@keboola/api-client 20.0.0 → 21.0.0

package/dist/index.js

@@ -1,276 +1,51 @@
+import { createConfigurationSdk } from './chunk-4IEIVLYT.js';
+export { isEmptyDeep, schemaGuidedMerge } from './chunk-4IEIVLYT.js';
+import { createProject } from './chunk-UABYNGBZ.js';
 import { createStorageTable } from './chunk-ZOREOLGE.js';
 import { ProjectFeature } from './chunk-GM3AKU5T.js';
-import { createVaultSdk } from './chunk-7ETZQGY7.js';
-import { generateUUID, createTagSdk } from './chunk-JURD5MC3.js';
-export { generateUUID, keboolaUID } from './chunk-JURD5MC3.js';
-import { delay, createStorageSdk } from './chunk-KQ2QNGRX.js';
-export { PollException, createStorageSdk, delay, poll } from './chunk-KQ2QNGRX.js';
-import { createConfigurationSdk } from './chunk-YUTWLJBK.js';
-export { isEmptyDeep, schemaGuidedMerge } from './chunk-YUTWLJBK.js';
-import './chunk-WFBQUWRC.js';
-import { createProject } from './chunk-UABYNGBZ.js';
-import { createStorageClient, ServiceUnavailableError } from './chunk-RHLDDKX6.js';
-export { ServiceUnavailableError, series } from './chunk-RHLDDKX6.js';
-export { concurrent } from './chunk-EBCZUGUX.js';
-import { createStreamClient } from './chunk-ISY2BOFY.js';
-import { createSyncActionsClient } from './chunk-YOD5F25S.js';
-import { createTelemetryClient } from './chunk-ZAPK7HZS.js';
-import { createVaultClient } from './chunk-IBELIKBL.js';
+import './chunk-XMC355U2.js';
+import { createVaultSdk } from './chunk-2BOG5U7C.js';
+import { createTagSdk } from './chunk-DHOVQ2TW.js';
+export { keboolaUID } from './chunk-DHOVQ2TW.js';
+import { createSemanticLayerSdk } from './chunk-M2LJZXVR.js';
+import { generateUUID } from './chunk-T526LPBK.js';
+export { generateUUID } from './chunk-T526LPBK.js';
+import { delay, createStorageSdk } from './chunk-6BYHD5DG.js';
+export { PollException, createStorageSdk, delay, poll } from './chunk-6BYHD5DG.js';
+import { createStorageClient, ServiceUnavailableError } from './chunk-NV3P6XBU.js';
+export { ServiceUnavailableError, series } from './chunk-NV3P6XBU.js';
+export { concurrent } from './chunk-SJZ66FD5.js';
+import { createStreamClient } from './chunk-DJ5LXAG3.js';
+import { createSyncActionsClient } from './chunk-V6QQZLEU.js';
+import { createTelemetryClient } from './chunk-ZCODWFCC.js';
+import { createVaultClient } from './chunk-WXGYFLFX.js';
 export { UserError } from './chunk-G3N5KDEY.js';
-import { createImportClient } from './chunk-V4FLCCD4.js';
-import { createManagementClient } from './chunk-KLVBTRLR.js';
-export { isManagementClientAuthError } from './chunk-KLVBTRLR.js';
+import { createImportClient } from './chunk-MUC6XWII.js';
+import { createManagementClient, dedupe } from './chunk-R2FAPJMZ.js';
+export { dedupe, isManagementClientAuthError } from './chunk-R2FAPJMZ.js';
 export { ManagementClientAuthError } from './chunk-ZHNOZHJG.js';
-import { createMetastoreClient } from './chunk-FPWOK2CR.js';
-import { createNotificationsClient } from './chunk-7KMFRSYA.js';
-import { createOauthClient } from './chunk-GENABZQ3.js';
-import { createSchedulerClient } from './chunk-6FE3CWV6.js';
-import { createQueryServiceClient } from './chunk-KDWIJTED.js';
-import { createQueueClient } from './chunk-PINOAERX.js';
-import { createAiClient } from './chunk-UREIP7XG.js';
-import { createAuthClient } from './chunk-4HJUQVXR.js';
-import { createChatClient } from './chunk-M3UUJIMO.js';
+import { createMetastoreClient } from './chunk-LFLFNQMQ.js';
+import { createNotificationsClient } from './chunk-5FDQYOJD.js';
+import { createOauthClient } from './chunk-VTC3FL4B.js';
+import { createSchedulerClient } from './chunk-IWNJ47CV.js';
+import { createQueryServiceClient } from './chunk-CWD66KRM.js';
+import { createQueueClient } from './chunk-QNDU44PQ.js';
+import { createAiClient } from './chunk-YVC4NGW2.js';
+import { createAuthClient } from './chunk-KF5EI2IB.js';
+import { createChatClient } from './chunk-U7CANHDD.js';
 import './chunk-4RC5E3SL.js';
-import { createDataScienceClient } from './chunk-HEVDH4JQ.js';
-export { parseLogLines } from './chunk-HEVDH4JQ.js';
+import { createDataScienceClient } from './chunk-4WX5W7YU.js';
+export { parseLogLines } from './chunk-4WX5W7YU.js';
 import { isPlainObject } from './chunk-MSI6FVGG.js';
 export { isPlainObject } from './chunk-MSI6FVGG.js';
-import { createEditorClient } from './chunk-K6E7LOWZ.js';
-import { createAuthHeaders } from './chunk-WJRHT346.js';
+import { createEditorClient } from './chunk-P6OWDUN7.js';
+import { createAuthHeaders } from './chunk-6JXSO3AR.js';
 import { createEncryptionClient } from './chunk-EXNR4FGV.js';
-import { KeboolaHttpHeader, HttpStatus, isApiError, ApiError, createOpenapiFetchClient, createGenericFetchClient } from './chunk-RK2VGHJE.js';
+import { KeboolaHttpHeader, HttpStatus, isApiError, ApiError, HttpHeader, createOpenapiFetchClient, createGenericFetchClient } from './chunk-RK2VGHJE.js';
 export { ApiError, HttpContentType, HttpHeader, KeboolaHttpHeader, createGenericFetchClient, isAbortError, isApiError, isFetchClientError } from './chunk-RK2VGHJE.js';
+import * as z2 from 'zod';
 import { z } from 'zod';
 
-var agentSettingsSchema = z.object({
-  projectId: z.string(),
-  customInstructions: z.string().nullable(),
-  createdAt: z.string(),
-  updatedAt: z.string()
-});
-var toolPermissionValueSchema = z.enum(["always_allow", "always_ask", "blocked"]);
-var userAgentSettingsSchema = z.object({
-  projectId: z.string(),
-  userId: z.string(),
-  customInstructions: z.string().nullable(),
-  toolPermissions: z.record(z.string(), toolPermissionValueSchema).nullable(),
-  createdAt: z.string(),
-  updatedAt: z.string()
-});
-var toolInfoSchema = z.object({
-  name: z.string(),
-  description: z.string(),
-  readOnly: z.boolean()
-});
-var toolsListResponseSchema = z.object({
-  tools: z.array(toolInfoSchema)
-});
-var skillInfoSchema = z.object({
-  name: z.string(),
-  description: z.string().nullable(),
-  source: z.enum(["first-party", "vendored", "project"])
-});
-var builtInCommandSchema = z.object({
-  name: z.string(),
-  description: z.string()
-});
-var skillsListResponseSchema = z.object({
-  skills: z.array(skillInfoSchema),
-  commands: z.array(builtInCommandSchema)
-});
-var sandboxFileEntrySchema = z.object({
-  name: z.string(),
-  path: z.string(),
-  type: z.enum(["file", "dir"]),
-  size: z.number().int().nonnegative().optional()
-});
-var sandboxFileListingSchema = z.object({
-  entries: z.array(sandboxFileEntrySchema)
-});
-var sandboxFileContentSchema = z.object({
-  content: z.string(),
-  encoding: z.enum(["utf-8", "binary"]),
-  truncated: z.boolean(),
-  size: z.number().int().nonnegative()
-});
-var sandboxGitBranchSchema = z.object({
-  branch: z.string().nullable()
-});
-var createKaiAgentClient = ({ baseUrl, middlewares, auth }) => {
-  const clientOptions = {
-    baseUrl,
-    middlewares,
-    headers: createAuthHeaders(auth)
-  };
-  const client = createOpenapiFetchClient(clientOptions);
-  const genericClient = createGenericFetchClient(clientOptions);
-  const getHistory = async (params) => {
-    const { data } = await client.get("/api/history", { query: params });
-    return data;
-  };
-  const getChat = async (chatId, signal) => {
-    const { data } = await client.get("/api/chat/{id}", { path: { id: chatId } }, { signal });
-    return data;
-  };
-  const deleteChat = async (chatId) => {
-    const { data } = await client.delete("/api/chat", { query: { id: chatId } });
-    return data;
-  };
-  const createChat = async (request) => {
-    const { response } = await client.post("/api/chat", { body: request });
-    return response;
-  };
-  const getVotes = async (chatId) => {
-    const { data } = await client.get("/api/vote", { query: { chatId } });
-    return data;
-  };
-  const submitVote = async (params) => {
-    await client.patch("/api/vote", { body: params });
-  };
-  const getUsage = async (signal) => {
-    const { data } = await client.get("/api/usage", {}, { signal });
-    return data;
-  };
-  const approveToolCall = async (chatId, body) => {
-    await client.post("/api/chat/{id}/approval", { path: { id: chatId }, body });
-  };
-  const submitToolOutput = async (chatId, body) => {
-    await client.post("/api/chat/{id}/ui-tool-result", { path: { id: chatId }, body });
-  };
-  const stopChat = async (chatId) => {
-    const { data } = await client.post("/api/chat/{id}/stop", { path: { id: chatId } });
-    return data;
-  };
-  const getSuggestions = async (request, signal) => {
-    const { data } = await client.post("/api/suggestions", { body: request }, { signal });
-    return data;
-  };
-  const getAgentSettings = async (signal) => {
-    const { data } = await genericClient.get("/api/settings", {}, { signal });
-    const result = agentSettingsSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid agent settings response format");
-    }
-    return result.data;
-  };
-  const updateAgentSettings = async (request, signal) => {
-    const { data } = await genericClient.patch(
-      "/api/settings",
-      { body: request },
-      { signal }
-    );
-    const result = agentSettingsSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid agent settings response format");
-    }
-    return result.data;
-  };
-  const getUserAgentSettings = async (signal) => {
-    const { data } = await genericClient.get(
-      "/api/settings/user",
