@keboola/api-client 39.0.0 → 41.0.0

package/dist/index.cjs

@@ -1,53 +1,54 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_project = require("./project-BvFi19K_.cjs");
-const require_jobStatus = require("./jobStatus-0_Y3Sr4i.cjs");
-const require_queue = require("./queue-e3rMWbmK.cjs");
-const require_concurrent = require("./concurrent-tbiIa0UL.cjs");
-const require_dedupe = require("./dedupe-CiskLkGR.cjs");
+const require_jobStatus = require("./jobStatus-BMlsyXWI.cjs");
+const require_queue = require("./queue-UG_BWKIC.cjs");
+const require_concurrent = require("./concurrent-CdVfR1N5.cjs");
+const require_dedupe = require("./dedupe-OSnnst2u.cjs");
 const require_store = require("./store-xS-Cu_VS.cjs");
-const require_storage = require("./storage-HFUdEy7P.cjs");
-const require_tag = require("./tag-CsoOZWB_.cjs");
+const require_storage = require("./storage-JinL1y1s.cjs");
+const require_tag = require("./tag-DHS_soa7.cjs");
 const require_generateUUID = require("./generateUUID-C6qKBPIv.cjs");
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-zkNjr73Q.cjs");
+const require_configurations = require("./configurations-VlfQ_37Y.cjs");
 const require_UserError = require("./UserError-CSGO1qII.cjs");
-const require_createFetchClient = require("./createFetchClient-BlgPbjFj.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-CvBKyeDO.cjs");
-const require_ManagementClientAuthError = require("./ManagementClientAuthError-FcfMJNhr.cjs");
+const require_createFetchClient = require("./createFetchClient-Cwp8max9.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-BEYkQpu9.cjs");
+const require_ManagementClientAuthError = require("./ManagementClientAuthError-DE7lNGZQ.cjs");
 const require_QueryJobTimeoutError = require("./QueryJobTimeoutError-CVNPdCWX.cjs");
 const require_SyncActionError = require("./SyncActionError-BG0zwchi.cjs");
-const require_ValidationError = require("./ValidationError-CLVJCCwH.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-lcozzwk2.cjs");
-const require_import = require("./import-7YyyD_U_.cjs");
-const require_authClient = require("./authClient-8yU1last.cjs");
-const require_management = require("./management-DeZiQSlw.cjs");
+const require_ValidationError = require("./ValidationError-D65QU0uq.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-Dl9cqTvR.cjs");
+const require_import = require("./import-CNk89mqy.cjs");
+const require_authClient = require("./authClient-BmuUo0J4.cjs");
+const require_management = require("./management-CCY0IYnq.cjs");
 const require_constants = require("./constants-C6xku_Vx.cjs");
 const require_storageTable = require("./storageTable-C9crh4Ef.cjs");
-const require_semanticLayer = require("./semanticLayer-9uTaU7UT.cjs");
+const require_kaiMemory = require("./kaiMemory-CClSPInt.cjs");
+const require_semanticLayer = require("./semanticLayer-CKDVkU56.cjs");
 const require_sdk_storage_index = require("./sdk/storage/index.cjs");
 const require_sdk_vault_index = require("./sdk/vault/index.cjs");
 const require_ai_index = require("./ai/index.cjs");
-const require_appLogs = require("./appLogs-C_zP0lpv.cjs");
+const require_appLogs = require("./appLogs-B9zFJIuy.cjs");
 const require_apps_index = require("./apps/index.cjs");
 const require_billing_index = require("./billing/index.cjs");
-const require_businessWorkspaceApi = require("./businessWorkspaceApi-wyBdbpIJ.cjs");
+const require_businessWorkspaceApi = require("./businessWorkspaceApi-6tCDdpnY.cjs");
 const require_chat_index = require("./chat/index.cjs");
-const require_dataScience = require("./dataScience-D-hyc4GY.cjs");
+const require_dataScience = require("./dataScience-B5QxZnvW.cjs");
 const require_editor_index = require("./editor/index.cjs");
 const require_encryption_index = require("./encryption/index.cjs");
-const require_kaiAgent = require("./kaiAgent-DaB6UCsh.cjs");
-const require_metastore = require("./metastore-9AGrwjmN.cjs");
+const require_kaiAgent = require("./kaiAgent-QNoeVKPs.cjs");
+const require_metastore = require("./metastore-XtWciCZT.cjs");
 const require_notifications_index = require("./notifications/index.cjs");
-const require_oauth = require("./oauth-DNtv4Ihb.cjs");
+const require_oauth = require("./oauth--2p8jkJf.cjs");
 const require_omnisearch_index = require("./omnisearch/index.cjs");
-const require_queryService = require("./queryService-BVwD6Vmc.cjs");
+const require_queryService = require("./queryService-CQzclHdL.cjs");
 const require_scheduler_index = require("./scheduler/index.cjs");
 const require_stream_index = require("./stream/index.cjs");
-const require_syncActions = require("./syncActions-D2DhY6pP.cjs");
+const require_syncActions = require("./syncActions-mFlF16cl.cjs");
 const require_telemetry_index = require("./telemetry/index.cjs");
 const require_vault_index = require("./vault/index.cjs");
-const require_credential = require("./credential-CAulvfZ-.cjs");
+const require_middleware = require("./middleware-IjYx3d5u.cjs");
 const require_sdk_queryService_index = require("./sdk/queryService/index.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
@@ -56,22 +57,29 @@ function assert(value, message) {
 	if (value == null) throw new Error(message);
 }
 //#endregion
+//#region src/utils/ensure.ts
+/**
+* Read a key, or build its value and keep it.
+*
+* `Map.prototype.getOrInsertComputed` is this natively — swap to it once it clears the app's
+* `baseline-widely-available` build target. Vite transpiles syntax, not methods, so adopting it
+* early fails in the browser rather than at build.
+*/
+const ensure = (map, key, build) => {
+	const existing = map.get(key);
+	if (existing !== void 0) return existing;
+	const created = build();
+	map.set(key, created);
+	return created;
+};
+//#endregion
 //#region src/utils/async/coalesce.ts
 /**
 * Coalesces concurrent triggers onto a single, never-parallel run of `task`.
-* Triggers fired while a run is busy collapse into one trailing run, and each
-* resolves with the first run that started after it — so it never sees stale state.
-*
-* Example — A triggers, then B and C trigger while A's run is still going:
-*   1. trigger A      → run #1 starts
-*   2. trigger B, C   → run #1 busy, so they wait
-*   3. run #1 done    → A resolves
-*   4. run #2 starts  → covers B and C together (one trailing run, not two)
-*   5. run #2 done    → B and C resolve
 *
-* @returns a trigger; each call returns a promise of the task result.
-* @throws The returned promise rejects with whatever `task` throws or rejects
-* with — the caller handles it (try/catch, or `.catch` on `void trigger()`).
+* - Triggers fired while a run is busy collapse into one trailing run.
+* - Each trigger resolves with the first run started after it, so it never sees stale state.
+* - The returned promise rejects with whatever `task` throws.
 */
 const coalesce = (task) => {
 	let running = false;
@@ -391,8 +399,7 @@ const createProjectRefreshMiddleware = (shouldRefresh, requestRefresh) => (next)
 	return response;
 };
 /**
-* The live project store: seeded from the verified token, re-verified (coalesced) after a
-* token-mutating request or an explicit re-scope. Its `middleware` drives the auto re-verify.
+* The live project store, re-verified (coalesced) after a token-mutating request or a re-scope.
 */
 const createLiveProject = ({ initialToken, verify }) => {
 	const store = require_store.createStore(require_project.createProject({ sapiToken: initialToken }));
@@ -415,24 +422,30 @@ const createLiveProject = ({ initialToken, verify }) => {
 const KeboolaErrorType = {
 	Unconfigured: "unconfigured",
 	NotAuthenticated: "not-authenticated",
+	SignInEnded: "sign-in-ended",
 	AlreadyAuthenticated: "already-authenticated",
 	NoStorageToken: "no-storage-token",
 	NoManagementToken: "no-management-token",
 	MissingProject: "missing-project",
 	NotBearer: "not-bearer",
 	NotReady: "not-ready",
-	InvalidBuildTransition: "invalid-build-transition"
+	InvalidBuildTransition: "invalid-build-transition",
+	StackActive: "stack-active",
+	CredentialKindMismatch: "credential-kind-mismatch"
 };
 const MESSAGES = {
 	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
 	[KeboolaErrorType.NotAuthenticated]: "The session is not authenticated — sign in first.",
+	[KeboolaErrorType.SignInEnded]: "The sign-in this operation started under has ended — its result belongs to nobody.",
 	[KeboolaErrorType.AlreadyAuthenticated]: "The session is already authenticated — reset before authenticating again.",
 	[KeboolaErrorType.NoStorageToken]: "No storage token — authenticate the storage realm first.",
 	[KeboolaErrorType.NoManagementToken]: "No management token — authenticate the management realm first.",
 	[KeboolaErrorType.MissingProject]: "A bearer storage session requires a project — call setProject(projectId) first.",
 	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
 	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
-	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed."
+	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed.",
+	[KeboolaErrorType.StackActive]: "The active stack cannot be closed — select another first.",
+	[KeboolaErrorType.CredentialKindMismatch]: "This client renews the other credential kind — log in the way its `credentials` mode expects."
