@keboola/api-client 56.0.0 → 57.0.0

package/dist/index.js

@@ -1,50 +1,50 @@
 import { t as UserError } from "./UserError-BxoOJJ_u.js";
 import { _ as HttpStatus, a as isTimeoutError, d as normalizeBaseUrl, h as CREDENTIAL_HEADERS, i as isFetchClientError, n as isAbortError, o as HttpContentType, p as ApiError, r as isApiError, s as HttpHeader, v as KeboolaHttpHeader, x as redactHeaders, y as REDACTED } from "./createFetchClient-Dc_ZMuq7.js";
-import { a as isHtmlResponseError, i as HtmlResponseError, n as nextCursorOf, t as collectByCursor } from "./collectByCursor-2-8SuJ-8.js";
-import { a as series, c as ServiceUnavailableError, d as isManageError, f as manageErrorCode, l as retryAfterSeconds, o as StorageJobError, s as isStorageJobError, t as createStorageClient, u as readableReason } from "./storage-Bw-HSnPp.js";
-import { n as ManagementClientAuthError, t as ManagementSessionMintError } from "./ManagementSessionMintError-BMHDcEqV.js";
+import { a as HtmlResponseError, i as nextCursorOf, n as collectByCursor, o as isHtmlResponseError, r as iterateByCursor } from "./validateConnectionStatus-DgJwuEy9.js";
+import { a as series, c as ServiceUnavailableError, d as isManageError, f as manageErrorCode, l as retryAfterSeconds, o as StorageJobError, s as isStorageJobError, t as createStorageClient, u as readableReason } from "./storage-o9teEKl_.js";
+import { n as ManagementClientAuthError, t as ManagementSessionMintError } from "./ManagementSessionMintError-KUX3utTV.js";
 import { i as isQueryJobError, n as isRowLevelSecurityError, r as QueryJobError, t as RowLevelSecurityError } from "./RowLevelSecurityError-CObFqj3E.js";
 import { n as isQueueJobError, t as QueueJobError } from "./QueueJobError-BJNUINXW.js";
 import { n as isSyncActionError, t as SyncActionError } from "./SyncActionError-DuGcDbkd.js";
 import { i as parseOrThrow, n as formatValidationIssues, r as isValidationError, t as ValidationError } from "./ValidationError-BsdFDGY2.js";
 import { t as createGenericFetchClient } from "./createGenericFetchClient-Ba4E4T-Y.js";
 import { t as createImportClient } from "./import-DxN6CJzJ.js";
-import { t as createAuthClient } from "./authClient-B_Mb4Vzs.js";
 import { t as collectByOffset } from "./collectByOffset-i8Tdoze7.js";
 import { t as concurrent } from "./concurrent-BtsT10Xe.js";
 import { t as dedupe } from "./dedupe-Bu0d2i_w.js";
-import { a as poller, c as Result, d as delay, i as failureOf, l as asError, n as jobStatus, o as clamp, r as emitter, s as finiteOr, u as lazy } from "./transientRetries-BORv47mH.js";
-import { n as createEmitter, t as createStore } from "./store-HP0zRcLz.js";
+import { a as poller, c as Result, d as delay, i as failureOf, l as asError, n as jobStatus, o as clamp, r as emitter, s as finiteOr, u as lazy } from "./transientRetries-dssygpwU.js";
+import { n as createEmitter, t as createStore } from "./store-DDUzPeCm.js";
 import { n as keboolaUID, t as createTagSdk } from "./tag-BwjbG3tT.js";
 import { t as generateUUID } from "./generateUUID-DE9sNyJF.js";
 import { t as isPlainObject } from "./isPlainObject-BxsT8_t2.js";
 import { n as isEmptyDeep, t as schemaGuidedMerge } from "./schemaGuidedMerge-DFNqj9Nz.js";
-import { n as isManagementClientAuthError, r as isManagementSessionMintError, t as createManagementClient } from "./management-BlMQnPNS.js";
-import { t as ServiceId } from "./serviceIds-RAVtP4nK.js";
+import { t as createAuthClient } from "./authClient-BKGpJI5L.js";
+import { n as isUnauthorized, t as createBearerAuthMiddleware } from "./middleware-DWmhthX0.js";
 import { i as createKaiMemorySdk } from "./kaiMemory-B1wIwH8Y.js";
 import { i as createSemanticLayerSdk } from "./semanticLayer-Btj1Qy9O.js";
 import { createVaultSdk } from "./sdk/vault/index.js";
 import { createAiClient } from "./ai/index.js";
-import { n as parseLogLines, t as createAppsClient } from "./apps-BN7fWtSm.js";
+import { n as parseLogLines, t as createAppsClient } from "./apps-DDcguJ1i.js";
 import { createBillingClient } from "./billing/index.js";
 import { createChatClient } from "./chat/index.js";
 import { t as createComponentsMcpClient } from "./componentsMcp-CAmrCpzV.js";
 import { createDataScienceClient } from "./dataScience/index.js";
 import { createEditorClient } from "./editor/index.js";
 import { createEncryptionClient } from "./encryption/index.js";
-import { t as createKaiAgentClient } from "./kaiAgent-D0MoKqXe.js";
+import { t as createKaiAgentClient } from "./kaiAgent-aqylPZHY.js";
 import { t as createMetastoreClient } from "./metastore-CkqFnEfu.js";
 import { createNotificationsClient } from "./notifications/index.js";
 import { n as createOauthClient } from "./oauth-Fri6IthS.js";
 import { createOmnisearchClient } from "./omnisearch/index.js";
-import { t as createQueryServiceClient } from "./queryService-DQHtHy2-.js";
-import { t as createQueueClient } from "./queue-6cywDnA-.js";
+import { t as createQueryServiceClient } from "./queryService-CIxb_mcP.js";
+import { t as createQueueClient } from "./queue-BBihD5qQ.js";
 import { createSchedulerClient } from "./scheduler/index.js";
 import { createStreamClient } from "./stream/index.js";
 import { t as createSyncActionsClient } from "./syncActions-W98Jme2Z.js";
+import { t as ServiceId } from "./serviceIds-RAVtP4nK.js";
 import { createTelemetryClient } from "./telemetry/index.js";
 import { createVaultClient } from "./vault/index.js";
-import { n as isUnauthorized, t as createBearerAuthMiddleware } from "./middleware-DxGv7DG8.js";
+import { n as isManagementClientAuthError, r as isManagementSessionMintError, t as createManagementClient } from "./management-CIK5-Aq5.js";
 import { t as createProject } from "./project-aAVAOcmx.js";
 import { n as createQueryServiceSdk } from "./queryService-DE_yE_S4.js";
 import * as z$1 from "zod";
@@ -58,24 +58,14 @@ const KeboolaErrorType = {
 	NotAuthenticated: "not-authenticated",
 	SignInEnded: "sign-in-ended",
 	AlreadyAuthenticated: "already-authenticated",
-	NoStorageToken: "no-storage-token",
-	NoManagementToken: "no-management-token",
-	MissingProject: "missing-project",
-	NotBearer: "not-bearer",
-	NotReady: "not-ready",
-	InvalidBuildTransition: "invalid-build-transition"
+	NotReady: "not-ready"
 };
 const MESSAGES = {
-	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
+	[KeboolaErrorType.Unconfigured]: "This stack has not been selected — call session.stack.select(baseUrl) first.",
 	[KeboolaErrorType.NotAuthenticated]: "The session is not authenticated — sign in first.",
 	[KeboolaErrorType.SignInEnded]: "The sign-in this operation started under has ended — its result belongs to nobody.",
-	[KeboolaErrorType.AlreadyAuthenticated]: "The session is already authenticated — reset before authenticating again.",
-	[KeboolaErrorType.NoStorageToken]: "No storage token — authenticate the storage realm first.",
-	[KeboolaErrorType.NoManagementToken]: "No management token — authenticate the management realm first.",
-	[KeboolaErrorType.MissingProject]: "A bearer storage session requires a project — call setProject(projectId) first.",
-	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
-	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
-	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed."
