@keboola/api-client 31.0.0 → 33.0.0

package/dist/index.cjs

@@ -1,52 +1,51 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_project = require("./project-BvFi19K_.cjs");
-const require_jobStatus = require("./jobStatus-kQ9JqF8t.cjs");
-const require_queue = require("./queue-CpcqeMPz.cjs");
+const require_jobStatus = require("./jobStatus-0_Y3Sr4i.cjs");
+const require_queue = require("./queue-D1_TCe0z.cjs");
 const require_concurrent = require("./concurrent-tbiIa0UL.cjs");
 const require_dedupe = require("./dedupe-CiskLkGR.cjs");
-const require_createStore = require("./createStore-MQbboXcB.cjs");
-const require_storage = require("./storage-vnH64B_Q.cjs");
+const require_store = require("./store-xS-Cu_VS.cjs");
+const require_storage = require("./storage-DexWot8H.cjs");
 const require_tag = require("./tag-CsoOZWB_.cjs");
 const require_generateUUID = require("./generateUUID-C6qKBPIv.cjs");
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-CujCwDcB.cjs");
+const require_configurations = require("./configurations-Ck-mNB_E.cjs");
 const require_UserError = require("./UserError-CSGO1qII.cjs");
-const require_createFetchClient = require("./createFetchClient-B9Cv0W9f.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-DVHXGTdi.cjs");
-const require_ManagementClientAuthError = require("./ManagementClientAuthError-DFhi5yxe.cjs");
+const require_createFetchClient = require("./createFetchClient-DvZvD31l.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-24zqIQ0p.cjs");
+const require_ManagementClientAuthError = require("./ManagementClientAuthError-DqeXL8nv.cjs");
 const require_QueryJobTimeoutError = require("./QueryJobTimeoutError-CVNPdCWX.cjs");
 const require_SyncActionError = require("./SyncActionError-BG0zwchi.cjs");
 const require_ValidationError = require("./ValidationError-h5qvwahi.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-BWoSkTki.cjs");
-const require_import = require("./import-CXHppAxd.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-yirrW6Tg.cjs");
-const require_authClient = require("./authClient-Cixa8_L1.cjs");
-const require_management = require("./management-DlVdxzPw.cjs");
-const require_auth = require("./auth-DmgTH0uY.cjs");
-const require_constants = require("./constants-CkAVvuUq.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-qfCZlCTv.cjs");
+const require_import = require("./import-DJilJ6tq.cjs");
+const require_authClient = require("./authClient-IwQ9Ti0J.cjs");
+const require_management = require("./management-DGfgKsaA.cjs");
+const require_constants = require("./constants-lIfSdTzS.cjs");
 const require_storageTable = require("./storageTable-C9crh4Ef.cjs");
 const require_sdk_semanticLayer_index = require("./sdk/semanticLayer/index.cjs");
 const require_sdk_storage_index = require("./sdk/storage/index.cjs");
 const require_sdk_vault_index = require("./sdk/vault/index.cjs");
 const require_ai_index = require("./ai/index.cjs");
-const require_appLogs = require("./appLogs-BCCi02w6.cjs");
+const require_appLogs = require("./appLogs-D8K0VeNM.cjs");
 const require_apps_index = require("./apps/index.cjs");
 const require_chat_index = require("./chat/index.cjs");
-const require_dataScience = require("./dataScience-BqNWX-Gr.cjs");
+const require_dataScience = require("./dataScience-BPW993AG.cjs");
 const require_editor_index = require("./editor/index.cjs");
 const require_encryption_index = require("./encryption/index.cjs");
-const require_metastore = require("./metastore-DbsxqjhS.cjs");
+const require_kaiAgent = require("./kaiAgent-CMVub6Sc.cjs");
+const require_metastore = require("./metastore-DksEte8P.cjs");
 const require_notifications_index = require("./notifications/index.cjs");
-const require_oauth = require("./oauth-DsZgmtPj.cjs");
+const require_oauth = require("./oauth-DFsI1TE5.cjs");
 const require_omnisearch_index = require("./omnisearch/index.cjs");
-const require_queryService = require("./queryService-DxUUkTcy.cjs");
+const require_queryService = require("./queryService--t_W9PSJ.cjs");
 const require_scheduler_index = require("./scheduler/index.cjs");
 const require_stream_index = require("./stream/index.cjs");