 };
 var KeboolaError = class KeboolaError extends Error {
 	type;
@@ -449,168 +462,6 @@ function assert$1(value, type) {
 	if (value == null) throw new KeboolaError(type);
 }
 //#endregion
-//#region src/middlewares/loggingMiddleware.ts
-const CORRELATION_ID_HEADER = "X-Correlation-ID";
-const ALWAYS_REDACTED_HEADERS = [
-	require_createFetchClient.KeboolaHttpHeader.MANAGEMENT_API_TOKEN,
-	require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN,
-	"authorization",
-	"cookie",
-	"set-cookie"
-];
-const ALWAYS_REDACTED_QUERY_PARAMS = /* @__PURE__ */ new Set([
-	"token",
-	"apikey",
-	"api_key",
-	"access_token",
-	"refresh_token",
-	"code",
-	"state",
-	"signature",
-	"sig",
-	"x-amz-signature",
-	"x-amz-credential",
-	"x-amz-security-token",
-	"password",
-	"secret"
-]);
-const REDACTED = "[REDACTED]";
-const getRedactedUrl = (rawUrl) => {
-	const url = new URL(rawUrl);
-	if (url.username) url.username = REDACTED;
-	if (url.password) url.password = REDACTED;
-	url.searchParams.forEach((_value, key) => {
-		if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) url.searchParams.set(key, REDACTED);
-	});
-	return url.toString();
-};
-const ensureCorrelationId = (request) => {
-	const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? require_generateUUID.generateUUID();
-	request.headers.set(CORRELATION_ID_HEADER, correlationId);
-	return correlationId;
-};
-const getRedactedHeaders = (headers, redacted) => {
-	const redactedSet = new Set([...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase()));
-	const result = {};
-	headers.forEach((value, name) => {
-		result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;
-	});
-	return result;
-};
-const getRequestLog = (request, redactedHeaders) => ({
-	url: getRedactedUrl(request.url),
-	headers: getRedactedHeaders(request.headers, redactedHeaders)
-});
-const getResponseLog = (response, redactedHeaders) => ({
-	status: response.status,
-	statusText: response.statusText,
-	headers: getRedactedHeaders(response.headers, redactedHeaders)
-});
-const redactApiError = (error, redactedHeaders) => new require_createFetchClient.ApiError({
-	request: new Request(getRedactedUrl(error.request.url), {
-		method: error.request.method,
-		headers: getRedactedHeaders(error.request.headers, redactedHeaders)
-	}),
-	response: new Response(null, {
-		status: error.response.status,
-		statusText: error.response.statusText,
-		headers: getRedactedHeaders(error.response.headers, redactedHeaders)
-	}),
-	data: error.data
-});
-const formatLog = (level, log) => {
-	const parts = [
-		`[${level.toUpperCase()}]`,
-		`${Math.round(log.durationMs)}ms`,
-		log.method
-	];
-	parts.push(log.request.url);
-	if ("response" in log) parts.push(String(log.response.status));
-	return parts.join(" ");
-};
-const createSafeLogger = (logger, level = "error-only") => {
-	return {
-		info: (log) => {
-			if (level !== "all") return;
-			try {
-				if (logger?.info) {
-					logger.info(log);
-					return;
-				}
-				console.info(formatLog("info", log));
-			} catch {}
-		},
-		error: (log) => {
-			try {
-				if (logger?.error) {
-					logger.error(log);
-					return;
-				}
-				console.error(formatLog("error", log));
-			} catch {}
-		}
-	};
-};
-const createLoggingMiddleware = (options = {}) => {
-	const safeLogger = createSafeLogger(options.logger, options.level);
-	const redactHeaders = options.redactHeaders ?? [];
-	return (next) => async (fetchRequest) => {
-		const correlationId = ensureCorrelationId(fetchRequest.request);
-		const start = performance.now();
-		const method = fetchRequest.request.method.toLowerCase();
-		const requestLog = getRequestLog(fetchRequest.request, redactHeaders);
-		try {
-			const result = await next(fetchRequest);
-			safeLogger.info({
-				correlationId,
-				method,
-				durationMs: performance.now() - start,
-				request: requestLog,
-				response: getResponseLog(result.response, redactHeaders)
-			});
-			return result;
-		} catch (error) {
-			if (error instanceof Error) safeLogger.error({
-				correlationId,
-				method,
-				durationMs: performance.now() - start,
-				request: requestLog,
-				error: require_createFetchClient.isApiError(error) ? redactApiError(error, redactHeaders) : error
-			});
-			throw error;
-		}
-	};
-};
-//#endregion
-//#region src/middlewares/retryMiddleware.ts
-const DEFAULT_MAX_RETRIES = 5;
-const DEFAULT_RETRYABLE_STATUSES = [
-	require_createFetchClient.HttpStatus.INTERNAL_SERVER_ERROR,
-	require_createFetchClient.HttpStatus.BAD_GATEWAY,
-	require_createFetchClient.HttpStatus.SERVICE_UNAVAILABLE,
-	require_createFetchClient.HttpStatus.GATEWAY_TIMEOUT
-];
-const DEFAULT_BACKOFF_FACTOR = .3;
-const defaultShouldRetry = (error) => error instanceof require_createFetchClient.ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);
-const createRetryMiddleware = (options) => {
-	const { maxRetries = DEFAULT_MAX_RETRIES, backoffFactor = DEFAULT_BACKOFF_FACTOR, shouldRetry = defaultShouldRetry } = options ?? {};
-	if (!Number.isInteger(maxRetries) || maxRetries < 0) throw new RangeError("maxRetries must be a non-negative integer");
-	if (!Number.isFinite(backoffFactor) || backoffFactor < 0) throw new RangeError("backoffFactor must be a finite non-negative number");
-	return (next) => async (request) => {
-		for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-			return await next({
-				...request,
-				request: request.request.clone()
-			});
-		} catch (error) {
-			if (attempt === maxRetries || !shouldRetry(error, attempt)) throw error;
-			const delayMs = backoffFactor * 1e3 * Math.pow(2, attempt);
-			await require_jobStatus.delay(delayMs, request.request.signal ?? void 0);
-		}
-		throw new Error("unreachable");
-	};
-};
-//#endregion
 //#region src/serviceClientRegistry/utils.ts
 const isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
 /**
@@ -699,146 +550,40 @@ const createMiddlewareFor = (middlewares) => {
 	};
 };
 //#endregion
-//#region src/keboola/bearer/createConfig.ts
-const INITIAL = {
-	status: "anonymous",
-	baseUrl: null
-};
-const stamp = (tokens) => ({
-	...tokens,
-	issuedAt: Date.now()
-});
-const createConfig$1 = (initial = INITIAL) => {
-	const store = require_store.createStore(initial);
-	let expiredNotified = false;
-	let epoch = 0;
+//#region src/keboola/legacy/createConfig.ts
+const createConfig = () => {
+	const store = require_store.createStore({
+		baseUrl: null,
+		sapiToken: null,
+		managementToken: null
+	});
 	const setBaseUrl = (baseUrl) => {
-		if (store.get().status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
 		store.set({
-			status: "anonymous",
+			...store.get(),
 			baseUrl
 		});
 	};
 	const authenticate = (tokens) => {
-		const state = store.get();
-		if (state.status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
-		if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);
-		expiredNotified = false;
-		epoch += 1;
-		store.set({
-			status: "authenticated",
-			baseUrl: state.baseUrl,
-			credential: stamp(tokens)
-		});
-	};
-	const setProjectId = (projectId) => {
-		const state = store.get();
-		if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-		store.set({
-			status: "scoped",
-			baseUrl: state.baseUrl,
-			credential: state.credential,
-			projectId
-		});
-	};
-	/**
-	* Drop the project scope, keeping the credential — the inverse of `setProjectId`, for leaving a
-	* project without signing out. The project clients are keyed on the scope, so they tear down and
-	* the storage build returns to `idle`; the session stays usable for `auth` and `management`.
-	* No-op unless currently scoped.
-	*/
-	const clearProjectId = () => {
-		const state = store.get();
-		if (state.status !== "scoped") return;
-		store.set({
-			status: "authenticated",
-			baseUrl: state.baseUrl,
-			credential: state.credential
-		});
-	};
-	/** Drop the credential (sign out); keeps the configured baseUrl. */
-	const reset = () => {
-		epoch += 1;
-		store.set({
-			status: "anonymous",
-			baseUrl: store.get().baseUrl
-		});
-	};
-	/** Apply a token refresh: replace the credential (fresh tokens, new issue time); no-op before auth. */
-	const applyRefresh = (tokens) => {
-		const state = store.get();
-		if (state.status === "anonymous") return;
-		store.set({
-			...state,
-			credential: stamp(tokens)
-		});
-	};
-	/**
-	* Dev/test lever: backdate the current token's issue time by a full lifetime so it reads as
-	* expired, making the refresh policy rotate it on the next request. No-op before auth.
-	*/
-	const forceExpire = () => {
-		const state = store.get();
-		if (state.status === "anonymous") return;
-		const issuedAt = Date.now() - state.credential.expiresIn * 1e3;
+		const current = store.get();
 		store.set({
-			...state,
-			credential: {
-				...state.credential,
-				issuedAt
-			}
+			...current,
+			sapiToken: tokens.sapiToken ?? current.sapiToken,
+			managementToken: tokens.managementToken ?? current.managementToken
 		});
 	};
-	/**
-	* The current credential, asserting the session is authenticated (or scoped). Single point for that
-	* check so callers (token attach, refresh) don't each re-narrow the state.
-	*/
-	const requireCredential = () => {
-		const state = store.get();
-		if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-		return state.credential;
-	};
-	const getBaseUrl = () => store.get().baseUrl;
-	/**
-	* Which sign-in this is — a counter, bumped by `authenticate` and `reset`.
-	*
-	* - For anything long-lived that must not outlive the credential it was built against: capture it,
-	*   compare it later. A rotation does not move it; only a new session or a sign-out does.
-	* - Distinct from `notifyExpired`'s latch, which answers "report this death once" rather than
-	*   "which session are we in".
-	*/
-	const getEpoch = () => epoch;
-	/**
-	* Session-expiry latch (fire-once):
-	* - why: concurrent 401s all report expiry, but the app must sign out once; and the credential /
-	*   auth middleware are long-lived singletons, so the latch can't live in them — it must reset
-	*   per session.
-	* - how: returns `true` only for the first call since the last `authenticate` (which re-arms it),
-	*   so the caller runs its sign-out exactly once per session death.
-	*/
-	const notifyExpired = () => {
-		if (expiredNotified) return false;
-		expiredNotified = true;
-		return true;
-	};
+	const getStorageToken = () => store.get().sapiToken ?? "";
+	const setStorageToken = (sapiToken) => store.set({
+		...store.get(),
+		sapiToken
+	});
+	/** Current state, for diagnostics. */
 	const debug = () => store.get();
 	return {
-		store: {
-			get: store.get,
-			subscribe: store.subscribe,
-			dispose: store.dispose
-		},
+		store,
 		setBaseUrl,
 		authenticate,
-		setProjectId,
-		clearProjectId,
-		reset,
-		applyRefresh,
-		forceExpire,
-		requireCredential,
-		getBaseUrl,
-		getEpoch,
-		notifyExpired,
+		getStorageToken,
+		setStorageToken,
 		debug
 	};
 };
@@ -979,6 +724,7 @@ const createVariablesSdk = ({ storageClient }) => {
 };
 //#endregion
 //#region src/keboola/createServiceClients.ts
+const withPath = (serviceBaseUrl, path) => typeof serviceBaseUrl === "string" ? `${serviceBaseUrl}${path}` : async () => `${await serviceBaseUrl()}${path}`;
 const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
 	getServiceBaseUrl,
 	onUnavailable: ({ serviceId, path, clientName }) => {
@@ -1004,7 +750,7 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 	serviceId: "data-science",
 	clientName: "apps",
 	clientFn: (serviceBaseUrl) => require_apps_index.createAppsClient({
-		baseUrl: `${serviceBaseUrl}/v2`,
+		baseUrl: withPath(serviceBaseUrl, "/v2"),
 		middlewares: middlewareFor("apps", [attachTokenMiddleware]),
 		auth
 	})
@@ -1076,7 +822,7 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 	serviceId: "ai",
 	clientName: "omnisearch",
 	clientFn: (serviceBaseUrl) => require_omnisearch_index.createOmnisearchClient({
-		baseUrl: `${serviceBaseUrl}/omnisearch`,
+		baseUrl: withPath(serviceBaseUrl, "/omnisearch"),
 		middlewares: middlewareFor("omnisearch", [attachTokenMiddleware]),
 		auth
 	})
@@ -1155,35 +901,26 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 	})
 }).build();
 //#endregion
-//#region src/keboola/bearer/createProjectClients.ts
-/**
-* Bearer (OAuth) project surface. Same handshake + assembly as the legacy build. The
-* `Authorization: Bearer` header + transparent refresh come from the engine-shared `authMiddleware`
-* (one instance for management + every project client). This build only adds the project-scoped
-* `X-KBC-ProjectId` header, composed *outside* the auth middleware so the header is present
-* before it clones the request for the 401 replay. Bearer has no static token header, so this
-* combined `attach` rides on every client — including the operational storage and the bootstrap reader.
-*/
-const createProjectClients$1 = async ({ baseUrl, projectId, authMiddleware, middlewareFor, clientServiceUrls }) => {
+//#region src/keboola/legacy/createProjectClients.ts
+const createAttachStorageToken = (getToken) => (next) => (request) => {
+	request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());
+	return next(request);
+};
+const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRefreshed, middlewareFor, clientServiceUrls }) => {
 	const auth = {
-		type: "bearer",
-		token: "",
-		projectId
-	};
-	const projectIdMiddleware = (next) => (request) => {
-		request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.PROJECT_ID, String(projectId));
-		return next(request);
+		type: "sapi-token",
+		token: getStorageToken()
 	};
-	const attach = (next) => projectIdMiddleware(authMiddleware(next));
-	const reader = require_storage.createStorageClient({
+	const attach = createAttachStorageToken(getStorageToken);
+	const _storage = require_storage.createStorageClient({
 		baseUrl,
 		auth,
 		middlewares: [attach]
 	});
 	const [stackInfo, sapiToken, devBranches] = await Promise.all([
-		reader.getStackInfo({ exclude: "componentDetails" }),
-		reader.tokens.verify(),
-		reader.branches.getDevBranches()
+		_storage.getStackInfo({ exclude: "componentDetails" }),
+		_storage.tokens.verify(),
+		_storage.branches.getDevBranches()
 	]);
 	const stack = createStack({
 		stackInfo,
@@ -1192,7 +929,7 @@ const createProjectClients$1 = async ({ baseUrl, projectId, authMiddleware, midd
 	const defaultBranch = createDefaultBranch({ devBranches });
 	const liveProject = createLiveProject({
 		initialToken: sapiToken,
-		verify: () => reader.tokens.verify()
+		verify: () => _storage.tokens.verify()
 	});
 	const storageTableStore = createDerivedStore({
 		source: liveProject.store,
@@ -1217,552 +954,8 @@ const createProjectClients$1 = async ({ baseUrl, projectId, authMiddleware, midd
 	const storage = require_storage.createStorageClient({
 		baseUrl,
 		auth,
-		middlewares: middlewareFor("storage", [attach, liveProject.middleware])
-	});
-	const { client: services, meta: serviceMeta } = createServiceClients({
-		baseUrl,
-		auth,
-		getServiceBaseUrl: context.stack.getServiceUrl,
-		middlewareFor,
-		attachTokenMiddleware: attach
-	});
-	const sdk = {
-		configuration: require_configurations.createConfigurationSdk({
-			storageClient: storage,
-			encryptionClient: services.encryption,
-			context
-		}),
-		tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
-		semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
-		storage: require_sdk_storage_index.createStorageSdk({ storageClient: storage }),
-		vault: require_sdk_vault_index.createVaultSdk({
-			vaultClient: services.vault,
-			encryptionClient: services.encryption
-		}),
-		variables: createVariablesSdk({ storageClient: storage })
-	};
-	return {
-		context,
-		serviceMeta,
-		storage,
-		...services,
-		sdk
-	};
-};
-//#endregion
-//#region src/keboola/bearer/middleware.ts
-/**
-* Bearer auth for every outgoing request:
-* - Stamps the current access token (from the credential) as the `Authorization` header.