+	[KeboolaErrorType.AlreadyAuthenticated]: "This stack is already signed in — sign out or use auth.replace first.",
+	[KeboolaErrorType.NotReady]: "The stack index has not loaded yet."
 };
 var KeboolaError = class KeboolaError extends Error {
 	type;
@@ -140,109 +130,6 @@ const coalesce = (task) => {
 		return waiter.promise;
 	};
 };
-// src/utils/store/derivedStore.ts
-const isPlainObjectOrArray = (value) => {
-	if (Array.isArray(value)) return true;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-};
-const shallowEqual = (a, b) => {
-	if (Object.is(a, b)) return true;
-	if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) return false;
-	if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;
-	const aKeys = Object.keys(a);
-	const bKeys = Object.keys(b);
-	return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));
-};
-const createDerivedStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
-	let key = dependsOn(source.get());
-	const store = createStore(build(key));
-	const unsubscribe = source.subscribe((state) => {
-		const next = dependsOn(state);
-		if (keyEquals(key, next)) return;
-		key = next;
-		store.set(build(next));
-	});
-	const get = store.get;
-	const subscribe = store.subscribe;
-	const dispose = () => {
-		unsubscribe();
-		store.dispose();
-	};
-	return {
-		get,
-		subscribe,
-		dispose
-	};
-};
-// src/utils/store/derivedAsyncStore.ts
-const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
-	const store = createStore({ state: "idle" });
-	let currentKey = null;
-	let generation = 0;
-	let controller = null;
-	const run = (key) => {
-		controller?.abort();
-		controller = new AbortController();
-		const runGeneration = ++generation;
-		store.set({ state: "pending" });
-		build(key, controller.signal).then((value) => {
-			if (runGeneration === generation) store.set({
-				state: "ready",
-				value
-			});
-		}, (error) => {
-			if (runGeneration === generation) store.set({
-				state: "errored",
-				error
-			});
-		});
-	};
-	const sync = (state) => {
-		const next = dependsOn(state);
-		if (next === null) {
-			if (currentKey === null) return;
-			controller?.abort();
-			controller = null;
-			generation += 1;
-			currentKey = null;
-			store.set({ state: "idle" });
-			return;
-		}
-		if (currentKey !== null && keyEquals(currentKey, next)) return;
-		currentKey = next;
-		run(next);
-	};
-	sync(source.get());
-	const unsubscribe = source.subscribe(sync);
-	const get = store.get;
-	const subscribe = store.subscribe;
-	const dispose = () => {
-		controller?.abort();
-		unsubscribe();
-		store.dispose();
-	};
-	const readable = {
-		get,
-		subscribe,
-		dispose
-	};
-	const settled = () => new Promise((resolve) => {
-		let unsubscribeSettled = () => {};
-		const check = (state) => {
-			if (state.state === "ready" || state.state === "errored") {
-				unsubscribeSettled();
-				resolve(state);
-			}
-		};
-		unsubscribeSettled = store.subscribe(check);
-		check(store.get());
-	});
-	return {
-		store: readable,
-		settled
-	};
-};
 // src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
 const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "requesting" && snapshot.state !== "polling";
@@ -454,721 +341,175 @@ const createPersistor = ({ storage = createNullStorage(), key, schema, defaultVa
 		locked
 	};
 };
-// src/serviceClientRegistry/utils.ts
-const isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
-/**
-* Creates a dummy client that intercepts method calls and invokes the provided onCall callback.
-*/
-const createDummyClient = ({ onCall }) => {
-	const createProxy = (path = []) => new Proxy(() => {}, {
-		get: (_target, prop) => {
-			if (isBuiltInProperty(prop)) return void 0;
-			return createProxy([...path, prop]);
-		},
-		apply: (_target, _thisArgs, args) => onCall(path, args)
-	});
-	return createProxy();
-};
-// src/serviceClientRegistry/createServiceClientRegistry.ts
-const createServiceClientRegistry = () => ({ getServiceBaseUrl, onUnavailable }) => {
-	const dummy = (serviceId, clientName) => createDummyClient({ onCall: (path, args) => {
-		onUnavailable?.({
-			serviceId,
-			path,
-			args,
-			clientName
-		});
-	} });
-	const configs = [];
-	const resolveClient = ({ serviceId, clientFn, clientName }) => {
-		const serviceBaseUrl = getServiceBaseUrl(serviceId);
-		return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);
-	};
-	const registry = {
-		add: (config) => {
-			configs.push(config);
-			return registry;
-		},
-		build: () => {
-			const clientMap = {};
-			const clientMeta = [];
-			configs.forEach((config) => {
-				clientMap[config.clientName] = resolveClient(config);
-				clientMeta.push({
-					clientName: config.clientName,
-					serviceId: config.serviceId,
-					isAvailable: !!getServiceBaseUrl(config.serviceId)
-				});
-			});
-			return {
-				client: clientMap,
-				meta: clientMeta
-			};
-		}
-	};
-	return registry;
-};
-// src/keboola/createApi.ts
-const createApi = (state) => new Proxy({}, { get(_target, property) {
-	if (isBuiltInProperty(property)) return void 0;
-	if (property === "auth") {
-		const authClient = state.getAuthClient();
-		assert$1(authClient, KeboolaErrorType.Unconfigured);
-		return authClient;
-	}
-	if (property === "management") {
-		const management = state.getManagementClient();
-		assert$1(management, KeboolaErrorType.NoManagementToken);
-		return management;
-	}
-	const clients = state.getProjectClients();
-	assert$1(clients, KeboolaErrorType.NotReady);
-	return clients[property];
-} });
 // src/keboola/createMiddlewareFor.ts
 const createMiddlewareFor = (middlewares) => {
 	return (target, baseline = []) => {
 		if (Array.isArray(middlewares)) return [...baseline, ...middlewares];
-		const all = middlewares?.all ?? [];
-		const targeted = middlewares?.[target] ?? [];
-		return [
-			...baseline,
-			...all,
-			...targeted
-		];
+		return [...baseline, ...middlewares?.[target] ?? []];
 	};
 };
-// src/keboola/legacy/createConfig.ts
-const createConfig = () => {
-	const store = createStore({
-		baseUrl: null,
-		sapiToken: null,
-		managementToken: null
-	});
-	const setBaseUrl = (baseUrl) => {
-		store.set({
-			...store.get(),
-			baseUrl
+// src/keboola/state/auth.ts
+const grantOf = (credential) => credential.type === "token" ? {
+	type: "token",
+	refreshToken: credential.refreshToken
+} : {
+	type: "cookie",
+	sessionId: credential.sessionId
+};
+const stamped = (input) => ({
+	...input,
+	issuedAt: Date.now()
+});
+const credentialOf = (auth) => auth.status === "authenticated" ? Result.success(auth.credential) : Result.failure(new KeboolaError(KeboolaErrorType.NotAuthenticated));
+/**
+* The stack's credential and its sign-in pin.
+*
+* - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly "which
+*   sign-in is this" — what an in-flight exchange compares itself against.