-      {},
-      { signal }
-    );
-    const result = userAgentSettingsSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid user agent settings response format");
-    }
-    return result.data;
-  };
-  const updateUserAgentSettings = async (request, signal) => {
-    const { data } = await genericClient.patch(
-      "/api/settings/user",
-      { body: request },
-      { signal }
-    );
-    const result = userAgentSettingsSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid user agent settings response format");
-    }
-    return result.data;
-  };
-  const getToolsList = async (signal) => {
-    const { data } = await genericClient.get(
-      "/api/settings/tools",
-      {},
-      { signal }
-    );
-    const result = toolsListResponseSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid tools list response format");
-    }
-    return result.data;
-  };
-  const getSkillsList = async (signal) => {
-    const { data } = await genericClient.get("/api/skills", {}, { signal });
-    const result = skillsListResponseSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid skills list response format");
-    }
-    return result.data;
-  };
-  const listSandboxFiles = async (chatId, path, signal) => {
-    const { data } = await genericClient.get(
-      `/api/chat/${encodeURIComponent(chatId)}/sandbox/files`,
-      { query: path ? { path } : void 0 },
-      { signal }
-    );
-    const result = sandboxFileListingSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid sandbox files response format");
-    }
-    return result.data;
-  };
-  const readSandboxFile = async (chatId, path, signal) => {
-    const { data } = await genericClient.get(
-      `/api/chat/${encodeURIComponent(chatId)}/sandbox/file`,
-      { query: { path } },
-      { signal }
-    );
-    const result = sandboxFileContentSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid sandbox file response format");
-    }
-    return result.data;
-  };
-  const getSandboxGitBranch = async (chatId, signal) => {
-    const { data } = await genericClient.get(
-      `/api/chat/${encodeURIComponent(chatId)}/sandbox/git-branch`,
-      {},
-      { signal }
-    );
-    const result = sandboxGitBranchSchema.safeParse(data);
-    if (!result.success) {
-      throw new Error("Invalid sandbox git-branch response format");
-    }
-    return result.data;
-  };
-  const chatStreamUrl = clientOptions.baseUrl + "/api/chat";
-  return {
-    getHistory,
-    getChat,
-    deleteChat,
-    createChat,
-    getVotes,
-    submitVote,
-    getUsage,
-    approveToolCall,
-    submitToolOutput,
-    stopChat,
-    getSuggestions,
-    getAgentSettings,
-    updateAgentSettings,
-    getUserAgentSettings,
-    updateUserAgentSettings,
-    getToolsList,
-    getSkillsList,
-    listSandboxFiles,
-    readSandboxFile,
-    getSandboxGitBranch,
-    chatStreamUrl
-  };
-};
-
 // src/utils/assert.ts
 function assert(value, message) {
   if (value == null) {
@@ -278,7 +53,7 @@ function assert(value, message) {
   }
 }
 
-// src/utils/coalesce.ts
+// src/utils/async/coalesce.ts
 var coalesce = (task) => {
   let running = false;
   const waiters = [];
@@ -318,6 +93,10 @@ var createStore = (initial) => {
       return () => {
         listeners.delete(listener);
       };
+    },
+    dispose: () => {
+      value = initial;
+      listeners.clear();
     }
   };
 };
@@ -342,13 +121,84 @@ var createDerivedStore = ({
 }) => {
   let key = dependsOn(source.get());
   const store = createStore(build(key));
-  source.subscribe((state) => {
+  const unsubscribe = source.subscribe((state) => {
     const next = dependsOn(state);
     if (keyEquals(key, next)) return;
     key = next;
     store.set(build(next));
   });
-  return { get: store.get, subscribe: store.subscribe };
+  return {
+    get: store.get,
+    subscribe: store.subscribe,
+    dispose: () => {
+      unsubscribe();
+      store.dispose();
+    }
+  };
+};
+var createDerivedAsyncStore = ({
+  source,
+  dependsOn,
+  build,
+  keyEquals = shallowEqual
+}) => {
+  const store = createStore({ state: "idle" });
+  let currentKey = null;
+  let generation = 0;
+  let controller = null;
+  const run = (key) => {
+    controller?.abort();
+    controller = new AbortController();
+    const runGeneration = ++generation;
+    store.set({ state: "pending" });
+    build(key, controller.signal).then(
+      (value) => {
+        if (runGeneration === generation) store.set({ state: "ready", value });
+      },
+      (error) => {
+        if (runGeneration === generation) store.set({ state: "errored", error });
+      }
+    );
+  };
+  const sync = (state) => {
+    const next = dependsOn(state);
+    if (next === null) {
+      if (currentKey === null) return;
+      controller?.abort();
+      controller = null;
+      generation += 1;
+      currentKey = null;
+      store.set({ state: "idle" });
+      return;
+    }
+    if (currentKey !== null && keyEquals(currentKey, next)) return;
+    currentKey = next;
+    run(next);
+  };
+  sync(source.get());
+  const unsubscribe = source.subscribe(sync);
+  const readable = {
+    get: store.get,
+    subscribe: store.subscribe,
+    dispose: () => {
+      controller?.abort();
+      unsubscribe();
+      store.dispose();
+    }
+  };
+  const settled = () => new Promise((resolve) => {
+    let unsubscribeSettled = () => {
+    };
+    const check = (state) => {
+      if (state.state === "ready" || state.state === "errored") {
+        unsubscribeSettled();
+        resolve(state);
+      }
+    };
+    unsubscribeSettled = store.subscribe(check);
+    check(store.get());
+  });
+  return { store: readable, settled };
 };
 
 // src/utils/deepMerge.ts
@@ -362,285 +212,1383 @@ var deepMerge = (base, patch) => {
   return out;
 };
 
-// src/domain/defaultBranch.ts
-var createDefaultBranch = ({ devBranches }) => {
-  const defaultBranch = devBranches.find((branch) => branch.isDefault);
+// src/utils/persistor/adapters.ts
+var createNullStorage = () => ({
+  getItem: () => null,
+  setItem: () => {
+  },
+  removeItem: () => {
+  }
+});
+var createMemoryStorage = () => {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => store.get(key) ?? null,
+    setItem: (key, value) => {
+      store.set(key, value);
+    },
+    removeItem: (key) => {
+      store.delete(key);
+    }
+  };
+};
+var createWebStorage = (pick) => {
+  let web = null;
+  try {
+    web = pick();
+    if (web) {
+      const probe = "__keboola_storage_probe__";
+      web.setItem(probe, probe);
+      web.removeItem(probe);
+    }
+  } catch (err) {
+    console.warn("createWebStorage: web storage unavailable, falling back to memory", err);
+    web = null;
+  }
+  if (!web) return createMemoryStorage();
+  const storage = web;
+  return {
+    getItem: (key) => storage.getItem(key),
+    setItem: (key, value) => {
+      storage.setItem(key, value);
+    },
+    removeItem: (key) => {
+      storage.removeItem(key);
+    }
+  };
+};
+var createLocalStorage = () => createWebStorage(() => "localStorage" in globalThis ? globalThis.localStorage : null);
+var createSessionStorage = () => createWebStorage(() => "sessionStorage" in globalThis ? globalThis.sessionStorage : null);
+
+// src/utils/persistor/persistor.ts
+var createPersistor = ({
+  storage = createNullStorage(),
+  key,
+  schema,
+  defaultValue,
+  encode = JSON.stringify,
+  decode = JSON.parse
+}) => {
+  const clear = () => {
+    try {
+      storage.removeItem(key);
+    } catch (err) {
+      console.warn(`createPersistor: failed to clear "${key}"`, err);
+    }
+  };
+  const hasPersistedValue = () => {
+    try {
+      return !!storage.getItem(key);
+    } catch (err) {
+      console.warn(`createPersistor: failed to read "${key}", assuming empty`, err);
+      return false;
+    }
+  };
+  const hydrate = () => {
+    let raw;
+    try {
+      raw = storage.getItem(key);
+    } catch (err) {
+      console.warn(`createPersistor: failed to read "${key}", using default`, err);
+      return defaultValue;
+    }
+    if (raw === null) return defaultValue;
+    let decoded;
+    try {
+      decoded = decode(raw);
+    } catch (err) {
+      console.warn(`createPersistor: failed to decode "${key}", resetting`, err);
+      clear();
+      return defaultValue;
+    }
+    const parsed = schema.safeParse(decoded);
+    if (parsed.success) return parsed.data;
+    clear();
+    return defaultValue;
+  };
+  const persist = (value) => {
+    let raw;
+    try {
+      raw = encode(value);
+    } catch (err) {
+      console.warn(`createPersistor: failed to encode "${key}", not persisting`, err);
+      return;
+    }
+    try {
+      storage.setItem(key, raw);
+    } catch (err) {
+      console.warn(`createPersistor: failed to write "${key}"`, err);
+    }
+  };
+  return { hydrate, persist, clear, hasPersistedValue };
+};
+
+// src/keboola/createLiveProject.ts
+var STORAGE_TOKEN_MUTATING_PATTERNS = [
+  // Bucket lifecycle (create / delete / register) — changes token.bucketPermissions.
+  // At most one trailing segment, so sub-resources (tables, listing, metadata, refresh)
+  // under /buckets/{id}/... don't trigger a re-verify.
+  /\/buckets(\/[^/]+)?$/,
+  // Project feature toggles — changes token.owner.features. Anchored to
+  // /projects/{id}/features so /manage/features and /users/{id}/features don't match.
