAW,OAAA,CAAQ,cAAA,EAAgB,CAAC,CAAA;AAEhF,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACvB,MAAA,UAAA,CAAW,OAAA,GAAU,IAAA;AACrB,MAAA,OAAA,CAAQ,WAAW,OAAO,CAAA;AAC1B,MAAA,IAAI,eAAA,EAAiB,OAAA,CAAQ,sBAAA,CAAuB,eAAe,CAAA;AAGnE,MAAA,KAAK,OAAA,CACF,wBAAA,CAAyB,YAAY,CAAA,CACrC,KAAA,CAAM,CAAC,KAAA,KAAU,OAAA,CAAQ,KAAA,CAAM,kCAAA,EAAoC,KAAK,CAAC,CAAA;AAAA,IAC9E;AAEA,IAAA,OAAO,WAAA;AAAA,EAGT,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,uBACEH,GAAAA,CAAC,yBAAA,EAAA,EAA0B,OAAO,OAAA,EAC/B,QAAA,EAAA,OAAA,GAAU,WAAW,QAAA,EACxB,CAAA;AAEJ","file":"index.js","sourcesContent":["import { createContext, use } from 'react';\n\nimport type { BearerSession, KeboolaApi, LegacySession } from '@keboola/api-client';\n\nconst MISSING_API_CLIENT_ERROR = 'useApiClient must be used within <ApiClientProvider />';\nconst MISSING_PROJECT_ERROR = 'useProject must be used within <ApiClientProvider />';\nconst MISSING_STACK_ERROR = 'useStack must be used within <ApiClientProvider />';\nconst MISSING_AUTH_ERROR = 'useAuth must be used within <AuthProvider />';\nconst MISSING_LEGACY_AUTH_ERROR = 'useLegacyAuth must be used within <LegacyAuthProvider />';\n\n// The product API (`auth` + `management` + every product namespace), flow-agnostic. Both the\n// bearer and legacy flows produce the same `KeboolaApi` surface, so consumers never branch on flow.\nconst ApiContext = createContext<KeboolaApi | null>(null);\nexport const ApiProvider = ApiContext;\n\n// The lifecycle sessions live in their own, flow-specific contexts so the auth surface a component\n// reaches for is explicit. Only the matching provider is mounted per flow.\nconst AuthContext = createContext<BearerSession | null>(null);\nexport const AuthContextProvider = AuthContext;\n\nconst LegacyAuthContext = createContext<LegacySession | null>(null);\nexport const LegacyAuthContextProvider = LegacyAuthContext;\n\nexport const useApiClient = () => {\n  const api = use(ApiContext);\n  if (api === null) throw new Error(MISSING_API_CLIENT_ERROR);\n  return api;\n};\n\nexport const useProject = () => {\n  const api = use(ApiContext);\n  if (api === null) throw new Error(MISSING_PROJECT_ERROR);\n  return api.context.project;\n};\n\nexport const useStack = () => {\n  const api = use(ApiContext);\n  if (api === null) throw new Error(MISSING_STACK_ERROR);\n  return api.context.stack;\n};\n\n/** The bearer (OAuth) lifecycle session. Throws outside `<AuthProvider />`. */\nexport const useAuth = () => {\n  const session = use(AuthContext);\n  if (session === null) throw new Error(MISSING_AUTH_ERROR);\n  return session;\n};\n\n/** The legacy (SAPI) lifecycle session. Throws outside `<LegacyAuthProvider />`. */\nexport const useLegacyAuth = () => {\n  const session = use(LegacyAuthContext);\n  if (session === null) throw new Error(MISSING_LEGACY_AUTH_ERROR);\n  return session;\n};\n","import type { ReactNode } from 'react';\n\nimport type { KeboolaApi } from '@keboola/api-client';\n\nimport { ApiProvider } from './context';\n\ntype Props = {\n  /** The flow-agnostic product API — the `api` half of a keboola client. */\n  api: KeboolaApi;\n  children: ReactNode;\n};\n\n/**\n * Provides the product API to `useApiClient()`. A pure pass-through: the auth lifecycle (driving\n * to ready, gating on a fallback) belongs to `AuthProvider` / `LegacyAuthProvider`, which mount\n * this provider once their session is ready.\n */\nexport const ApiClientProvider = ({ api, children }: Props) => (\n  <ApiProvider value={api}>{children}</ApiProvider>\n);\n","import { useEffect, useRef, useState } from 'react';\nimport type { ReactNode } from 'react';\n\nimport type { BearerSession } from '@keboola/api-client';\n\nimport { AuthContextProvider } from './context';\n\ntype BearerCredential = Parameters<BearerSession['authenticate']>[0];\ntype Snapshot = ReturnType<BearerSession['debug']>;\ntype RestoreStatus = Awaited<ReturnType<BearerSession['restore']>>['status'];\n\n/** The session state guaranteed to exist once the storage build is ready. */\ntype ScopedState = { projectId: number; baseUrl: string };\n\ntype BaseProps = {\n  session: BearerSession;\n  onAccessTokenChange?: (accessToken: string) => void;\n  /** Rendered while a persisted session is being restored, or the bootstrap is in flight. */\n  loadingFallback?: ReactNode;\n  /** Rendered when the storage build fails. */\n  errorFallback?: ReactNode;\n  /**\n   * Rendered only once the session is scoped and the storage build is ready. Pass a function to\n   * receive the scoped state (the project the session settled on) without re-narrowing it yourself.