+*/
+const createAuth = (stacks) => {
+	const expired = /* @__PURE__ */ new Set();
+	const requireCredential = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => credentialOf(stack.auth));
+	const requireUnauthenticated = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? Result.failure(new KeboolaError(KeboolaErrorType.AlreadyAuthenticated)) : Result.success(stack));
+	const requireAnonymous = (baseUrl) => Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`)) : Result.success(stack));
+	const requireRestoring = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? Result.success(stack) : Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`)));
+	const startRestore = (baseUrl) => Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: { status: "restoring" }
+	}));
+	const cancelRestore = (baseUrl) => Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: { status: "anonymous" }
+	}));
+	const authenticate = (baseUrl, input) => Result.map(requireUnauthenticated(baseUrl), (stack) => {
+		expired.delete(baseUrl);
+		return stacks.set({
+			...stack,
+			epoch: stack.epoch + 1,
+			auth: {
+				status: "authenticated",
+				credential: stamped(input)
+			},
+			retained: null
 		});
-	};
-	const authenticate = (tokens) => {
-		const current = store.get();
-		store.set({
-			...current,
-			sapiToken: tokens.sapiToken ?? current.sapiToken,
-			managementToken: tokens.managementToken ?? current.managementToken
+	});
+	const applyRefresh = (baseUrl, input) => Result.andThen(requireCredential(baseUrl), (credential) => credential.type !== input.type ? Result.failure(/* @__PURE__ */ new Error(`A ${credential.type} grant cannot become ${input.type}`)) : Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: {
+			status: "authenticated",
+			credential: stamped(input)
+		}
+	})));
+	const forceExpire = (baseUrl) => Result.andThen(requireCredential(baseUrl), (credential) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		auth: {
+			status: "authenticated",
+			credential: {
+				...credential,
+				issuedAt: Date.now() - credential.expiresIn * 1e3
+			}
+		}
+	})));
+	const signOut = (baseUrl, { retain = false } = {}) => Result.map(stacks.get(baseUrl), (stack) => {
+		const retained = retain ? Result.unwrapOr(Result.map(credentialOf(stack.auth), (credential) => ({ grant: grantOf(credential) })), stack.retained) : null;
+		return stacks.set({
+			...stack,
+			epoch: stack.epoch + 1,
+			auth: { status: "anonymous" },
+			retained
 		});
-	};
-	const getStorageToken = () => store.get().sapiToken ?? "";
-	const setStorageToken = (sapiToken) => store.set({
-		...store.get(),
-		sapiToken
 	});
-	/** Current state, for diagnostics. */
-	const debug = () => store.get();
+	const retain = (baseUrl, retained) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained
+	}));
+	const dropRetained = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained: null
+	}));
+	const requireRetained = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? Result.success(stack.retained) : Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`)));
+	const notifyExpired = (baseUrl) => {
+		if (expired.has(baseUrl)) return false;
+		expired.add(baseUrl);
+		return true;
+	};
+	const getEpoch = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
+	const getAccessToken = (baseUrl) => Result.unwrapOr(Result.map(requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
 	return {
-		store,
-		setBaseUrl,
+		startRestore,
+		cancelRestore,
 		authenticate,
-		getStorageToken,
-		setStorageToken,
-		debug
+		applyRefresh,
+		forceExpire,
+		signOut,
+		retain,
+		dropRetained,
+		requireRetained,
+		notifyExpired,
+		requireCredential,
+		getEpoch,
+		getAccessToken
 	};
 };
-// src/domain/stack.ts
-const isServiceId = (id) => Object.values(ServiceId).includes(id);
-const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
-const createStack = ({ stackInfo, clientServiceUrls }) => {
-	const { services, components, features, ...infoRest } = stackInfo;
-	const serviceMap = new Map(services.map((service) => {
-		if (!isServiceId(service.id)) return [service.id, service.url];
-		const devOverride = clientServiceUrls?.[service.id]?.(service.url);
-		const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
-		const url = devOverride ?? prodOverride ?? service.url;
-		return [service.id, url];
-	}));
-	const componentMap = new Map(components.map((component) => [component.id, component]));
-	const featureSet = new Set(features);
-	const hasFeature = (...feature) => {
-		if (feature.length === 0) return false;
-		return feature.every((x) => featureSet.has(x));
+// src/keboola/state/stacks.ts
+const newStack = (baseUrl) => ({
+	baseUrl,
+	context: "idle",
+	epoch: 0,
+	auth: { status: "anonymous" },
+	retained: null
+});
+/** One entry per stack, and the verbs that open and select them. */
+const createStacks = (store) => {
+	const get = (baseUrl) => {
+		const stack = store.get().stacks[baseUrl];
+		return stack ? Result.success(stack) : Result.failure(new KeboolaError(KeboolaErrorType.Unconfigured));
 	};
-	const hasComponent = (...componentId) => {
-		if (componentId.length === 0) return false;
-		return componentId.every((x) => componentMap.has(x));
+	const set = (stack) => {
+		const state = store.get();
+		store.set({
+			...state,
+			stacks: {
+				...state.stacks,
+				[stack.baseUrl]: stack
+			}
+		});
+		return stack;
 	};
-	const getComponent = (componentId) => componentMap.get(componentId) ?? null;
-	const hasService = (serviceId) => serviceMap.has(serviceId);
-	const getServiceUrl = (serviceId) => serviceMap.get(serviceId) ?? null;
+	const ensure = (baseUrl) => {
+		const existing = get(baseUrl);
+		if (existing.success) return existing.data;
+		return set(newStack(baseUrl));
+	};
+	const getActive = () => {
+		const { active } = store.get();
+		const stack = get(active);
+		if (!stack.success) throw new Error(`The active stack has no row: ${active}`);
+		return stack.data;
+	};
+	const select = (baseUrl) => {
+		const stack = ensure(baseUrl);
+		const state = store.get();
+		if (state.active !== baseUrl) store.set({
+			...state,
+			active: baseUrl
+		});
+		return stack;
+	};
+	const updateContext = (baseUrl, context) => Result.map(get(baseUrl), (stack) => set({
+		...stack,
+		context
+	}));
 	return {
-		...infoRest,
-		services,
-		features,
-		components,
-		hasFeature,
-		getServiceUrl,
-		hasService,
-		getComponent,
-		hasComponent
+		get,
+		set,
+		ensure,
+		getActive,
+		select,
+		updateContext
 	};
 };
-// src/sdks/variables/variablesSdk.ts
-const VARIABLES_COMPONENT_ID = "keboola.variables";
-/** Union the definitions by name; on a name conflict the target's definition is kept. */
-const mergeVariableDefinitions = (target, source) => {
-	const targetNames = new Set(target.map((definition) => definition.name));
-	return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];
-};
-/** Add values missing in the target; on a name conflict the value is updated to the source's. */
-const mergeVariableValues = (target, source) => {
-	const sourceByName = new Map(source.map((value) => [value.name, value.value]));
-	const targetNames = new Set(target.map((value) => value.name));
-	return [...target.map((value) => sourceByName.has(value.name) ? {
-		...value,
-		value: sourceByName.get(value.name)
-	} : value), ...source.filter((value) => !targetNames.has(value.name))];
-};
-/**
-* Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh
-* one (union definitions, upsert values — source wins on a name conflict). Each result is a brand
-* new config + values row, so the caller can reference it without sharing lineage with the source.