+  /\/projects\/[^/]+\/features(\/[^/]+)?$/
+];
+var isStorageTokenMutatingRequest = (request) => {
+  if (request.method === "GET") return false;
+  const { pathname } = new URL(request.url);
+  return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));
+};
+var createProjectRefreshMiddleware = (shouldRefresh, requestRefresh) => (next) => async (request) => {
+  const response = await next(request);
+  if (shouldRefresh(request.request)) await requestRefresh();
+  return response;
+};
+var createLiveProject = ({
+  initialToken,
+  verify
+}) => {
+  const store = createStore(createProject({ sapiToken: initialToken }));
+  const refresh = coalesce(async () => store.set(createProject({ sapiToken: await verify() })));
+  const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);
+  return { store, getProject: () => store.get(), subscribe: store.subscribe, middleware, refresh };
+};
+
+// src/keboola/errors.ts
+var KeboolaErrorType = {
+  Unconfigured: "unconfigured",
+  NotAuthenticated: "not-authenticated",
+  AlreadyAuthenticated: "already-authenticated",
+  NoStorageToken: "no-storage-token",
+  NoManagementToken: "no-management-token",
+  MissingProject: "missing-project",
+  NotBearer: "not-bearer",
+  NotReady: "not-ready",
+  InvalidBuildTransition: "invalid-build-transition"
+};
+var MESSAGES = {
+  [KeboolaErrorType.Unconfigured]: "The session is not configured \u2014 set a baseUrl first.",
+  [KeboolaErrorType.NotAuthenticated]: "The session is not authenticated \u2014 sign in first.",
+  [KeboolaErrorType.AlreadyAuthenticated]: "The session is already authenticated \u2014 reset before authenticating again.",
+  [KeboolaErrorType.NoStorageToken]: "No storage token \u2014 authenticate the storage realm first.",
+  [KeboolaErrorType.NoManagementToken]: "No management token \u2014 authenticate the management realm first.",
+  [KeboolaErrorType.MissingProject]: "A bearer storage session requires a project \u2014 call setProject(projectId) first.",
+  [KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
+  [KeboolaErrorType.NotReady]: "The client is not ready \u2014 authenticate the storage realm first.",
+  [KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition \u2014 the build goes idle \u2192 initializing \u2192 ready | failed."
+};
+var KeboolaError = class _KeboolaError extends Error {
+  type;
+  constructor(type) {
+    super(MESSAGES[type]);
+    this.type = type;
+    this.name = "KeboolaError";
+    Object.setPrototypeOf(this, _KeboolaError.prototype);
+  }
+};
+var isKeboolaError = (error) => error instanceof KeboolaError;
+function assert2(value, type) {
+  if (value == null) throw new KeboolaError(type);
+}
+
+// src/middlewares/loggingMiddleware.ts
+var CORRELATION_ID_HEADER = "X-Correlation-ID";
+var ALWAYS_REDACTED_HEADERS = [
+  KeboolaHttpHeader.MANAGEMENT_API_TOKEN,
+  KeboolaHttpHeader.STORAGE_API_TOKEN,
+  "authorization",
+  "cookie",
+  "set-cookie"
+];
+var ALWAYS_REDACTED_QUERY_PARAMS = /* @__PURE__ */ new Set([
+  "token",
+  "apikey",
+  "api_key",
+  "access_token",
+  "refresh_token",
+  "code",
+  "state",
+  "signature",
+  "sig",
+  "x-amz-signature",
+  "x-amz-credential",
+  "x-amz-security-token",
+  "password",
+  "secret"
+]);
+var REDACTED = "[REDACTED]";
+var getRedactedUrl = (rawUrl) => {
+  const url = new URL(rawUrl);
+  if (url.username) url.username = REDACTED;
+  if (url.password) url.password = REDACTED;
+  url.searchParams.forEach((_value, key) => {
+    if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) {
+      url.searchParams.set(key, REDACTED);
+    }
+  });
+  return url.toString();
+};
+var ensureCorrelationId = (request) => {
+  const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? generateUUID();
+  request.headers.set(CORRELATION_ID_HEADER, correlationId);
+  return correlationId;
+};
+var getRedactedHeaders = (headers, redacted) => {
+  const redactedSet = new Set(
+    [...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase())
+  );
+  const result = {};
+  headers.forEach((value, name) => {
+    result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;
+  });
+  return result;
+};
+var getRequestLog = (request, redactedHeaders) => ({
+  url: getRedactedUrl(request.url),
+  headers: getRedactedHeaders(request.headers, redactedHeaders)
+});
+var getResponseLog = (response, redactedHeaders) => ({
+  status: response.status,
+  statusText: response.statusText,
+  headers: getRedactedHeaders(response.headers, redactedHeaders)
+});
+var redactApiError = (error, redactedHeaders) => new ApiError({
+  request: new Request(getRedactedUrl(error.request.url), {
+    method: error.request.method,
+    headers: getRedactedHeaders(error.request.headers, redactedHeaders)
+  }),
+  response: new Response(null, {
+    status: error.response.status,
+    statusText: error.response.statusText,
+    headers: getRedactedHeaders(error.response.headers, redactedHeaders)
+  }),
+  data: error.data
+});
+var formatLog = (level, log) => {
+  const parts = [`[${level.toUpperCase()}]`, `${Math.round(log.durationMs)}ms`, log.method];
+  parts.push(log.request.url);
+  if ("response" in log) parts.push(String(log.response.status));
+  return parts.join(" ");
+};
+var createSafeLogger = (logger, level = "error-only") => {
+  return {
+    info: (log) => {
+      if (level !== "all") return;
+      try {
+        if (logger?.info) {
+          logger.info(log);
+          return;
+        }
+        console.info(formatLog("info", log));
+      } catch {
+      }
+    },
+    error: (log) => {
+      try {
+        if (logger?.error) {
+          logger.error(log);
+          return;
+        }
+        console.error(formatLog("error", log));
+      } catch {
+      }
+    }
+  };
+};
+var createLoggingMiddleware = (options = {}) => {
+  const safeLogger = createSafeLogger(options.logger, options.level);
+  const redactHeaders = options.redactHeaders ?? [];
+  return (next) => async (fetchRequest) => {
+    const correlationId = ensureCorrelationId(fetchRequest.request);
+    const start = performance.now();
+    const method = fetchRequest.request.method.toLowerCase();
+    const requestLog = getRequestLog(fetchRequest.request, redactHeaders);
+    try {
+      const result = await next(fetchRequest);
+      safeLogger.info({
+        correlationId,
+        method,
+        durationMs: performance.now() - start,
+        request: requestLog,
+        response: getResponseLog(result.response, redactHeaders)
+      });
+      return result;
+    } catch (error) {
+      if (error instanceof Error)
+        safeLogger.error({
+          correlationId,
+          method,
+          durationMs: performance.now() - start,
+          request: requestLog,
+          error: isApiError(error) ? redactApiError(error, redactHeaders) : error
+        });
+      throw error;
+    }
+  };
+};
+
+// src/middlewares/retryMiddleware.ts
+var DEFAULT_MAX_RETRIES = 5;
+var DEFAULT_RETRYABLE_STATUSES = [
+  HttpStatus.INTERNAL_SERVER_ERROR,
+  HttpStatus.BAD_GATEWAY,
+  HttpStatus.SERVICE_UNAVAILABLE,
+  HttpStatus.GATEWAY_TIMEOUT
+];
+var DEFAULT_BACKOFF_FACTOR = 0.3;
+var defaultShouldRetry = (error) => error instanceof ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);
+var createRetryMiddleware = (options) => {
+  const {
+    maxRetries = DEFAULT_MAX_RETRIES,
+    backoffFactor = DEFAULT_BACKOFF_FACTOR,
+    shouldRetry = defaultShouldRetry
+  } = options ?? {};
+  if (!Number.isInteger(maxRetries) || maxRetries < 0) {
+    throw new RangeError("maxRetries must be a non-negative integer");
+  }
+  if (!Number.isFinite(backoffFactor) || backoffFactor < 0) {
+    throw new RangeError("backoffFactor must be a finite non-negative number");
+  }
+  return (next) => async (request) => {
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        return await next({ ...request, request: request.request.clone() });
+      } catch (error) {
+        if (attempt === maxRetries || !shouldRetry(error, attempt)) {
+          throw error;
+        }
+        const delayMs = backoffFactor * 1e3 * Math.pow(2, attempt);
+        await delay(delayMs, request.request.signal ?? void 0);
+      }
+    }
+    throw new Error("unreachable");
+  };
+};
+
+// src/serviceClientRegistry/utils.ts
+var isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
+var createDummyClient = ({
+  onCall
+}) => {
+  const createProxy = (path = []) => new Proxy(() => {
+  }, {
+    // Create a new proxy for nested property access
+    get: (_target, prop) => {
+      if (isBuiltInProperty(prop)) return void 0;
+      return createProxy([...path, prop]);
+    },
+    // When called as a function, invoke the interceptor
+    apply: (_target, _thisArgs, args) => onCall(path, args)
+  });
+  return createProxy();
+};
+
+// src/serviceClientRegistry/createServiceClientRegistry.ts
+var createServiceClientRegistry = () => ({
+  getServiceBaseUrl,
+  onUnavailable
+}) => {
+  const dummy = (serviceId, clientName) => createDummyClient({
+    onCall: (path, args) => {
+      onUnavailable?.({
+        serviceId,
+        path,
+        args,
+        clientName
+      });
+    }
+  });
+  const configs = [];
+  const resolveClient = ({
+    serviceId,
+    clientFn,
+    clientName
+  }) => {
+    const serviceBaseUrl = getServiceBaseUrl(serviceId);
+    return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);
+  };
+  const registry = {
+    add: (config) => {
+      configs.push(config);
+      return registry;
+    },
+    build: () => {
+      const clientMap = {};
+      const clientMeta = [];
+      configs.forEach((config) => {
+        clientMap[config.clientName] = resolveClient(config);
+        clientMeta.push({
+          clientName: config.clientName,
+          serviceId: config.serviceId,
+          isAvailable: !!getServiceBaseUrl(config.serviceId)
+        });
+      });
+      return {
+        client: clientMap,
+        meta: clientMeta
+      };
+    }
+  };
+  return registry;
+};
+
+// src/keboola/createApi.ts
+var createApi = (state) => new Proxy({}, {
+  get(_target, property) {
+    if (isBuiltInProperty(property)) return void 0;
+    if (property === "auth") {
+      const authClient = state.getAuthClient();
+      assert2(authClient, KeboolaErrorType.Unconfigured);
+      return authClient;
+    }
+    if (property === "management") {
+      const management = state.getManagementClient();
+      assert2(management, KeboolaErrorType.NoManagementToken);
+      return management;
+    }
+    const clients = state.getProjectClients();
+    assert2(clients, KeboolaErrorType.NotReady);
+    return clients[property];
+  }
+});
+
+// src/keboola/createMiddlewareFor.ts
+var createMiddlewareFor = (middlewares) => {
+  return (target, baseline = []) => {
+    if (Array.isArray(middlewares)) return [...baseline, ...middlewares];
+    const all = middlewares?.all ?? [];
+    const targeted = middlewares?.[target] ?? [];
+    return [...baseline, ...all, ...targeted];
+  };
+};
+
+// src/keboola/bearer/createConfig.ts
+var INITIAL = { status: "anonymous", baseUrl: null };
+var stamp = (tokens) => ({ ...tokens, issuedAt: Date.now() });
+var createConfig = (initial = INITIAL) => {
+  const store = createStore(initial);
+  let expiredNotified = false;
+  const setBaseUrl = (baseUrl) => {
+    if (store.get().status !== "anonymous")
+      throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
+    store.set({ status: "anonymous", baseUrl });
+  };
+  const authenticate = (tokens) => {
+    const state = store.get();
+    if (state.status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
+    if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);
+    expiredNotified = false;
+    store.set({ status: "authenticated", baseUrl: state.baseUrl, credential: stamp(tokens) });
+  };
+  const setProjectId = (projectId) => {
+    const state = store.get();
+    if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+    store.set({
+      status: "scoped",
+      baseUrl: state.baseUrl,
+      credential: state.credential,
+      projectId
+    });
+  };
+  const reset = () => {
+    store.set({ status: "anonymous", baseUrl: store.get().baseUrl });
+  };
+  const applyRefresh = (tokens) => {
+    const state = store.get();
+    if (state.status === "anonymous") return;
+    store.set({ ...state, credential: stamp(tokens) });
+  };
+  const forceExpire = () => {
+    const state = store.get();
+    if (state.status === "anonymous") return;
+    const issuedAt = Date.now() - state.credential.expiresIn * 1e3;
+    store.set({ ...state, credential: { ...state.credential, issuedAt } });
+  };
+  const requireCredential = () => {
+    const state = store.get();
+    if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+    return state.credential;
+  };
+  const getBaseUrl = () => store.get().baseUrl;
+  const notifyExpired = () => {
+    if (expiredNotified) return false;
+    expiredNotified = true;
+    return true;
+  };
+  const debug = () => store.get();
+  const readable = {
+    get: store.get,
+    subscribe: store.subscribe,
+    dispose: store.dispose
+  };
+  return {
+    store: readable,
+    setBaseUrl,
+    authenticate,
+    setProjectId,
+    reset,
+    applyRefresh,
+    forceExpire,
+    requireCredential,
+    getBaseUrl,
+    notifyExpired,
+    debug
+  };
+};
+
+// src/domain/defaultBranch.ts
+var createDefaultBranch = ({ devBranches }) => {
+  const defaultBranch = devBranches.find((branch) => branch.isDefault);
   assert(defaultBranch, "No default branch found for the project.");
   const getType = (branchId) => {
     if (branchId == null || branchId === "default") return "default";
     return Number(branchId) === defaultBranch.id ? "default" : "dev";
   };
   return {
-    id: defaultBranch.id,
-    name: defaultBranch.name,
-    getType,
-    isDev: (branchId) => getType(branchId) === "dev",
-    isDefault: (branchId) => getType(branchId) === "default"
+    id: defaultBranch.id,
+    name: defaultBranch.name,
+    getType,
+    isDev: (branchId) => getType(branchId) === "dev",
+    isDefault: (branchId) => getType(branchId) === "default"
+  };
+};
+
+// src/domain/stack.ts
+var SERVICE_URL_OVERRIDES = {
+  // The service URL for the Kai Assistant is incomplete; we need to add the `/api` suffix to get the full URL for the API.
