@keboola/api-client 55.0.0 → 57.0.0

package/dist/index.cjs

@@ -2,51 +2,51 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-CmQyd0Gu.cjs");
 const require_UserError = require("./UserError-D4P9Tbhf.cjs");
 const require_createFetchClient = require("./createFetchClient-CDKSkd7i.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-ckaHcRx8.cjs");
-const require_storage = require("./storage-BL-TfHp8.cjs");
-const require_ManagementSessionMintError = require("./ManagementSessionMintError-Bc9bc7Ai.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-DpYRsU-e.cjs");
+const require_storage = require("./storage-chxoWtAL.cjs");
+const require_ManagementSessionMintError = require("./ManagementSessionMintError-BCOLLaJi.cjs");
 const require_RowLevelSecurityError = require("./RowLevelSecurityError-RK_NhhAx.cjs");
 const require_QueueJobError = require("./QueueJobError-DruZK3tc.cjs");
 const require_SyncActionError = require("./SyncActionError-mbpVg63X.cjs");
 const require_ValidationError = require("./ValidationError-BXcFX4nD.cjs");
 const require_createGenericFetchClient = require("./createGenericFetchClient-BuYzzV_D.cjs");
 const require_import = require("./import-DHq6q3Fm.cjs");
-const require_authClient = require("./authClient-DspK50e7.cjs");
 const require_collectByOffset = require("./collectByOffset-DgxJ3zT9.cjs");
 const require_concurrent = require("./concurrent-DnTV_ppY.cjs");
 const require_dedupe = require("./dedupe-Bf0gl9TJ.cjs");
-const require_transientRetries = require("./transientRetries-CBorl4Ue.cjs");
-const require_store = require("./store-2OyH1XOP.cjs");
+const require_transientRetries = require("./transientRetries-yVaQgKqP.cjs");
+const require_store = require("./store-7xlVu4qF.cjs");
 const require_tag = require("./tag-A5z4tJn1.cjs");
 const require_generateUUID = require("./generateUUID-DbSTmvVP.cjs");
 const require_isPlainObject = require("./isPlainObject-CcvQt0qB.cjs");
 const require_schemaGuidedMerge = require("./schemaGuidedMerge-C8CqrNGe.cjs");
-const require_management = require("./management-dIMrTTpI.cjs");
-const require_serviceIds = require("./serviceIds-Bg1pWiPE.cjs");
+const require_authClient = require("./authClient-C3KG9hXw.cjs");
+const require_middleware = require("./middleware-DYdDD4O6.cjs");
 const require_kaiMemory = require("./kaiMemory-DZ6hXni_.cjs");
 const require_semanticLayer = require("./semanticLayer-BVpdWKJn.cjs");
 const require_sdk_vault_index = require("./sdk/vault/index.cjs");
 const require_ai_index = require("./ai/index.cjs");
-const require_apps = require("./apps-C1x5IKNQ.cjs");
+const require_apps = require("./apps-BA9JRLAZ.cjs");
 const require_billing_index = require("./billing/index.cjs");
 const require_chat_index = require("./chat/index.cjs");
 const require_componentsMcp = require("./componentsMcp-DXu-0Qt-.cjs");
 const require_dataScience_index = require("./dataScience/index.cjs");
 const require_editor_index = require("./editor/index.cjs");
 const require_encryption_index = require("./encryption/index.cjs");
-const require_kaiAgent = require("./kaiAgent-De2T6G4G.cjs");
+const require_kaiAgent = require("./kaiAgent-Q00g6S1v.cjs");
 const require_metastore = require("./metastore-CV4DUDxP.cjs");
 const require_notifications_index = require("./notifications/index.cjs");
 const require_oauth = require("./oauth-CEW2AvDV.cjs");
 const require_omnisearch_index = require("./omnisearch/index.cjs");
-const require_queryService = require("./queryService-C3BQ6GKW.cjs");
-const require_queue = require("./queue-J2uXzXR9.cjs");
+const require_queryService = require("./queryService-CECWubS0.cjs");
+const require_queue = require("./queue-PmTfoniJ.cjs");
 const require_scheduler_index = require("./scheduler/index.cjs");
 const require_stream_index = require("./stream/index.cjs");
 const require_syncActions = require("./syncActions-B9JTiSao.cjs");
+const require_serviceIds = require("./serviceIds-Bg1pWiPE.cjs");
 const require_telemetry_index = require("./telemetry/index.cjs");
 const require_vault_index = require("./vault/index.cjs");
-const require_middleware = require("./middleware-vIaPDtQI.cjs");
+const require_management = require("./management-Dqrc516s.cjs");
 const require_project = require("./project-BQ2oD6IW.cjs");
 const require_queryService$1 = require("./queryService-B4h1Ez44.cjs");
 let zod = require("zod");
@@ -61,24 +61,14 @@ const KeboolaErrorType = {
 	NotAuthenticated: "not-authenticated",
 	SignInEnded: "sign-in-ended",
 	AlreadyAuthenticated: "already-authenticated",
-	NoStorageToken: "no-storage-token",
-	NoManagementToken: "no-management-token",
-	MissingProject: "missing-project",
-	NotBearer: "not-bearer",
-	NotReady: "not-ready",
-	InvalidBuildTransition: "invalid-build-transition"
+	NotReady: "not-ready"
 };
 const MESSAGES = {
-	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
+	[KeboolaErrorType.Unconfigured]: "This stack has not been selected — call session.stack.select(baseUrl) first.",
 	[KeboolaErrorType.NotAuthenticated]: "The session is not authenticated — sign in first.",
 	[KeboolaErrorType.SignInEnded]: "The sign-in this operation started under has ended — its result belongs to nobody.",
-	[KeboolaErrorType.AlreadyAuthenticated]: "The session is already authenticated — reset before authenticating again.",
-	[KeboolaErrorType.NoStorageToken]: "No storage token — authenticate the storage realm first.",
-	[KeboolaErrorType.NoManagementToken]: "No management token — authenticate the management realm first.",
-	[KeboolaErrorType.MissingProject]: "A bearer storage session requires a project — call setProject(projectId) first.",
-	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
-	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
-	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed."
+	[KeboolaErrorType.AlreadyAuthenticated]: "This stack is already signed in — sign out or use auth.replace first.",
+	[KeboolaErrorType.NotReady]: "The stack index has not loaded yet."