-*/
-const createVariablesSdk = ({ storageClient }) => {
-	const configs = storageClient.configurations;
-	const rows = storageClient.configurationRows;
-	const readVariables = async (configId, valuesRowId, branchId) => {
-		const config = await configs.getConfiguration({
-			componentId: VARIABLES_COMPONENT_ID,
-			configId,
-			branchId
-		});
-		const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];
-		const rawDefinitions = config.configuration?.variables;
-		const rawValues = row?.configuration?.values;
-		return {
-			definitions: Array.isArray(rawDefinitions) ? rawDefinitions : [],
-			values: Array.isArray(rawValues) ? rawValues : []
-		};
-	};
-	const createVariables = async (definitions, values, branchId) => {
-		const config = await configs.createConfiguration({
-			branchId,
-			componentId: VARIABLES_COMPONENT_ID,
-			name: "Variables definition",
-			configuration: { variables: definitions }
-		});
-		try {
-			const row = await rows.createConfigurationRow({
-				branchId: String(branchId),
-				componentId: VARIABLES_COMPONENT_ID,
-				configurationId: config.id,
-				name: "Default values",
-				configuration: { values }
-			});
-			return {
-				variablesId: config.id,
-				variablesValuesId: row.id
-			};
-		} catch (error) {
-			await configs.deleteConfiguration({
-				branchId,
-				componentId: VARIABLES_COMPONENT_ID,
-				configId: config.id
-			}).catch((cleanupError) => {
-				if (error instanceof Error && error.cause === void 0) error.cause = cleanupError;
-			});
-			throw error;
-		}
-	};
-	return {
-		/** Copy a variables config into a fresh, independent config + values row. */
-		copy: async ({ variablesId, variablesValuesId, branchId = "default" }) => {
-			const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);
-			return createVariables(definitions, values, branchId);
-		},
-		/** Merge the source's variables into the target's and create a fresh merged config + values row. */
-		merge: async ({ targetVariablesId, targetValuesId, sourceVariablesId, sourceValuesId, branchId = "default" }) => {
-			const [target, source] = await Promise.all([readVariables(targetVariablesId, targetValuesId, branchId), readVariables(sourceVariablesId, sourceValuesId, branchId)]);
-			return createVariables(mergeVariableDefinitions(target.definitions, source.definitions), mergeVariableValues(target.values, source.values), branchId);
-		}
-	};
-};
-// src/keboola/createSdk.ts
-const createSdk = ({ storage, services }) => ({
-	tag: createTagSdk({ metastoreClient: services.metastore }),
-	semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),
-	kaiMemory: createKaiMemorySdk({ metastoreClient: services.metastore }),
-	vault: createVaultSdk({
-		vaultClient: services.vault,
-		encryptionClient: services.encryption
-	}),
-	variables: createVariablesSdk({ storageClient: storage })
-});
-// src/keboola/createServiceClients.ts
-const withPath = (serviceBaseUrl, path) => typeof serviceBaseUrl === "string" ? `${serviceBaseUrl}${path}` : async () => `${await serviceBaseUrl()}${path}`;
-const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
-	getServiceBaseUrl,
-	onUnavailable: ({ serviceId, path, clientName }) => {
-		throw new ServiceUnavailableError(serviceId, path, clientName);
-	}
-}).add({
-	serviceId: "vault",
-	clientName: "vault",
-	clientFn: (serviceBaseUrl) => createVaultClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("vault", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "data-science",
-	clientName: "dataScience",
-	clientFn: (serviceBaseUrl) => createDataScienceClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("dataScience", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "data-science",
-	clientName: "apps",
-	clientFn: (serviceBaseUrl) => createAppsClient({
-		baseUrl: withPath(serviceBaseUrl, "/v2"),
-		middlewares: middlewareFor("apps", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "encryption",
-	clientName: "encryption",
-	clientFn: (serviceBaseUrl) => createEncryptionClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("encryption")
-	})
-}).add({
-	serviceId: "editor",
-	clientName: "editor",
-	clientFn: (serviceBaseUrl) => createEditorClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("editor", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "sync-actions",
-	clientName: "syncActions",
-	clientFn: (serviceBaseUrl) => createSyncActionsClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("syncActions", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "telemetry",
-	clientName: "telemetry",
-	clientFn: (serviceBaseUrl) => createTelemetryClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("telemetry", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "query",
-	clientName: "queryService",
-	clientFn: (serviceBaseUrl) => createQueryServiceClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("queryService", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "queue",
-	clientName: "queue",
-	clientFn: (serviceBaseUrl) => createQueueClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("queue", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "kai-assistant",
-	clientName: "chat",
-	clientFn: (serviceBaseUrl) => createChatClient({
-		storageApiUrl: baseUrl,
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("chat", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "ai",
-	clientName: "ai",
-	clientFn: (serviceBaseUrl) => createAiClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("ai", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "ai",
-	clientName: "omnisearch",
-	clientFn: (serviceBaseUrl) => createOmnisearchClient({
-		baseUrl: withPath(serviceBaseUrl, "/omnisearch"),
-		middlewares: middlewareFor("omnisearch", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "import",
-	clientName: "import",
-	clientFn: (serviceBaseUrl) => createImportClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("import", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "kai-agent",
-	clientName: "kaiAgent",
-	clientFn: (serviceBaseUrl) => createKaiAgentClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "components-mcp",
-	clientName: "componentsMcp",
-	clientFn: (serviceBaseUrl) => createComponentsMcpClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("componentsMcp", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "oauth",
-	clientName: "oauth",
-	clientFn: (serviceBaseUrl) => createOauthClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("oauth", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "scheduler",
-	clientName: "scheduler",
-	clientFn: (serviceBaseUrl) => createSchedulerClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("scheduler", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "stream",
-	clientName: "stream",
-	clientFn: (serviceBaseUrl) => createStreamClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("stream", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "notification",
-	clientName: "notifications",
-	clientFn: (serviceBaseUrl) => createNotificationsClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("notifications", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "billing",
-	clientName: "billing",
-	clientFn: (serviceBaseUrl) => createBillingClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("billing", [attachTokenMiddleware]),
-		auth
-	})
-}).add({
-	serviceId: "metastore",
-	clientName: "metastore",
-	clientFn: (serviceBaseUrl) => createMetastoreClient({
-		baseUrl: serviceBaseUrl,
-		middlewares: middlewareFor("metastore", [attachTokenMiddleware]),
-		auth
-	})
-}).build();
-// src/keboola/legacy/createProjectClients.ts
-const createAttachStorageToken = (getToken) => (next) => (request) => {
-	request.request.headers.set(KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());
-	return next(request);
-};
-const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRefreshed, middlewareFor, clientServiceUrls }) => {
-	const auth = {
-		type: "sapi-token",
-		token: getStorageToken()
-	};
-	const attach = createAttachStorageToken(getStorageToken);
-	const stackInfo = await createStorageClient({
-		baseUrl,
-		auth,
-		middlewares: [attach]
-	}).getStackInfo({ exclude: "componentDetails" });
-	const stack = createStack({
-		stackInfo,
-		clientServiceUrls
-	});
-	const storage = createStorageClient({
-		baseUrl,
-		auth,
-		middlewares: middlewareFor("storage", []),
-		onRefreshToken: onStorageTokenRefreshed
-	});
-	const { client: services, meta: serviceMeta } = createServiceClients({
-		baseUrl,
-		auth,
-		getServiceBaseUrl: stack.getServiceUrl,
-		middlewareFor,
-		attachTokenMiddleware: attach
-	});
-	return {
-		baseUrl: normalizeBaseUrl(baseUrl),
-		stack,
-		serviceMeta,
-		storage,
-		...services,
-		sdk: createSdk({
-			storage,
-			services
-		})
-	};
-};
-// src/keboola/legacy/keboola.ts
-const createLegacyKeboola = (options = {}) => {
-	const config = createConfig();
-	const middlewareFor = createMiddlewareFor(options.middlewares);
-	const authClient = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => state.baseUrl,
-		build: (baseUrl) => baseUrl ? createAuthClient({
-			baseUrl,
-			middlewares: middlewareFor("auth", [])
-		}) : null
-	});
-	const management = createDerivedStore({
-		source: config.store,
-		dependsOn: (state) => ({
-			baseUrl: state.baseUrl,
-			token: state.managementToken
-		}),
-		build: ({ baseUrl, token }) => baseUrl ? createManagementClient({
-			baseUrl,
-			auth: token ? {
-				type: "management-token",
-				token
-			} : { type: "management-token" },
-			middlewares: middlewareFor("management", [])
-		}) : null
-	});
-	const build = createDerivedAsyncStore({
-		source: config.store,
-		dependsOn: (state) => state.sapiToken && state.baseUrl ? state.baseUrl : null,
-		build: (baseUrl) => createProjectClients({
-			baseUrl,
-			getStorageToken: config.getStorageToken,
-			onStorageTokenRefreshed: config.setStorageToken,
-			middlewareFor,
-			clientServiceUrls: options.clientServiceUrls
-		})
-	});
-	if (options.baseUrl) config.setBaseUrl(options.baseUrl);
-	const debug = () => {
-		const info = config.debug();
-		return {
-			type: "Sapi",
-			config: info,
-			authReady: authClient.get() !== null,
-			managementReady: !!info.managementToken,
-			storage: build.store.get().state
-		};
-	};
-	const session = {
-		setBaseUrl: config.setBaseUrl,
-		isStorageReady: () => build.store.get().state === "ready",
-		authenticateStorage: (sapiToken) => config.authenticate({ sapiToken }),
-		authenticateStorageAsync: async (sapiToken) => {
-			config.authenticate({ sapiToken });
-			await build.settled();
-		},
-		authenticateManagement: (managementToken) => config.authenticate({ managementToken }),
-		subscribe: (listener) => {
-			const unsubscribeConfig = config.store.subscribe(() => listener(debug()));
-			const unsubscribeBuild = build.store.subscribe(() => listener(debug()));
-			return () => {
-				unsubscribeConfig();
-				unsubscribeBuild();
-			};
-		},
-		debug
-	};
-	return {
-		api: createApi({
-			getAuthClient: () => authClient.get(),
-			getManagementClient: () => management.get(),
-			getProjectClients: () => {
-				const state = build.store.get();
-				return state.state === "ready" ? state.value : null;
-			}
-		}),
-		session
-	};
-};
-// src/keboola/bearer/state/auth.ts
-const grantOf = (credential) => credential.type === "token" ? {
-	type: "token",
-	refreshToken: credential.refreshToken
-} : {
-	type: "cookie",
-	sessionId: credential.sessionId
-};
-const stamped = (input) => ({
-	...input,
-	issuedAt: Date.now()
-});
-const credentialOf = (auth) => auth.status === "authenticated" ? Result.success(auth.credential) : Result.failure(new KeboolaError(KeboolaErrorType.NotAuthenticated));
-/**
-* The stack's credential and its sign-in pin.