\n   */\n  children: ReactNode | ((scoped: ScopedState) => ReactNode);\n};\n\n/**\n * Two mutually exclusive bootstrap modes, discriminated by whether a credential is supplied:\n * - **programmatic** — `credential` + `projectId` given, so `baseUrl` is **required**: a credential\n *   is bound to the stack that issued it and `authenticate` refuses an unconfigured session.\n * - **interactive** — none of the three given; the stack comes from the session instead — `restore()`\n *   adopts the persisted one, otherwise the login UI sets it. `anonymousFallback` is **required**\n *   here (a missing login UI would leave the app on a permanently blank screen).\n */\ntype Props = BaseProps &\n  (\n    | {\n        credential: BearerCredential;\n        projectId: number;\n        baseUrl: string;\n        anonymousFallback?: never;\n      }\n    | {\n        credential?: undefined;\n        projectId?: undefined;\n        baseUrl?: never;\n        anonymousFallback: ReactNode;\n      }\n  );\n\nexport const AuthProvider = ({\n  session,\n  baseUrl,\n  credential,\n  projectId,\n  onAccessTokenChange,\n  loadingFallback = null,\n  errorFallback = null,\n  anonymousFallback = null,\n  children,\n}: Props) => {\n  const [snapshot, setSnapshot] = useState<Snapshot>(() => session.debug());\n  const [isRestoring, setIsRestoring] = useState(() => session.hasPersistedValue());\n  const [restoreStatus, setRestoreStatus] = useState<RestoreStatus | null>(null);\n  const restoreStartedRef = useRef(false);\n\n  useEffect(() => session.subscribe(setSnapshot), [session]);\n\n  // Programmatic only. Interactive leaves the stack unset: `restore()` adopts the persisted one, and\n  // failing that the login UI picks it — so there is nothing to configure up front.\n  useEffect(() => {\n    if (baseUrl === undefined) return;\n    if (snapshot.config.baseUrl !== null) return;\n    session.setBaseUrl(baseUrl);\n  }, [session, baseUrl, snapshot.config.baseUrl]);\n\n  // Runs regardless of whether a stack is configured — with none, `restore()` adopts the stack the\n  // persisted session belongs to. (Declared after the effect above, so programmatic mode has already\n  // configured its stack by the time this runs.) The ref guards StrictMode's double-invoked effect:\n  // `restoreStatus` only lands asynchronously, so it cannot prevent a second synchronous call.\n  useEffect(() => {\n    if (restoreStartedRef.current) return;\n    restoreStartedRef.current = true;\n    session\n      .restore()\n      .then((result) => setRestoreStatus(result.status))\n      .catch((error) => {\n        console.error('Keboola bearer session restore failed', error);\n        setRestoreStatus('empty');\n      })\n      .finally(() => setIsRestoring(false));\n  }, [session]);\n\n  useEffect(() => {\n    if (restoreStatus === null || restoreStatus === 'restored') return;\n    if (credential === undefined) return;\n    if (snapshot.config.status !== 'anonymous') return;\n    session.authenticate(credential);\n  }, [session, restoreStatus, credential, snapshot.config.status]);\n\n  useEffect(() => {\n    if (restoreStatus === null || restoreStatus === 'restored') return;\n    if (projectId === undefined) return;\n    if (snapshot.config.status !== 'authenticated') return;\n    session.setProject(projectId);\n  }, [session, restoreStatus, projectId, snapshot.config.status]);\n\n  const accessToken =\n    snapshot.config.status === 'anonymous' ? undefined : snapshot.config.credential.accessToken;\n\n  useEffect(() => {\n    if (accessToken !== undefined) onAccessTokenChange?.