+  // I assume the service is versioned.
+  "kai-assistant": (url) => `${url}/api`
+};
+var createStack = ({ stackInfo, clientServiceUrls }) => {
+  const { services, components, features, ...infoRest } = stackInfo;
+  const serviceMap = new Map(
+    services.map((service) => {
+      const devOverride = clientServiceUrls?.[service.id]?.(service.url);
+      const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
+      const url = devOverride ?? prodOverride ?? service.url;
+      return [service.id, url];
+    })
+  );
+  const componentMap = new Map(components.map((component) => [component.id, component]));
+  const featureSet = new Set(features);
+  const hasFeature = (...feature) => {
+    if (feature.length === 0) return false;
+    return feature.every((x) => featureSet.has(x));
+  };
+  const hasComponent = (...componentId) => {
+    if (componentId.length === 0) return false;
+    return componentId.every((x) => componentMap.has(x));
+  };
+  const getComponent = (componentId) => componentMap.get(componentId) ?? null;
+  const hasService = (serviceId) => serviceMap.has(serviceId);
+  const getServiceUrl = (serviceId) => serviceMap.get(serviceId) ?? null;
+  return {
+    ...infoRest,
+    services,
+    features,
+    components,
+    hasFeature,
+    getServiceUrl,
+    hasService,
+    getComponent,
+    hasComponent
+  };
+};
+
+// src/sdks/variables/variablesSdk.ts
+var VARIABLES_COMPONENT_ID = "keboola.variables";
+var mergeVariableDefinitions = (target, source) => {
+  const targetNames = new Set(target.map((definition) => definition.name));
+  return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];
+};
+var mergeVariableValues = (target, source) => {
+  const sourceByName = new Map(source.map((value) => [value.name, value.value]));
+  const targetNames = new Set(target.map((value) => value.name));
+  return [
+    ...target.map(
+      (value) => sourceByName.has(value.name) ? { ...value, value: sourceByName.get(value.name) } : value
+    ),
+    ...source.filter((value) => !targetNames.has(value.name))
+  ];
+};
+var createVariablesSdk = ({ storageClient }) => {
+  const configs = storageClient.componentsAndConfigurations;
+  const readVariables = async (configId, valuesRowId, branchId) => {
+    const config = await configs.getConfiguration({
+      componentId: VARIABLES_COMPONENT_ID,
+      configId,
+      branchId
+    });
+    const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];
+    const rawDefinitions = config.configuration?.variables;
+    const rawValues = row?.configuration?.values;
+    return {
+      definitions: Array.isArray(rawDefinitions) ? rawDefinitions : [],
+      values: Array.isArray(rawValues) ? rawValues : []
+    };
+  };
+  const createVariables = async (definitions, values, branchId) => {
+    const config = await configs.createConfiguration({
+      branchId,
+      componentId: VARIABLES_COMPONENT_ID,
+      name: "Variables definition",
+      configuration: { variables: definitions }
+    });
+    try {
+      const row = await configs.createConfigurationRow({
+        branchId,
+        componentId: VARIABLES_COMPONENT_ID,
+        configId: config.id,
+        name: "Default values",
+        configuration: { values }
+      });
+      return { variablesId: config.id, variablesValuesId: row.id };
+    } catch (error) {
+      await configs.deleteConfiguration({
+        branchId,
+        componentId: VARIABLES_COMPONENT_ID,
+        configId: config.id
+      }).catch((cleanupError) => {
+        if (error instanceof Error && error.cause === void 0) {
+          error.cause = cleanupError;
+        }
+      });
+      throw error;
+    }
+  };
+  return {
+    /** Copy a variables config into a fresh, independent config + values row. */
+    copy: async ({
+      variablesId,
+      variablesValuesId,
+      branchId = "default"
+    }) => {
+      const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);
+      return createVariables(definitions, values, branchId);
+    },
+    /** Merge the source's variables into the target's and create a fresh merged config + values row. */
+    merge: async ({
+      targetVariablesId,
+      targetValuesId,
+      sourceVariablesId,
+      sourceValuesId,
+      branchId = "default"
+    }) => {
+      const [target, source] = await Promise.all([
+        readVariables(targetVariablesId, targetValuesId, branchId),
+        readVariables(sourceVariablesId, sourceValuesId, branchId)
+      ]);
+      return createVariables(
+        mergeVariableDefinitions(target.definitions, source.definitions),
+        mergeVariableValues(target.values, source.values),
+        branchId
+      );
+    }
+  };
+};
+var agentSettingsSchema = z.object({
+  projectId: z.string(),
+  customInstructions: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var toolPermissionValueSchema = z.enum(["always_allow", "always_ask", "blocked"]);
+var userAgentSettingsSchema = z.object({
+  projectId: z.string(),
+  userId: z.string(),
+  customInstructions: z.string().nullable(),
+  toolPermissions: z.record(z.string(), toolPermissionValueSchema).nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var toolInfoSchema = z.object({
+  name: z.string(),
+  description: z.string(),
+  readOnly: z.boolean()
+});
+var toolsListResponseSchema = z.object({
+  tools: z.array(toolInfoSchema)
+});
+var skillInfoSchema = z.object({
+  name: z.string(),
+  description: z.string().nullable(),
+  source: z.enum(["first-party", "vendored", "project"])
+});
+var builtInCommandSchema = z.object({
+  name: z.string(),
+  description: z.string()
+});
+var skillsListResponseSchema = z.object({
+  skills: z.array(skillInfoSchema),
+  commands: z.array(builtInCommandSchema)
+});
+var sandboxFileEntrySchema = z.object({
+  name: z.string(),
+  path: z.string(),
+  type: z.enum(["file", "dir"]),
+  size: z.number().int().nonnegative().optional()
+});
+var sandboxFileListingSchema = z.object({
+  entries: z.array(sandboxFileEntrySchema)
+});
+var sandboxFileContentSchema = z.object({
+  content: z.string(),
+  encoding: z.enum(["utf-8", "binary"]),
+  truncated: z.boolean(),
+  size: z.number().int().nonnegative()
+});
+var sandboxGitBranchSchema = z.object({
+  branch: z.string().nullable()
+});
+var createKaiAgentClient = ({ baseUrl, middlewares, auth }) => {
+  const clientOptions = {
+    baseUrl,
+    middlewares,
+    headers: createAuthHeaders(auth)
+  };
+  const client = createOpenapiFetchClient(clientOptions);
+  const genericClient = createGenericFetchClient(clientOptions);
+  const getHistory = async (params) => {
+    const { data } = await client.get("/api/history", { query: params });
+    return data;
+  };
+  const getChat = async (chatId, signal) => {
+    const { data } = await client.get("/api/chat/{id}", { path: { id: chatId } }, { signal });
+    return data;
+  };
+  const deleteChat = async (chatId) => {
+    const { data } = await client.delete("/api/chat", { query: { id: chatId } });
+    return data;
+  };
+  const createChat = async (request) => {
+    const { response } = await client.post("/api/chat", { body: request });
+    return response;
+  };
+  const getVotes = async (chatId) => {
+    const { data } = await client.get("/api/vote", { query: { chatId } });
+    return data;
+  };
+  const submitVote = async (params) => {
+    await client.patch("/api/vote", { body: params });
+  };
+  const getUsage = async (signal) => {
+    const { data } = await client.get("/api/usage", {}, { signal });
+    return data;
+  };
+  const approveToolCall = async (chatId, body) => {
+    await client.post("/api/chat/{id}/approval", { path: { id: chatId }, body });
+  };
+  const submitToolOutput = async (chatId, body) => {
+    await client.post("/api/chat/{id}/ui-tool-result", { path: { id: chatId }, body });
+  };
+  const stopChat = async (chatId) => {
+    const { data } = await client.post("/api/chat/{id}/stop", { path: { id: chatId } });
+    return data;
+  };
+  const getSuggestions = async (request, signal) => {
+    const { data } = await client.post("/api/suggestions", { body: request }, { signal });
+    return data;
+  };
+  const getAgentSettings = async (signal) => {
+    const { data } = await genericClient.get("/api/settings", {}, { signal });
+    const result = agentSettingsSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid agent settings response format");
+    }
+    return result.data;
+  };
+  const updateAgentSettings = async (request, signal) => {
+    const { data } = await genericClient.patch(
+      "/api/settings",
+      { body: request },
+      { signal }
+    );
+    const result = agentSettingsSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid agent settings response format");
+    }
+    return result.data;
+  };
+  const getUserAgentSettings = async (signal) => {
+    const { data } = await genericClient.get(
+      "/api/settings/user",
+      {},
+      { signal }
+    );
+    const result = userAgentSettingsSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid user agent settings response format");
+    }
+    return result.data;
+  };
+  const updateUserAgentSettings = async (request, signal) => {
+    const { data } = await genericClient.patch(
+      "/api/settings/user",
+      { body: request },
+      { signal }
+    );
+    const result = userAgentSettingsSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid user agent settings response format");
+    }
+    return result.data;
+  };
+  const getToolsList = async (signal) => {
+    const { data } = await genericClient.get(
+      "/api/settings/tools",
+      {},
+      { signal }
+    );
+    const result = toolsListResponseSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid tools list response format");
+    }
+    return result.data;
+  };
+  const getSkillsList = async (signal) => {
+    const { data } = await genericClient.get("/api/skills", {}, { signal });
+    const result = skillsListResponseSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid skills list response format");
+    }
+    return result.data;
+  };
+  const listSandboxFiles = async (chatId, path, signal) => {
+    const { data } = await genericClient.get(
+      `/api/chat/${encodeURIComponent(chatId)}/sandbox/files`,
+      { query: path ? { path } : void 0 },
+      { signal }
+    );
+    const result = sandboxFileListingSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid sandbox files response format");
+    }