-*
-* - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly "which
-*   sign-in is this" — what an in-flight exchange compares itself against.
-*/
-const createAuth = (stacks) => {
-	const expired = /* @__PURE__ */ new Set();
-	const requireCredential = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => credentialOf(stack.auth));
-	const requireUnauthenticated = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? Result.failure(new KeboolaError(KeboolaErrorType.AlreadyAuthenticated)) : Result.success(stack));
-	const requireAnonymous = (baseUrl) => Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`)) : Result.success(stack));
-	const requireRestoring = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? Result.success(stack) : Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`)));
-	const startRestore = (baseUrl) => Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: { status: "restoring" }
-	}));
-	const cancelRestore = (baseUrl) => Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: { status: "anonymous" }
-	}));
-	const authenticate = (baseUrl, input) => Result.map(requireUnauthenticated(baseUrl), (stack) => {
-		expired.delete(baseUrl);
-		return stacks.set({
-			...stack,
-			epoch: stack.epoch + 1,
-			auth: {
-				status: "authenticated",
-				credential: stamped(input)
-			},
-			retained: null
-		});
-	});
-	const applyRefresh = (baseUrl, input) => Result.andThen(requireCredential(baseUrl), (credential) => credential.type !== input.type ? Result.failure(/* @__PURE__ */ new Error(`A ${credential.type} grant cannot become ${input.type}`)) : Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: {
-			status: "authenticated",
-			credential: stamped(input)
-		}
-	})));
-	const forceExpire = (baseUrl) => Result.andThen(requireCredential(baseUrl), (credential) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		auth: {
-			status: "authenticated",
-			credential: {
-				...credential,
-				issuedAt: Date.now() - credential.expiresIn * 1e3
-			}
-		}
-	})));
-	const signOut = (baseUrl, { retain = false } = {}) => Result.map(stacks.get(baseUrl), (stack) => {
-		const retained = retain ? Result.unwrapOr(Result.map(credentialOf(stack.auth), (credential) => ({ grant: grantOf(credential) })), stack.retained) : null;
-		return stacks.set({
-			...stack,
-			epoch: stack.epoch + 1,
-			auth: { status: "anonymous" },
-			retained
-		});
-	});
-	const retain = (baseUrl, retained) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		retained
-	}));
-	const dropRetained = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
-		...stack,
-		retained: null
-	}));
-	const requireRetained = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? Result.success(stack.retained) : Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`)));
-	const notifyExpired = (baseUrl) => {
-		if (expired.has(baseUrl)) return false;
-		expired.add(baseUrl);
-		return true;
-	};
-	const getEpoch = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
-	const getAccessToken = (baseUrl) => Result.unwrapOr(Result.map(requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
-	return {
-		startRestore,
-		cancelRestore,
-		authenticate,
-		applyRefresh,
-		forceExpire,
-		signOut,
-		retain,
-		dropRetained,
-		requireRetained,
-		notifyExpired,
-		requireCredential,
-		getEpoch,
-		getAccessToken
-	};
-};
-// src/keboola/bearer/state/stacks.ts
-const newStack = (baseUrl) => ({
-	baseUrl,
-	context: "idle",
-	epoch: 0,
-	auth: { status: "anonymous" },
-	retained: null
-});
-/** One entry per stack, and the verbs that open and select them. */
-const createStacks = (store) => {
-	const get = (baseUrl) => {
-		const stack = store.get().stacks[baseUrl];
-		return stack ? Result.success(stack) : Result.failure(new KeboolaError(KeboolaErrorType.Unconfigured));
-	};
-	const set = (stack) => {
-		const state = store.get();
-		store.set({
-			...state,
-			stacks: {
-				...state.stacks,
-				[stack.baseUrl]: stack
-			}
-		});
-		return stack;
-	};
-	const update = (baseUrl, updater) => Result.map(get(baseUrl), (stack) => set(updater(stack)));
-	const ensure = (baseUrl) => {
-		const existing = get(baseUrl);
-		if (existing.success) return existing.data;
-		return set(newStack(baseUrl));
-	};
-	const getActive = () => {
-		const { active } = store.get();
-		const stack = get(active);
-		if (!stack.success) throw new Error(`The active stack has no row: ${active}`);
-		return stack.data;
-	};
-	const select = (baseUrl) => {
-		const stack = ensure(baseUrl);
-		const state = store.get();
-		if (state.active !== baseUrl) store.set({
-			...state,
-			active: baseUrl
-		});
-		return stack;
-	};
-	const updateContext = (baseUrl, context) => update(baseUrl, (stack) => ({
-		...stack,
-		context
-	}));
-	return {
-		get,
-		set,
-		update,
-		ensure,
-		getActive,
-		select,
-		updateContext
-	};
-};
-// src/keboola/bearer/state/state.ts
+// src/keboola/state/state.ts
 /**
 * The stack table and the rules over it, one namespace per concern.
 *
@@ -1187,8 +528,9 @@ const createState = (defaultBaseUrl) => {
 		auth
 	};
 };
-// src/keboola/bearer/credentials/credentials.ts
+// src/keboola/credentials/credentials.ts
 const DEFAULT_REFRESH_THRESHOLD = .9;
+const END_SESSION_TIMEOUT_MS = 1e4;
 const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
 const toRestoreStatus = (outcome) => {
 	if (outcome === void 0 || outcome === "skipped") return "empty";
@@ -1229,13 +571,18 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		const refreshed = await Result.tryCatchAsync(() => renew(client, grant));
 		return isSameSignIn() ? refreshed : Result.failure(signInEnded());
 	};
+	/**
+	* The grant to rotate, or the sign-out another tab stored.
+	*
+	* - `{ retained }`: the stored sign-in ended; `retained` is what a retained sign-out kept.