 };
 var KeboolaError = class KeboolaError extends Error {
 	type;
@@ -143,109 +133,6 @@ const coalesce = (task) => {
 		return waiter.promise;
 	};
 };
-// src/utils/store/derivedStore.ts
-const isPlainObjectOrArray = (value) => {
-	if (Array.isArray(value)) return true;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-};
-const shallowEqual = (a, b) => {
-	if (Object.is(a, b)) return true;
-	if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) return false;
-	if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;
-	const aKeys = Object.keys(a);
-	const bKeys = Object.keys(b);
-	return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));
-};
-const createDerivedStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
-	let key = dependsOn(source.get());
-	const store = require_store.createStore(build(key));
-	const unsubscribe = source.subscribe((state) => {
-		const next = dependsOn(state);
-		if (keyEquals(key, next)) return;
-		key = next;
-		store.set(build(next));
-	});
-	const get = store.get;
-	const subscribe = store.subscribe;
-	const dispose = () => {
-		unsubscribe();
-		store.dispose();
-	};
-	return {
-		get,
-		subscribe,
-		dispose
-	};
-};
-// src/utils/store/derivedAsyncStore.ts
-const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
-	const store = require_store.createStore({ state: "idle" });
-	let currentKey = null;
-	let generation = 0;
-	let controller = null;
-	const run = (key) => {
-		controller?.abort();
-		controller = new AbortController();
-		const runGeneration = ++generation;
-		store.set({ state: "pending" });
-		build(key, controller.signal).then((value) => {
-			if (runGeneration === generation) store.set({
-				state: "ready",
-				value
-			});
-		}, (error) => {
-			if (runGeneration === generation) store.set({
-				state: "errored",
-				error
-			});
-		});
-	};
-	const sync = (state) => {
-		const next = dependsOn(state);
-		if (next === null) {
-			if (currentKey === null) return;
-			controller?.abort();
-			controller = null;
-			generation += 1;
-			currentKey = null;
-			store.set({ state: "idle" });
-			return;
-		}
-		if (currentKey !== null && keyEquals(currentKey, next)) return;
-		currentKey = next;
-		run(next);
-	};
-	sync(source.get());
-	const unsubscribe = source.subscribe(sync);
-	const get = store.get;
-	const subscribe = store.subscribe;
-	const dispose = () => {
-		controller?.abort();
-		unsubscribe();
-		store.dispose();
-	};
-	const readable = {
-		get,
-		subscribe,
-		dispose
-	};
-	const settled = () => new Promise((resolve) => {
-		let unsubscribeSettled = () => {};
-		const check = (state) => {
-			if (state.state === "ready" || state.state === "errored") {
-				unsubscribeSettled();
-				resolve(state);
-			}
-		};
-		unsubscribeSettled = store.subscribe(check);
-		check(store.get());
-	});
-	return {
-		store: readable,
-		settled
-	};
-};
 // src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
 const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "requesting" && snapshot.state !== "polling";
@@ -457,721 +344,175 @@ const createPersistor = ({ storage = createNullStorage(), key, schema, defaultVa
 		locked
 	};
 };
-// src/serviceClientRegistry/utils.ts
-const isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
-/**
-* Creates a dummy client that intercepts method calls and invokes the provided onCall callback.
-*/
-const createDummyClient = ({ onCall }) => {
-	const createProxy = (path = []) => new Proxy(() => {}, {
-		get: (_target, prop) => {
-			if (isBuiltInProperty(prop)) return void 0;
-			return createProxy([...path, prop]);
-		},
-		apply: (_target, _thisArgs, args) => onCall(path, args)
-	});
-	return createProxy();
-};
-// src/serviceClientRegistry/createServiceClientRegistry.ts
-const createServiceClientRegistry = () => ({ getServiceBaseUrl, onUnavailable }) => {
-	const dummy = (serviceId, clientName) => createDummyClient({ onCall: (path, args) => {
-		onUnavailable?.({
-			serviceId,
-			path,
-			args,
-			clientName
-		});
-	} });
-	const configs = [];
-	const resolveClient = ({ serviceId, clientFn, clientName }) => {
-		const serviceBaseUrl = getServiceBaseUrl(serviceId);
-		return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);
-	};
-	const registry = {
-		add: (config) => {
-			configs.push(config);
-			return registry;
-		},
-		build: () => {
-			const clientMap = {};
-			const clientMeta = [];
-			configs.forEach((config) => {
-				clientMap[config.clientName] = resolveClient(config);
-				clientMeta.push({
-					clientName: config.clientName,
-					serviceId: config.serviceId,
-					isAvailable: !!getServiceBaseUrl(config.serviceId)
-				});
-			});
-			return {
-				client: clientMap,
-				meta: clientMeta
-			};
-		}
-	};
-	return registry;
-};
-// src/keboola/createApi.ts
-const createApi = (state) => new Proxy({}, { get(_target, property) {
-	if (isBuiltInProperty(property)) return void 0;
-	if (property === "auth") {
-		const authClient = state.getAuthClient();
-		assert$1(authClient, KeboolaErrorType.Unconfigured);
-		return authClient;
-	}
-	if (property === "management") {
-		const management = state.getManagementClient();
-		assert$1(management, KeboolaErrorType.NoManagementToken);
-		return management;
-	}
-	const clients = state.getProjectClients();
-	assert$1(clients, KeboolaErrorType.NotReady);
-	return clients[property];
-} });
 // src/keboola/createMiddlewareFor.ts
 const createMiddlewareFor = (middlewares) => {
 	return (target, baseline = []) => {
 		if (Array.isArray(middlewares)) return [...baseline, ...middlewares];
-		const all = middlewares?.all ?? [];
-		const targeted = middlewares?.[target] ?? [];
-		return [
-			...baseline,
-			...all,
-			...targeted
-		];
+		return [...baseline, ...middlewares?.[target] ?? []];
 	};
 };
-// src/keboola/legacy/createConfig.ts
-const createConfig = () => {
-	const store = require_store.createStore({
-		baseUrl: null,
-		sapiToken: null,
-		managementToken: null
-	});
-	const setBaseUrl = (baseUrl) => {
-		store.set({
-			...store.get(),
-			baseUrl
+// src/keboola/state/auth.ts
+const grantOf = (credential) => credential.type === "token" ? {
+	type: "token",
+	refreshToken: credential.refreshToken
+} : {
+	type: "cookie",
+	sessionId: credential.sessionId
+};
+const stamped = (input) => ({
+	...input,
+	issuedAt: Date.now()
+});
+const credentialOf = (auth) => auth.status === "authenticated" ? require_transientRetries.Result.success(auth.credential) : require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.NotAuthenticated));
+/**
+* The stack's credential and its sign-in pin.
+*
+* - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly "which
+*   sign-in is this" — what an in-flight exchange compares itself against.