-* - On a 401, force-refreshes the token and replays the request once.
-* - If the replay still 401s, the fresh token is rejected → marks the session expired.
-*
-* When the session is anonymous (`getAccessToken` → `null`) the request is passed through untouched
-* with no 401 dance — so pre-auth calls on the auth client (`login`, `refresh`) work and a failed
-* login is never mistaken for session expiry.
-*
-* Holds no token and never touches config — all token and refresh state lives in the credential.
-*/
-const createBearerAuthMiddleware = (credential) => {
-	return (next) => async (request) => {
-		const token = await credential.getAccessToken({ forceRefresh: false });
-		if (token === null) return next(request);
-		const retryRequest = request.request.clone();
-		request.request.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, `Bearer ${token}`);
-		try {
-			return await next(request);
-		} catch (error) {
-			if (!require_credential.isUnauthorized(error)) throw error;
-			const refreshed = await credential.getAccessToken({ forceRefresh: true });
-			if (refreshed === null) throw error;
-			retryRequest.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);
-			try {
-				return await next({
-					...request,
-					request: retryRequest
-				});
-			} catch (retryError) {
-				if (require_credential.isUnauthorized(retryError)) credential.notifyExpired();
-				throw retryError;
-			}
-		}
-	};
-};
-//#endregion
-//#region src/keboola/bearer/persistor.ts
-const SESSION_KEY = "keboola:bearer-session";
-const persistedSessionSchema = zod.object({
-	baseUrl: zod.string().nullable(),
-	projectId: zod.number().nullable(),
-	refreshToken: zod.string().nullable()
-});
-const EMPTY_PERSISTED_SESSION = {
-	baseUrl: null,
-	projectId: null,
-	refreshToken: null
-};
-const createSessionPersistor = (storage) => createPersistor({
-	storage,
-	key: SESSION_KEY,
-	schema: persistedSessionSchema,
-	defaultValue: EMPTY_PERSISTED_SESSION
-});
-//#endregion
-//#region src/keboola/bearer/keboola.ts
-const createKeboola = (options = {}) => {
-	const persistor = createSessionPersistor(options.storage);
-	const config = createConfig$1();
-	const middlewareFor = createMiddlewareFor(options.middlewares);
-	const retryContention = createRetryMiddleware({ shouldRetry: (error) => error instanceof require_createFetchClient.ApiError && error.response.status === require_createFetchClient.HttpStatus.SERVICE_UNAVAILABLE });
-	const authClientBare = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => state.baseUrl,
-		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
-			baseUrl,
-			middlewares: middlewareFor("auth", [retryContention])
-		}) : null
-	});
-	const refresh = async () => {
-		const client = authClientBare.get();
-		assert$1(client, KeboolaErrorType.NotReady);
-		const epoch = config.getEpoch();
-		const refreshed = await client.token.refresh(config.requireCredential().refreshToken).catch((error) => {
-			if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-			throw error;
-		});
-		if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-		config.applyRefresh(refreshed);
-		return refreshed.accessToken;
-	};
-	const getToken = () => {
-		const state = config.store.get();
-		if (state.status === "anonymous") return null;
-		const { accessToken, issuedAt, expiresIn } = state.credential;
-		return {
-			accessToken,
-			timing: {
-				issuedAt,
-				expiresIn
-			}
-		};
-	};
-	/**
-	* The session's state, once it is known to carry a credential.
-	*
-	* - Returns the state rather than nothing, so the caller reads `baseUrl` and `credential` off a
-	*   narrowed union instead of re-checking the status to get at them.
-	* - `NotAuthenticated`, the same refusal `requireScopedProject` opens with. The two differ only in
-	*   how far they go: this one stops at "somebody is signed in", which is all a request naming its
-	*   own project needs.
-	*/
-	const requireAuthenticated = () => {
-		const state = config.store.get();
-		if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-		return state;
-	};
-	/**
-	* The project this session is scoped to, right now.
-	*
-	* - Read at every point that stamps a project, never snapshotted across an `await`: the scope moves
-	*   with `setProject`/`clearProject`, and neither ends the session, so it is not in the epoch and
-	*   `assertSameSession` cannot see it change.
-	* - `NotReady` rather than `NotAuthenticated` when merely unscoped — the credential is fine, the
-	*   project is what is missing. A credential alone does not authorize a project request: kai-agent
-	*   reads the project from the header, not the token, and cannot attribute a call that omits it.
-	*/
-	const requireScopedProject = () => {
-		const state = requireAuthenticated();
-		if (state.status !== "scoped") throw new KeboolaError(KeboolaErrorType.NotReady);
-		return state.projectId;
-	};
-	/**
-	* The project client sets `forProject` has handed out, keyed by project id.
-	*
-	* - Not keyed by stack: `setBaseUrl` throws once authenticated and `signOut` empties this, so one
-	*   entry can never belong to a different `baseUrl` than the live session.
-	* - A `lazy` per key, not a bare promise: concurrent callers share one bootstrap, later ones replay
-	*   the resolved set, and a rejected build clears only its own slot — so a build orphaned by a
-	*   sign-out cannot evict the entry that replaced it.
-	*/
-	const extraProjects = /* @__PURE__ */ new Map();
-	const signOut = () => {
-		config.reset();
-		credential.abandonRefresh();
-		extraProjects.clear();
-		persistor.clear();
-	};
-	const onSessionExpired = () => {
-		if (config.notifyExpired()) signOut();
-	};
-	const credential = require_credential.createBearerCredential({
-		refresh,
-		getToken,
-		onSessionExpired
-	});
-	const sessionGuard = (epoch) => () => {
-		if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-	};
-	/**
-	* The auth middleware, refusing to carry a request across a change of session.
-	*
-	* - The middleware holds no token — it reads the credential live — so anything built on it acts as
-	*   whoever is signed in *at request time*, not whoever built it. Rebuilding a store on sign-out
-	*   only stops new reads; a request already in flight completes as the next user, still stamped
-	*   with the old project. `config`'s epoch moves on `authenticate` and `reset` and never on a
-	*   rotation, so it is exactly "which sign-in is this".
-	* - `epochFor` says which sign-in a request answers to, resolved per request:
-	*   1. a client set pins to the sign-in that *built* it (`pinToSession`) — a set the caller still
-	*      holds must not ride the session that replaced it;
-	*   2. `api.auth` pins to the sign-in the request *started* on, because its store is keyed on
-	*      `baseUrl` alone: it is built once, while anonymous, so a build-time pin would freeze at that
-	*      epoch and refuse every authenticated call.
-	* - The guard covers every credential read, not only the wire request, so it wraps the credential
-	*   rather than sitting beside it. The 401 path rotates the token by calling the credential
-	*   directly: a straggler from a dead session would otherwise spend the *live* session's
-	*   single-use refresh token, and sign that session out if the rotation itself came back 401.
-	* - `expiresSession` decides whether a 401 that survives a rotation means the session is dead.
-	*   True for this session's own realms; false where the 401 may be about the project instead of
-	*   the credential (see `forProject`).
-	* - `inner` is for middleware that **re-invokes `next`** — a retry. Composed outside the pin it
-	*   would re-enter it per attempt, and with a per-request `epochFor` each attempt would re-pin to
-	*   whoever is signed in by then: a 503 backoff is exactly long enough for a sign-out to land, and
-	*   the retry then goes out as the next user. Inside, one epoch covers every attempt and each
-	*   attempt still passes the guard. Anything new that retries belongs here, not in the array.
-	*/
-	const createPinnedAuthMiddleware = (epochFor, { expiresSession = true, inner = [] } = {}) => {
-		return (next) => (request) => {
-			const assertSameSession = sessionGuard(epochFor());
-			const pinnedCredential = {
-				...credential,
-				getAccessToken: async (options) => {
-					assertSameSession();
-					return credential.getAccessToken(options);
-				},
-				notifyExpired: expiresSession ? credential.notifyExpired : () => {}
-			};
-			const guarded = (wire) => (repeated) => {
-				assertSameSession();
-				return wire(repeated);
-			};
-			const chain = inner.reduceRight((acc, middleware) => middleware(acc), guarded(next));
-			return createBearerAuthMiddleware(pinnedCredential)(chain)(request);
-		};
-	};
-	/**
-	* Pin something long-lived to the sign-in live right now.
-	*
-	* - `assertSameSession` is for whatever no middleware chain covers: a bootstrap whose every
-	*   request passed the guard before the sign-out resolves anyway and must not be handed back, and
-	*   `getAuthHeaders`, which emits the credential by hand.
-	*/
-	const pinToSession = (options) => {
-		const epoch = config.getEpoch();
-		return {
-			assertSameSession: sessionGuard(epoch),
-			pinnedAuthMiddleware: createPinnedAuthMiddleware(() => epoch, options)
-		};
-	};
-	const authClient = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => state.baseUrl,
-		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
-			baseUrl,
-			middlewares: middlewareFor("auth", [createPinnedAuthMiddleware(config.getEpoch, { inner: [retryContention] })])
-		}) : null
-	});
-	const management = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => state.status === "anonymous" ? null : state.baseUrl,
-		build: (baseUrl) => baseUrl ? require_management.createManagementClient({
-			baseUrl,
-			auth: {
-				type: "bearer",
-				token: ""
-			},
-			middlewares: middlewareFor("management", [pinToSession().pinnedAuthMiddleware])
-		}) : null
-	});
-	const projectClientsAsync = createDerivedAsyncStore({
-		source: config.store,
-		dependsOn: (state) => state.status === "scoped" ? {
-			baseUrl: state.baseUrl,
-			projectId: state.projectId
-		} : null,
-		build: ({ baseUrl, projectId }) => {
-			return createProjectClients$1({
-				baseUrl,
-				authMiddleware: pinToSession().pinnedAuthMiddleware,
-				projectId,
-				middlewareFor,
-				clientServiceUrls: options.clientServiceUrls
-			});
-		}
-	});
-	const forProject = async (projectId) => {
-		const state = requireAuthenticated();
-		const cached = extraProjects.get(projectId);
-		if (cached) return cached();
-		const { assertSameSession, pinnedAuthMiddleware } = pinToSession({ expiresSession: false });
-		const build = require_jobStatus.lazy(async () => {
-			const clients = await createProjectClients$1({
-				baseUrl: state.baseUrl,
-				authMiddleware: pinnedAuthMiddleware,
-				projectId,
-				middlewareFor,
-				clientServiceUrls: options.clientServiceUrls
-			});
-			assertSameSession();
-			return clients;
-		});
-		extraProjects.set(projectId, build);
-		return build();
-	};
-	if (options.baseUrl) config.setBaseUrl(options.baseUrl);
-	config.store.subscribe((state) => {
-		if (state.status === "anonymous") return;
-		persistor.persist({
-			baseUrl: state.baseUrl,
-			projectId: state.status === "scoped" ? state.projectId : null,
-			refreshToken: state.credential.refreshToken
-		});
-	});
-	const debug = () => ({
-		type: "Bearer",
-		config: config.debug(),
-		authReady: authClient.get() !== null,
-		managementReady: management.get() !== null,
-		storage: projectClientsAsync.store.get().state
-	});
-	const session = {
-		hasPersistedValue: persistor.hasPersistedValue,
-		setBaseUrl: config.setBaseUrl,
-		isStorageReady: () => projectClientsAsync.store.get().state === "ready",
-		authenticate: (tokens) => config.authenticate(tokens),
-		setProject: config.setProjectId,
-		setProjectAsync: async (projectId) => {
-			config.setProjectId(projectId);
-			await projectClientsAsync.settled();
-		},
-		/**
-		* Leave the current project but stay signed in — the storage build returns to `idle`, so a
-		* consumer gating on it falls back to its project picker. The persisted session is rewritten with
-		* `projectId: null` by the subscription above, so a reload lands on the picker rather than
-		* re-entering the project. Use `reset` to sign out instead.
-		*/
-		clearProject: config.clearProjectId,
-		/**
-		* The clients for one project, off this session — for reaching a second project without leaving
-		* the first.
-		*
-		* - `setProjectAsync` *moves* the session (and `api`) to another project; this *adds* one. The
-		*   returned set is the caller's to hold and never appears on `api`.
-		* - Every set shares this session's auth middleware, so one rotation serves all of them. A second
-		*   `createKeboola()` does not: both hold the same single-use refresh token, and the first to
-		*   rotate invalidates the other's, whose next refresh 401s and signs it out.