+	*/
 	const getGrantForRotation = async (store, baseUrl, credential) => {
 		const isSameSignIn = markSignIn(baseUrl);
 		const hydrated = await Result.tryCatchAsync(() => store.read());
 		if (!hydrated.success) return hydrated;
 		if (!isSameSignIn()) return Result.failure(signInEnded());
 		const persistedStack = hydrated.data.stacks.find((stack) => stack.baseUrl === baseUrl);
-		if (persistedStack && persistedStack.credential === null) return Result.failure(signInEnded());
+		if (persistedStack && persistedStack.credential === null) return Result.success({ retained: persistedStack.retained ?? null });
 		return Result.success(persistedStack?.credential ?? grantOf(credential));
 	};
 	const rotateOnce = async (baseUrl) => persistor.locked(async (store) => {
@@ -1243,6 +590,10 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		if (!credential.success) return credential;
 		const grant = await getGrantForRotation(store, baseUrl, credential.data);
 		if (!grant.success) return grant;
+		if ("retained" in grant.data) {
+			await expire(baseUrl, store, grant.data.retained);
+			return Result.failure(signInEnded());
+		}
 		const refreshed = await refresh(baseUrl, grant.data);
 		if (!refreshed.success) {
 			if (isUnauthorized(refreshed.error)) await expire(baseUrl, store);
@@ -1314,9 +665,10 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		onSignedOut?.(baseUrl);
 		return signedOut;
 	};
-	const expire = async (baseUrl, store) => {
+	const expire = async (baseUrl, store, retained = null) => {
 		if (!state.auth.notifyExpired(baseUrl)) return;
 		signOut(baseUrl);
+		if (retained) state.auth.retain(baseUrl, retained);
 		await store.persistStack(baseUrl, state.store.get());
 		onExpired?.(baseUrl);
 	};
@@ -1329,19 +681,360 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 			if (!state.auth.requireCredential(baseUrl).success) return null;
 			return Result.unwrap(await rotate(baseUrl));
 		}
-		await renewIfStale(baseUrl);
-		return state.auth.getAccessToken(baseUrl);
-	} });
+		await renewIfStale(baseUrl);
+		return state.auth.getAccessToken(baseUrl);
+	} });
+	/**
+	* Ends a signed-out grant's server session: its refresh, derived PATs and paired browser session.
+	*
+	* 1. `token`: revokes the refresh token; the server also takes the one before the last rotation.
+	* 2. `cookie`: renews off the session cookie, then revokes that fresh access token.
+	* - Never an access token held from before: one rotation later the server no longer knows it.
+	* - Best effort, bounded by `END_SESSION_TIMEOUT_MS`: a failure is logged, the sign-out stands.
+	*/
+	const endSession = async (baseUrl, grant) => {
+		const client = createAuthClient({
+			baseUrl,
+			middlewares
+		});
+		const signal = AbortSignal.timeout(END_SESSION_TIMEOUT_MS);
+		try {
+			const body = grant.type === "token" ? {
+				token: grant.refreshToken,
+				tokenTypeHint: "refreshToken"
+			} : {
+				token: (await client.token.refreshWithSession({ sessionId: grant.sessionId }, signal)).accessToken,
+				tokenTypeHint: "accessToken"
+			};
+			await client.token.revoke(body, signal);
+		} catch (error) {
+			console.warn("createCredentials: the session could not be ended", error);
+		}
+	};
+	return {
+		middleware,
+		rotate,
+		renewIfStale,
+		restore,
+		restoreRetained,
+		signOut,
+		endSession
+	};
+};
+// src/serviceClientRegistry/utils.ts
+const isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
+/**
+* Creates a dummy client that intercepts method calls and invokes the provided onCall callback.
+*/
+const createDummyClient = ({ onCall }) => {
+	const createProxy = (path = []) => new Proxy(() => {}, {
+		get: (_target, prop) => {
+			if (isBuiltInProperty(prop)) return void 0;
+			return createProxy([...path, prop]);
+		},
+		apply: (_target, _thisArgs, args) => onCall(path, args)
+	});
+	return createProxy();
+};
+// src/serviceClientRegistry/createServiceClientRegistry.ts
+const createServiceClientRegistry = () => ({ getServiceBaseUrl, onUnavailable }) => {
+	const dummy = (serviceId, clientName) => createDummyClient({ onCall: (path, args) => {
+		onUnavailable?.({
+			serviceId,
+			path,
+			args,
+			clientName
+		});
+	} });
+	const configs = [];
+	const resolveClient = ({ serviceId, clientFn, clientName }) => {
+		const serviceBaseUrl = getServiceBaseUrl(serviceId);
+		return serviceBaseUrl ? clientFn(serviceBaseUrl) : dummy(serviceId, clientName);
+	};
+	const registry = {
+		add: (config) => {
+			configs.push(config);
+			return registry;
+		},
+		build: () => {
+			const clientMap = {};
+			configs.forEach((config) => {
+				clientMap[config.clientName] = resolveClient(config);
+			});
+			return { client: clientMap };
+		}
+	};
+	return registry;
+};
+// src/sdks/variables/variablesSdk.ts
+const VARIABLES_COMPONENT_ID = "keboola.variables";
+/** Union the definitions by name; on a name conflict the target's definition is kept. */
+const mergeVariableDefinitions = (target, source) => {
+	const targetNames = new Set(target.map((definition) => definition.name));
+	return [...target, ...source.filter((definition) => !targetNames.has(definition.name))];
+};
+/** Add values missing in the target; on a name conflict the value is updated to the source's. */
+const mergeVariableValues = (target, source) => {
+	const sourceByName = new Map(source.map((value) => [value.name, value.value]));
+	const targetNames = new Set(target.map((value) => value.name));
+	return [...target.map((value) => sourceByName.has(value.name) ? {
+		...value,
+		value: sourceByName.get(value.name)
+	} : value), ...source.filter((value) => !targetNames.has(value.name))];
+};
+/**
+* Orchestration for `keboola.variables` configs: copy a config, or merge two configs into a fresh
+* one (union definitions, upsert values — source wins on a name conflict). Each result is a brand
+* new config + values row, so the caller can reference it without sharing lineage with the source.