+    return result.data;
+  };
+  const readSandboxFile = async (chatId, path, signal) => {
+    const { data } = await genericClient.get(
+      `/api/chat/${encodeURIComponent(chatId)}/sandbox/file`,
+      { query: { path } },
+      { signal }
+    );
+    const result = sandboxFileContentSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid sandbox file response format");
+    }
+    return result.data;
+  };
+  const getSandboxGitBranch = async (chatId, signal) => {
+    const { data } = await genericClient.get(
+      `/api/chat/${encodeURIComponent(chatId)}/sandbox/git-branch`,
+      {},
+      { signal }
+    );
+    const result = sandboxGitBranchSchema.safeParse(data);
+    if (!result.success) {
+      throw new Error("Invalid sandbox git-branch response format");
+    }
+    return result.data;
+  };
+  const chatStreamUrl = clientOptions.baseUrl + "/api/chat";
+  return {
+    getHistory,
+    getChat,
+    deleteChat,
+    createChat,
+    getVotes,
+    submitVote,
+    getUsage,
+    approveToolCall,
+    submitToolOutput,
+    stopChat,
+    getSuggestions,
+    getAgentSettings,
+    updateAgentSettings,
+    getUserAgentSettings,
+    updateUserAgentSettings,
+    getToolsList,
+    getSkillsList,
+    listSandboxFiles,
+    readSandboxFile,
+    getSandboxGitBranch,
+    chatStreamUrl
   };
 };
 
-// src/domain/stack.ts
-var SERVICE_URL_OVERRIDES = {
-  // The service URL for the Kai Assistant is incomplete; we need to add the `/api` suffix to get the full URL for the API.
-  // I assume the service is versioned.
-  "kai-assistant": (url) => `${url}/api`
-};
-var createStack = ({ stackInfo, clientServiceUrls }) => {
-  const { services, components, features, ...infoRest } = stackInfo;
-  const serviceMap = new Map(
-    services.map((service) => {
-      const devOverride = clientServiceUrls?.[service.id]?.(service.url);
-      const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
-      const url = devOverride ?? prodOverride ?? service.url;
-      return [service.id, url];
-    })
-  );
-  const componentMap = new Map(components.map((component) => [component.id, component]));
-  const featureSet = new Set(features);
-  const hasFeature = (...feature) => {
-    if (feature.length === 0) return false;
-    return feature.every((x) => featureSet.has(x));
+// src/keboola/createServiceClients.ts
+var createServiceClients = ({
+  baseUrl,
+  auth,
+  getServiceBaseUrl,
+  middlewareFor,
+  attachTokenMiddleware
+}) => createServiceClientRegistry()({
+  getServiceBaseUrl,
+  onUnavailable: ({ serviceId, path, clientName }) => {
+    throw new ServiceUnavailableError(serviceId, path, clientName);
+  }
+}).add({
+  serviceId: "vault",
+  clientName: "vault",
+  clientFn: (serviceBaseUrl) => createVaultClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("vault", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "data-science",
+  clientName: "dataScience",
+  clientFn: (serviceBaseUrl) => createDataScienceClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("dataScience", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "encryption",
+  clientName: "encryption",
+  clientFn: (serviceBaseUrl) => createEncryptionClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("encryption")
+  })
+}).add({
+  serviceId: "editor",
+  clientName: "editor",
+  clientFn: (serviceBaseUrl) => createEditorClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("editor", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "sync-actions",
+  clientName: "syncActions",
+  clientFn: (serviceBaseUrl) => createSyncActionsClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("syncActions", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "telemetry",
+  clientName: "telemetry",
+  clientFn: (serviceBaseUrl) => createTelemetryClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("telemetry", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "query",
+  clientName: "queryService",
+  clientFn: (serviceBaseUrl) => createQueryServiceClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("queryService", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "queue",
+  clientName: "queue",
+  clientFn: (serviceBaseUrl) => createQueueClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("queue", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "kai-assistant",
+  clientName: "chat",
+  clientFn: (serviceBaseUrl) => createChatClient({
+    storageApiUrl: baseUrl,
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("chat", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "ai",
+  clientName: "ai",
+  clientFn: (serviceBaseUrl) => createAiClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("ai", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "import",
+  clientName: "import",
+  clientFn: (serviceBaseUrl) => createImportClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("import", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "kai-agent",
+  clientName: "kaiAgent",
+  clientFn: (serviceBaseUrl) => createKaiAgentClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "oauth",
+  clientName: "oauth",
+  clientFn: (serviceBaseUrl) => createOauthClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("oauth", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "scheduler",
+  clientName: "scheduler",
+  clientFn: (serviceBaseUrl) => createSchedulerClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("scheduler", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "stream",
+  clientName: "stream",
+  clientFn: (serviceBaseUrl) => createStreamClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("stream", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "notification",
+  clientName: "notifications",
+  clientFn: (serviceBaseUrl) => createNotificationsClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("notifications", [attachTokenMiddleware]),
+    auth
+  })
+}).add({
+  serviceId: "metastore",
+  clientName: "metastore",
+  clientFn: (serviceBaseUrl) => createMetastoreClient({
+    baseUrl: serviceBaseUrl,
+    middlewares: middlewareFor("metastore", [attachTokenMiddleware]),
+    auth
+  })
+}).build();
+
+// src/keboola/bearer/createProjectClients.ts
+var createProjectClients = async ({
+  baseUrl,
+  projectId,
+  authMiddleware,
+  middlewareFor,
+  clientServiceUrls
+}) => {
+  const auth = { type: "bearer", token: "", projectId };
+  const projectIdMiddleware = (next) => (request) => {
+    request.request.headers.set(KeboolaHttpHeader.PROJECT_ID, String(projectId));
+    return next(request);
   };
-  const hasComponent = (...componentId) => {
-    if (componentId.length === 0) return false;
-    return componentId.every((x) => componentMap.has(x));
+  const attach = (next) => projectIdMiddleware(authMiddleware(next));
+  const reader = createStorageClient({ baseUrl, auth, middlewares: [attach] });
+  const [stackInfo, sapiToken, devBranches] = await Promise.all([
+    reader.getStackInfo({ exclude: "componentDetails" }),
+    reader.tokens.verify(),
+    reader.branches.getDevBranches()
+  ]);
+  const stack = createStack({ stackInfo, clientServiceUrls });
+  const defaultBranch = createDefaultBranch({ devBranches });
+  const liveProject = createLiveProject({
+    initialToken: sapiToken,
+    verify: () => reader.tokens.verify()
+  });
+  const storageTableStore = createDerivedStore({
+    source: liveProject.store,
+    build: createStorageTable,
+    dependsOn: (project) => ({
+      useLegacyBucketPrefix: !project.hasFeature(ProjectFeature.DisableLegacyBucketPrefix),
+      hasProtectedDefaultBranch: project.hasFeature(ProjectFeature.SoxProtectedDefaultBranch),
+      hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches)
+    })
+  });
+  const context = {
+    stack,
+    defaultBranch,
+    get project() {
+      return liveProject.getProject();
+    },
+    get st() {
+      return storageTableStore.get();
+    }
   };
-  const getComponent = (componentId) => componentMap.get(componentId) ?? null;
-  const hasService = (serviceId) => serviceMap.has(serviceId);
-  const getServiceUrl = (serviceId) => serviceMap.get(serviceId) ?? null;
-  return {
-    ...infoRest,
-    services,
-    features,
-    components,
-    hasFeature,
-    getServiceUrl,
-    hasService,
-    getComponent,
-    hasComponent
+  const storage = createStorageClient({
+    baseUrl,
+    auth,
+    middlewares: middlewareFor("storage", [attach, liveProject.middleware])
+  });
+  const { client: services, meta: serviceMeta } = createServiceClients({
+    baseUrl,
+    auth,
+    getServiceBaseUrl: context.stack.getServiceUrl,
+    middlewareFor,
+    attachTokenMiddleware: attach
+  });
+  const sdk = {
+    configuration: createConfigurationSdk({
+      storageClient: storage,
+      encryptionClient: services.encryption,
+      context
+    }),
+    tag: createTagSdk({ metastoreClient: services.metastore }),
+    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),
+    storage: createStorageSdk({ storageClient: storage }),
+    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),
+    variables: createVariablesSdk({ storageClient: storage })
   };
+  return { context, serviceMeta, storage, ...services, sdk };
 };
 
-// src/sdks/variables/variablesSdk.ts
-var VARIABLES_COMPONENT_ID = "keboola.variables";
-var mergeVariableDefinitions = (target, source) => {
-  const targetNames = new Set(target.map((definition) => definition.name));
-  return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];
-};
-var mergeVariableValues = (target, source) => {
-  const sourceByName = new Map(source.map((value) => [value.name, value.value]));
-  const targetNames = new Set(target.map((value) => value.name));
-  return [
-    ...target.map(
-      (value) => sourceByName.has(value.name) ? { ...value, value: sourceByName.get(value.name) } : value
-    ),
-    ...source.filter((value) => !targetNames.has(value.name))
-  ];
-};
-var createVariablesSdk = ({ storageClient }) => {
-  const configs = storageClient.componentsAndConfigurations;
-  const readVariables = async (configId, valuesRowId, branchId) => {
-    const config = await configs.getConfiguration({
-      componentId: VARIABLES_COMPONENT_ID,
-      configId,
-      branchId
-    });
-    const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];
-    const rawDefinitions = config.configuration?.variables;
-    const rawValues = row?.configuration?.values;
-    return {