-		* - Independent of the scope, including for the scoped project itself — asking for that one
-		*   builds a second set with its own `liveProject`, so prefer `api.*` there.
-		*/
-		forProject,
-		reset: signOut,
-		/**
-		* Dev/test only: mark the current access token as expired so the bearer credential rotates it on
-		* the next request. Pair with any authenticated call (e.g. `api.storage.tokens.verify()`) to force
-		* the rotation immediately and observe the new credential.
-		*/
-		debugForceRefresh: config.forceExpire,
-		/**
-		* The headers that authorize one off-client request, resolved fresh each call.
-		*
-		* - For a transport this package does not own — the chat SSE stream, whose `fetch` the AI SDK
-		*   holds. Anything with a service client on `api` should use that instead.
-		* - Returns the assembled bag, never the bare token: no caller handles the credential as a
-		*   string, and `X-KBC-ProjectId` is composed here rather than in every consuming app.
-		* - Resolved per call, through the credential — so a near-expiry token rotates and a revoked
-		*   one is never re-sent. A snapshot held by the caller would do neither.
-		* - Throws rather than emitting a half-formed `Bearer null`: a session with no credential has
-		*   nothing to authorize with.
-		* - Pinned to the sign-in it was called on, like every client here. This is the one
-		*   credential-emitting surface with no middleware chain for the guard to sit in, so the check
-		*   is written out around the `await` that rotates the token.
-		*
-		* `projectId` names the project the headers authorize, for a caller reaching a project the
-		* session is not scoped to:
-		*
-		* - **Omitted**, the session's own scope answers — unchanged, and re-read *after* the rotation
-		*   rather than carried across it. The epoch the pin compares moves on a sign-in and a sign-out
-		*   only, so a project switch mid-rotation is invisible to it.
-		* - **Given**, it is what the header says, and the scope is not consulted at all. A caller that
-		*   names a project has said everything the request needs: the credential is user-level and the
-		*   project is a header on top of it, so an authenticated session suffices where an unnamed call
-		*   requires a scoped one. Nothing about the session can change the answer, so there is nothing
-		*   to re-read after the `await`.
-		* - **Not checked against an access set**, because this session cannot acquire one:
-		*   `forProject` — the only other surface taking a caller-supplied project id — records that
-		*   connection collapses every bearer failure into a single `invalid_token` 401, so "no access
-		*   to this project" and "revoked token" are the same response. Whether the caller may reach a
-		*   project is the caller's own knowledge, from `token.introspect`. What is guaranteed here is
-		*   that the header names what was asked for and never something else — which is the failure
-		*   worth preventing: a turn sent somewhere the transcript above it did not come from.
-		*/
-		getAuthHeaders: async (projectId) => {
-			const { assertSameSession } = pinToSession();
-			if (projectId === void 0) requireScopedProject();
-			else requireAuthenticated();
-			const accessToken = await credential.getAccessToken();
-			assertSameSession();
-			const authorizedProjectId = projectId ?? requireScopedProject();
-			assert$1(accessToken, KeboolaErrorType.NotAuthenticated);
-			return {
-				[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${accessToken}`,
-				[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(authorizedProjectId)
-			};
-		},
-		restore: async () => {
-			const persisted = persistor.hydrate();
-			if (!persisted.refreshToken || !persisted.baseUrl) return { status: "empty" };
-			const configured = config.getBaseUrl();
-			if (configured && configured !== persisted.baseUrl) {
-				persistor.clear();
-				return { status: "empty" };
-			}
-			if (!configured) config.setBaseUrl(persisted.baseUrl);
-			const client = authClientBare.get();
-			assert$1(client, KeboolaErrorType.NotReady);
-			const startedOn = config.getEpoch();
-			try {
-				const refreshed = await client.token.refresh(persisted.refreshToken);
-				if (config.getEpoch() !== startedOn) return { status: "empty" };
-				config.authenticate(refreshed);
-				if (persisted.projectId !== null) {
-					config.setProjectId(persisted.projectId);
-					await projectClientsAsync.settled();
-				}
-				return { status: "restored" };
-			} catch (err) {
-				if (config.getEpoch() !== startedOn) return { status: "empty" };
-				if (require_credential.isUnauthorized(err)) {
-					persistor.clear();
-					return { status: "expired" };
-				}
-				throw err;
-			}
-		},
-		subscribe: (listener) => {
-			const unsubscribeConfig = config.store.subscribe(() => listener(debug()));
-			const unsubscribeBuild = projectClientsAsync.store.subscribe(() => listener(debug()));
-			return () => {
-				unsubscribeConfig();
-				unsubscribeBuild();
-			};
-		},
-		debug
-	};
-	return {
-		api: createApi({
-			getAuthClient: () => authClient.get(),
-			getManagementClient: () => management.get(),
-			getProjectClients: () => {
-				const state = projectClientsAsync.store.get();
-				return state.state === "ready" ? state.value : null;
-			}
-		}),
-		session
-	};
-};
-//#endregion
-//#region src/keboola/legacy/createConfig.ts
-const createConfig = () => {
-	const store = require_store.createStore({
-		baseUrl: null,
-		sapiToken: null,
-		managementToken: null
-	});
-	const setBaseUrl = (baseUrl) => {
-		store.set({
-			...store.get(),
-			baseUrl
-		});
-	};
-	const authenticate = (tokens) => {
-		const current = store.get();
-		store.set({
-			...current,
-			sapiToken: tokens.sapiToken ?? current.sapiToken,
-			managementToken: tokens.managementToken ?? current.managementToken
-		});
-	};
-	const getStorageToken = () => store.get().sapiToken ?? "";
-	const setStorageToken = (sapiToken) => store.set({
-		...store.get(),
-		sapiToken
-	});
-	/** Current state, for diagnostics. */
-	const debug = () => store.get();
-	return {
-		store,
-		setBaseUrl,
-		authenticate,
-		getStorageToken,
-		setStorageToken,
-		debug
-	};
-};
-//#endregion
-//#region src/keboola/legacy/createProjectClients.ts
-const createAttachStorageToken = (getToken) => (next) => (request) => {
-	request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());
-	return next(request);
-};
-const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRefreshed, middlewareFor, clientServiceUrls }) => {
-	const auth = {
-		type: "sapi-token",
-		token: getStorageToken()
-	};
-	const attach = createAttachStorageToken(getStorageToken);
-	const _storage = require_storage.createStorageClient({
-		baseUrl,
-		auth,
-		middlewares: [attach]
-	});
-	const [stackInfo, sapiToken, devBranches] = await Promise.all([
-		_storage.getStackInfo({ exclude: "componentDetails" }),
-		_storage.tokens.verify(),
-		_storage.branches.getDevBranches()
-	]);
-	const stack = createStack({
-		stackInfo,
-		clientServiceUrls
-	});
-	const defaultBranch = createDefaultBranch({ devBranches });
-	const liveProject = createLiveProject({
-		initialToken: sapiToken,
-		verify: () => _storage.tokens.verify()
-	});
-	const storageTableStore = createDerivedStore({
-		source: liveProject.store,
-		build: require_storageTable.createStorageTable,
-		dependsOn: (project) => ({
-			useLegacyBucketPrefix: !project.hasFeature(require_constants.ProjectFeature.DisableLegacyBucketPrefix),
-			hasProtectedDefaultBranch: project.hasFeature(require_constants.ProjectFeature.SoxProtectedDefaultBranch),
-			hasStorageBranches: project.hasFeature(require_constants.ProjectFeature.StorageBranches)
-		})
-	});
-	const context = {
-		baseUrl: require_createFetchClient.normalizeBaseUrl(baseUrl),
-		stack,
-		defaultBranch,
-		get project() {
-			return liveProject.getProject();
-		},
-		get st() {
-			return storageTableStore.get();
-		}
-	};
-	const storage = require_storage.createStorageClient({
-		baseUrl,
-		auth,
-		middlewares: middlewareFor("storage", [liveProject.middleware]),
-		onRefreshToken: onStorageTokenRefreshed
+		middlewares: middlewareFor("storage", [liveProject.middleware]),
+		onRefreshToken: onStorageTokenRefreshed
 	});
 	const { client: services, meta: serviceMeta } = createServiceClients({
 		baseUrl,
@@ -1779,6 +972,7 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 		}),
 		tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
 		semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
+		kaiMemory: require_kaiMemory.createKaiMemorySdk({ metastoreClient: services.metastore }),
 		storage: require_sdk_storage_index.createStorageSdk({ storageClient: storage }),
 		vault: require_sdk_vault_index.createVaultSdk({
 			vaultClient: services.vault,
@@ -1876,6 +1070,1407 @@ const createLegacyKeboola = (options = {}) => {
 	};
 };
 //#endregion
+//#region src/keboola/bearer/credentials/renewal.ts
+const renewalGrant = (credential) => credential.type === "token" ? {
+	type: "token",
+	refreshToken: credential.refreshToken
+} : {
+	type: "cookie",
+	sessionId: credential.sessionId
+};
+const renew = async (client, grant) => {
+	if (grant.type === "cookie") {
+		const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({ sessionId: grant.sessionId });
+		return {
+			type: "cookie",
+			accessToken,
+			expiresIn,
+			sessionId
+		};
+	}
+	const { accessToken, expiresIn, refreshToken } = await client.token.refreshWithToken({ refreshToken: grant.refreshToken });
+	if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+	return {
+		type: "token",
+		accessToken,
+		expiresIn,
+		refreshToken
+	};
+};
+//#endregion
+//#region src/keboola/bearer/credentials/credentials.ts
+const DEFAULT_REFRESH_THRESHOLD = .9;
+const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
+const createCredentials = ({ state, persistor, middlewares, mode = "token", refreshThreshold = DEFAULT_REFRESH_THRESHOLD, onSignedOut }) => {
+	const rotationMap = /* @__PURE__ */ new Map();
+	const generations = /* @__PURE__ */ new Map();
+	const generationOf = (baseUrl) => generations.get(baseUrl) ?? 0;
+	const refresh = async (baseUrl, grant) => {
+		const client = require_authClient.createAuthClient({
+			baseUrl,
+			middlewares
+		});
+		const epochBefore = require_jobStatus.Result.unwrap(state.auth.getEpoch(baseUrl));
+		const generationBefore = generationOf(baseUrl);
+		const refreshed = await require_jobStatus.Result.tryCatchAsync(() => renew(client, grant));
+		return require_jobStatus.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epochBefore && generationOf(baseUrl) === generationBefore ? refreshed : require_jobStatus.Result.failure(signInEnded());
+	};
+	/**
+	* A stack's teardown, from the credential's side.
+	*
+	* - Bumps the generation, so an in-flight rotation can no longer write.
+	* - Drops the deduped entry, so nothing joins that rotation.
+	*/
+	const forget = (baseUrl) => {
+		generations.set(baseUrl, generationOf(baseUrl) + 1);
+		rotationMap.delete(baseUrl);
+	};
+	/**
+	* The rotation, and the one place a credential is declared dead.
+	*
+	* - A refused refresh token or session is unambiguous.
+	* - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.
+	*/
+	const rotateOnce = async (baseUrl) => {
+		const credential = state.auth.requireCredentialOf(baseUrl, mode);
+		if (!credential.success) return credential;
+		const refreshed = await refresh(baseUrl, renewalGrant(credential.data));
+		if (!refreshed.success) {
+			if (require_middleware.isUnauthorized(refreshed.error)) expire(baseUrl);
+			return refreshed;
+		}
+		return require_jobStatus.Result.map(state.auth.applyRefresh(baseUrl, refreshed.data), () => refreshed.data.accessToken);
+	};
+	const rotate = (baseUrl) => ensure(rotationMap, baseUrl, () => require_dedupe.dedupe(() => rotateOnce(baseUrl)))();
+	const restoreStack = async (baseUrl, grant) => {
+		if (!state.auth.startRestore(baseUrl).success) return "unreachable";
+		const refreshed = await refresh(baseUrl, grant);
+		if (!refreshed.success) {
+			state.auth.cancelRestore(baseUrl);
+			return require_middleware.isUnauthorized(refreshed.error) ? "refused" : "unreachable";
+		}
+		state.auth.authenticate(baseUrl, refreshed.data);
+		return "restored";
+	};
+	const restoreProjects = (baseUrl, projects) => {
+		for (const { projectId } of projects) state.projects.open(baseUrl, projectId);
+	};
+	/**
+	* Every persisted stack back into the table, with whatever credential it can hand back.
+	*
+	* - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the
+	*   caller to select.
+	* - `status` reports what became of `lastActive`'s credential; the client reads it to decide
+	*   when persistence may start.