-const require_syncActions = require("./syncActions-DPcAPYgJ.cjs");
-const require_telemetry = require("./telemetry-BLgaYEvi.cjs");
+const require_syncActions = require("./syncActions-DQq_A9v6.cjs");
+const require_telemetry = require("./telemetry-CAu1Qt7B.cjs");
 const require_vault_index = require("./vault/index.cjs");
-const require_credential = require("./credential-D-tX9gP4.cjs");
+const require_credential = require("./credential-D-X5QQrM.cjs");
 const require_sdk_queryService_index = require("./sdk/queryService/index.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
@@ -95,11 +94,116 @@ const coalesce = (task) => {
 	};
 };
 //#endregion
+//#region src/utils/store/derivedStore.ts
+const isPlainObjectOrArray = (value) => {
+	if (Array.isArray(value)) return true;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+};
+const shallowEqual = (a, b) => {
+	if (Object.is(a, b)) return true;
+	if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) return false;
+	if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;
+	const aKeys = Object.keys(a);
+	const bKeys = Object.keys(b);
+	return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));
+};
+const createDerivedStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
+	let key = dependsOn(source.get());
+	const store = require_store.createStore(build(key));
+	const unsubscribe = source.subscribe((state) => {
+		const next = dependsOn(state);
+		if (keyEquals(key, next)) return;
+		key = next;
+		store.set(build(next));
+	});
+	const get = store.get;
+	const subscribe = store.subscribe;
+	const dispose = () => {
+		unsubscribe();
+		store.dispose();
+	};
+	return {
+		get,
+		subscribe,
+		dispose
+	};
+};
+//#endregion
+//#region src/utils/store/derivedAsyncStore.ts
+const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
+	const store = require_store.createStore({ state: "idle" });
+	let currentKey = null;
+	let generation = 0;
+	let controller = null;
+	const run = (key) => {
+		controller?.abort();
+		controller = new AbortController();
+		const runGeneration = ++generation;
+		store.set({ state: "pending" });
+		build(key, controller.signal).then((value) => {
+			if (runGeneration === generation) store.set({
+				state: "ready",
+				value
+			});
+		}, (error) => {
+			if (runGeneration === generation) store.set({
+				state: "errored",
+				error
+			});
+		});
+	};
+	const sync = (state) => {
+		const next = dependsOn(state);
+		if (next === null) {
+			if (currentKey === null) return;
+			controller?.abort();
+			controller = null;
+			generation += 1;
+			currentKey = null;
+			store.set({ state: "idle" });
+			return;
+		}
+		if (currentKey !== null && keyEquals(currentKey, next)) return;
+		currentKey = next;
+		run(next);
+	};
+	sync(source.get());
+	const unsubscribe = source.subscribe(sync);
+	const get = store.get;
+	const subscribe = store.subscribe;
+	const dispose = () => {
+		controller?.abort();
+		unsubscribe();
+		store.dispose();
+	};
+	const readable = {
+		get,
+		subscribe,
+		dispose
+	};
+	const settled = () => new Promise((resolve) => {
+		let unsubscribeSettled = () => {};
+		const check = (state) => {
+			if (state.state === "ready" || state.state === "errored") {
+				unsubscribeSettled();
+				resolve(state);
+			}
+		};
+		unsubscribeSettled = store.subscribe(check);
+		check(store.get());
+	});
+	return {
+		store: readable,
+		settled
+	};
+};
+//#endregion
 //#region src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
 const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "polling";
 const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
-	const entries = require_createStore.createStore([]);
+	const entries = require_store.createStore([]);
 	const unsubscribes = /* @__PURE__ */ new Map();
 	const maxEntries = require_jobStatus.clamp(require_jobStatus.finiteOr(limit, DEFAULT_LIMIT), 1);
 	let nextKey = 1;
@@ -289,7 +393,7 @@ const createProjectRefreshMiddleware = (shouldRefresh, requestRefresh) => (next)
 * token-mutating request or an explicit re-scope. Its `middleware` drives the auto re-verify.