(accessToken);\n  }, [accessToken, onAccessTokenChange]);\n\n  // Programmatic mode drives itself to ready, so it must never fall through to `anonymousFallback`.\n  const isProgrammatic = credential !== undefined && projectId !== undefined;\n\n  const content = (() => {\n    if (snapshot.storage === 'ready') {\n      if (typeof children !== 'function') return children;\n      // A ready storage build implies a scoped session; narrowing here is for the type checker.\n      if (snapshot.config.status !== 'scoped') return null;\n      const { projectId: scopedProjectId, baseUrl: scopedBaseUrl } = snapshot.config;\n      return children({ projectId: scopedProjectId, baseUrl: scopedBaseUrl });\n    }\n    if (snapshot.storage === 'errored') return errorFallback;\n    if (isRestoring || snapshot.storage === 'pending' || isProgrammatic) return loadingFallback;\n    return anonymousFallback;\n  })();\n\n  return <AuthContextProvider value={session}>{content}</AuthContextProvider>;\n};\n","import { useEffect, useRef, useState } from 'react';\nimport type { ReactNode } from 'react';\n\nimport type { LegacySession } from '@keboola/api-client';\n\nimport { LegacyAuthContextProvider } from './context';\n\ntype Props = {\n  session: LegacySession;\n  /** Stack base URL. */\n  baseUrl: string;\n  /** SAPI token — drives the storage build to ready. */\n  storageToken: string;\n  /** Optional manage-api token — unlocks `api.management`. */\n  managementToken?: string;\n  /** Rendered until the storage build reaches ready. */\n  fallback?: ReactNode;\n  children: ReactNode;\n};\n\n/**\n * Owns the legacy (SAPI) lifecycle: on mount it configures the stack and drives the session to\n * ready, rendering `fallback` until the storage build resolves. The backend-injected SAPI token is\n * known up front, so this drives itself (unlike the interactive bearer `AuthProvider`). Exposes the\n * session via `useLegacyAuth()` and gates `children` behind readiness.\n */\nexport const LegacyAuthProvider = ({\n  session,\n  baseUrl,\n  storageToken,\n  managementToken,\n  fallback = null,\n  children,\n}: Props) => {\n  const [isReady, setIsReady] = useState<boolean>(() => session.isStorageReady());\n  // Guards the once-only drive against React StrictMode's double-mounted effect.\n  const startedRef = useRef<boolean>(false);\n\n  useEffect(() => {\n    const unsubscribe = session.subscribe(() => setIsReady(session.isStorageReady()));\n\n    if (!startedRef.current) {\n      startedRef.current = true;\n      session.setBaseUrl(baseUrl);\n      if (managementToken) session.authenticateManagement(managementToken);\n      // Fire-and-forget: `subscribe` flips `isReady` once the build resolves. A failure leaves the\n      // fallback in place; log it so the bootstrap error isn't silent.\n      void session\n        .authenticateStorageAsync(storageToken)\n        .catch((error) => console.error('Keboola session bootstrap failed', error));\n    }\n\n    return unsubscribe;\n    // drive to ready only on initial mount\n    // oxlint-disable-next-line react/exhaustive-deps\n  }, []);\n\n  return (\n    <LegacyAuthContextProvider value={session}>\n      {isReady ? children : fallback}\n    </LegacyAuthContextProvider>\n  );\n};\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keboola/api-client-react",
-  "version": "20.0.0",
+  "version": "21.0.0",
   "description": "React bindings for @keboola/api-client",
   "license": "MIT",
   "type": "module",
@@ -49,7 +49,7 @@
   },
   "peerDependencies": {
     "react": "^19.0.0",
-    "@keboola/api-client": "^20.0.0"
+    "@keboola/api-client": "^21.0.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
@@ -70,10 +70,10 @@
     "tsup": "^8.5.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vite": "^8.0.16",
-    "vitest": "^4.1.8",
-    "@keboola/api-client": "^20.0.0",
+    "vitest": "^4.1.10",
     "@keboola/oxlint-config": "^8.0.0",
-    "@keboola/tsconfig": "^0.2.0"
+    "@keboola/tsconfig": "^0.2.0",
+    "@keboola/api-client": "^21.0.0"
   },
   "scripts": {
     "type-check": "tsc",