+*/
+const createAuth = (stacks) => {
+	const expired = /* @__PURE__ */ new Set();
+	const requireCredential = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => credentialOf(stack.auth));
+	const requireUnauthenticated = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.AlreadyAuthenticated)) : require_transientRetries.Result.success(stack));
+	const requireAnonymous = (baseUrl) => require_transientRetries.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`)) : require_transientRetries.Result.success(stack));
+	const requireRestoring = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`)));
+	const startRestore = (baseUrl) => require_transientRetries.Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: { status: "restoring" }
+	}));
+	const cancelRestore = (baseUrl) => require_transientRetries.Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: { status: "anonymous" }
+	}));
+	const authenticate = (baseUrl, input) => require_transientRetries.Result.map(requireUnauthenticated(baseUrl), (stack) => {
+		expired.delete(baseUrl);
+		return stacks.set({
+			...stack,
+			epoch: stack.epoch + 1,
+			auth: {
+				status: "authenticated",
+				credential: stamped(input)
+			},
+			retained: null
 		});
-	};
-	const authenticate = (tokens) => {
-		const current = store.get();
-		store.set({
-			...current,
-			sapiToken: tokens.sapiToken ?? current.sapiToken,
-			managementToken: tokens.managementToken ?? current.managementToken
+	});
+	const applyRefresh = (baseUrl, input) => require_transientRetries.Result.andThen(requireCredential(baseUrl), (credential) => credential.type !== input.type ? require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`A ${credential.type} grant cannot become ${input.type}`)) : require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: {
+			status: "authenticated",
+			credential: stamped(input)
+		}
+	})));
+	const forceExpire = (baseUrl) => require_transientRetries.Result.andThen(requireCredential(baseUrl), (credential) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: {
+			status: "authenticated",
+			credential: {
+				...credential,
+				issuedAt: Date.now() - credential.expiresIn * 1e3
+			}
+		}
+	})));
+	const signOut = (baseUrl, { retain = false } = {}) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => {
+		const retained = retain ? require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(credentialOf(stack.auth), (credential) => ({ grant: grantOf(credential) })), stack.retained) : null;
+		return stacks.set({
+			...stack,
+			epoch: stack.epoch + 1,
+			auth: { status: "anonymous" },
+			retained
 		});
-	};
-	const getStorageToken = () => store.get().sapiToken ?? "";
-	const setStorageToken = (sapiToken) => store.set({
-		...store.get(),
-		sapiToken
 	});
-	/** Current state, for diagnostics. */
-	const debug = () => store.get();
+	const retain = (baseUrl, retained) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained
+	}));
+	const dropRetained = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained: null
+	}));
+	const requireRetained = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? require_transientRetries.Result.success(stack.retained) : require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`)));
+	const notifyExpired = (baseUrl) => {
+		if (expired.has(baseUrl)) return false;
+		expired.add(baseUrl);
+		return true;
+	};
+	const getEpoch = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
+	const getAccessToken = (baseUrl) => require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
 	return {
-		store,
-		setBaseUrl,
+		startRestore,
+		cancelRestore,
 		authenticate,
-		getStorageToken,
-		setStorageToken,
-		debug
+		applyRefresh,
+		forceExpire,
+		signOut,
+		retain,
+		dropRetained,
+		requireRetained,
+		notifyExpired,
+		requireCredential,
+		getEpoch,
+		getAccessToken
 	};
 };
-// src/domain/stack.ts
-const isServiceId = (id) => Object.values(require_serviceIds.ServiceId).includes(id);
-const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
-const createStack = ({ stackInfo, clientServiceUrls }) => {
-	const { services, components, features, ...infoRest } = stackInfo;
-	const serviceMap = new Map(services.map((service) => {
-		if (!isServiceId(service.id)) return [service.id, service.url];
-		const devOverride = clientServiceUrls?.[service.id]?.(service.url);
-		const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
-		const url = devOverride ?? prodOverride ?? service.url;
-		return [service.id, url];
-	}));
-	const componentMap = new Map(components.map((component) => [component.id, component]));
-	const featureSet = new Set(features);
-	const hasFeature = (...feature) => {
-		if (feature.length === 0) return false;
-		return feature.every((x) => featureSet.has(x));
+// src/keboola/state/stacks.ts
+const newStack = (baseUrl) => ({
+	baseUrl,
+	context: "idle",
+	epoch: 0,
+	auth: { status: "anonymous" },
+	retained: null
+});
+/** One entry per stack, and the verbs that open and select them. */
+const createStacks = (store) => {
+	const get = (baseUrl) => {
+		const stack = store.get().stacks[baseUrl];
+		return stack ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.Unconfigured));
 	};
-	const hasComponent = (...componentId) => {
-		if (componentId.length === 0) return false;
-		return componentId.every((x) => componentMap.has(x));
+	const set = (stack) => {
+		const state = store.get();
+		store.set({
+			...state,
+			stacks: {
+				...state.stacks,
+				[stack.baseUrl]: stack
+			}
+		});
+		return stack;
 	};
-	const getComponent = (componentId) => componentMap.get(componentId) ?? null;
-	const hasService = (serviceId) => serviceMap.has(serviceId);
-	const getServiceUrl = (serviceId) => serviceMap.get(serviceId) ?? null;
+	const ensure = (baseUrl) => {
+		const existing = get(baseUrl);
+		if (existing.success) return existing.data;
+		return set(newStack(baseUrl));
+	};
+	const getActive = () => {
+		const { active } = store.get();
+		const stack = get(active);
+		if (!stack.success) throw new Error(`The active stack has no row: ${active}`);
+		return stack.data;
+	};
+	const select = (baseUrl) => {
+		const stack = ensure(baseUrl);
+		const state = store.get();
+		if (state.active !== baseUrl) store.set({
+			...state,
+			active: baseUrl
+		});
+		return stack;
+	};
+	const updateContext = (baseUrl, context) => require_transientRetries.Result.map(get(baseUrl), (stack) => set({
+		...stack,
+		context
+	}));
 	return {
-		...infoRest,
-		services,
-		features,
-		components,
-		hasFeature,
-		getServiceUrl,
-		hasService,
-		getComponent,
-		hasComponent
+		get,
+		set,
+		ensure,
+		getActive,
+		select,
+		updateContext
 	};
 };
-// src/sdks/variables/variablesSdk.ts
-const VARIABLES_COMPONENT_ID = "keboola.variables";
-/** Union the definitions by name; on a name conflict the target's definition is kept. */
-const mergeVariableDefinitions = (target, source) => {
-	const targetNames = new Set(target.map((definition) => definition.name));
-	return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];
-};
-/** Add values missing in the target; on a name conflict the value is updated to the source's. */
-const mergeVariableValues = (target, source) => {
-	const sourceByName = new Map(source.map((value) => [value.name, value.value]));
-	const targetNames = new Set(target.map((value) => value.name));
-	return [...target.map((value) => sourceByName.has(value.name) ? {
-		...value,
-		value: sourceByName.get(value.name)
-	} : value), ...source.filter((value) => !targetNames.has(value.name))];
-};
-/**
-* Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh
-* one (union definitions, upsert values — source wins on a name conflict). Each result is a brand
-* new config + values row, so the caller can reference it without sharing lineage with the source.