 */
 const createLiveProject = ({ initialToken, verify }) => {
-	const store = require_createStore.createStore(require_project.createProject({ sapiToken: initialToken }));
+	const store = require_store.createStore(require_project.createProject({ sapiToken: initialToken }));
 	const refresh = coalesce(async () => store.set(require_project.createProject({ sapiToken: await verify() })));
 	const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);
 	return {
@@ -603,8 +707,9 @@ const stamp = (tokens) => ({
 	issuedAt: Date.now()
 });
 const createConfig$1 = (initial = INITIAL) => {
-	const store = require_createStore.createStore(initial);
+	const store = require_store.createStore(initial);
 	let expiredNotified = false;
+	let epoch = 0;
 	const setBaseUrl = (baseUrl) => {
 		if (store.get().status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
 		store.set({
@@ -617,6 +722,7 @@ const createConfig$1 = (initial = INITIAL) => {
 		if (state.status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
 		if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);
 		expiredNotified = false;
+		epoch += 1;
 		store.set({
 			status: "authenticated",
 			baseUrl: state.baseUrl,
@@ -650,6 +756,7 @@ const createConfig$1 = (initial = INITIAL) => {
 	};
 	/** Drop the credential (sign out); keeps the configured baseUrl. */
 	const reset = () => {
+		epoch += 1;
 		store.set({
 			status: "anonymous",
 			baseUrl: store.get().baseUrl
@@ -691,6 +798,15 @@ const createConfig$1 = (initial = INITIAL) => {
 	};
 	const getBaseUrl = () => store.get().baseUrl;
 	/**
+	* Which sign-in this is — a counter, bumped by `authenticate` and `reset`.
+	*
+	* - For anything long-lived that must not outlive the credential it was built against: capture it,
+	*   compare it later. A rotation does not move it; only a new session or a sign-out does.
+	* - Distinct from `notifyExpired`'s latch, which answers "report this death once" rather than
+	*   "which session are we in".
+	*/
+	const getEpoch = () => epoch;
+	/**
 	* Session-expiry latch (fire-once):
 	* - why: concurrent 401s all report expiry, but the app must sign out once; and the credential /
 	*   auth middleware are long-lived singletons, so the latch can't live in them — it must reset
@@ -719,6 +835,7 @@ const createConfig$1 = (initial = INITIAL) => {
 		forceExpire,
 		requireCredential,
 		getBaseUrl,
+		getEpoch,
 		notifyExpired,
 		debug
 	};
@@ -859,216 +976,6 @@ const createVariablesSdk = ({ storageClient }) => {
 	};
 };
 //#endregion
-//#region src/clients/kaiAgent/kaiAgentClient.ts
-const agentSettingsSchema = zod.z.object({
-	projectId: zod.z.string(),
-	customInstructions: zod.z.string().nullable(),
-	createdAt: zod.z.string(),
-	updatedAt: zod.z.string()
-});
-const toolPermissionValueSchema = zod.z.enum([
-	"always_allow",
-	"always_ask",
-	"blocked"
-]);
-const userAgentSettingsSchema = zod.z.object({
-	projectId: zod.z.string(),
-	userId: zod.z.string(),
-	customInstructions: zod.z.string().nullable(),
-	toolPermissions: zod.z.record(zod.z.string(), toolPermissionValueSchema).nullable(),
-	createdAt: zod.z.string(),
-	updatedAt: zod.z.string()
-});
-const toolInfoSchema = zod.z.object({
-	name: zod.z.string(),
-	description: zod.z.string(),
-	readOnly: zod.z.boolean()
-});
-const toolsListResponseSchema = zod.z.object({ tools: zod.z.array(toolInfoSchema) });
-const skillInfoSchema = zod.z.object({
-	name: zod.z.string(),
-	description: zod.z.string().nullable(),
-	source: zod.z.enum([
-		"first-party",
-		"vendored",
-		"project"
-	])
-});
-const builtInCommandSchema = zod.z.object({
-	name: zod.z.string(),
-	description: zod.z.string()
-});
-const skillsListResponseSchema = zod.z.object({
-	skills: zod.z.array(skillInfoSchema),
-	commands: zod.z.array(builtInCommandSchema)
-});
-const sandboxFileEntrySchema = zod.z.object({
-	name: zod.z.string(),
-	path: zod.z.string(),
-	type: zod.z.enum(["file", "dir"]),
-	size: zod.z.number().int().nonnegative().optional()
-});
-const sandboxFileListingSchema = zod.z.object({ entries: zod.z.array(sandboxFileEntrySchema) });
-const sandboxFileContentSchema = zod.z.object({
-	content: zod.z.string(),
-	encoding: zod.z.enum(["utf-8", "binary"]),
-	truncated: zod.z.boolean(),
-	size: zod.z.number().int().nonnegative()
-});
-const sandboxGitBranchSchema = zod.z.object({ branch: zod.z.string().nullable() });
-const votesResponseSchema = zod.z.array(zod.z.object({
-	chatId: zod.z.string(),
-	messageId: zod.z.string(),
-	isUpvoted: zod.z.boolean()
-}));
-const createKaiAgentClient = ({ baseUrl, middlewares, auth }) => {
-	const clientOptions = {
-		baseUrl,
-		middlewares,
-		headers: require_auth.createAuthHeaders(auth)
-	};
-	const client = require_createOpenapiFetchClient.createOpenapiFetchClient(clientOptions);
-	const genericClient = require_createGenericFetchClient.createGenericFetchClient(clientOptions);