-      definitions: Array.isArray(rawDefinitions) ? rawDefinitions : [],
-      values: Array.isArray(rawValues) ? rawValues : []
-    };
-  };
-  const createVariables = async (definitions, values, branchId) => {
-    const config = await configs.createConfiguration({
-      branchId,
-      componentId: VARIABLES_COMPONENT_ID,
-      name: "Variables definition",
-      configuration: { variables: definitions }
-    });
+// src/keboola/bearer/credential.ts
+var DEFAULT_REFRESH_THRESHOLD = 0.9;
+var isUnauthorized = (error) => error instanceof ApiError && error.response.status === HttpStatus.UNAUTHORIZED;
+var createBearerCredential = ({
+  refresh,
+  getToken,
+  onSessionExpired,
+  refreshThreshold = DEFAULT_REFRESH_THRESHOLD
+}) => {
+  const doRefresh = async () => {
     try {
-      const row = await configs.createConfigurationRow({
-        branchId,
-        componentId: VARIABLES_COMPONENT_ID,
-        configId: config.id,
-        name: "Default values",
-        configuration: { values }
-      });
-      return { variablesId: config.id, variablesValuesId: row.id };
+      return await refresh();
     } catch (error) {
-      await configs.deleteConfiguration({
-        branchId,
-        componentId: VARIABLES_COMPONENT_ID,
-        configId: config.id
-      }).catch((cleanupError) => {
-        if (error instanceof Error && error.cause === void 0) {
-          error.cause = cleanupError;
-        }
-      });
+      if (isUnauthorized(error)) onSessionExpired?.();
       throw error;
     }
   };
-  return {
-    /** Copy a variables config into a fresh, independent config + values row. */
-    copy: async ({
-      variablesId,
-      variablesValuesId,
-      branchId = "default"
-    }) => {
-      const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);
-      return createVariables(definitions, values, branchId);
-    },
-    /** Merge the source's variables into the target's and create a fresh merged config + values row. */
-    merge: async ({
-      targetVariablesId,
-      targetValuesId,
-      sourceVariablesId,
-      sourceValuesId,
-      branchId = "default"
-    }) => {
-      const [target, source] = await Promise.all([
-        readVariables(targetVariablesId, targetValuesId, branchId),
-        readVariables(sourceVariablesId, sourceValuesId, branchId)
-      ]);
-      return createVariables(
-        mergeVariableDefinitions(target.definitions, source.definitions),
-        mergeVariableValues(target.values, source.values),
-        branchId
-      );
-    }
+  const refreshShared = dedupe(doRefresh);
+  const refreshAt = (timing) => timing.issuedAt + timing.expiresIn * 1e3 * refreshThreshold;
+  const getAccessToken = async ({ forceRefresh = false } = {}) => {
+    const snapshot = getToken();
+    if (snapshot === null) return null;
+    const { accessToken, timing } = snapshot;
+    if (forceRefresh) return refreshShared();
+    if (Date.now() < refreshAt(timing)) return accessToken;
+    return refreshShared().catch(() => accessToken);
   };
+  return { getAccessToken, notifyExpired: () => onSessionExpired?.() };
 };
 
-// src/createMiddlewareFor.ts
-var createMiddlewareFor = (middlewares) => {
-  return (target, baseline = []) => {
-    if (Array.isArray(middlewares)) return [...baseline, ...middlewares];
-    const all = middlewares?.all ?? [];
-    const targeted = middlewares?.[target] ?? [];
-    return [...baseline, ...all, ...targeted];
+// src/keboola/bearer/middleware.ts
+var createBearerAuthMiddleware = (credential) => {
+  return (next) => async (request) => {
+    const token = await credential.getAccessToken({ forceRefresh: false });
+    if (token === null) return next(request);
+    const retryRequest = request.request.clone();
+    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);
+    try {
+      return await next(request);
+    } catch (error) {
+      if (!isUnauthorized(error)) throw error;
+      const refreshed = await credential.getAccessToken({ forceRefresh: true });
+      if (refreshed === null) throw error;
+      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);
+      try {
+        return await next({ ...request, request: retryRequest });
+      } catch (retryError) {
+        if (isUnauthorized(retryError)) credential.notifyExpired();
+        throw retryError;
+      }
+    }
   };
 };
-
-// src/serviceClientRegistry/utils.ts
-var isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
-var createDummyClient = ({
-  onCall
-}) => {
-  const createProxy = (path = []) => new Proxy(() => {
-  }, {
-    // Create a new proxy for nested property access
-    get: (_target, prop) => {
-      if (isBuiltInProperty(prop)) return void 0;
-      return createProxy([...path, prop]);
-    },
-    // When called as a function, invoke the interceptor
-    apply: (_target, _thisArgs, args) => onCall(path, args)
-  });
-  return createProxy();
+var SESSION_KEY = "keboola:bearer-session";
+var persistedSessionSchema = z2.object({
+  baseUrl: z2.string().nullable(),
+  projectId: z2.number().nullable(),
+  refreshToken: z2.string().nullable()
+});
+var EMPTY_PERSISTED_SESSION = {
+  baseUrl: null,
+  projectId: null,
+  refreshToken: null
 };
+var createSessionPersistor = (storage) => createPersistor({
+  storage,
+  key: SESSION_KEY,
+  schema: persistedSessionSchema,
+  defaultValue: EMPTY_PERSISTED_SESSION
+});
 
-// src/serviceClientRegistry/createServiceClientRegistry.ts
-var createServiceClientRegistry = () => ({
-  getServiceBaseUrl,
-  onUnavailable
-}) => {
-  const dummy = (serviceId, clientName) => createDummyClient({
-    onCall: (path, args) => {
-      onUnavailable?.({
-        serviceId,
-        path,
-        args,
-        clientName
+// src/keboola/bearer/keboola.ts
+var createKeboola = (options = {}) => {
+  const persistor = createSessionPersistor(options.storage);
+  const config = createConfig();
+  const middlewareFor = createMiddlewareFor(options.middlewares);
+  const retryContention = createRetryMiddleware({
+    shouldRetry: (error) => error instanceof ApiError && error.response.status === HttpStatus.SERVICE_UNAVAILABLE
+  });
+  const authClientBare = createDerivedStore({
+    source: config.store,
+    dependsOn: (state) => state.baseUrl,
+    build: (baseUrl) => baseUrl ? createAuthClient({ baseUrl, middlewares: middlewareFor("auth", [retryContention]) }) : null
+  });
+  const refresh = async () => {
+    const client = authClientBare.get();
+    assert2(client, KeboolaErrorType.NotReady);
+    const refreshed = await client.token.refresh(config.requireCredential().refreshToken);
+    config.applyRefresh(refreshed);
+    return refreshed.accessToken;
+  };
+  const getToken = () => {
+    const state = config.store.get();
+    if (state.status === "anonymous") return null;
+    const { accessToken, issuedAt, expiresIn } = state.credential;
+    return { accessToken, timing: { issuedAt, expiresIn } };
+  };
+  const signOut = () => {
+    config.reset();
+    persistor.clear();
+  };
+  const onSessionExpired = () => {
+    if (config.notifyExpired()) signOut();
+  };
+  const credential = createBearerCredential({ refresh, getToken, onSessionExpired });
+  const authMiddleware = createBearerAuthMiddleware(credential);
+  const authClient = createDerivedStore({
+    source: config.store,
+    dependsOn: (state) => state.baseUrl,
+    build: (baseUrl) => baseUrl ? createAuthClient({
+      baseUrl,
+      middlewares: middlewareFor("auth", [retryContention, authMiddleware])
+    }) : null
+  });
+  const management = createDerivedStore({
+    source: config.store,
+    dependsOn: (state) => state.status === "anonymous" ? null : state.baseUrl,
+    build: (baseUrl) => baseUrl ? createManagementClient({
+      baseUrl,
+      auth: { type: "bearer", token: "" },
+      middlewares: middlewareFor("management", [authMiddleware])
+    }) : null
+  });
+  const projectClientsAsync = createDerivedAsyncStore({
+    source: config.store,
+    // Keyed on baseUrl + projectId only — a rotation (new credential, same project) must not rebuild.
+    dependsOn: (state) => state.status === "scoped" ? { baseUrl: state.baseUrl, projectId: state.projectId } : null,
+    build: ({ baseUrl, projectId }) => {
+      return createProjectClients({
+        baseUrl,
+        authMiddleware,
+        projectId,
+        middlewareFor,
+        clientServiceUrls: options.clientServiceUrls
       });
     }
   });
-  const configs = [];
-  const resolveClient = ({
-    serviceId,
-    clientFn,
-    clientName
-  }) => {
-    const serviceBaseUrl = getServiceBaseUrl(serviceId);
-    return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);
-  };
-  const registry = {
-    add: (config) => {
-      configs.push(config);
-      return registry;
+  if (options.baseUrl) config.setBaseUrl(options.baseUrl);
+  config.store.subscribe((state) => {
+    if (state.status === "anonymous") return;
+    persistor.persist({
+      baseUrl: state.baseUrl,
+      projectId: state.status === "scoped" ? state.projectId : null,
+      refreshToken: state.credential.refreshToken
+    });
+  });
+  const debug = () => ({
+    type: "Bearer",
+    config: config.debug(),
+    authReady: authClient.get() !== null,
+    managementReady: management.get() !== null,
+    storage: projectClientsAsync.store.get().state
+  });
+  const session = {
+    hasPersistedValue: persistor.hasPersistedValue,
+    setBaseUrl: config.setBaseUrl,
+    isStorageReady: () => projectClientsAsync.store.get().state === "ready",
+    authenticate: (tokens) => config.authenticate(tokens),
+    setProject: config.setProjectId,
+    setProjectAsync: async (projectId) => {
+      config.setProjectId(projectId);
+      await projectClientsAsync.settled();
     },
-    build: () => {
-      const clientMap = {};
-      const clientMeta = [];
-      configs.forEach((config) => {
-        clientMap[config.clientName] = resolveClient(config);
-        clientMeta.push({
-          clientName: config.clientName,
-          serviceId: config.serviceId,
-          isAvailable: !!getServiceBaseUrl(config.serviceId)
-        });
-      });
-      return {
-        client: clientMap,
-        meta: clientMeta
+    reset: signOut,
+    /**
+     * Dev/test only: mark the current access token as expired so the bearer credential rotates it on
+     * the next request. Pair with any authenticated call (e.g. `api.storage.tokens.verify()`) to force
+     * the rotation immediately and observe the new credential.