-*/
-const createVariablesSdk = ({ storageClient }) => {
-	const configs = storageClient.configurations;
-	const rows = storageClient.configurationRows;
-	const readVariables = async (configId, valuesRowId, branchId) => {
-		const config = await configs.getConfiguration({
-			componentId: VARIABLES_COMPONENT_ID,
-			configId,
-			branchId
-		});
-		const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];
-		const rawDefinitions = config.configuration?.variables;
-		const rawValues = row?.configuration?.values;
-		return {
-			definitions: Array.isArray(rawDefinitions) ? rawDefinitions : [],
-			values: Array.isArray(rawValues) ? rawValues : []
-		};
-	};
-	const createVariables = async (definitions, values, branchId) => {
-		const config = await configs.createConfiguration({
-			branchId,
-			componentId: VARIABLES_COMPONENT_ID,
-			name: "Variables definition",
-			configuration: { variables: definitions }
-		});
-		try {
-			const row = await rows.createConfigurationRow({
-				branchId: String(branchId),
-				componentId: VARIABLES_COMPONENT_ID,
-				configurationId: config.id,
-				name: "Default values",
-				configuration: { values }
-			});
-			return {
-				variablesId: config.id,
-				variablesValuesId: row.id
-			};
-		} catch (error) {
-			await configs.deleteConfiguration({
-				branchId,
-				componentId: VARIABLES_COMPONENT_ID,
-				configId: config.id
-			}).catch((cleanupError) => {
-				if (error instanceof Error && error.cause === void 0) error.cause = cleanupError;
-			});
-			throw error;
-		}
-	};
-	return {
-		/** Copy a variables config into a fresh, independent config + values row. */
-		copy: async ({ variablesId, variablesValuesId, branchId = "default" }) => {
-			const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);
-			return createVariables(definitions, values, branchId);
-		},
-		/** Merge the source's variables into the target's and create a fresh merged config + values row. */
-		merge: async ({ targetVariablesId, targetValuesId, sourceVariablesId, sourceValuesId, branchId = "default" }) => {
-			const [target, source] = await Promise.all([readVariables(targetVariablesId, targetValuesId, branchId), readVariables(sourceVariablesId, sourceValuesId, branchId)]);
-			return createVariables(mergeVariableDefinitions(target.definitions, source.definitions), mergeVariableValues(target.values, source.values), branchId);
-		}
-	};
-};
-// src/keboola/createSdk.ts
-const createSdk = ({ storage, services }) => ({
-	tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
-	semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
-	kaiMemory: require_kaiMemory.createKaiMemorySdk({ metastoreClient: services.metastore }),
-	vault: require_sdk_vault_index.createVaultSdk({
-		vaultClient: services.vault,
-		encryptionClient: services.encryption
-	}),
-	variables: createVariablesSdk({ storageClient: storage })
-});
-// src/keboola/createServiceClients.ts
-const withPath = (serviceBaseUrl, path) => typeof serviceBaseUrl === "string" ? `${serviceBaseUrl}${path}` : async () => `${await serviceBaseUrl()}${path}`;
-const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
-	getServiceBaseUrl,
-	onUnavailable: ({ serviceId, path, clientName }) => {
-		throw new require_storage.ServiceUnavailableError(serviceId, path, clientName);
-	}
-}).add({
-	serviceId: "vault",
-	clientName: "vault",
-	clientFn: (serviceBaseUrl) => require_vault_index.createVaultClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("vault", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "data-science",
-	clientName: "dataScience",
-	clientFn: (serviceBaseUrl) => require_dataScience_index.createDataScienceClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("dataScience", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "data-science",
-	clientName: "apps",
-	clientFn: (serviceBaseUrl) => require_apps.createAppsClient({
-		baseUrl: withPath(serviceBaseUrl, "/v2"),
-		middlewares: middlewareFor("apps", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "encryption",
-	clientName: "encryption",
-	clientFn: (serviceBaseUrl) => require_encryption_index.createEncryptionClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("encryption")
-	})
-}).add({
-	serviceId: "editor",
-	clientName: "editor",
-	clientFn: (serviceBaseUrl) => require_editor_index.createEditorClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("editor", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "sync-actions",
-	clientName: "syncActions",
-	clientFn: (serviceBaseUrl) => require_syncActions.createSyncActionsClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("syncActions", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "telemetry",
-	clientName: "telemetry",
-	clientFn: (serviceBaseUrl) => require_telemetry_index.createTelemetryClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("telemetry", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "query",
-	clientName: "queryService",
-	clientFn: (serviceBaseUrl) => require_queryService.createQueryServiceClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("queryService", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "queue",
-	clientName: "queue",
-	clientFn: (serviceBaseUrl) => require_queue.createQueueClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("queue", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "kai-assistant",
-	clientName: "chat",
-	clientFn: (serviceBaseUrl) => require_chat_index.createChatClient({
-		storageApiUrl: baseUrl,
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("chat", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "ai",
-	clientName: "ai",
-	clientFn: (serviceBaseUrl) => require_ai_index.createAiClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("ai", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "ai",
-	clientName: "omnisearch",
-	clientFn: (serviceBaseUrl) => require_omnisearch_index.createOmnisearchClient({
-		baseUrl: withPath(serviceBaseUrl, "/omnisearch"),
-		middlewares: middlewareFor("omnisearch", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "import",
-	clientName: "import",
-	clientFn: (serviceBaseUrl) => require_import.createImportClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("import", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "kai-agent",
-	clientName: "kaiAgent",
-	clientFn: (serviceBaseUrl) => require_kaiAgent.createKaiAgentClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "components-mcp",
-	clientName: "componentsMcp",
-	clientFn: (serviceBaseUrl) => require_componentsMcp.createComponentsMcpClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("componentsMcp", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "oauth",
-	clientName: "oauth",
-	clientFn: (serviceBaseUrl) => require_oauth.createOauthClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("oauth", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "scheduler",
-	clientName: "scheduler",
-	clientFn: (serviceBaseUrl) => require_scheduler_index.createSchedulerClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("scheduler", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "stream",
-	clientName: "stream",
-	clientFn: (serviceBaseUrl) => require_stream_index.createStreamClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("stream", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "notification",
-	clientName: "notifications",
-	clientFn: (serviceBaseUrl) => require_notifications_index.createNotificationsClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("notifications", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "billing",
-	clientName: "billing",
-	clientFn: (serviceBaseUrl) => require_billing_index.createBillingClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("billing", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "metastore",
-	clientName: "metastore",
-	clientFn: (serviceBaseUrl) => require_metastore.createMetastoreClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("metastore", [attachTokenMiddleware]),
-		auth
-	})
-}).build();
-// src/keboola/legacy/createProjectClients.ts
-const createAttachStorageToken = (getToken) => (next) => (request) => {
-	request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());
-	return next(request);
-};
-const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRefreshed, middlewareFor, clientServiceUrls }) => {
-	const auth = {
-		type: "sapi-token",
-		token: getStorageToken()
-	};
-	const attach = createAttachStorageToken(getStorageToken);
-	const stackInfo = await require_storage.createStorageClient({
-		baseUrl,
-		auth,
-		middlewares: [attach]
-	}).getStackInfo({ exclude: "componentDetails" });
-	const stack = createStack({
-		stackInfo,
-		clientServiceUrls
-	});
-	const storage = require_storage.createStorageClient({
-		baseUrl,
-		auth,
-		middlewares: middlewareFor("storage", []),
-		onRefreshToken: onStorageTokenRefreshed
-	});
-	const { client: services, meta: serviceMeta } = createServiceClients({
-		baseUrl,
-		auth,
-		getServiceBaseUrl: stack.getServiceUrl,
-		middlewareFor,
-		attachTokenMiddleware: attach
-	});
-	return {
-		baseUrl: require_createFetchClient.normalizeBaseUrl(baseUrl),
-		stack,
-		serviceMeta,
-		storage,
-		...services,
-		sdk: createSdk({
-			storage,
-			services
-		})
-	};
-};
-// src/keboola/legacy/keboola.ts
-const createLegacyKeboola = (options = {}) => {
-	const config = createConfig();
-	const middlewareFor = createMiddlewareFor(options.middlewares);
-	const authClient = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => state.baseUrl,
-		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
-			baseUrl,
-			middlewares: middlewareFor("auth", [])
-		}) : null
-	});
-	const management = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => ({
-			baseUrl: state.baseUrl,
-			token: state.managementToken
-		}),
-		build: ({ baseUrl, token }) => baseUrl ? require_management.createManagementClient({
-			baseUrl,
-			auth: token ? {
-				type: "management-token",
-				token
-			} : { type: "management-token" },
-			middlewares: middlewareFor("management", [])
-		}) : null
-	});
-	const build = createDerivedAsyncStore({
-		source: config.store,
-		dependsOn: (state) => state.sapiToken && state.baseUrl ? state.baseUrl : null,
-		build: (baseUrl) => createProjectClients({
-			baseUrl,
-			getStorageToken: config.getStorageToken,
-			onStorageTokenRefreshed: config.setStorageToken,
-			middlewareFor,
-			clientServiceUrls: options.clientServiceUrls
-		})
-	});
-	if (options.baseUrl) config.setBaseUrl(options.baseUrl);
-	const debug = () => {
-		const info = config.debug();
-		return {
-			type: "Sapi",
-			config: info,
-			authReady: authClient.get() !== null,
-			managementReady: !!info.managementToken,
-			storage: build.store.get().state
-		};
-	};
-	const session = {
-		setBaseUrl: config.setBaseUrl,
-		isStorageReady: () => build.store.get().state === "ready",
-		authenticateStorage: (sapiToken) => config.authenticate({ sapiToken }),
-		authenticateStorageAsync: async (sapiToken) => {
-			config.authenticate({ sapiToken });
-			await build.settled();
-		},
-		authenticateManagement: (managementToken) => config.authenticate({ managementToken }),
-		subscribe: (listener) => {
-			const unsubscribeConfig = config.store.subscribe(() => listener(debug()));
-			const unsubscribeBuild = build.store.subscribe(() => listener(debug()));
-			return () => {
-				unsubscribeConfig();
-				unsubscribeBuild();
-			};
-		},
-		debug
-	};
-	return {
-		api: createApi({
-			getAuthClient: () => authClient.get(),
-			getManagementClient: () => management.get(),
-			getProjectClients: () => {
-				const state = build.store.get();
-				return state.state === "ready" ? state.value : null;
-			}
-		}),
-		session
-	};
-};
-// src/keboola/bearer/state/auth.ts
-const grantOf = (credential) => credential.type === "token" ? {
-	type: "token",
-	refreshToken: credential.refreshToken
-} : {
-	type: "cookie",
-	sessionId: credential.sessionId
-};
-const stamped = (input) => ({
-	...input,
-	issuedAt: Date.now()
-});
-const credentialOf = (auth) => auth.status === "authenticated" ? require_transientRetries.Result.success(auth.credential) : require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.NotAuthenticated));
-/**
-* The stack's credential and its sign-in pin.