-	const getHistory = async (params) => {
-		const { data } = await client.get("/api/history", { query: params });
-		return data;
-	};
-	const getChat = async (chatId, signal) => {
-		const { data } = await client.get("/api/chat/{id}", { path: { id: chatId } }, { signal });
-		return data;
-	};
-	const deleteChat = async (chatId) => {
-		const { data } = await client.delete("/api/chat", { query: { id: chatId } });
-		return data;
-	};
-	const createChat = async (request) => {
-		const { response } = await client.post("/api/chat", { body: request });
-		return response;
-	};
-	const getVotes = async (chatId) => {
-		const { data } = await client.get("/api/vote", { query: { chatId } });
-		const result = votesResponseSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid votes response format");
-		return result.data;
-	};
-	const submitVote = async (params) => {
-		await client.patch("/api/vote", { body: params });
-	};
-	const getUsage = async (signal) => {
-		const { data } = await client.get("/api/usage", {}, { signal });
-		return data;
-	};
-	const approveToolCall = async (chatId, body) => {
-		await client.post("/api/chat/{id}/approval", {
-			path: { id: chatId },
-			body
-		});
-	};
-	const submitToolOutput = async (chatId, body) => {
-		await client.post("/api/chat/{id}/ui-tool-result", {
-			path: { id: chatId },
-			body
-		});
-	};
-	const stopChat = async (chatId) => {
-		const { data } = await client.post("/api/chat/{id}/stop", { path: { id: chatId } });
-		return data;
-	};
-	const getSuggestions = async (request, signal) => {
-		const { data } = await client.post("/api/suggestions", { body: request }, { signal });
-		return data;
-	};
-	const getAgentSettings = async (signal) => {
-		const { data } = await genericClient.get("/api/settings", {}, { signal });
-		const result = agentSettingsSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid agent settings response format");
-		return result.data;
-	};
-	const updateAgentSettings = async (request, signal) => {
-		const { data } = await genericClient.patch("/api/settings", { body: request }, { signal });
-		const result = agentSettingsSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid agent settings response format");
-		return result.data;
-	};
-	const getUserAgentSettings = async (signal) => {
-		const { data } = await genericClient.get("/api/settings/user", {}, { signal });
-		const result = userAgentSettingsSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid user agent settings response format");
-		return result.data;
-	};
-	const updateUserAgentSettings = async (request, signal) => {
-		const { data } = await genericClient.patch("/api/settings/user", { body: request }, { signal });
-		const result = userAgentSettingsSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid user agent settings response format");
-		return result.data;
-	};
-	const getToolsList = async (signal) => {
-		const { data } = await genericClient.get("/api/settings/tools", {}, { signal });
-		const result = toolsListResponseSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid tools list response format");
-		return result.data;
-	};
-	const getSkillsList = async (signal) => {
-		const { data } = await genericClient.get("/api/skills", {}, { signal });
-		const result = skillsListResponseSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid skills list response format");
-		return result.data;
-	};
-	const listSandboxFiles = async (chatId, path, signal) => {
-		const { data } = await genericClient.get(`/api/chat/${encodeURIComponent(chatId)}/sandbox/files`, { query: path ? { path } : void 0 }, { signal });
-		const result = sandboxFileListingSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid sandbox files response format");
-		return result.data;
-	};
-	const readSandboxFile = async (chatId, path, signal) => {
-		const { data } = await genericClient.get(`/api/chat/${encodeURIComponent(chatId)}/sandbox/file`, { query: { path } }, { signal });
-		const result = sandboxFileContentSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid sandbox file response format");
-		return result.data;
-	};
-	const downloadSandboxFile = async (chatId, path, signal) => {
-		const { data } = await genericClient.get(`/api/chat/${encodeURIComponent(chatId)}/sandbox/file/download`, { query: { path } }, { signal });
-		if (!(data instanceof Blob)) throw new Error("Invalid sandbox file download response format");
-		return data;
-	};
-	const getSandboxGitBranch = async (chatId, signal) => {
-		const { data } = await genericClient.get(`/api/chat/${encodeURIComponent(chatId)}/sandbox/git-branch`, {}, { signal });
-		const result = sandboxGitBranchSchema.safeParse(data);
-		if (!result.success) throw new Error("Invalid sandbox git-branch response format");