+*/
+const createVariablesSdk = ({ storageClient }) => {
+	const configs = storageClient.configurations;
+	const rows = storageClient.configurationRows;
+	const readVariables = async (configId, valuesRowId, branchId) => {
+		const config = await configs.getConfiguration({
+			componentId: VARIABLES_COMPONENT_ID,
+			configId,
+			branchId
+		});
+		const row = config.rows.find((candidate) => candidate.id === valuesRowId) ?? config.rows[0];
+		const rawDefinitions = config.configuration?.variables;
+		const rawValues = row?.configuration?.values;
+		return {
+			definitions: Array.isArray(rawDefinitions) ? rawDefinitions : [],
+			values: Array.isArray(rawValues) ? rawValues : []
+		};
+	};
+	const createVariables = async (definitions, values, branchId) => {
+		const config = await configs.createConfiguration({
+			branchId,
+			componentId: VARIABLES_COMPONENT_ID,
+			name: "Variables definition",
+			configuration: { variables: definitions }
+		});
+		try {
+			const row = await rows.createConfigurationRow({
+				branchId: String(branchId),
+				componentId: VARIABLES_COMPONENT_ID,
+				configurationId: config.id,
+				name: "Default values",
+				configuration: { values }
+			});
+			return {
+				variablesId: config.id,
+				variablesValuesId: row.id
+			};
+		} catch (error) {
+			await configs.deleteConfiguration({
+				branchId,
+				componentId: VARIABLES_COMPONENT_ID,
+				configId: config.id
+			}).catch((cleanupError) => {
+				if (error instanceof Error && error.cause === void 0) error.cause = cleanupError;
+			});
+			throw error;
+		}
+	};
 	return {
-		middleware,
-		rotate,
-		renewIfStale,
-		restore,
-		restoreRetained,
-		signOut
+		/** Copy a variables config into a fresh, independent config + values row. */
+		copy: async ({ variablesId, variablesValuesId, branchId = "default" }) => {
+			const { definitions, values } = await readVariables(variablesId, variablesValuesId, branchId);
+			return createVariables(definitions, values, branchId);
+		},
+		/** Merge the source's variables into the target's and create a fresh merged config + values row. */
+		merge: async ({ targetVariablesId, targetValuesId, sourceVariablesId, sourceValuesId, branchId = "default" }) => {
+			const [target, source] = await Promise.all([readVariables(targetVariablesId, targetValuesId, branchId), readVariables(sourceVariablesId, sourceValuesId, branchId)]);
+			return createVariables(mergeVariableDefinitions(target.definitions, source.definitions), mergeVariableValues(target.values, source.values), branchId);
+		}
 	};
 };
-// src/keboola/bearer/perProject.ts
+// src/keboola/createSdk.ts
+const createSdk = ({ storage, services }) => ({
+	tag: createTagSdk({ metastoreClient: services.metastore }),
+	semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),
+	kaiMemory: createKaiMemorySdk({ metastoreClient: services.metastore }),
+	vault: createVaultSdk({
+		vaultClient: services.vault,
+		encryptionClient: services.encryption
+	}),
+	variables: createVariablesSdk({ storageClient: storage })
+});
+// src/keboola/createServiceClients.ts
+const withPath = (serviceBaseUrl, path) => typeof serviceBaseUrl === "string" ? `${serviceBaseUrl}${path}` : async () => `${await serviceBaseUrl()}${path}`;
+const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
+	getServiceBaseUrl,
+	onUnavailable: ({ serviceId, path, clientName }) => {
+		throw new ServiceUnavailableError(serviceId, path, clientName);
+	}
+}).add({
+	serviceId: "vault",
+	clientName: "vault",
+	clientFn: (serviceBaseUrl) => createVaultClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("vault", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "data-science",
+	clientName: "dataScience",
+	clientFn: (serviceBaseUrl) => createDataScienceClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("dataScience", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "data-science",
+	clientName: "apps",
+	clientFn: (serviceBaseUrl) => createAppsClient({
+		baseUrl: withPath(serviceBaseUrl, "/v2"),
+		middlewares: middlewareFor("apps", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "encryption",
+	clientName: "encryption",
+	clientFn: (serviceBaseUrl) => createEncryptionClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("encryption")
+	})
+}).add({
+	serviceId: "editor",
+	clientName: "editor",
+	clientFn: (serviceBaseUrl) => createEditorClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("editor", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "sync-actions",
+	clientName: "syncActions",
+	clientFn: (serviceBaseUrl) => createSyncActionsClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("syncActions", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "telemetry",
+	clientName: "telemetry",
+	clientFn: (serviceBaseUrl) => createTelemetryClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("telemetry", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "query",
+	clientName: "queryService",
+	clientFn: (serviceBaseUrl) => createQueryServiceClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("queryService", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "queue",
+	clientName: "queue",
+	clientFn: (serviceBaseUrl) => createQueueClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("queue", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "kai-assistant",
+	clientName: "chat",
+	clientFn: (serviceBaseUrl) => createChatClient({
+		storageApiUrl: baseUrl,
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("chat", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "ai",
+	clientName: "ai",
+	clientFn: (serviceBaseUrl) => createAiClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("ai", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "ai",
+	clientName: "omnisearch",
+	clientFn: (serviceBaseUrl) => createOmnisearchClient({
+		baseUrl: withPath(serviceBaseUrl, "/omnisearch"),
+		middlewares: middlewareFor("omnisearch", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "import",
+	clientName: "import",
+	clientFn: (serviceBaseUrl) => createImportClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("import", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "kai-agent",
+	clientName: "kaiAgent",
+	clientFn: (serviceBaseUrl) => createKaiAgentClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "components-mcp",
+	clientName: "componentsMcp",
+	clientFn: (serviceBaseUrl) => createComponentsMcpClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("componentsMcp", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "oauth",
+	clientName: "oauth",
+	clientFn: (serviceBaseUrl) => createOauthClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("oauth", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "scheduler",
+	clientName: "scheduler",
+	clientFn: (serviceBaseUrl) => createSchedulerClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("scheduler", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "stream",
+	clientName: "stream",
+	clientFn: (serviceBaseUrl) => createStreamClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("stream", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "notification",
+	clientName: "notifications",
+	clientFn: (serviceBaseUrl) => createNotificationsClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("notifications", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "billing",
+	clientName: "billing",
+	clientFn: (serviceBaseUrl) => createBillingClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("billing", [attachTokenMiddleware]),
+		auth
+	})
+}).add({
+	serviceId: "metastore",
+	clientName: "metastore",
+	clientFn: (serviceBaseUrl) => createMetastoreClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("metastore", [attachTokenMiddleware]),
+		auth
+	})
+}).build();
+// src/keboola/perProject.ts
 const projectKey = ({ baseUrl, projectId }) => `${baseUrl}#${projectId}`;
 /**
 * One handle per project, and the one call that drops it.
@@ -1376,12 +1069,12 @@ const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 			auth: authFor(project),
 			middlewares: middlewareFor("storage", [attach])
 		});
-		const { client, meta } = createServiceClients({
+		const { client } = createServiceClients({
 			baseUrl: project.baseUrl,
 			auth: authFor(project),
 			getServiceBaseUrl: (serviceId) => async () => {
 				const serviceUrl = (await stack.context.getAsync(project.baseUrl)).getServiceUrl(serviceId);
-				assert$1(serviceUrl, KeboolaErrorType.NotReady);
+				if (!serviceUrl) throw new ServiceUnavailableError(serviceId);
 				return serviceUrl;
 			},
 			middlewareFor,
@@ -1400,7 +1093,6 @@ const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 				if (property === "stack" || property === "auth" || property === "management") return stack.get(project.baseUrl)[property];
 				if (property === "storage") return storage;
 				if (property === "sdk") return sdk;
-				if (property === "serviceMeta") return meta;
 				return client[property];
 			} }),
 			end: () => {
@@ -1422,13 +1114,13 @@ const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 		forgetUnder
 	};
 };
-// src/keboola/bearer/persistor.ts
+// src/keboola/persistor.ts
 /**
 * Where a bearer session is persisted, under whichever adapter the client was given.
 *
 * Exported because a consumer sometimes has to drop a session a client cannot reach: the adapter is
 * chosen at construction, so a client built without one holds no handle to the storage its own
-* session is sitting in. `AppAuthStrategy` in kbc-ui is that case.
+* session is sitting in.
 */
 const SESSION_STORAGE_KEY = "keboola:session";
 /**
@@ -1555,7 +1247,44 @@ const createSessionPersistor = (storage) => {
 		snapshot
 	};
 };
-// src/keboola/bearer/context.ts
+// src/domain/stack.ts
+const isServiceId = (id) => Object.values(ServiceId).includes(id);
+const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
+const createStack = ({ stackInfo, clientServiceUrls }) => {
+	const { services, components, features, ...infoRest } = stackInfo;
+	const serviceMap = new Map(services.map((service) => {
+		if (!isServiceId(service.id)) return [service.id, service.url];
+		const devOverride = clientServiceUrls?.[service.id]?.(service.url);
+		const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
+		const url = devOverride ?? prodOverride ?? service.url;
+		return [service.id, url];
+	}));
+	const componentMap = new Map(components.map((component) => [component.id, component]));
+	const featureSet = new Set(features);
+	const hasFeature = (...feature) => {
+		if (feature.length === 0) return false;
+		return feature.every((x) => featureSet.has(x));
+	};
+	const hasComponent = (...componentId) => {
+		if (componentId.length === 0) return false;
+		return componentId.every((x) => componentMap.has(x));
+	};
+	const getComponent = (componentId) => componentMap.get(componentId) ?? null;
+	const hasService = (serviceId) => serviceMap.has(serviceId);
+	const getServiceUrl = (serviceId) => serviceMap.get(serviceId) ?? null;
+	return {
+		...infoRest,
+		services,
+		features,
+		components,
+		hasFeature,
+		getServiceUrl,
+		hasService,
+		getComponent,
+		hasComponent
+	};
+};
+// src/keboola/context.ts
 const STACK_INDEX_TIMEOUT_MS = 3e4;
 /**
 * One parsed stack index per stack; `createStack` applies the dev and production overrides.