-*
-* - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly "which
-*   sign-in is this" — what an in-flight exchange compares itself against.
-*/
-const createAuth = (stacks) => {
-	const expired = /* @__PURE__ */ new Set();
-	const requireCredential = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => credentialOf(stack.auth));
-	const requireUnauthenticated = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.AlreadyAuthenticated)) : require_transientRetries.Result.success(stack));
-	const requireAnonymous = (baseUrl) => require_transientRetries.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`)) : require_transientRetries.Result.success(stack));
-	const requireRestoring = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`)));
-	const startRestore = (baseUrl) => require_transientRetries.Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: { status: "restoring" }
-	}));
-	const cancelRestore = (baseUrl) => require_transientRetries.Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: { status: "anonymous" }
-	}));
-	const authenticate = (baseUrl, input) => require_transientRetries.Result.map(requireUnauthenticated(baseUrl), (stack) => {
-		expired.delete(baseUrl);
-		return stacks.set({
-			...stack,
-			epoch: stack.epoch + 1,
-			auth: {
-				status: "authenticated",
-				credential: stamped(input)
-			},
-			retained: null
-		});
-	});
-	const applyRefresh = (baseUrl, input) => require_transientRetries.Result.andThen(requireCredential(baseUrl), (credential) => credential.type !== input.type ? require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`A ${credential.type} grant cannot become ${input.type}`)) : require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: {
-			status: "authenticated",
-			credential: stamped(input)
-		}
-	})));
-	const forceExpire = (baseUrl) => require_transientRetries.Result.andThen(requireCredential(baseUrl), (credential) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: {
-			status: "authenticated",
-			credential: {
-				...credential,
-				issuedAt: Date.now() - credential.expiresIn * 1e3
-			}
-		}
-	})));
-	const signOut = (baseUrl, { retain = false } = {}) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => {
-		const retained = retain ? require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(credentialOf(stack.auth), (credential) => ({ grant: grantOf(credential) })), stack.retained) : null;
-		return stacks.set({
-			...stack,
-			epoch: stack.epoch + 1,
-			auth: { status: "anonymous" },
-			retained
-		});
-	});
-	const retain = (baseUrl, retained) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		retained
-	}));
-	const dropRetained = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		retained: null
-	}));
-	const requireRetained = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? require_transientRetries.Result.success(stack.retained) : require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`)));
-	const notifyExpired = (baseUrl) => {
-		if (expired.has(baseUrl)) return false;
-		expired.add(baseUrl);
-		return true;
-	};
-	const getEpoch = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
-	const getAccessToken = (baseUrl) => require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
-	return {
-		startRestore,
-		cancelRestore,
-		authenticate,
-		applyRefresh,
-		forceExpire,
-		signOut,
-		retain,
-		dropRetained,
-		requireRetained,
-		notifyExpired,
-		requireCredential,
-		getEpoch,
-		getAccessToken
-	};
-};
-// src/keboola/bearer/state/stacks.ts
-const newStack = (baseUrl) => ({
-	baseUrl,
-	context: "idle",
-	epoch: 0,
-	auth: { status: "anonymous" },
-	retained: null
-});
-/** One entry per stack, and the verbs that open and select them. */
-const createStacks = (store) => {
-	const get = (baseUrl) => {
-		const stack = store.get().stacks[baseUrl];
-		return stack ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.Unconfigured));
-	};
-	const set = (stack) => {
-		const state = store.get();
-		store.set({
-			...state,
-			stacks: {
-				...state.stacks,
-				[stack.baseUrl]: stack
-			}
-		});
-		return stack;
-	};
-	const update = (baseUrl, updater) => require_transientRetries.Result.map(get(baseUrl), (stack) => set(updater(stack)));
-	const ensure = (baseUrl) => {
-		const existing = get(baseUrl);
-		if (existing.success) return existing.data;
-		return set(newStack(baseUrl));
-	};
-	const getActive = () => {
-		const { active } = store.get();
-		const stack = get(active);
-		if (!stack.success) throw new Error(`The active stack has no row: ${active}`);
-		return stack.data;
-	};
-	const select = (baseUrl) => {
-		const stack = ensure(baseUrl);
-		const state = store.get();
-		if (state.active !== baseUrl) store.set({
-			...state,
-			active: baseUrl
-		});
-		return stack;
-	};
-	const updateContext = (baseUrl, context) => update(baseUrl, (stack) => ({
-		...stack,
-		context
-	}));
-	return {
-		get,
-		set,
-		update,
-		ensure,
-		getActive,
-		select,
-		updateContext
-	};
-};
-// src/keboola/bearer/state/state.ts
+// src/keboola/state/state.ts
 /**
 * The stack table and the rules over it, one namespace per concern.
 *
@@ -1190,8 +531,9 @@ const createState = (defaultBaseUrl) => {
 		auth
 	};
 };
-// src/keboola/bearer/credentials/credentials.ts
+// src/keboola/credentials/credentials.ts
 const DEFAULT_REFRESH_THRESHOLD = .9;
+const END_SESSION_TIMEOUT_MS = 1e4;
 const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
 const toRestoreStatus = (outcome) => {
 	if (outcome === void 0 || outcome === "skipped") return "empty";
@@ -1232,13 +574,18 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		const refreshed = await require_transientRetries.Result.tryCatchAsync(() => renew(client, grant));
 		return isSameSignIn() ? refreshed : require_transientRetries.Result.failure(signInEnded());
 	};
+	/**
+	* The grant to rotate, or the sign-out another tab stored.
+	*
+	* - `{ retained }`: the stored sign-in ended; `retained` is what a retained sign-out kept.