+	*/
+	const restore = async () => {
+		const hydrated = persistor.hydrate();
+		const stacks = hydrated.stacks.map((stack) => stack.credential && stack.credential.type !== "static" && stack.credential.type !== mode ? {
+			...stack,
+			credential: null
+		} : stack);
+		const { current } = hydrated;
+		const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);
+		const restored = stacks.map(async ({ baseUrl, credential, projects }) => {
+			state.stacks.ensure(baseUrl);
+			if (!credential) return "unreachable";
+			if (require_jobStatus.Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return "skipped";
+			const outcome = credential.type === "static" ? state.auth.authenticate(baseUrl, credential).success ? "restored" : "refused" : await restoreStack(baseUrl, credential);
+			if (outcome === "restored") restoreProjects(baseUrl, projects);
+			return outcome;
+		});
+		const results = await Promise.all(restored);
+		const outcome = scoped?.credential ? results[stacks.indexOf(scoped)] : void 0;
+		return {
+			lastActive: current,
+			status: outcome === void 0 || outcome === "skipped" ? "empty" : outcome === "restored" ? "restored" : outcome === "unreachable" ? "unreachable" : "expired"
+		};
+	};
+	const isStale = (baseUrl) => {
+		const ageing = require_jobStatus.Result.map(state.auth.requireCredentialOf(baseUrl, mode), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
+		return require_jobStatus.Result.unwrapOr(ageing, false);
+	};
+	const signOut = (baseUrl) => {
+		rotationMap.delete(baseUrl);
+		const signedOut = state.auth.signOut(baseUrl);
+		onSignedOut?.(baseUrl);
+		return signedOut;
+	};
+	const expire = (baseUrl) => {
+		if (state.auth.notifyExpired(baseUrl)) signOut(baseUrl);
+	};
+	const canRefresh = (baseUrl) => state.auth.requireCredentialOf(baseUrl, mode).success;
+	const middleware = (baseUrl) => require_middleware.createBearerAuthMiddleware({ getAccessToken: async ({ forceRefresh = false } = {}) => {
+		if (forceRefresh) return canRefresh(baseUrl) ? require_jobStatus.Result.unwrap(await rotate(baseUrl)) : null;
+		if (!isStale(baseUrl)) return state.auth.getAccessToken(baseUrl);
+		return require_jobStatus.Result.unwrapOr(await rotate(baseUrl), state.auth.getAccessToken(baseUrl));
+	} });
+	return {
+		middleware,
+		rotate,
+		restore,
+		signOut,
+		forget
+	};
+};
+//#endregion
+//#region src/keboola/bearer/state/factories.ts
+/**
+* Everything the table constructs: the entries themselves, and the failures reading them produces.
+*
+* Nothing here touches the store — a factory takes what it is told and returns a value, so the
+* namespaces the tables build on can be read without following a dependency.
+*/
+const projectEntryId = (baseUrl, projectId) => `${baseUrl}#${projectId}`;
+/** What every project entry of one stack shares — the one thing a per-stack teardown matches on. */
+const projectEntryPrefix = (baseUrl) => `${baseUrl}#`;
+const isUnderStack = (baseUrl) => (id) => id.startsWith(projectEntryPrefix(baseUrl));
+const anonymousAuth = () => ({ status: "anonymous" });
+const restoringAuth = () => ({ status: "restoring" });
+const authenticatedAuth = (credential) => ({
+	status: "authenticated",
+	credential
+});
+const bearerCredential = (input) => input.type === "static" ? input : {
+	...input,
+	issuedAt: Date.now()
+};
+const expiredCredential = (credential) => ({
+	...credential,
+	issuedAt: Date.now() - credential.expiresIn * 1e3
+});
+const stack = (baseUrl) => ({
+	baseUrl,
+	context: "idle",
+	epoch: 0,
+	auth: anonymousAuth()
+});
+const project = (baseUrl, projectId) => ({
+	id: projectEntryId(baseUrl, projectId),
+	baseUrl,
+	projectId,
+	context: "idle"
+});
+const stackAddress = (baseUrl) => ({
+	baseUrl,
+	projectId: null
+});
+const projectAddress = (baseUrl, projectId) => ({
+	baseUrl,
+	projectId
+});
+const table = (defaultBaseUrl) => ({
+	active: stackAddress(defaultBaseUrl),
+	stacks: { [defaultBaseUrl]: stack(defaultBaseUrl) },
+	projects: {}
+});
+const Entry = {
+	projectEntryId,
+	isUnderStack,
+	stack,
+	project,
+	stackAddress,
+	projectAddress,
+	table,
+	anonymousAuth,
+	restoringAuth,
+	authenticatedAuth,
+	bearerCredential,
+	expiredCredential
+};
+/**
+* Every failure the table can produce.
+*
+* - The typed ones carry a `KeboolaErrorType` a consumer branches on; the rest are plain `Error`s
+*   whose message names the entry, because nothing branches on them.
+*/
+const Errors = {
+	notAuthenticated: () => new KeboolaError(KeboolaErrorType.NotAuthenticated),
+	stackActive: () => new KeboolaError(KeboolaErrorType.StackActive),
+	/** A stack that was never opened — nothing has been configured for it. */
+	unconfigured: () => new KeboolaError(KeboolaErrorType.Unconfigured),
+	alreadyAuthenticated: () => new KeboolaError(KeboolaErrorType.AlreadyAuthenticated),
+	notReady: () => new KeboolaError(KeboolaErrorType.NotReady),
+	alreadyRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`),
+	notRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`),
+	unexpectedCredentialKind: (baseUrl, kind) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" holds a ${kind} credential`),
+	notRotatingCredential: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" holds a static credential`),
+	credentialKindChanged: (from, to) => /* @__PURE__ */ new Error(`A ${from} credential cannot become ${to}`),
+	missingProject: (id) => /* @__PURE__ */ new Error(`No project "${id}"`)
+};
+const authenticated = (auth) => auth.status === "authenticated" ? require_jobStatus.Result.success(auth.credential) : require_jobStatus.Result.failure(Errors.notAuthenticated());
+//#endregion
+//#region src/keboola/bearer/state/auth.ts
+/**
+* Fire-once per sign-in: the first report of a dead credential returns `true`, the rest `false`,
+* and `authenticate` re-arms it. Held beside the table because it is not state anyone restores.
+*/
+const createExpiryLatch = () => {
+	const notified = /* @__PURE__ */ new Map();
+	return {
+		arm: (baseUrl) => notified.set(baseUrl, false),
+		forget: (baseUrl) => notified.delete(baseUrl),
+		report: (baseUrl) => {
+			if (notified.get(baseUrl)) return false;
+			notified.set(baseUrl, true);
+			return true;
+		}
+	};
+};
+/**
+* The stack's credential and its sign-in pin.
+*
+* - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly "which
+*   sign-in is this" — what an in-flight exchange compares itself against.
+*/
+const createAuth = ({ stacks, projects, expiry }) => {
+	const requireUnauthenticated = (baseUrl) => require_jobStatus.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_jobStatus.Result.failure(Errors.alreadyAuthenticated()) : require_jobStatus.Result.success(stack));
+	const requireAnonymous = (baseUrl) => require_jobStatus.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_jobStatus.Result.failure(Errors.alreadyRestoring(baseUrl)) : require_jobStatus.Result.success(stack));
+	const requireRestoring = (baseUrl) => require_jobStatus.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_jobStatus.Result.success(stack) : require_jobStatus.Result.failure(Errors.notRestoring(baseUrl)));
+	const requireRotatingCredential = (baseUrl) => require_jobStatus.Result.andThen(stacks.requireCredential(baseUrl), (credential) => credential.type === "static" ? require_jobStatus.Result.failure(Errors.notRotatingCredential(baseUrl)) : require_jobStatus.Result.success(credential));
+	const requireCredentialOf = (baseUrl, mode) => require_jobStatus.Result.andThen(requireRotatingCredential(baseUrl), (credential) => credential.type === mode ? require_jobStatus.Result.success(credential) : require_jobStatus.Result.failure(Errors.unexpectedCredentialKind(baseUrl, credential.type)));
+	const startRestore = (baseUrl) => require_jobStatus.Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: Entry.restoringAuth()
+	}));
+	const cancelRestore = (baseUrl) => require_jobStatus.Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: Entry.anonymousAuth()
+	}));
+	const authenticate = (baseUrl, input) => require_jobStatus.Result.map(requireUnauthenticated(baseUrl), (stack) => {
+		expiry.arm(baseUrl);
+		return stacks.set({
+			...stack,
+			epoch: stack.epoch + 1,
+			auth: Entry.authenticatedAuth(Entry.bearerCredential(input))
+		});
+	});
+	const applyRefresh = (baseUrl, input) => require_jobStatus.Result.andThen(requireRotatingCredential(baseUrl), (credential) => credential.type !== input.type ? require_jobStatus.Result.failure(Errors.credentialKindChanged(credential.type, input.type)) : require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: Entry.authenticatedAuth(Entry.bearerCredential(input))
+	})));
+	const forceExpire = (baseUrl) => require_jobStatus.Result.andThen(requireRotatingCredential(baseUrl), (credential) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: Entry.authenticatedAuth(Entry.expiredCredential(credential))
+	})));
+	const signOut = (baseUrl) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => {
+		projects.closeAll(baseUrl);
+		return stacks.set({
+			...stack,
+			epoch: stack.epoch + 1,
+			auth: Entry.anonymousAuth()
+		});
+	});
+	const getEpoch = (baseUrl) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
+	const getAccessToken = (baseUrl) => require_jobStatus.Result.unwrapOr(require_jobStatus.Result.map(stacks.requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
+	return {
+		startRestore,
+		cancelRestore,
+		authenticate,
+		applyRefresh,
+		forceExpire,
+		signOut,
+		notifyExpired: expiry.report,
+		requireCredential: stacks.requireCredential,
+		requireRotatingCredential,
+		requireCredentialOf,
+		getEpoch,
+		getAccessToken
+	};
+};
+//#endregion
+//#region src/keboola/bearer/state/projects.ts
+/** The projects open under a stack, and what authorizes a request to one. */
+const createProjects = ({ store, stacks }) => {
+	const has = (id) => id in store.get().projects;
+	const get = (id) => {
+		const project = store.get().projects[id];
+		return project ? require_jobStatus.Result.success(project) : require_jobStatus.Result.failure(Errors.missingProject(id));
+	};
+	const list = (baseUrl) => Object.values(store.get().projects).filter((project) => project.baseUrl === baseUrl);
+	/** Every open project with this id, whatever stack it sits on — a project number is not unique. */
+	const findAll = (projectId) => Object.values(store.get().projects).filter((project) => project.projectId === projectId);
+	const set = (project) => {
+		const state = store.get();
+		store.set({
+			...state,
+			projects: {
+				...state.projects,
+				[project.id]: project
+			}
+		});
+		return project;
+	};
+	const update = (id, updater) => require_jobStatus.Result.map(get(id), (project) => set(updater(project)));
+	const removeMany = (ids, nextActive) => {
+		const state = store.get();
+		const projects = { ...state.projects };
+		for (const id of ids) delete projects[id];
+		store.set({
+			...state,
+			active: nextActive,
+			projects
+		});
+	};
+	const requireCredential = (id) => require_jobStatus.Result.andThen(get(id), (project) => stacks.requireCredential(project.baseUrl));
+	const open = (baseUrl, projectId) => {
+		const id = Entry.projectEntryId(baseUrl, projectId);
+		if (has(id)) return get(id);
+		return require_jobStatus.Result.map(stacks.requireCredential(baseUrl), () => set(Entry.project(baseUrl, projectId)));
+	};
+	const close = (id) => require_jobStatus.Result.tap(get(id), ({ baseUrl, projectId }) => {
+		const { active } = store.get();
+		const isScoped = active.baseUrl === baseUrl && active.projectId === projectId;
+		removeMany([id], isScoped ? Entry.stackAddress(baseUrl) : active);
+	});
+	/** Every project under a stack, with the scope falling back to the stack itself. */
+	const closeAll = (baseUrl) => {
+		const ids = list(baseUrl).map((project) => project.id);
+		const { active } = store.get();
+		removeMany(ids, active.baseUrl === baseUrl ? Entry.stackAddress(baseUrl) : active);
+	};
+	const updateContext = (id, context) => update(id, (project) => ({
+		...project,
+		context
+	}));
+	return {
+		has,
+		get,
+		list,
+		findAll,
+		set,
+		update,
+		open,
+		close,
+		closeAll,
+		updateContext,
+		requireCredential
+	};
+};
+//#endregion
+//#region src/keboola/bearer/state/scope.ts
+/**
+* What `api.*` addresses: the `active` slot, and the address in it resolved against the tables it
+* points into.
+*
+* The tables never write here — they read `active` through the pure helpers in `address.ts`, so
+* that this can depend on them rather than the other way round.