+     */
+    debugForceRefresh: config.forceExpire,
+    restore: async () => {
+      const persisted = persistor.hydrate();
+      if (!persisted.refreshToken || !persisted.baseUrl) return { status: "empty" };
+      const configured = config.getBaseUrl();
+      if (configured && configured !== persisted.baseUrl) {
+        persistor.clear();
+        return { status: "empty" };
+      }
+      if (!configured) config.setBaseUrl(persisted.baseUrl);
+      const client = authClientBare.get();
+      assert2(client, KeboolaErrorType.NotReady);
+      try {
+        const refreshed = await client.token.refresh(persisted.refreshToken);
+        config.authenticate(refreshed);
+        if (persisted.projectId !== null) {
+          config.setProjectId(persisted.projectId);
+          await projectClientsAsync.settled();
+        }
+        return { status: "restored" };
+      } catch (err) {
+        if (isUnauthorized(err)) {
+          persistor.clear();
+          return { status: "expired" };
+        }
+        throw err;
+      }
+    },
+    subscribe: (listener) => {
+      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));
+      const unsubscribeBuild = projectClientsAsync.store.subscribe(() => listener(debug()));
+      return () => {
+        unsubscribeConfig();
+        unsubscribeBuild();
       };
+    },
+    debug
+  };
+  const api = createApi({
+    getAuthClient: () => authClient.get(),
+    getManagementClient: () => management.get(),
+    getProjectClients: () => {
+      const state = projectClientsAsync.store.get();
+      return state.state === "ready" ? state.value : null;
     }
+  });
+  return { api, session };
+};
+
+// src/keboola/legacy/createConfig.ts
+var createConfig2 = () => {
+  const store = createStore({ baseUrl: null, sapiToken: null, managementToken: null });
+  const setBaseUrl = (baseUrl) => {
+    store.set({ ...store.get(), baseUrl });
   };
-  return registry;
+  const authenticate = (tokens) => {
+    const current = store.get();
+    store.set({
+      ...current,
+      sapiToken: tokens.sapiToken ?? current.sapiToken,
+      managementToken: tokens.managementToken ?? current.managementToken
+    });
+  };
+  const getStorageToken = () => store.get().sapiToken ?? "";
+  const setStorageToken = (sapiToken) => store.set({ ...store.get(), sapiToken });
+  const debug = () => store.get();
+  return { store, setBaseUrl, authenticate, getStorageToken, setStorageToken, debug };
 };
 
-// src/client.ts
-var createAttachTokenMiddleware = (getToken) => (next) => (request) => {
+// src/keboola/legacy/createProjectClients.ts
+var createAttachStorageToken = (getToken) => (next) => (request) => {
   request.request.headers.set(KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());
   return next(request);
 };
-var STORAGE_TOKEN_MUTATING_PATTERNS = [
-  // Bucket lifecycle (create / delete / register) — changes token.bucketPermissions.
-  // At most one trailing segment, so sub-resources (tables, listing, metadata, refresh)
-  // under /buckets/{id}/... don't trigger a re-verify.
-  /\/buckets(\/[^/]+)?$/,
-  // Project feature toggles — changes token.owner.features. Anchored to
-  // /projects/{id}/features so /manage/features and /users/{id}/features don't match.
-  /\/projects\/[^/]+\/features(\/[^/]+)?$/
-];
-var isStorageTokenMutatingRequest = (request) => {
-  if (request.method === "GET") return false;
-  const { pathname } = new URL(request.url);
-  return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));
-};
-var createProjectRefreshMiddleware = (shouldRefresh, requestRefresh) => (next) => async (request) => {
-  const response = await next(request);
-  if (shouldRefresh(request.request)) await requestRefresh();
-  return response;
-};
-var createLiveProject = ({
-  initialToken,
-  verify
-}) => {
-  const store = createStore(createProject({ sapiToken: initialToken }));
-  const refresh = coalesce(async () => store.set(createProject({ sapiToken: await verify() })));
-  const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);
-  return { store, getProject: () => store.get(), subscribe: store.subscribe, middleware };
-};
-var createLiveToken = ({ initialToken }) => {
-  const store = createStore(initialToken);
-  const attachTokenMiddleware = createAttachTokenMiddleware(() => store.get());
-  return { attachTokenMiddleware, set: store.set };
-};
-var createClients = async ({
+var createProjectClients2 = async ({
   baseUrl,
-  token,
-  clientServiceUrls,
-  middlewares
+  getStorageToken,
+  onStorageTokenRefreshed,
+  middlewareFor,
+  clientServiceUrls
 }) => {
-  const middlewareFor = createMiddlewareFor(middlewares);
-  const liveToken = createLiveToken({ initialToken: token.storageApi });
-  const _storage = createStorageClient({
-    baseUrl,
-    auth: { type: "sapi-token", token: token.storageApi },
-    middlewares: [liveToken.attachTokenMiddleware]
-  });
+  const auth = { type: "sapi-token", token: getStorageToken() };
+  const attach = createAttachStorageToken(getStorageToken);
+  const _storage = createStorageClient({ baseUrl, auth, middlewares: [attach] });
   const [stackInfo, sapiToken, devBranches] = await Promise.all([
     _storage.getStackInfo({ exclude: "componentDetails" }),
     _storage.tokens.verify(),
@@ -661,176 +1609,6 @@ var createClients = async ({
       hasStorageBranches: project.hasFeature(ProjectFeature.StorageBranches)
     })
   });
-  const storage = createStorageClient({
-    baseUrl,
-    auth: { type: "sapi-token", token: token.storageApi },
-    middlewares: middlewareFor("storage", [liveProject.middleware]),
-    onRefreshToken: liveToken.set
-  });
-  const management = createManagementClient({
-    baseUrl,
-    auth: { type: "management-token", token: token.managementApi },
-    middlewares: middlewareFor("management", [liveProject.middleware])
-  });
-  const auth = createAuthClient({
-    baseUrl,
-    middlewares: middlewareFor("auth")
-  });
-  const { client, meta } = createServiceClientRegistry()({
-    getServiceBaseUrl: (serviceId) => stack.getServiceUrl(serviceId),
-    onUnavailable: ({ serviceId, path, clientName }) => {
-      throw new ServiceUnavailableError(serviceId, path, clientName);
-    }
-  }).add({
-    serviceId: "vault",
-    clientName: "vault",
-    clientFn: (serviceBaseUrl) => createVaultClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("vault", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "data-science",
-    clientName: "dataScience",
-    clientFn: (serviceBaseUrl) => createDataScienceClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("dataScience", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "encryption",
-    clientName: "encryption",
-    clientFn: (serviceBaseUrl) => createEncryptionClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("encryption")
-    })
-  }).add({
-    serviceId: "editor",
-    clientName: "editor",
-    clientFn: (serviceBaseUrl) => createEditorClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("editor", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "sync-actions",
-    clientName: "syncActions",
-    clientFn: (serviceBaseUrl) => createSyncActionsClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("syncActions", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "telemetry",
-    clientName: "telemetry",
-    clientFn: (serviceBaseUrl) => createTelemetryClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("telemetry", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "query",
-    clientName: "queryService",
-    clientFn: (serviceBaseUrl) => createQueryServiceClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("queryService", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "queue",
-    clientName: "queue",
-    clientFn: (serviceBaseUrl) => createQueueClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("queue", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "kai-assistant",
-    clientName: "chat",
-    clientFn: (serviceBaseUrl) => createChatClient({
-      storageApiUrl: baseUrl,
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("chat", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "ai",
-    clientName: "ai",
-    clientFn: (serviceBaseUrl) => createAiClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("ai", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "import",
-    clientName: "import",
-    clientFn: (serviceBaseUrl) => createImportClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("import", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "kai-agent",
-    clientName: "kaiAgent",
-    clientFn: (serviceBaseUrl) => createKaiAgentClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("kaiAgent", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "oauth",
-    clientName: "oauth",
-    clientFn: (serviceBaseUrl) => createOauthClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("oauth", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "scheduler",
-    clientName: "scheduler",
-    clientFn: (serviceBaseUrl) => createSchedulerClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("scheduler", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "stream",
-    clientName: "stream",
-    clientFn: (serviceBaseUrl) => createStreamClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("stream", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "notification",
-    clientName: "notifications",
-    clientFn: (serviceBaseUrl) => createNotificationsClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("notifications", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).add({
-    serviceId: "metastore",
-    clientName: "metastore",
-    clientFn: (serviceBaseUrl) => createMetastoreClient({
-      baseUrl: serviceBaseUrl,
-      middlewares: middlewareFor("metastore", [liveToken.attachTokenMiddleware]),
-      auth: { type: "sapi-token", token: token.storageApi }
-    })
-  }).build();
-  const tag = createTagSdk({
-    metastoreClient: client.metastore
-  });
-  const storageSdk = createStorageSdk({
-    storageClient: storage
-  });
-  const vault = createVaultSdk({
-    vaultClient: client.vault,
-    encryptionClient: client.encryption
-  });
-  const variables = createVariablesSdk({
-    storageClient: storage
-  });
   const context = {
     stack,
     defaultBranch,
@@ -839,222 +1617,106 @@ var createClients = async ({
     },
     get st() {
       return storageTableStore.get();
-    },
-    serviceMeta: meta
+    }
   };
-  const configuration = createConfigurationSdk({
-    storageClient: storage,