+	*/
 	const getGrantForRotation = async (store, baseUrl, credential) => {
 		const isSameSignIn = markSignIn(baseUrl);
 		const hydrated = await require_transientRetries.Result.tryCatchAsync(() => store.read());
 		if (!hydrated.success) return hydrated;
 		if (!isSameSignIn()) return require_transientRetries.Result.failure(signInEnded());
 		const persistedStack = hydrated.data.stacks.find((stack) => stack.baseUrl === baseUrl);
-		if (persistedStack && persistedStack.credential === null) return require_transientRetries.Result.failure(signInEnded());
+		if (persistedStack && persistedStack.credential === null) return require_transientRetries.Result.success({ retained: persistedStack.retained ?? null });
 		return require_transientRetries.Result.success(persistedStack?.credential ?? grantOf(credential));
 	};
 	const rotateOnce = async (baseUrl) => persistor.locked(async (store) => {
@@ -1246,6 +593,10 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		if (!credential.success) return credential;
 		const grant = await getGrantForRotation(store, baseUrl, credential.data);
 		if (!grant.success) return grant;
+		if ("retained" in grant.data) {
+			await expire(baseUrl, store, grant.data.retained);
+			return require_transientRetries.Result.failure(signInEnded());
+		}
 		const refreshed = await refresh(baseUrl, grant.data);
 		if (!refreshed.success) {
 			if (require_middleware.isUnauthorized(refreshed.error)) await expire(baseUrl, store);
@@ -1317,9 +668,10 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		onSignedOut?.(baseUrl);
 		return signedOut;
 	};
-	const expire = async (baseUrl, store) => {
+	const expire = async (baseUrl, store, retained = null) => {
 		if (!state.auth.notifyExpired(baseUrl)) return;
 		signOut(baseUrl);
+		if (retained) state.auth.retain(baseUrl, retained);
 		await store.persistStack(baseUrl, state.store.get());
 		onExpired?.(baseUrl);
 	};
@@ -1332,19 +684,360 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 			if (!state.auth.requireCredential(baseUrl).success) return null;
 			return require_transientRetries.Result.unwrap(await rotate(baseUrl));
 		}
-		await renewIfStale(baseUrl);
-		return state.auth.getAccessToken(baseUrl);
-	} });
+		await renewIfStale(baseUrl);
+		return state.auth.getAccessToken(baseUrl);
+	} });
+	/**
+	* Ends a signed-out grant's server session: its refresh, derived PATs and paired browser session.
+	*
+	* 1. `token`: revokes the refresh token; the server also takes the one before the last rotation.
+	* 2. `cookie`: renews off the session cookie, then revokes that fresh access token.
+	* - Never an access token held from before: one rotation later the server no longer knows it.
+	* - Best effort, bounded by `END_SESSION_TIMEOUT_MS`: a failure is logged, the sign-out stands.
+	*/
+	const endSession = async (baseUrl, grant) => {
+		const client = require_authClient.createAuthClient({
+			baseUrl,
+			middlewares
+		});
+		const signal = AbortSignal.timeout(END_SESSION_TIMEOUT_MS);
+		try {
+			const body = grant.type === "token" ? {
+				token: grant.refreshToken,
+				tokenTypeHint: "refreshToken"
+			} : {
+				token: (await client.token.refreshWithSession({ sessionId: grant.sessionId }, signal)).accessToken,
+				tokenTypeHint: "accessToken"
+			};
+			await client.token.revoke(body, signal);
+		} catch (error) {
+			console.warn("createCredentials: the session could not be ended", error);
+		}
+	};
+	return {
+		middleware,
+		rotate,
+		renewIfStale,
+		restore,
+		restoreRetained,
+		signOut,
+		endSession
+	};
+};
+// src/serviceClientRegistry/utils.ts
+const isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
+/**
+* Creates a dummy client that intercepts method calls and invokes the provided onCall callback.
+*/
+const createDummyClient = ({ onCall }) => {
+	const createProxy = (path = []) => new Proxy(() => {}, {
+		get: (_target, prop) => {
+			if (isBuiltInProperty(prop)) return void 0;
+			return createProxy([...path, prop]);
+		},
+		apply: (_target, _thisArgs, args) => onCall(path, args)
+	});
+	return createProxy();
+};
+// src/serviceClientRegistry/createServiceClientRegistry.ts
+const createServiceClientRegistry = () => ({ getServiceBaseUrl, onUnavailable }) => {
+	const dummy = (serviceId, clientName) => createDummyClient({ onCall: (path, args) => {
+		onUnavailable?.({
+			serviceId,
+			path,
+			args,
+			clientName
+		});
+	} });
+	const configs = [];
+	const resolveClient = ({ serviceId, clientFn, clientName }) => {
+		const serviceBaseUrl = getServiceBaseUrl(serviceId);
+		return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);
+	};
+	const registry = {
+		add: (config) => {
+			configs.push(config);
+			return registry;
+		},
+		build: () => {
+			const clientMap = {};
+			configs.forEach((config) => {
+				clientMap[config.clientName] = resolveClient(config);
+			});
+			return { client: clientMap };
+		}
+	};
+	return registry;
+};
+// src/sdks/variables/variablesSdk.ts
+const VARIABLES_COMPONENT_ID = "keboola.variables";
+/** Union the definitions by name; on a name conflict the target's definition is kept. */
+const mergeVariableDefinitions = (target, source) => {
+	const targetNames = new Set(target.map((definition) => definition.name));
+	return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];
+};
+/** Add values missing in the target; on a name conflict the value is updated to the source's. */
+const mergeVariableValues = (target, source) => {
+	const sourceByName = new Map(source.map((value) => [value.name, value.value]));
+	const targetNames = new Set(target.map((value) => value.name));
+	return [...target.map((value) => sourceByName.has(value.name) ? {
+		...value,
+		value: sourceByName.get(value.name)
+	} : value), ...source.filter((value) => !targetNames.has(value.name))];
+};
+/**
+* Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh
+* one (union definitions, upsert values — source wins on a name conflict). Each result is a brand
+* new config + values row, so the caller can reference it without sharing lineage with the source.