-		return result.data;
-	};
-	const chatStreamUrl = clientOptions.baseUrl + "/api/chat";
-	const healthCheck = async (signal) => {
-		const { data } = await genericClient.get("/health", {}, { signal });
-		return data;
-	};
-	return {
-		healthCheck,
-		getHistory,
-		getChat,
-		deleteChat,
-		createChat,
-		getVotes,
-		submitVote,
-		getUsage,
-		approveToolCall,
-		submitToolOutput,
-		stopChat,
-		getSuggestions,
-		getAgentSettings,
-		updateAgentSettings,
-		getUserAgentSettings,
-		updateUserAgentSettings,
-		getToolsList,
-		getSkillsList,
-		listSandboxFiles,
-		readSandboxFile,
-		downloadSandboxFile,
-		getSandboxGitBranch,
-		chatStreamUrl
-	};
-};
-//#endregion
 //#region src/keboola/createServiceClients.ts
 const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
 	getServiceBaseUrl,
@@ -1182,7 +1089,7 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 }).add({
 	serviceId: "kai-agent",
 	clientName: "kaiAgent",
-	clientFn: (serviceBaseUrl) => createKaiAgentClient({
+	clientFn: (serviceBaseUrl) => require_kaiAgent.createKaiAgentClient({
 		baseUrl: serviceBaseUrl,
 		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
 		auth
@@ -1268,7 +1175,7 @@ const createProjectClients$1 = async ({ baseUrl, projectId, authMiddleware, midd
 		initialToken: sapiToken,
 		verify: () => reader.tokens.verify()
 	});
-	const storageTableStore = require_createStore.createDerivedStore({
+	const storageTableStore = createDerivedStore({
 		source: liveProject.store,
 		build: require_storageTable.createStorageTable,
 		dependsOn: (project) => ({
@@ -1388,7 +1295,7 @@ const createKeboola = (options = {}) => {
 	const config = createConfig$1();
 	const middlewareFor = createMiddlewareFor(options.middlewares);
 	const retryContention = createRetryMiddleware({ shouldRetry: (error) => error instanceof require_createFetchClient.ApiError && error.response.status === require_createFetchClient.HttpStatus.SERVICE_UNAVAILABLE });
-	const authClientBare = require_createStore.createDerivedStore({
+	const authClientBare = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
@@ -1399,7 +1306,12 @@ const createKeboola = (options = {}) => {
 	const refresh = async () => {
 		const client = authClientBare.get();
 		assert$1(client, KeboolaErrorType.NotReady);
-		const refreshed = await client.token.refresh(config.requireCredential().refreshToken);
+		const epoch = config.getEpoch();
+		const refreshed = await client.token.refresh(config.requireCredential().refreshToken).catch((error) => {
+			if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+			throw error;
+		});
+		if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
 		config.applyRefresh(refreshed);
 		return refreshed.accessToken;
 	};
@@ -1415,8 +1327,36 @@ const createKeboola = (options = {}) => {
 			}
 		};
 	};
+	/**
+	* The project this session is scoped to, right now.
+	*
+	* - Read at every point that stamps a project, never snapshotted across an `await`: the scope moves
+	*   with `setProject`/`clearProject`, and neither ends the session, so it is not in the epoch and
+	*   `assertSameSession` cannot see it change.
+	* - `NotReady` rather than `NotAuthenticated` when merely unscoped — the credential is fine, the
+	*   project is what is missing. A credential alone does not authorize a project request: kai-agent
+	*   reads the project from the header, not the token, and cannot attribute a call that omits it.
+	*/
+	const requireScopedProject = () => {
+		const state = config.store.get();
+		if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+		if (state.status !== "scoped") throw new KeboolaError(KeboolaErrorType.NotReady);
+		return state.projectId;
+	};
+	/**
+	* The project client sets `forProject` has handed out, keyed by project id.
+	*
+	* - Not keyed by stack: `setBaseUrl` throws once authenticated and `signOut` empties this, so one
+	*   entry can never belong to a different `baseUrl` than the live session.
+	* - A `lazy` per key, not a bare promise: concurrent callers share one bootstrap, later ones replay
+	*   the resolved set, and a rejected build clears only its own slot — so a build orphaned by a
+	*   sign-out cannot evict the entry that replaced it.
+	*/
+	const extraProjects = /* @__PURE__ */ new Map();
 	const signOut = () => {
 		config.reset();
+		credential.abandonRefresh();
+		extraProjects.clear();
 		persistor.clear();
 	};
 	const onSessionExpired = () => {
@@ -1427,16 +1367,78 @@ const createKeboola = (options = {}) => {
 		getToken,
 		onSessionExpired
 	});
-	const authMiddleware = createBearerAuthMiddleware(credential);
-	const authClient = require_createStore.createDerivedStore({
+	const sessionGuard = (epoch) => () => {
+		if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+	};
+	/**
+	* The auth middleware, refusing to carry a request across a change of session.