-    encryptionClient: client.encryption,
-    context
+  const storage = createStorageClient({
+    baseUrl,
+    auth,
+    middlewares: middlewareFor("storage", [liveProject.middleware]),
+    onRefreshToken: onStorageTokenRefreshed
   });
-  return {
-    context,
-    // clients
-    storage,
-    management,
+  const { client: services, meta: serviceMeta } = createServiceClients({
+    baseUrl,
     auth,
-    ...client,
-    sdk: {
-      configuration,
-      tag,
-      storage: storageSdk,
-      vault,
-      variables
-    }
-  };
-};
-var createApiClient = () => {
-  let clients = null;
-  const init = async (options) => {
-    if (clients) throw new Error("API is already initialized.");
-    clients = await createClients(options);
-  };
-  const result = { init };
-  const handler = {
-    get(_, property) {
-      if (isBuiltInProperty(property)) return void 0;
-      if (property === "init") return init;
-      assert(clients, `API is not initialized. Call init() before accessing ${String(property)}`);
-      return clients[property];
-    }
+    getServiceBaseUrl: context.stack.getServiceUrl,
+    middlewareFor,
+    attachTokenMiddleware: attach
+  });
+  const sdk = {
+    configuration: createConfigurationSdk({
+      storageClient: storage,
+      encryptionClient: services.encryption,
+      context
+    }),
+    tag: createTagSdk({ metastoreClient: services.metastore }),
+    semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),
+    storage: createStorageSdk({ storageClient: storage }),
+    vault: createVaultSdk({ vaultClient: services.vault, encryptionClient: services.encryption }),
+    variables: createVariablesSdk({ storageClient: storage })
   };
-  return new Proxy(result, handler);
+  return { context, serviceMeta, storage, ...services, sdk };
 };
 
-// src/middlewares/loggingMiddleware.ts
-var CORRELATION_ID_HEADER = "X-Correlation-ID";
-var ALWAYS_REDACTED_HEADERS = [
-  KeboolaHttpHeader.MANAGEMENT_API_TOKEN,
-  KeboolaHttpHeader.STORAGE_API_TOKEN,
-  "authorization",
-  "cookie",
-  "set-cookie"
-];
-var ALWAYS_REDACTED_QUERY_PARAMS = /* @__PURE__ */ new Set([
-  "token",
-  "apikey",
-  "api_key",
-  "access_token",
-  "refresh_token",
-  "code",
-  "state",
-  "signature",
-  "sig",
-  "x-amz-signature",
-  "x-amz-credential",
-  "x-amz-security-token",
-  "password",
-  "secret"
-]);
-var REDACTED = "[REDACTED]";
-var getRedactedUrl = (rawUrl) => {
-  const url = new URL(rawUrl);
-  if (url.username) url.username = REDACTED;
-  if (url.password) url.password = REDACTED;
-  url.searchParams.forEach((_value, key) => {
-    if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) {
-      url.searchParams.set(key, REDACTED);
-    }
+// src/keboola/legacy/keboola.ts
+var createLegacyKeboola = (options = {}) => {
+  const config = createConfig2();
+  const middlewareFor = createMiddlewareFor(options.middlewares);
+  const authClient = createDerivedStore({
+    source: config.store,
+    dependsOn: (state) => state.baseUrl,
+    build: (baseUrl) => baseUrl ? createAuthClient({ baseUrl, middlewares: middlewareFor("auth", []) }) : null
   });
-  return url.toString();
-};
-var ensureCorrelationId = (request) => {
-  const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? generateUUID();
-  request.headers.set(CORRELATION_ID_HEADER, correlationId);
-  return correlationId;
-};
-var getRedactedHeaders = (headers, redacted) => {
-  const redactedSet = new Set(
-    [...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase())
-  );
-  const result = {};
-  headers.forEach((value, name) => {
-    result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;
+  const management = createDerivedStore({
+    source: config.store,
+    dependsOn: (state) => ({ baseUrl: state.baseUrl, token: state.managementToken }),
+    build: ({ baseUrl, token }) => baseUrl ? createManagementClient({
+      baseUrl,
+      auth: token ? { type: "management-token", token } : { type: "management-token" },
+      middlewares: middlewareFor("management", [])
+    }) : null
   });
-  return result;
-};
-var getRequestLog = (request, redactedHeaders) => ({
-  url: getRedactedUrl(request.url),
-  headers: getRedactedHeaders(request.headers, redactedHeaders)
-});
-var getResponseLog = (response, redactedHeaders) => ({
-  status: response.status,
-  statusText: response.statusText,
-  headers: getRedactedHeaders(response.headers, redactedHeaders)
-});
-var redactApiError = (error, redactedHeaders) => new ApiError({
-  request: new Request(getRedactedUrl(error.request.url), {
-    method: error.request.method,
-    headers: getRedactedHeaders(error.request.headers, redactedHeaders)
-  }),
-  response: new Response(null, {
-    status: error.response.status,
-    statusText: error.response.statusText,
-    headers: getRedactedHeaders(error.response.headers, redactedHeaders)
-  }),
-  data: error.data
-});
-var formatLog = (level, log) => {
-  const parts = [`[${level.toUpperCase()}]`, `${Math.round(log.durationMs)}ms`, log.method];
-  parts.push(log.request.url);
-  if ("response" in log) parts.push(String(log.response.status));
-  return parts.join(" ");
-};
-var createSafeLogger = (logger, level = "error-only") => {
-  return {
-    info: (log) => {
-      if (level !== "all") return;
-      try {
-        if (logger?.info) {
-          logger.info(log);
-          return;
-        }
-        console.info(formatLog("info", log));
-      } catch {
-      }
-    },
-    error: (log) => {
-      try {
-        if (logger?.error) {
-          logger.error(log);
-          return;
-        }
-        console.error(formatLog("error", log));
-      } catch {
-      }
-    }
+  const build = createDerivedAsyncStore({
+    source: config.store,
+    dependsOn: (state) => state.sapiToken && state.baseUrl ? state.baseUrl : null,
+    build: (baseUrl) => createProjectClients2({
+      baseUrl,
+      getStorageToken: config.getStorageToken,
+      onStorageTokenRefreshed: config.setStorageToken,
+      middlewareFor,
+      clientServiceUrls: options.clientServiceUrls
+    })
+  });
+  if (options.baseUrl) config.setBaseUrl(options.baseUrl);
+  const debug = () => {
+    const info = config.debug();
+    return {
+      type: "Sapi",
+      config: info,
+      authReady: authClient.get() !== null,
+      managementReady: !!info.managementToken,
+      storage: build.store.get().state
+    };
   };
-};
-var createLoggingMiddleware = (options = {}) => {
-  const safeLogger = createSafeLogger(options.logger, options.level);
-  const redactHeaders = options.redactHeaders ?? [];
-  return (next) => async (fetchRequest) => {
-    const correlationId = ensureCorrelationId(fetchRequest.request);
-    const start = performance.now();
-    const method = fetchRequest.request.method.toLowerCase();
-    const requestLog = getRequestLog(fetchRequest.request, redactHeaders);
-    try {
-      const result = await next(fetchRequest);
-      safeLogger.info({
-        correlationId,
-        method,
-        durationMs: performance.now() - start,
-        request: requestLog,
-        response: getResponseLog(result.response, redactHeaders)
-      });
-      return result;
-    } catch (error) {
-      if (error instanceof Error)
-        safeLogger.error({
-          correlationId,
-          method,
-          durationMs: performance.now() - start,
-          request: requestLog,
-          error: isApiError(error) ? redactApiError(error, redactHeaders) : error
-        });
-      throw error;
-    }
+  const session = {
+    setBaseUrl: config.setBaseUrl,
+    isStorageReady: () => build.store.get().state === "ready",
+    authenticateStorage: (sapiToken) => config.authenticate({ sapiToken }),
+    authenticateStorageAsync: async (sapiToken) => {
+      config.authenticate({ sapiToken });
+      await build.settled();
+    },
+    authenticateManagement: (managementToken) => config.authenticate({ managementToken }),
+    subscribe: (listener) => {
+      const unsubscribeConfig = config.store.subscribe(() => listener(debug()));
+      const unsubscribeBuild = build.store.subscribe(() => listener(debug()));
+      return () => {
+        unsubscribeConfig();
+        unsubscribeBuild();
+      };
+    },
+    debug
   };
-};
-
-// src/middlewares/retryMiddleware.ts
-var DEFAULT_MAX_RETRIES = 5;
-var DEFAULT_RETRYABLE_STATUSES = [
-  HttpStatus.INTERNAL_SERVER_ERROR,
-  HttpStatus.BAD_GATEWAY,
-  HttpStatus.SERVICE_UNAVAILABLE,
-  HttpStatus.GATEWAY_TIMEOUT
-];
-var DEFAULT_BACKOFF_FACTOR = 0.3;
-var defaultShouldRetry = (error) => error instanceof ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);
-var createRetryMiddleware = (options) => {
-  const {
-    maxRetries = DEFAULT_MAX_RETRIES,
-    backoffFactor = DEFAULT_BACKOFF_FACTOR,
-    shouldRetry = defaultShouldRetry
-  } = options ?? {};
-  if (!Number.isInteger(maxRetries) || maxRetries < 0) {
-    throw new RangeError("maxRetries must be a non-negative integer");
-  }
-  if (!Number.isFinite(backoffFactor) || backoffFactor < 0) {
-    throw new RangeError("backoffFactor must be a finite non-negative number");
-  }
-  return (next) => async (request) => {
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      try {
-        return await next({ ...request, request: request.request.clone() });
-      } catch (error) {
-        if (attempt === maxRetries || !shouldRetry(error, attempt)) {
-          throw error;
-        }
-        const delayMs = backoffFactor * 1e3 * Math.pow(2, attempt);
-        await delay(delayMs, request.request.signal ?? void 0);
-      }
+  const api = createApi({
+    getAuthClient: () => authClient.get(),
+    getManagementClient: () => management.get(),
+    getProjectClients: () => {
+      const state = build.store.get();
+      return state.state === "ready" ? state.value : null;
     }
-    throw new Error("unreachable");
-  };
+  });
+  return { api, session };
 };
 
-export { assert, coalesce, createApiClient, createDerivedStore, createLiveProject, createLoggingMiddleware, createRetryMiddleware, createStore, deepMerge, isStorageTokenMutatingRequest, shallowEqual };
+export { KeboolaError, KeboolaErrorType, assert, coalesce, createDerivedAsyncStore, createDerivedStore, createKeboola, createLegacyKeboola, createLocalStorage, createLoggingMiddleware, createMemoryStorage, createNullStorage, createPersistor, createRetryMiddleware, createSessionStorage, createStore, deepMerge, isKeboolaError, isStorageTokenMutatingRequest, shallowEqual };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map