@@ -1621,7 +1350,7 @@ const createStackContext = ({ state, clientServiceUrls }) => {
 		getAsync
 	};
 };
-// src/keboola/bearer/perStack.ts
+// src/keboola/perStack.ts
 /**
 * Everything one stack derives.
 *
@@ -1659,7 +1388,7 @@ const createPerStack = ({ state, credentials, middlewareFor, clientServiceUrls }
 		get
 	};
 };
-// src/keboola/bearer/keboola.ts
+// src/keboola/keboola.ts
 /**
 * The bearer client: the session table, its two scopes, and the surface they back.
 *
@@ -1747,20 +1476,39 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			return active().management;
 		}
 	};
-	const getStackApi = () => stackApi;
-	const getProjectApi = (projectId) => perProject.get(onActiveStack(projectId));
+	const projectApi = (projectId) => perProject.get(onActiveStack(projectId));
 	/**
 	* The scope's sign-in, or a named stack's — and everything that sign-in derived.
 	*
+	* - Ends the server session too (`credentials.endSession`).
 	* - `retain` keeps the grant on the stack, persisted beside the sign-in it ended, for
-	*   `restoreRetained`; the next sign-in on the stack replaces it.
-	* - The table is signed out on return; the promise resolves once that is stored, so a caller
-	*   leaving the document waits for it.
+	*   `restoreRetained`, and so leaves the server session live; the next sign-in replaces it.
+	* - The table is signed out on return; the promise resolves once that is stored and the
+	*   session's end was attempted, so a caller leaving the document waits for both.
 	*/
-	const signOut = ({ baseUrl, ...options } = {}) => {
-		const target = requireStackUrl(baseUrl);
+	const signOut = ({ baseUrl, ...options } = {}) => endSignIn(requireStackUrl(baseUrl), options, !options.retain);
+	const endingSessions = /* @__PURE__ */ new Map();
+	/** `signOut`; `endSession: false` leaves the server session alone. */
+	const endSignIn = (target, options, endSession) => {
+		const held = endSession ? Result.unwrapOr(state.auth.requireCredential(target), null) : null;
 		const signedOut = Result.unwrap(credentials.signOut(target, options));
-		return persistor.locked((store) => store.persistStack(target, state.store.get())).then(() => signedOut);
+		let newest = held && grantOf(held);
+		const ended = persistor.locked(async (store) => {
+			if (held !== null) newest = (await store.read()).stacks.find((stack) => stack.baseUrl === target)?.credential ?? newest;
+			await store.persistStack(target, state.store.get());
+		}).then(() => newest ? credentials.endSession(target, newest) : void 0, async (error) => {
+			if (newest) await credentials.endSession(target, newest);
+			throw error;
+		});
+		const earlier = endingSessions.get(target);
+		if (held !== null) {
+			endingSessions.set(target, ended);
+			const forget = () => {
+				if (endingSessions.get(target) === ended) endingSessions.delete(target);
+			};
+			ended.then(forget, forget);
+		}
+		return Promise.all([ended, earlier]).then(() => signedOut);
 	};
 	/** Signs a stack back in from what a retained sign-out kept; `unreachable` leaves it to retry. */
 	const restoreRetained = (baseUrl) => credentials.restoreRetained(normalizeBaseUrl(baseUrl));
@@ -1769,9 +1517,12 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	*
 	* - Signs out first, always: a sign-out moves the epoch even on an anonymous stack, so a stored
 	*   session still being restored cannot land on top of this one.
+	* - Locally only: the replaced sign-in can share a browser session with `input`.
 	*/
 	const replace = (input) => {
-		signOut();
+		endSignIn(requireStackUrl(), {}, false).catch((error) => {
+			console.warn("createKeboola: the replaced sign-in could not be stored", error);
+		});
 		return authenticate(input);
 	};
 	let persisting = false;
@@ -1837,8 +1588,8 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		return verb(...args);
 	};
 	return {
-		getStackApi,
-		getProjectApi,
+		stackApi,
+		projectApi,
 		session: {
 			getState: state.store.get,
 			subscribe: state.store.subscribe,
@@ -2061,6 +1812,6 @@ const createBranchRefs = ({ devBranches }) => {
 		resolve: (ref) => getType(ref) === "default" ? defaultBranch.id : Number(ref)
 	};
 };
-export { ApiError, HtmlResponseError, HttpContentType, HttpHeader, KeboolaError, KeboolaErrorType, KeboolaHttpHeader, ManagementClientAuthError, ManagementSessionMintError, QueryJobError, QueueJobError, Result, RowLevelSecurityError, SESSION_STORAGE_KEY, ServiceUnavailableError, StorageJobError, SyncActionError, UserError, ValidationError, asError, assert, coalesce, collectByCursor, collectByOffset, concurrent, createAdminAccount, createBranchRefs, createDerivedAsyncStore, createDerivedStore, createEmitter, createGenericFetchClient, createKeboola, createLegacyKeboola, createLocalStorage, createLoggingMiddleware, createMemoryStorage, createNullStorage, createPersistor, createPollRegistry, createProject, createQueryServiceSdk, createRetryMiddleware, createSessionStorage, createStore, createUiVersionMiddleware, dedupe, deepMerge, delay, emitter, ensure, failureOf, formatValidationIssues, generateUUID, isAbortError, isApiError, isEmptyDeep, isFetchClientError, isHtmlResponseError, isKeboolaError, isManageError, isManagementClientAuthError, isManagementSessionMintError, isPlainObject, isQueryJobError, isQueueJobError, isRowLevelSecurityError, isStorageJobError, isSyncActionError, isTimeoutError, isValidationError, jobStatus, keboolaUID, lazy, manageErrorCode, nextCursorOf, parseLogLines, parseOrThrow, poller, queueSeries, readableReason, retryAfterSeconds, schemaGuidedMerge, series, shallowEqual };
+export { ApiError, HtmlResponseError, HttpContentType, HttpHeader, KeboolaError, KeboolaErrorType, KeboolaHttpHeader, ManagementClientAuthError, ManagementSessionMintError, QueryJobError, QueueJobError, Result, RowLevelSecurityError, SESSION_STORAGE_KEY, ServiceUnavailableError, StorageJobError, SyncActionError, UserError, ValidationError, asError, assert, coalesce, collectByCursor, collectByOffset, concurrent, createAdminAccount, createBranchRefs, createEmitter, createGenericFetchClient, createKeboola, createLocalStorage, createLoggingMiddleware, createMemoryStorage, createNullStorage, createPersistor, createPollRegistry, createProject, createQueryServiceSdk, createRetryMiddleware, createSessionStorage, createStore, createUiVersionMiddleware, dedupe, deepMerge, delay, emitter, ensure, failureOf, formatValidationIssues, generateUUID, isAbortError, isApiError, isEmptyDeep, isFetchClientError, isHtmlResponseError, isKeboolaError, isManageError, isManagementClientAuthError, isManagementSessionMintError, isPlainObject, isQueryJobError, isQueueJobError, isRowLevelSecurityError, isStorageJobError, isSyncActionError, isTimeoutError, isValidationError, iterateByCursor, jobStatus, keboolaUID, lazy, manageErrorCode, nextCursorOf, parseLogLines, parseOrThrow, poller, queueSeries, readableReason, retryAfterSeconds, schemaGuidedMerge, series };
 
 //# sourceMappingURL=index.js.map