+*/
+const createVariablesSdk = ({ storageClient }) => {
+	const configs = storageClient.configurations;
+	const rows = storageClient.configurationRows;
+	const readVariables = async (configId, valuesRowId, branchId) => {
+		const config = await configs.getConfiguration({
+			componentId: VARIABLES_COMPONENT_ID,
+			configId,
+			branchId
+		});
+		const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];
+		const rawDefinitions = config.configuration?.variables;
+		const rawValues = row?.configuration?.values;
+		return {
+			definitions: Array.isArray(rawDefinitions) ? rawDefinitions : [],
+			values: Array.isArray(rawValues) ? rawValues : []
+		};
+	};
+	const createVariables = async (definitions, values, branchId) => {
+		const config = await configs.createConfiguration({
+			branchId,
+			componentId: VARIABLES_COMPONENT_ID,
+			name: "Variables definition",
+			configuration: { variables: definitions }
+		});
+		try {
+			const row = await rows.createConfigurationRow({
+				branchId: String(branchId),
+				componentId: VARIABLES_COMPONENT_ID,
+				configurationId: config.id,
+				name: "Default values",
+				configuration: { values }
+			});
+			return {
+				variablesId: config.id,
+				variablesValuesId: row.id
+			};
+		} catch (error) {
+			await configs.deleteConfiguration({
+				branchId,
+				componentId: VARIABLES_COMPONENT_ID,
+				configId: config.id
+			}).catch((cleanupError) => {
+				if (error instanceof Error && error.cause === void 0) error.cause = cleanupError;
+			});
+			throw error;
+		}
+	};
 	return {
-		middleware,
-		rotate,
-		renewIfStale,
-		restore,
-		restoreRetained,
-		signOut
+		/** Copy a variables config into a fresh, independent config + values row. */
+		copy: async ({ variablesId, variablesValuesId, branchId = "default" }) => {
+			const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);
+			return createVariables(definitions, values, branchId);
+		},
+		/** Merge the source's variables into the target's and create a fresh merged config + values row. */
+		merge: async ({ targetVariablesId, targetValuesId, sourceVariablesId, sourceValuesId, branchId = "default" }) => {
+			const [target, source] = await Promise.all([readVariables(targetVariablesId, targetValuesId, branchId), readVariables(sourceVariablesId, sourceValuesId, branchId)]);
+			return createVariables(mergeVariableDefinitions(target.definitions, source.definitions), mergeVariableValues(target.values, source.values), branchId);
+		}
 	};
 };
-// src/keboola/bearer/perProject.ts
+// src/keboola/createSdk.ts
+const createSdk = ({ storage, services }) => ({
+	tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
+	semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
+	kaiMemory: require_kaiMemory.createKaiMemorySdk({ metastoreClient: services.metastore }),
+	vault: require_sdk_vault_index.createVaultSdk({
+		vaultClient: services.vault,
+		encryptionClient: services.encryption
+	}),
+	variables: createVariablesSdk({ storageClient: storage })
+});
+// src/keboola/createServiceClients.ts
+const withPath = (serviceBaseUrl, path) => typeof serviceBaseUrl === "string" ? `${serviceBaseUrl}${path}` : async () => `${await serviceBaseUrl()}${path}`;
+const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
+	getServiceBaseUrl,
+	onUnavailable: ({ serviceId, path, clientName }) => {
+		throw new require_storage.ServiceUnavailableError(serviceId, path, clientName);
+	}
+}).add({
+	serviceId: "vault",
+	clientName: "vault",
+	clientFn: (serviceBaseUrl) => require_vault_index.createVaultClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("vault", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "data-science",
+	clientName: "dataScience",
+	clientFn: (serviceBaseUrl) => require_dataScience_index.createDataScienceClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("dataScience", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "data-science",
+	clientName: "apps",
+	clientFn: (serviceBaseUrl) => require_apps.createAppsClient({
+		baseUrl: withPath(serviceBaseUrl, "/v2"),
+		middlewares: middlewareFor("apps", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "encryption",
+	clientName: "encryption",
+	clientFn: (serviceBaseUrl) => require_encryption_index.createEncryptionClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("encryption")
+	})
+}).add({
+	serviceId: "editor",
+	clientName: "editor",
+	clientFn: (serviceBaseUrl) => require_editor_index.createEditorClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("editor", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "sync-actions",
+	clientName: "syncActions",
+	clientFn: (serviceBaseUrl) => require_syncActions.createSyncActionsClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("syncActions", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "telemetry",
+	clientName: "telemetry",
+	clientFn: (serviceBaseUrl) => require_telemetry_index.createTelemetryClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("telemetry", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "query",
+	clientName: "queryService",
+	clientFn: (serviceBaseUrl) => require_queryService.createQueryServiceClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("queryService", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "queue",
+	clientName: "queue",
+	clientFn: (serviceBaseUrl) => require_queue.createQueueClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("queue", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "kai-assistant",
+	clientName: "chat",
+	clientFn: (serviceBaseUrl) => require_chat_index.createChatClient({
+		storageApiUrl: baseUrl,
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("chat", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "ai",
+	clientName: "ai",
+	clientFn: (serviceBaseUrl) => require_ai_index.createAiClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("ai", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "ai",
+	clientName: "omnisearch",
+	clientFn: (serviceBaseUrl) => require_omnisearch_index.createOmnisearchClient({
+		baseUrl: withPath(serviceBaseUrl, "/omnisearch"),
+		middlewares: middlewareFor("omnisearch", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "import",
+	clientName: "import",
+	clientFn: (serviceBaseUrl) => require_import.createImportClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("import", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "kai-agent",
+	clientName: "kaiAgent",
+	clientFn: (serviceBaseUrl) => require_kaiAgent.createKaiAgentClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "components-mcp",
+	clientName: "componentsMcp",
+	clientFn: (serviceBaseUrl) => require_componentsMcp.createComponentsMcpClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("componentsMcp", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "oauth",
+	clientName: "oauth",
+	clientFn: (serviceBaseUrl) => require_oauth.createOauthClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("oauth", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "scheduler",
+	clientName: "scheduler",
+	clientFn: (serviceBaseUrl) => require_scheduler_index.createSchedulerClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("scheduler", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "stream",
+	clientName: "stream",
+	clientFn: (serviceBaseUrl) => require_stream_index.createStreamClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("stream", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "notification",
+	clientName: "notifications",
+	clientFn: (serviceBaseUrl) => require_notifications_index.createNotificationsClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("notifications", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "billing",
+	clientName: "billing",
+	clientFn: (serviceBaseUrl) => require_billing_index.createBillingClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("billing", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "metastore",
+	clientName: "metastore",
+	clientFn: (serviceBaseUrl) => require_metastore.createMetastoreClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("metastore", [attachTokenMiddleware]),
+		auth
+	})
+}).build();
+// src/keboola/perProject.ts
 const projectKey = ({ baseUrl, projectId }) => `${baseUrl}#${projectId}`;
 /**
 * One handle per project, and the one call that drops it.
@@ -1379,12 +1072,12 @@ const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 			auth: authFor(project),
 			middlewares: middlewareFor("storage", [attach])
 		});
-		const { client, meta } = createServiceClients({
+		const { client } = createServiceClients({
 			baseUrl: project.baseUrl,
 			auth: authFor(project),
 			getServiceBaseUrl: (serviceId) => async () => {
 				const serviceUrl = (await stack.context.getAsync(project.baseUrl)).getServiceUrl(serviceId);
-				assert$1(serviceUrl, KeboolaErrorType.NotReady);
+				if (!serviceUrl) throw new require_storage.ServiceUnavailableError(serviceId);
 				return serviceUrl;
 			},
 			middlewareFor,
@@ -1403,7 +1096,6 @@ const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 				if (property === "stack" || property === "auth" || property === "management") return stack.get(project.baseUrl)[property];
 				if (property === "storage") return storage;
 				if (property === "sdk") return sdk;
-				if (property === "serviceMeta") return meta;
 				return client[property];
 			} }),
 			end: () => {
@@ -1425,13 +1117,13 @@ const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 		forgetUnder
 	};
 };
-// src/keboola/bearer/persistor.ts
+// src/keboola/persistor.ts
 /**
 * Where a bearer session is persisted, under whichever adapter the client was given.
 *
 * Exported because a consumer sometimes has to drop a session a client cannot reach: the adapter is
 * chosen at construction, so a client built without one holds no handle to the storage its own
-* session is sitting in. `AppAuthStrategy` in kbc-ui is that case.
+* session is sitting in.