+	*
+	* - The middleware holds no token — it reads the credential live — so anything built on it acts as
+	*   whoever is signed in *at request time*, not whoever built it. Rebuilding a store on sign-out
+	*   only stops new reads; a request already in flight completes as the next user, still stamped
+	*   with the old project. `config`'s epoch moves on `authenticate` and `reset` and never on a
+	*   rotation, so it is exactly "which sign-in is this".
+	* - `epochFor` says which sign-in a request answers to, resolved per request:
+	*   1. a client set pins to the sign-in that *built* it (`pinToSession`) — a set the caller still
+	*      holds must not ride the session that replaced it;
+	*   2. `api.auth` pins to the sign-in the request *started* on, because its store is keyed on
+	*      `baseUrl` alone: it is built once, while anonymous, so a build-time pin would freeze at that
+	*      epoch and refuse every authenticated call.
+	* - The guard covers every credential read, not only the wire request, so it wraps the credential
+	*   rather than sitting beside it. The 401 path rotates the token by calling the credential
+	*   directly: a straggler from a dead session would otherwise spend the *live* session's
+	*   single-use refresh token, and sign that session out if the rotation itself came back 401.
+	* - `expiresSession` decides whether a 401 that survives a rotation means the session is dead.
+	*   True for this session's own realms; false where the 401 may be about the project instead of
+	*   the credential (see `forProject`).
+	* - `inner` is for middleware that **re-invokes `next`** — a retry. Composed outside the pin it
+	*   would re-enter it per attempt, and with a per-request `epochFor` each attempt would re-pin to
+	*   whoever is signed in by then: a 503 backoff is exactly long enough for a sign-out to land, and
+	*   the retry then goes out as the next user. Inside, one epoch covers every attempt and each
+	*   attempt still passes the guard. Anything new that retries belongs here, not in the array.
+	*/
+	const createPinnedAuthMiddleware = (epochFor, { expiresSession = true, inner = [] } = {}) => {
+		return (next) => (request) => {
+			const assertSameSession = sessionGuard(epochFor());
+			const pinnedCredential = {
+				...credential,
+				getAccessToken: async (options) => {
+					assertSameSession();
+					return credential.getAccessToken(options);
+				},
+				notifyExpired: expiresSession ? credential.notifyExpired : () => {}
+			};
+			const guarded = (wire) => (repeated) => {
+				assertSameSession();
+				return wire(repeated);
+			};
+			const chain = inner.reduceRight((acc, middleware) => middleware(acc), guarded(next));
+			return createBearerAuthMiddleware(pinnedCredential)(chain)(request);
+		};
+	};
+	/**
+	* Pin something long-lived to the sign-in live right now.
+	*
+	* - `assertSameSession` is for whatever no middleware chain covers: a bootstrap whose every
+	*   request passed the guard before the sign-out resolves anyway and must not be handed back, and
+	*   `getAuthHeaders`, which emits the credential by hand.
+	*/
+	const pinToSession = (options) => {
+		const epoch = config.getEpoch();
+		return {
+			assertSameSession: sessionGuard(epoch),
+			pinnedAuthMiddleware: createPinnedAuthMiddleware(() => epoch, options)
+		};
+	};
+	const authClient = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
 			baseUrl,
-			middlewares: middlewareFor("auth", [retryContention, authMiddleware])
+			middlewares: middlewareFor("auth", [createPinnedAuthMiddleware(config.getEpoch, { inner: [retryContention] })])
 		}) : null
 	});
-	const management = require_createStore.createDerivedStore({
+	const management = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.status === "anonymous" ? null : state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_management.createManagementClient({
@@ -1445,10 +1447,10 @@ const createKeboola = (options = {}) => {
 				type: "bearer",
 				token: ""
 			},
-			middlewares: middlewareFor("management", [authMiddleware])
+			middlewares: middlewareFor("management", [pinToSession().pinnedAuthMiddleware])
 		}) : null
 	});
-	const projectClientsAsync = require_createStore.createDerivedAsyncStore({
+	const projectClientsAsync = createDerivedAsyncStore({
 		source: config.store,
 		dependsOn: (state) => state.status === "scoped" ? {
 			baseUrl: state.baseUrl,
@@ -1457,13 +1459,33 @@ const createKeboola = (options = {}) => {
 		build: ({ baseUrl, projectId }) => {
 			return createProjectClients$1({
 				baseUrl,
-				authMiddleware,
+				authMiddleware: pinToSession().pinnedAuthMiddleware,
 				projectId,
 				middlewareFor,
 				clientServiceUrls: options.clientServiceUrls
 			});
 		}
 	});
+	const forProject = async (projectId) => {
+		const state = config.store.get();
+		if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+		const cached = extraProjects.get(projectId);
+		if (cached) return cached();
+		const { assertSameSession, pinnedAuthMiddleware } = pinToSession({ expiresSession: false });
+		const build = require_jobStatus.lazy(async () => {
+			const clients = await createProjectClients$1({
+				baseUrl: state.baseUrl,
+				authMiddleware: pinnedAuthMiddleware,
+				projectId,
+				middlewareFor,
+				clientServiceUrls: options.clientServiceUrls
+			});
+			assertSameSession();
+			return clients;
+		});
+		extraProjects.set(projectId, build);
+		return build();
+	};
 	if (options.baseUrl) config.setBaseUrl(options.baseUrl);
 	config.store.subscribe((state) => {
 		if (state.status === "anonymous") return;
@@ -1497,6 +1519,19 @@ const createKeboola = (options = {}) => {
 		* re-entering the project. Use `reset` to sign out instead.