+*/
+const createScope = ({ store, stacks, projects }) => {
+	const get = () => store.get().active;
+	const isSame = (a, b) => a === b || a.baseUrl === b.baseUrl && a.projectId === b.projectId;
+	const set = (active) => {
+		if (isSame(store.get().active, active)) return;
+		store.set({
+			...store.get(),
+			active
+		});
+	};
+	const locate = (active) => {
+		const stack = stacks.get(active.baseUrl);
+		if (!stack.success) return null;
+		if (active.projectId === null) return {
+			stack: stack.data,
+			project: null
+		};
+		const project = projects.get(Entry.projectEntryId(active.baseUrl, active.projectId));
+		if (!project.success) return null;
+		return {
+			stack: stack.data,
+			project: project.data
+		};
+	};
+	const getActive = () => {
+		const location = locate(get());
+		if (!location) throw new Error(`The scope names no row: ${JSON.stringify(get())}`);
+		return location;
+	};
+	const getActiveStack = () => getActive().stack;
+	const activateStack = (baseUrl) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => {
+		const next = Entry.stackAddress(stack.baseUrl);
+		set(next);
+		return next;
+	});
+	const activateProject = (baseUrl, projectId) => require_jobStatus.Result.map(projects.requireCredential(Entry.projectEntryId(baseUrl, projectId)), () => {
+		const next = Entry.projectAddress(baseUrl, projectId);
+		set(next);
+		return next;
+	});
+	const selectStack = (baseUrl) => {
+		const stack = stacks.ensure(baseUrl);
+		return require_jobStatus.Result.map(activateStack(stack.baseUrl), () => stack);
+	};
+	const selectProject = (projectId) => {
+		const { baseUrl } = getActiveStack();
+		const project = projects.open(baseUrl, projectId);
+		if (!project.success) return project;
+		return require_jobStatus.Result.map(activateProject(baseUrl, projectId), () => project.data);
+	};
+	const deactivate = () => {
+		const active = get();
+		if (active.projectId === null) return;
+		set(Entry.stackAddress(active.baseUrl));
+	};
+	const requireActiveProject = () => {
+		const { project } = getActive();
+		return project ? require_jobStatus.Result.success(project) : require_jobStatus.Result.failure(Errors.notReady());
+	};
+	return {
+		get,
+		getActive,
+		activateStack,
+		activateProject,
+		selectStack,
+		selectProject,
+		deactivate,
+		getActiveStack,
+		requireActiveProject
+	};
+};
+//#endregion
+//#region src/keboola/bearer/state/stacks.ts
+/** One entry per stack: the entries, and the verbs that open and close them. */
+const createStacks = ({ store, forgetExpiry }) => {
+	const has = (baseUrl) => baseUrl in store.get().stacks;
+	const get = (baseUrl) => {
+		const stack = store.get().stacks[baseUrl];
+		return stack ? require_jobStatus.Result.success(stack) : require_jobStatus.Result.failure(Errors.unconfigured());
+	};
+	const list = () => Object.values(store.get().stacks);
+	const set = (stack) => {
+		const state = store.get();
+		store.set({
+			...state,
+			stacks: {
+				...state.stacks,
+				[stack.baseUrl]: stack
+			}
+		});
+		return stack;
+	};
+	const update = (baseUrl, updater) => require_jobStatus.Result.map(get(baseUrl), (stack) => set(updater(stack)));
+	const requireCredential = (baseUrl) => require_jobStatus.Result.andThen(get(baseUrl), (stack) => authenticated(stack.auth));
+	const ensure = (baseUrl) => {
+		const existing = get(baseUrl);
+		if (existing.success) return existing.data;
+		return set(Entry.stack(baseUrl));
+	};
+	const close = (baseUrl) => {
+		const stack = get(baseUrl);
+		if (!stack.success) return stack;
+		const state = store.get();
+		if (state.active.baseUrl === baseUrl) return require_jobStatus.Result.failure(Errors.stackActive());
+		const stacks = { ...state.stacks };
+		delete stacks[baseUrl];
+		const projects = Object.fromEntries(Object.entries(state.projects).filter(([, project]) => project.baseUrl !== baseUrl));
+		store.set({
+			active: state.active,
+			stacks,
+			projects
+		});
+		forgetExpiry(baseUrl);
+		return stack;
+	};
+	const updateContext = (baseUrl, context) => update(baseUrl, (stack) => ({
+		...stack,
+		context
+	}));
+	return {
+		has,
+		get,
+		list,
+		set,
+		update,
+		ensure,
+		close,
+		updateContext,
+		requireCredential
+	};
+};
+//#endregion
+//#region src/keboola/bearer/state/state.ts
+/**
+* The stack table and the rules over it, one namespace per concern.
+*
+* - Built in dependency order: a project reads its stack's credential, and the scope resolves
+*   the active address against both tables.
+*/
+const createState = (defaultBaseUrl) => {
+	const store = require_store.createStore(Entry.table(defaultBaseUrl));
+	const expiry = createExpiryLatch();
+	const stacks = createStacks({
+		store,
+		forgetExpiry: expiry.forget
+	});
+	const projects = createProjects({
+		store,
+		stacks
+	});
+	const scope = createScope({
+		store,
+		stacks,
+		projects
+	});
+	const auth = createAuth({
+		stacks,
+		projects,
+		expiry
+	});
+	return {
+		store: store.asReadable(),
+		stacks,
+		projects,
+		auth,
+		scope
+	};
+};
+//#endregion
+//#region src/keboola/bearer/context/resource.ts
+/**
+* Owns fetching one async value per key — a caller names what it needs and never orchestrates the
+* request. Backs the stack and project contexts.
+*
+* - One fetch per key: concurrent askers share it, a landed value is never refetched.
+* - A failure is held, not thrown away — nothing here needs a rejection handler.
+* - Status lives here and nowhere else; a consumer that has to mirror it subscribes.
+*/
+const createResource = ({ key, fetch }) => {
+	const entries = /* @__PURE__ */ new Map();
+	const changes = require_store.createEmitter();
+	const set = (id, entry) => {
+		entries.set(id, entry);
+		changes.emit({
+			key: id,
+			status: entry.status
+		});
+	};
+	const run = (id, input) => {
+		const settle = (next) => {
+			if (entries.get(id) === entry) set(id, {
+				input,
+				...next
+			});
+			return next;
+		};
+		const attempt = async () => await fetch(input);
+		const entry = {
+			input,
+			status: "pending",
+			settled: attempt().then((value) => settle({
+				status: "ready",
+				value
+			}), (error) => settle({
+				status: "errored",
+				error
+			}))
+		};
+		set(id, entry);
+		return entry;
+	};
+	const get = (id) => {
+		const entry = entries.get(id);
+		return entry?.status === "ready" ? entry.value : null;
+	};
+	const getAsync = async (input) => {
+		const id = key(input);
+		const cached = entries.get(id);
+		const entry = cached === void 0 || cached.status === "errored" ? run(id, input) : cached;
+		const settled = entry.status === "pending" ? await entry.settled : entry;
+		if (settled.status === "errored") throw settled.error;
+		return settled.value;
+	};
+	const forget = (matches) => {
+		for (const id of entries.keys()) if (matches(id)) entries.delete(id);
+	};
+	const prefetch = (input) => {
+		const id = key(input);
+		if (!entries.has(id)) run(id, input);
+	};
+	const retry = (id) => {
+		const entry = entries.get(id);
+		if (entry !== void 0) run(id, entry.input);
+	};
+	return {
+		get,
+		getAsync,
+		prefetch,
+		retry,
+		forget,
+		subscribe: changes.subscribe
+	};
+};
+//#endregion
+//#region src/keboola/bearer/context/project.ts
+const createProjectContext = ({ state, credentials, stackContext }) => {
+	const resource = createResource({
+		key: (project) => project.id,
+		fetch: async ({ baseUrl, projectId }) => {
+			const withProjectId = (next) => (request) => {
+				request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.PROJECT_ID, String(projectId));
+				return next(request);
+			};
+			const client = require_storage.createStorageClient({
+				baseUrl,
+				auth: {
+					type: "bearer",
+					token: "",
+					projectId
+				},
+				middlewares: [(next) => withProjectId(credentials.middleware(baseUrl)(next))]
+			});
+			const [token, devBranches] = await Promise.all([
+				client.tokens.verify(),
+				client.branches.getDevBranches(),
+				stackContext.getAsync(baseUrl)
+			]);
+			return {
+				token,
+				defaultBranch: createDefaultBranch({ devBranches })
+			};
+		}
+	});
+	resource.subscribe(({ key, status }) => {
+		state.projects.updateContext(key, status);
+	});
+	const subscriber = ({ projects }) => {
+		for (const project of Object.values(projects)) resource.prefetch(project);
+	};
+	/**
+	* Dropped with the sign-in that fetched them: a verified token is what a credential answered
+	* for, so it belongs to that credential and not to the project id it was keyed by.
+	*/
+	const forgetUnder = (baseUrl) => resource.forget(Entry.isUnderStack(baseUrl));
+	/** One project, closed on purpose. */
+	const forget = (id) => resource.forget((key) => key === id);
+	return {
+		subscriber,
+		get: resource.get,
+		getAsync: resource.getAsync,
+		retry: resource.retry,
+		forget,
+		forgetUnder
+	};
+};
+//#endregion
+//#region src/keboola/bearer/context/stack.ts
+const createStackContext = (state) => {
+	const resource = createResource({
+		key: (baseUrl) => baseUrl,
+		fetch: (baseUrl) => require_storage.createStorageClient({
+			baseUrl,
+			auth: {
+				type: "sapi-token",
+				token: ""
+			}
+		}).getStackInfo({ exclude: "componentDetails" })
+	});
+	resource.subscribe(({ key, status }) => {
+		state.stacks.updateContext(key, status);
+	});
+	const subscriber = ({ stacks }) => {
+		for (const { baseUrl } of Object.values(stacks)) resource.prefetch(baseUrl);
+	};
+	/** Dropped with the stack itself — a stack that comes back re-reads its index. */
+	const forget = (baseUrl) => resource.forget((key) => key === baseUrl);
+	return {
+		subscriber,
+		get: resource.get,
+		getAsync: resource.getAsync,
+		retry: resource.retry,
+		forget
+	};
+};
+//#endregion
+//#region src/keboola/bearer/perProject.ts
+const once = (build) => {
+	let value = null;
+	return () => value ??= build();
+};
+/**
+* Everything one project derives, and the one call that drops it.
+*
+* Every field belongs to the credential that built it — a client set carries its middleware chain,
+* the storage client holds a `liveProject` seeded with its token, a fetched context *is* what it
+* answered for `tokens.verify` — so the record dies with the sign-in, and `forgetUnder` is the
+* only thing that ends one.
+*/
+const createPerProject = ({ state, credentials, middlewareFor, stack, clientServiceUrls, buildApi }) => {
+	const context = createProjectContext({
+		state,
+		credentials,
+		stackContext: stack.context
+	});
+	const attachFor = ({ baseUrl, projectId }) => {
+		const withProjectId = (next) => (request) => {
+			request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.PROJECT_ID, String(projectId));
+			return next(request);
+		};
+		return (next) => withProjectId(credentials.middleware(baseUrl)(next));
+	};
+	const buildClients = ({ baseUrl, projectId }, attach) => createServiceClients({
+		baseUrl,
+		auth: {
+			type: "bearer",
+			token: "",
+			projectId
+		},
+		getServiceBaseUrl: (serviceId) => async () => {
+			const stackInfo = await stack.context.getAsync(baseUrl);
+			const serviceUrl = createStack({
+				stackInfo,
+				clientServiceUrls
+			}).getServiceUrl(serviceId);
+			assert$1(serviceUrl, KeboolaErrorType.NotReady);
+			return serviceUrl;
+		},
+		middlewareFor,
+		attachTokenMiddleware: attach
+	});
+	/**
+	* `api.storage` and `api.context`, built together: both read one live token — the storage client
+	* carries its re-verify middleware, the context reports the project it re-verifies.
+	*
+	* - Both fetches it reads are already running. `NotReady` covers the window before they land,
+	*   which the table reports as `project.context`.
+	* - `storage` is gated on the stack index too, though it addresses the project's own `baseUrl`
+	*   and does not need it — that is the gate as it stands, not a requirement.