 */
 const SESSION_STORAGE_KEY = "keboola:session";
 /**
@@ -1558,7 +1250,44 @@ const createSessionPersistor = (storage) => {
 		snapshot
 	};
 };
-// src/keboola/bearer/context.ts
+// src/domain/stack.ts
+const isServiceId = (id) => Object.values(require_serviceIds.ServiceId).includes(id);
+const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
+const createStack = ({ stackInfo, clientServiceUrls }) => {
+	const { services, components, features, ...infoRest } = stackInfo;
+	const serviceMap = new Map(services.map((service) => {
+		if (!isServiceId(service.id)) return [service.id, service.url];
+		const devOverride = clientServiceUrls?.[service.id]?.(service.url);
+		const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
+		const url = devOverride ?? prodOverride ?? service.url;
+		return [service.id, url];
+	}));
+	const componentMap = new Map(components.map((component) => [component.id, component]));
+	const featureSet = new Set(features);
+	const hasFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => featureSet.has(x));
+	};
+	const hasComponent = (...componentId) => {
+		if (componentId.length === 0) return false;
+		return componentId.every((x) => componentMap.has(x));
+	};
+	const getComponent = (componentId) => componentMap.get(componentId) ?? null;
+	const hasService = (serviceId) => serviceMap.has(serviceId);
+	const getServiceUrl = (serviceId) => serviceMap.get(serviceId) ?? null;
+	return {
+		...infoRest,
+		services,
+		features,
+		components,
+		hasFeature,
+		getServiceUrl,
+		hasService,
+		getComponent,
+		hasComponent
+	};
+};
+// src/keboola/context.ts
 const STACK_INDEX_TIMEOUT_MS = 3e4;
 /**
 * One parsed stack index per stack; `createStack` applies the dev and production overrides.
@@ -1624,7 +1353,7 @@ const createStackContext = ({ state, clientServiceUrls }) => {
 		getAsync
 	};
 };
-// src/keboola/bearer/perStack.ts
+// src/keboola/perStack.ts
 /**
 * Everything one stack derives.
 *
@@ -1662,7 +1391,7 @@ const createPerStack = ({ state, credentials, middlewareFor, clientServiceUrls }
 		get
 	};
 };
-// src/keboola/bearer/keboola.ts
+// src/keboola/keboola.ts
 /**
 * The bearer client: the session table, its two scopes, and the surface they back.
 *
@@ -1750,20 +1479,39 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			return active().management;
 		}
 	};
-	const getStackApi = () => stackApi;
-	const getProjectApi = (projectId) => perProject.get(onActiveStack(projectId));
+	const projectApi = (projectId) => perProject.get(onActiveStack(projectId));
 	/**
 	* The scope's sign-in, or a named stack's — and everything that sign-in derived.
 	*
+	* - Ends the server session too (`credentials.endSession`).
 	* - `retain` keeps the grant on the stack, persisted beside the sign-in it ended, for
-	*   `restoreRetained`; the next sign-in on the stack replaces it.
-	* - The table is signed out on return; the promise resolves once that is stored, so a caller
-	*   leaving the document waits for it.
+	*   `restoreRetained`, and so leaves the server session live; the next sign-in replaces it.
+	* - The table is signed out on return; the promise resolves once that is stored and the
+	*   session's end was attempted, so a caller leaving the document waits for both.
 	*/
-	const signOut = ({ baseUrl, ...options } = {}) => {
-		const target = requireStackUrl(baseUrl);
+	const signOut = ({ baseUrl, ...options } = {}) => endSignIn(requireStackUrl(baseUrl), options, !options.retain);
+	const endingSessions = /* @__PURE__ */ new Map();
+	/** `signOut`; `endSession: false` leaves the server session alone. */
+	const endSignIn = (target, options, endSession) => {
+		const held = endSession ? require_transientRetries.Result.unwrapOr(state.auth.requireCredential(target), null) : null;
 		const signedOut = require_transientRetries.Result.unwrap(credentials.signOut(target, options));
-		return persistor.locked((store) => store.persistStack(target, state.store.get())).then(() => signedOut);
+		let newest = held && grantOf(held);
+		const ended = persistor.locked(async (store) => {
+			if (held !== null) newest = (await store.read()).stacks.find((stack) => stack.baseUrl === target)?.credential ?? newest;
+			await store.persistStack(target, state.store.get());
+		}).then(() => newest ? credentials.endSession(target, newest) : void 0, async (error) => {
+			if (newest) await credentials.endSession(target, newest);
+			throw error;
+		});
+		const earlier = endingSessions.get(target);
+		if (held !== null) {
+			endingSessions.set(target, ended);
+			const forget = () => {
+				if (endingSessions.get(target) === ended) endingSessions.delete(target);
+			};
+			ended.then(forget, forget);
+		}
+		return Promise.all([ended, earlier]).then(() => signedOut);
 	};
 	/** Signs a stack back in from what a retained sign-out kept; `unreachable` leaves it to retry. */
 	const restoreRetained = (baseUrl) => credentials.restoreRetained(require_createFetchClient.normalizeBaseUrl(baseUrl));
@@ -1772,9 +1520,12 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	*
 	* - Signs out first, always: a sign-out moves the epoch even on an anonymous stack, so a stored
 	*   session still being restored cannot land on top of this one.
+	* - Locally only: the replaced sign-in can share a browser session with `input`.
 	*/
 	const replace = (input) => {
-		signOut();
+		endSignIn(requireStackUrl(), {}, false).catch((error) => {
+			console.warn("createKeboola: the replaced sign-in could not be stored", error);
+		});
 		return authenticate(input);
 	};
 	let persisting = false;
@@ -1840,8 +1591,8 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		return verb(...args);
 	};
 	return {
-		getStackApi,
-		getProjectApi,
+		stackApi,
+		projectApi,
 		session: {
 			getState: state.store.get,
 			subscribe: state.store.subscribe,
@@ -2086,17 +1837,14 @@ exports.ValidationError = require_ValidationError.ValidationError;
 exports.asError = require_transientRetries.asError;
 exports.assert = assert;
 exports.coalesce = coalesce;
-exports.collectByCursor = require_authClient.collectByCursor;
+exports.collectByCursor = require_validateConnectionStatus.collectByCursor;
 exports.collectByOffset = require_collectByOffset.collectByOffset;
 exports.concurrent = require_concurrent.concurrent;
 exports.createAdminAccount = createAdminAccount;
 exports.createBranchRefs = createBranchRefs;
-exports.createDerivedAsyncStore = createDerivedAsyncStore;
-exports.createDerivedStore = createDerivedStore;
 exports.createEmitter = require_store.createEmitter;
 exports.createGenericFetchClient = require_createGenericFetchClient.createGenericFetchClient;
 exports.createKeboola = createKeboola;
-exports.createLegacyKeboola = createLegacyKeboola;
 exports.createLocalStorage = createLocalStorage;
 exports.createLoggingMiddleware = createLoggingMiddleware;
 exports.createMemoryStorage = createMemoryStorage;
@@ -2134,11 +1882,12 @@ exports.isStorageJobError = require_storage.isStorageJobError;
 exports.isSyncActionError = require_SyncActionError.isSyncActionError;
 exports.isTimeoutError = require_createFetchClient.isTimeoutError;
 exports.isValidationError = require_ValidationError.isValidationError;
+exports.iterateByCursor = require_validateConnectionStatus.iterateByCursor;
 exports.jobStatus = require_transientRetries.jobStatus;
 exports.keboolaUID = require_tag.keboolaUID;
 exports.lazy = require_transientRetries.lazy;
 exports.manageErrorCode = require_storage.manageErrorCode;
-exports.nextCursorOf = require_authClient.nextCursorOf;
+exports.nextCursorOf = require_validateConnectionStatus.nextCursorOf;
 exports.parseLogLines = require_apps.parseLogLines;
 exports.parseOrThrow = require_ValidationError.parseOrThrow;
 exports.poller = require_transientRetries.poller;
@@ -2147,6 +1896,5 @@ exports.readableReason = require_storage.readableReason;
 exports.retryAfterSeconds = require_storage.retryAfterSeconds;
 exports.schemaGuidedMerge = require_schemaGuidedMerge.schemaGuidedMerge;
 exports.series = require_storage.series;
-exports.shallowEqual = shallowEqual;
 
 //# sourceMappingURL=index.cjs.map