 		*/
 		clearProject: config.clearProjectId,
+		/**
+		* The clients for one project, off this session — for reaching a second project without leaving
+		* the first.
+		*
+		* - `setProjectAsync` *moves* the session (and `api`) to another project; this *adds* one. The
+		*   returned set is the caller's to hold and never appears on `api`.
+		* - Every set shares this session's auth middleware, so one rotation serves all of them. A second
+		*   `createKeboola()` does not: both hold the same single-use refresh token, and the first to
+		*   rotate invalidates the other's, whose next refresh 401s and signs it out.
+		* - Independent of the scope, including for the scoped project itself — asking for that one
+		*   builds a second set with its own `liveProject`, so prefer `api.*` there.
+		*/
+		forProject,
 		reset: signOut,
 		/**
 		* Dev/test only: mark the current access token as expired so the bearer credential rotates it on
@@ -1504,6 +1539,35 @@ const createKeboola = (options = {}) => {
 		* the rotation immediately and observe the new credential.
 		*/
 		debugForceRefresh: config.forceExpire,
+		/**
+		* The headers that authorize one off-client request, resolved fresh each call.
+		*
+		* - For a transport this package does not own — the chat SSE stream, whose `fetch` the AI SDK
+		*   holds. Anything with a service client on `api` should use that instead.
+		* - Returns the assembled bag, never the bare token: no caller handles the credential as a
+		*   string, and `X-KBC-ProjectId` is composed here rather than in every consuming app.
+		* - Resolved per call, through the credential — so a near-expiry token rotates and a revoked
+		*   one is never re-sent. A snapshot held by the caller would do neither.
+		* - Throws rather than emitting a half-formed `Bearer null`: an unauthenticated or unscoped
+		*   session has nothing to authorize with.
+		* - Pinned to the sign-in it was called on, like every client here. This is the one
+		*   credential-emitting surface with no middleware chain for the guard to sit in, so the check
+		*   is written out around the `await` that rotates the token.
+		* - The scope is re-read after that `await`, not carried across it. The epoch the pin compares
+		*   moves on a sign-in and a sign-out only, so a project switch mid-rotation is invisible to it.