+	*/
+	const buildLive = (project, attach) => {
+		const stackInfo = stack.context.get(project.baseUrl);
+		assert$1(stackInfo, KeboolaErrorType.NotReady);
+		const fetched = context.get(project.id);
+		assert$1(fetched, KeboolaErrorType.NotReady);
+		const { baseUrl, projectId } = project;
+		const auth = {
+			type: "bearer",
+			token: "",
+			projectId
+		};
+		const reader = require_storage.createStorageClient({
+			baseUrl,
+			auth,
+			middlewares: [attach]
+		});
+		const liveProject = createLiveProject({
+			initialToken: fetched.token,
+			verify: () => reader.tokens.verify()
+		});
+		const storageTableStore = createDerivedStore({
+			source: liveProject.store,
+			build: require_storageTable.createStorageTable,
+			dependsOn: (live) => ({
+				useLegacyBucketPrefix: !live.hasFeature(require_constants.ProjectFeature.DisableLegacyBucketPrefix),
+				hasProtectedDefaultBranch: live.hasFeature(require_constants.ProjectFeature.SoxProtectedDefaultBranch),
+				hasStorageBranches: live.hasFeature(require_constants.ProjectFeature.StorageBranches)
+			})
+		});
+		return {
+			storage: require_storage.createStorageClient({
+				baseUrl,
+				auth,
+				middlewares: middlewareFor("storage", [attach, liveProject.middleware])
+			}),
+			context: {
+				baseUrl,
+				stack: createStack({
+					stackInfo,
+					clientServiceUrls
+				}),
+				defaultBranch: fetched.defaultBranch,
+				get project() {
+					return liveProject.getProject();
+				},
+				get st() {
+					return storageTableStore.get();
+				}
+			}
+		};
+	};
+	const build = (project) => {
+		const attach = attachFor(project);
+		const live = once(() => buildLive(project, attach));
+		const clients = once(() => buildClients(project, attach));
+		return {
+			api: buildApi(project),
+			get clients() {
+				return clients();
+			},
+			get storage() {
+				return live().storage;
+			},
+			get context() {
+				return live().context;
+			}
+		};
+	};
+	const derived = /* @__PURE__ */ new Map();
+	const get = (project) => ensure(derived, project.id, () => build(project));
+	/** One project, closed on purpose — a handle for it stops answering from the next read. */
+	const forget = (id) => {
+		derived.delete(id);
+		context.forget(id);
+	};
+	const forgetUnder = (baseUrl) => {
+		const isUnder = Entry.isUnderStack(baseUrl);
+		for (const id of derived.keys()) if (isUnder(id)) derived.delete(id);
+		context.forgetUnder(baseUrl);
+	};
+	return {
+		context,
+		get,
+		forget,
+		forgetUnder
+	};
+};
+//#endregion
+//#region src/keboola/bearer/persistor.ts
+/**
+* Where a bearer session is persisted, under whichever adapter the client was given.
+*
+* Exported because a consumer sometimes has to drop a session a client cannot reach: the adapter is
+* chosen at construction, so a client built without one holds no handle to the storage its own
+* session is sitting in. `AppAuthStrategy` in kbc-ui is that case.
+*/
+const SESSION_STORAGE_KEY = "keboola:session";
+/**
+* What survives a reload, per credential kind.
+*
+* - `token`: the refresh token. It rotates, is single-use and is server-revocable, so a leaked
+*   snapshot has limited and revocable value. The access token is never written.
+* - `static`: the token itself — a long-lived PAT the user pasted, which nothing can re-mint.
+* - `cookie`: the session id. The session cookie is the durable half and the browser keeps it;
+*   the id alone renews nothing.
+*/
+const persistedCredentialSchema = zod.discriminatedUnion("type", [
+	zod.object({
+		type: zod.literal("token"),
+		refreshToken: zod.string()
+	}),
+	zod.object({
+		type: zod.literal("cookie"),
+		sessionId: zod.string()
+	}),
+	zod.object({
+		type: zod.literal("static"),
+		accessToken: zod.string()
+	})
+]);
+/** A record per project rather than a bare id, so a project can grow a field without a migration. */
+const persistedProjectSchema = zod.object({ projectId: zod.number() });
+const persistedSessionSchema = zod.object({
+	current: zod.object({
+		baseUrl: zod.string(),
+		projectId: zod.number().nullable()
+	}).nullable(),
+	stacks: zod.array(zod.object({
+		baseUrl: zod.string(),
+		credential: persistedCredentialSchema.nullable(),
+		projects: zod.array(persistedProjectSchema)
+	}))
+});
+const EMPTY_PERSISTED_SESSION = {
+	current: null,
+	stacks: []
+};
+const durableCredential = (stack) => {
+	if (stack.auth.status !== "authenticated") return null;
+	const { credential } = stack.auth;
+	if (credential.type === "token") return {
+		type: "token",
+		refreshToken: credential.refreshToken
+	};
+	if (credential.type === "cookie") return {
+		type: "cookie",
+		sessionId: credential.sessionId
+	};
+	return {
+		type: "static",
+		accessToken: credential.accessToken
+	};
+};
+const createSessionPersistor = (storage) => {
+	const persistor = createPersistor({
+		storage,
+		key: SESSION_STORAGE_KEY,
+		schema: persistedSessionSchema,
+		defaultValue: EMPTY_PERSISTED_SESSION
+	});
+	const persist = ({ active, stacks, projects }) => persistor.persist({
+		current: {
+			baseUrl: active.baseUrl,
+			projectId: active.projectId
+		},
+		stacks: Object.values(stacks).map((stack) => ({
+			baseUrl: stack.baseUrl,
+			credential: durableCredential(stack),
+			projects: Object.values(projects).filter((project) => project.baseUrl === stack.baseUrl).map(({ projectId }) => ({ projectId }))
+		}))
+	});
+	return {
+		...persistor,
+		persist
+	};
+};
+//#endregion
+//#region src/keboola/bearer/perStack.ts
+/**
+* Everything one stack derives, and the one call that drops it.
+*
+* Outlives a sign-out, unlike anything in `perProject`: both clients read the credential live per
+* request, so neither belongs to one sign-in, and the stack index is public.
+*/
+const createPerStack = ({ state, credentials, middlewareFor }) => {
+	const context = createStackContext(state);
+	const derived = /* @__PURE__ */ new Map();
+	const get = (baseUrl) => ensure(derived, baseUrl, () => ({
+		auth: require_authClient.createAuthClient({
+			baseUrl,
+			middlewares: middlewareFor("auth", [credentials.middleware(baseUrl)])
+		}),
+		management: require_management.createManagementClient({
+			baseUrl,
+			auth: {
+				type: "bearer",
+				token: ""
+			},
+			middlewares: middlewareFor("management", [credentials.middleware(baseUrl)])
+		})
+	}));
+	const forget = (baseUrl) => {
+		derived.delete(baseUrl);
+		context.forget(baseUrl);
+	};
+	return {
+		context,
+		get,
+		forget
+	};
+};
+//#endregion
+//#region src/keboola/bearer/keboola.ts
+/**
+* The bearer client: the session table, its two scopes, and the surface they back.
+*
+* - Credential-derived state is owned by the scope whose end ends it (`perStack`, `perProject`).
+*/
+const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls, credentials: mode = "token" }) => {
+	const state = createState(require_createFetchClient.normalizeBaseUrl(defaultBaseUrl));
+	const persistor = createSessionPersistor(storage);
+	const middlewareFor = createMiddlewareFor(middlewares);
+	const credentials = createCredentials({
+		state,
+		persistor,
+		middlewares: middlewareFor("auth"),
+		mode,
+		onSignedOut: (baseUrl) => perProject.forgetUnder(baseUrl)
+	});
+	const perStack = createPerStack({
+		state,
+		credentials,
+		middlewareFor
+	});
+	const perProject = createPerProject({
+		state,
+		credentials,
+		middlewareFor,
+		stack: perStack,
+		clientServiceUrls,
+		buildApi: (project) => createApiFor({
+			stackUrl: () => project.baseUrl,
+			project: () => require_jobStatus.Result.unwrap(state.projects.get(project.id)),
+			pinned: true
+		})
+	});
+	state.store.subscribe(perStack.context.subscriber);
+	perStack.context.subscriber(state.store.get());
+	state.store.subscribe(perProject.context.subscriber);
+	const selectStack = (baseUrl) => require_jobStatus.Result.unwrap(state.scope.selectStack(require_createFetchClient.normalizeBaseUrl(baseUrl)));
+	const selectProject = (projectId) => require_jobStatus.Result.unwrap(state.scope.selectProject(projectId));
+	/** The scoped stack, or a named one — normalised to key like `select`. */
+	const requireStackUrl = (baseUrl) => baseUrl === void 0 ? state.scope.getActiveStack().baseUrl : require_createFetchClient.normalizeBaseUrl(baseUrl);
+	/** The scoped project, or the row a table id names — on whichever stack that is. */
+	const requireProjectEntry = (id) => id === void 0 ? require_jobStatus.Result.unwrap(state.scope.requireActiveProject()) : require_jobStatus.Result.unwrap(state.projects.get(id));
+	/**
+	* The scoped project, or a named open one.
+	*
+	* - An id is ambiguous across stacks: the active stack decides, else the single one open elsewhere.
+	*/
+	const requireProject = (projectId) => {
+		if (projectId === void 0) return require_jobStatus.Result.unwrap(state.scope.requireActiveProject());
+		const scoped = state.projects.get(Entry.projectEntryId(requireStackUrl(), projectId));
+		if (scoped.success) return scoped.data;
+		const [only, ...rest] = state.projects.findAll(projectId);
+		return only !== void 0 && rest.length === 0 ? only : require_jobStatus.Result.unwrap(scoped);
+	};
+	/**
+	* Auth headers for a non-fetch transport (the chat stream).
+	*
+	* - A read, not a rotation: no middleware recovers a 401 there; the fetch clients keep it fresh.
+	*/
+	const getAuthHeaders = (projectId) => {
+		const project = requireProject(projectId);
+		const credential = require_jobStatus.Result.unwrap(state.auth.requireCredential(project.baseUrl));
+		return {
+			[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${credential.accessToken}`,
+			[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(project.projectId)
+		};
+	};
+	const authenticate = (input) => {
+		const stack = state.scope.getActiveStack();
+		if (input.type !== "static" && input.type !== mode) throw new KeboolaError(KeboolaErrorType.CredentialKindMismatch);
+		if (input.type !== "token") return require_jobStatus.Result.unwrap(state.auth.authenticate(stack.baseUrl, input));
+		const { refreshToken } = input;
+		if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+		return require_jobStatus.Result.unwrap(state.auth.authenticate(stack.baseUrl, {
+			...input,
+			refreshToken
+		}));
+	};
+	/**
+	* The flat product surface: `auth` and `management` per stack, the rest per project.
+	*
+	* - Both resolvers run per property read: that re-points the active handle and makes a pinned
+	*   one throw once its project is gone.
+	*/
+	const createApiFor = (resolve) => new Proxy({}, { get: (_target, property) => {
+		if (isBuiltInProperty(property)) return void 0;
+		if (property === "auth" || property === "management") {
+			if (resolve.pinned) resolve.project();
+			return perStack.get(resolve.stackUrl())[property];
+		}
+		const derived = perProject.get(resolve.project());
+		if (property === "context") return derived.context;
+		if (property === "storage") return derived.storage;
+		const { client, meta } = derived.clients;
+		if (property === "serviceMeta") return meta;
+		return client[property];
+	} });
+	const activeApi = createApiFor({
+		stackUrl: () => state.scope.getActiveStack().baseUrl,
+		project: () => require_jobStatus.Result.unwrap(state.scope.requireActiveProject())
+	});
+	/** The scoped project's surface. Re-points when the scope moves. */
+	const getActiveApi = () => activeApi;
+	/**
+	* One project's surface, on the active stack — one credential serves all of them.
+	*
+	* - Pinned: never re-points; stops once the project closes (`session.project.close`, sign-out).
+	* - Memoised per project: a React `key` or a hook dep compares handles by identity.
+	*/
+	const getApi = (projectId) => {
+		const { baseUrl } = state.scope.getActiveStack();
+		const project = Entry.project(baseUrl, projectId);
+		require_jobStatus.Result.unwrapOr(state.projects.open(baseUrl, projectId), null);
+		return perProject.get(project).api;
+	};
+	/** The scope's sign-in, or a named stack's — and everything that sign-in derived. */
+	const signOut = (baseUrl) => {
+		const target = requireStackUrl(baseUrl);
+		return require_jobStatus.Result.unwrap(credentials.signOut(target));
+	};
+	/**
+	* `input` replaces the active stack's sign-in, whatever it holds.
+	*
+	* - Signs out first, always: a sign-out moves the epoch even on an anonymous stack, so a stored
+	*   session still being restored cannot land on top of this one.
+	*/
+	const replace = (input) => {
+		signOut();
+		return authenticate(input);
+	};
+	/**
+	* A server-injected `token` credential, adopted whatever this client's mode.
+	*
+	* @deprecated Temporary, for the agent-project claim page only: Connection injects an API-mode
+	* session through `UiConfig.programmaticAuth`. Remove together with that injection.