+		*/
+		getAuthHeaders: async () => {
+			const { assertSameSession } = pinToSession();
+			requireScopedProject();
+			const accessToken = await credential.getAccessToken();
+			assertSameSession();
+			const projectId = requireScopedProject();
+			assert$1(accessToken, KeboolaErrorType.NotAuthenticated);
+			return {
+				[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${accessToken}`,
+				[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(projectId)
+			};
+		},
 		restore: async () => {
 			const persisted = persistor.hydrate();
 			if (!persisted.refreshToken || !persisted.baseUrl) return { status: "empty" };
@@ -1515,8 +1579,10 @@ const createKeboola = (options = {}) => {
 			if (!configured) config.setBaseUrl(persisted.baseUrl);
 			const client = authClientBare.get();
 			assert$1(client, KeboolaErrorType.NotReady);
+			const startedOn = config.getEpoch();
 			try {
 				const refreshed = await client.token.refresh(persisted.refreshToken);
+				if (config.getEpoch() !== startedOn) return { status: "empty" };
 				config.authenticate(refreshed);
 				if (persisted.projectId !== null) {
 					config.setProjectId(persisted.projectId);
@@ -1524,6 +1590,7 @@ const createKeboola = (options = {}) => {
 				}
 				return { status: "restored" };
 			} catch (err) {
+				if (config.getEpoch() !== startedOn) return { status: "empty" };
 				if (require_credential.isUnauthorized(err)) {
 					persistor.clear();
 					return { status: "expired" };
@@ -1556,7 +1623,7 @@ const createKeboola = (options = {}) => {
 //#endregion
 //#region src/keboola/legacy/createConfig.ts
 const createConfig = () => {
-	const store = require_createStore.createStore({
+	const store = require_store.createStore({
 		baseUrl: null,
 		sapiToken: null,
 		managementToken: null
@@ -1622,7 +1689,7 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 		initialToken: sapiToken,
 		verify: () => _storage.tokens.verify()
 	});
-	const storageTableStore = require_createStore.createDerivedStore({
+	const storageTableStore = createDerivedStore({
 		source: liveProject.store,
 		build: require_storageTable.createStorageTable,
 		dependsOn: (project) => ({
@@ -1683,7 +1750,7 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 const createLegacyKeboola = (options = {}) => {
 	const config = createConfig();
 	const middlewareFor = createMiddlewareFor(options.middlewares);
-	const authClient = require_createStore.createDerivedStore({
+	const authClient = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
@@ -1691,7 +1758,7 @@ const createLegacyKeboola = (options = {}) => {
 			middlewares: middlewareFor("auth", [])
 		}) : null
 	});
-	const management = require_createStore.createDerivedStore({
+	const management = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => ({
 			baseUrl: state.baseUrl,
@@ -1706,7 +1773,7 @@ const createLegacyKeboola = (options = {}) => {
 			middlewares: middlewareFor("management", [])
 		}) : null
 	});
-	const build = require_createStore.createDerivedAsyncStore({
+	const build = createDerivedAsyncStore({
 		source: config.store,
 		dependsOn: (state) => state.sapiToken && state.baseUrl ? state.baseUrl : null,
 		build: (baseUrl) => createProjectClients({
@@ -1780,9 +1847,9 @@ exports.assert = assert;
 exports.coalesce = coalesce;
 exports.collect = require_queue.collect;
 exports.concurrent = require_concurrent.concurrent;
-exports.createDerivedAsyncStore = require_createStore.createDerivedAsyncStore;
-exports.createDerivedStore = require_createStore.createDerivedStore;
-exports.createEmitter = require_createStore.createEmitter;
+exports.createDerivedAsyncStore = createDerivedAsyncStore;
+exports.createDerivedStore = createDerivedStore;
+exports.createEmitter = require_store.createEmitter;
 exports.createGenericFetchClient = require_createGenericFetchClient.createGenericFetchClient;
 exports.createKeboola = createKeboola;
 exports.createLegacyKeboola = createLegacyKeboola;
@@ -1796,7 +1863,7 @@ exports.createQueryServiceSdk = require_sdk_queryService_index.createQueryServic
 exports.createRetryMiddleware = createRetryMiddleware;
 exports.createSessionStorage = createSessionStorage;
 exports.createStorageSdk = require_sdk_storage_index.createStorageSdk;
-exports.createStore = require_createStore.createStore;
+exports.createStore = require_store.createStore;
 exports.dedupe = require_dedupe.dedupe;
 exports.deepMerge = deepMerge;
 exports.delay = require_jobStatus.delay;
@@ -1815,6 +1882,7 @@ exports.isQueryJobError = require_QueryJobTimeoutError.isQueryJobError;
 exports.isQueryJobTimeoutError = require_QueryJobTimeoutError.isQueryJobTimeoutError;
 exports.isStorageTokenMutatingRequest = isStorageTokenMutatingRequest;
 exports.isSyncActionError = require_SyncActionError.isSyncActionError;
+exports.isTimeoutError = require_createFetchClient.isTimeoutError;
 exports.isValidationError = require_ValidationError.isValidationError;
 exports.jobStatus = require_jobStatus.jobStatus;
 exports.keboolaUID = require_tag.keboolaUID;
@@ -1825,6 +1893,6 @@ exports.poll = require_jobStatus.poll;
 exports.poller = require_jobStatus.poller;
 exports.schemaGuidedMerge = require_configurations.schemaGuidedMerge;
 exports.series = require_storage.series;
-exports.shallowEqual = require_createStore.shallowEqual;
+exports.shallowEqual = shallowEqual;
 
 //# sourceMappingURL=index.cjs.map