+	*
+	* - Replaces the active stack's sign-in, like `replace`.
+	* - A cookie-mode client never rotates it, so it lasts as long as its access token.
+	*/
+	const adoptInjected = (input) => {
+		signOut();
+		return require_jobStatus.Result.unwrap(state.auth.authenticate(getActiveStack().baseUrl, input));
+	};
+	/**
+	* Leave one project: its row and everything built for it; its handles stop answering.
+	*
+	* - Counterpart of `getApi(projectId)`; without it the project is held and persisted until sign-out.
+	*/
+	const closeProject = (projectId) => {
+		const id = Entry.projectEntryId(requireStackUrl(), projectId);
+		const closed = require_jobStatus.Result.unwrapOr(state.projects.close(id), null);
+		if (closed === null) return null;
+		perProject.forget(id);
+		return closed;
+	};
+	const closeStack = (baseUrl) => {
+		const target = require_createFetchClient.normalizeBaseUrl(baseUrl);
+		if (state.scope.get().baseUrl === target) throw new KeboolaError(KeboolaErrorType.StackActive);
+		const closed = require_jobStatus.Result.unwrapOr(state.stacks.close(target), null);
+		if (closed === null) return null;
+		perProject.forgetUnder(target);
+		perStack.forget(target);
+		credentials.forget(target);
+		return closed;
+	};
+	let persisting = false;
+	/**
+	* Persistence starts only once the restore has settled.
+	*
+	* - Mid-hydration an unexchanged stack is `anonymous`; `durableCredential` would erase the
+	*   refresh token the exchange is about to spend.
+	* - Writes the settled table once: the subscription fires only on the next change.
+	*/
+	const enablePersistence = () => {
+		if (persisting) return;
+		persisting = true;
+		persistor.persist(state.store.get());
+		state.store.subscribe(persistor.persist);
+	};
+	/**
+	* The same, deferred until a sign-in.
+	*
+	* - After an unreachable restore the table is anonymous but the stored token is still good;
+	*   writing earlier would drop it.
+	*/
+	const enablePersistenceOnSignIn = () => {
+		const stop = state.store.subscribe((next) => {
+			if (!Object.values(next.stacks).some(({ auth }) => auth.status === "authenticated")) return;
+			stop();
+			enablePersistence();
+		});
+	};
+	const restore = require_jobStatus.lazy(() => credentials.restore().then((restored) => {
+		if (restored.status === "unreachable") enablePersistenceOnSignIn();
+		else enablePersistence();
+		return restored;
+	}, (error) => {
+		enablePersistenceOnSignIn();
+		throw error;
+	}));
+	const getActiveStack = state.scope.getActiveStack;
+	const isAuthenticated = () => getActiveStack().auth.status === "authenticated";
+	/**
+	* Picks up where the stored session left off, once.
+	*
+	* 1. A stored stack becomes active again, with its project if its credential came back.
+	* 2. Nothing stored, or the restore failed: `defaultBaseUrl` stays active; a failure rethrows.
+	* 3. The caller got there first (a select, sign-in or sign-out): its scope and sign-ins stand.
+	*
+	* - Resolves with the stored credential's fate — only this tells `expired` from `empty`.
+	* - Other stacks still come back, persistence still starts; repeat calls share one promise.
+	*/
+	const resume = require_jobStatus.lazy(() => restore().then(({ lastActive, status }) => {
+		if (!lastActive || callerScoped) return status;
+		const stack = selectStack(lastActive.baseUrl);
+		if (lastActive.projectId !== null && stack.auth.status === "authenticated") selectProject(lastActive.projectId);
+		return status;
+	}));
+	let callerScoped = false;
+	const byCaller = (verb) => (...args) => {
+		callerScoped = true;
+		return verb(...args);
+	};
+	return {
+		getActiveApi,
+		getApi,
+		session: {
+			getState: state.store.get,
+			subscribe: state.store.subscribe,
+			resume,
+			stack: {
+				getActive: getActiveStack,
+				select: byCaller(selectStack),
+				close: closeStack,
+				retryContext: perStack.context.retry,
+				getContext: (baseUrl) => perStack.context.get(requireStackUrl(baseUrl)),
+				getContextAsync: (baseUrl) => perStack.context.getAsync(requireStackUrl(baseUrl))
+			},
+			project: {
+				select: byCaller(selectProject),
+				close: closeProject,
+				deactivate: state.scope.deactivate,
+				retryContext: perProject.context.retry,
+				getContext: (id) => perProject.context.get(id ?? requireProjectEntry().id),
+				getContextAsync: (id) => perProject.context.getAsync(requireProjectEntry(id))
+			},
+			auth: {
+				authenticate: byCaller(authenticate),
+				replace: byCaller(replace),
+				adoptInjected: byCaller(adoptInjected),
+				signOut: byCaller(signOut),
+				/** Whether the active stack holds a credential — `restoring` is not one yet. */
+				isAuthenticated,
+				isAuthenticatedAsync: () => resume().then(isAuthenticated),
+				rotate: (baseUrl) => credentials.rotate(baseUrl).then(require_jobStatus.Result.unwrap),
+				getHeaders: getAuthHeaders
+			}
+		}
+	};
+};
+//#endregion
+//#region src/middlewares/loggingMiddleware.ts
+const CORRELATION_ID_HEADER = "X-Correlation-ID";
+const ALWAYS_REDACTED_HEADERS = [
+	require_createFetchClient.KeboolaHttpHeader.MANAGEMENT_API_TOKEN,
+	require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN,
+	"authorization",
+	"cookie",
+	"set-cookie"
+];
+const ALWAYS_REDACTED_QUERY_PARAMS = /* @__PURE__ */ new Set([
+	"token",
+	"apikey",
+	"api_key",
+	"access_token",
+	"refresh_token",
+	"code",
+	"state",
+	"signature",
+	"sig",
+	"x-amz-signature",
+	"x-amz-credential",
+	"x-amz-security-token",
+	"password",
+	"secret"
+]);
+const REDACTED = "[REDACTED]";
+const getRedactedUrl = (rawUrl) => {
+	const url = new URL(rawUrl);
+	if (url.username) url.username = REDACTED;
+	if (url.password) url.password = REDACTED;
+	url.searchParams.forEach((_value, key) => {
+		if (ALWAYS_REDACTED_QUERY_PARAMS.has(key.toLowerCase())) url.searchParams.set(key, REDACTED);
+	});
+	return url.toString();
+};
+const ensureCorrelationId = (request) => {
+	const correlationId = request.headers.get(CORRELATION_ID_HEADER) ?? require_generateUUID.generateUUID();
+	request.headers.set(CORRELATION_ID_HEADER, correlationId);
+	return correlationId;
+};
+const getRedactedHeaders = (headers, redacted) => {
+	const redactedSet = new Set([...ALWAYS_REDACTED_HEADERS, ...redacted].map((h) => h.toLowerCase()));
+	const result = {};
+	headers.forEach((value, name) => {
+		result[name] = redactedSet.has(name.toLowerCase()) ? REDACTED : value;
+	});
+	return result;
+};
+const getRequestLog = (request, redactedHeaders) => ({
+	url: getRedactedUrl(request.url),
+	headers: getRedactedHeaders(request.headers, redactedHeaders)
+});
+const getResponseLog = (response, redactedHeaders) => ({
+	status: response.status,
+	statusText: response.statusText,
+	headers: getRedactedHeaders(response.headers, redactedHeaders)
+});
+const redactApiError = (error, redactedHeaders) => new require_createFetchClient.ApiError({
+	request: new Request(getRedactedUrl(error.request.url), {
+		method: error.request.method,
+		headers: getRedactedHeaders(error.request.headers, redactedHeaders)
+	}),
+	response: new Response(null, {
+		status: error.response.status,
+		statusText: error.response.statusText,
+		headers: getRedactedHeaders(error.response.headers, redactedHeaders)
+	}),
+	data: error.data
+});
+const formatLog = (level, log) => {
+	const parts = [
+		`[${level.toUpperCase()}]`,
+		`${Math.round(log.durationMs)}ms`,
+		log.method
+	];
+	parts.push(log.request.url);
+	if ("response" in log) parts.push(String(log.response.status));
+	return parts.join(" ");
+};
+const createSafeLogger = (logger, level = "error-only") => {
+	return {
+		info: (log) => {
+			if (level !== "all") return;
+			try {
+				if (logger?.info) {
+					logger.info(log);
+					return;
+				}
+				console.info(formatLog("info", log));
+			} catch {}
+		},
+		error: (log) => {
+			try {
+				if (logger?.error) {
+					logger.error(log);
+					return;
+				}
+				console.error(formatLog("error", log));
+			} catch {}
+		}
+	};
+};
+const createLoggingMiddleware = (options = {}) => {
+	const safeLogger = createSafeLogger(options.logger, options.level);
+	const redactHeaders = options.redactHeaders ?? [];
+	return (next) => async (fetchRequest) => {
+		const correlationId = ensureCorrelationId(fetchRequest.request);
+		const start = performance.now();
+		const method = fetchRequest.request.method.toLowerCase();
+		const requestLog = getRequestLog(fetchRequest.request, redactHeaders);
+		try {
+			const result = await next(fetchRequest);
+			safeLogger.info({
+				correlationId,
+				method,
+				durationMs: performance.now() - start,
+				request: requestLog,
+				response: getResponseLog(result.response, redactHeaders)
+			});
+			return result;
+		} catch (error) {
+			if (error instanceof Error) safeLogger.error({
+				correlationId,
+				method,
+				durationMs: performance.now() - start,
+				request: requestLog,
+				error: require_createFetchClient.isApiError(error) ? redactApiError(error, redactHeaders) : error
+			});
+			throw error;
+		}
+	};
+};
+//#endregion
+//#region src/middlewares/retryMiddleware.ts
+const DEFAULT_MAX_RETRIES = 5;
+const DEFAULT_RETRYABLE_STATUSES = [
+	require_createFetchClient.HttpStatus.INTERNAL_SERVER_ERROR,
+	require_createFetchClient.HttpStatus.BAD_GATEWAY,
+	require_createFetchClient.HttpStatus.SERVICE_UNAVAILABLE,
+	require_createFetchClient.HttpStatus.GATEWAY_TIMEOUT
+];
+const DEFAULT_BACKOFF_FACTOR = .3;
+const defaultShouldRetry = (error) => error instanceof require_createFetchClient.ApiError && DEFAULT_RETRYABLE_STATUSES.includes(error.response.status);
+const createRetryMiddleware = (options) => {
+	const { maxRetries = DEFAULT_MAX_RETRIES, backoffFactor = DEFAULT_BACKOFF_FACTOR, shouldRetry = defaultShouldRetry } = options ?? {};
+	if (!Number.isInteger(maxRetries) || maxRetries < 0) throw new RangeError("maxRetries must be a non-negative integer");
+	if (!Number.isFinite(backoffFactor) || backoffFactor < 0) throw new RangeError("backoffFactor must be a finite non-negative number");
+	return (next) => async (request) => {
+		for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+			return await next({
+				...request,
+				request: request.request.clone()
+			});
+		} catch (error) {
+			if (attempt === maxRetries || !shouldRetry(error, attempt)) throw error;
+			const delayMs = backoffFactor * 1e3 * Math.pow(2, attempt);
+			await require_jobStatus.delay(delayMs, request.request.signal ?? void 0);
+		}
+		throw new Error("unreachable");
+	};
+};
+//#endregion
 exports.ApiError = require_createFetchClient.ApiError;
 exports.HtmlResponseError = require_validateConnectionStatus.HtmlResponseError;
 exports.HttpContentType = require_createFetchClient.HttpContentType;
@@ -1887,6 +2482,7 @@ exports.ManagementClientAuthError = require_ManagementClientAuthError.Management
 exports.QueryJobError = require_QueryJobTimeoutError.QueryJobError;
 exports.QueryJobTimeoutError = require_QueryJobTimeoutError.QueryJobTimeoutError;
 exports.Result = require_jobStatus.Result;
+exports.SESSION_STORAGE_KEY = SESSION_STORAGE_KEY;
 exports.ServiceUnavailableError = require_storage.ServiceUnavailableError;
 exports.SyncActionError = require_SyncActionError.SyncActionError;
 exports.UserError = require_UserError.UserError;
@@ -1917,6 +2513,7 @@ exports.dedupe = require_dedupe.dedupe;
 exports.deepMerge = deepMerge;
 exports.delay = require_jobStatus.delay;
 exports.emitter = require_jobStatus.emitter;
+exports.ensure = ensure;
 exports.failureOf = require_jobStatus.failureOf;
 exports.formatValidationIssues = require_ValidationError.formatValidationIssues;
 exports.generateUUID = require_generateUUID.generateUUID;