@keboola/api-client 32.0.0 → 34.0.0

package/dist/index.cjs

@@ -1,51 +1,52 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_project = require("./project-BvFi19K_.cjs");
-const require_jobStatus = require("./jobStatus-kQ9JqF8t.cjs");
-const require_queue = require("./queue-B7TY4JLf.cjs");
+const require_jobStatus = require("./jobStatus-0_Y3Sr4i.cjs");
+const require_queue = require("./queue-OJJUUqc2.cjs");
 const require_concurrent = require("./concurrent-tbiIa0UL.cjs");
 const require_dedupe = require("./dedupe-CiskLkGR.cjs");
-const require_createStore = require("./createStore-MQbboXcB.cjs");
-const require_storage = require("./storage-CihHwZ7z.cjs");
+const require_store = require("./store-xS-Cu_VS.cjs");
+const require_storage = require("./storage-BKm7cztt.cjs");
 const require_tag = require("./tag-CsoOZWB_.cjs");
 const require_generateUUID = require("./generateUUID-C6qKBPIv.cjs");
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-Ck-mNB_E.cjs");
+const require_configurations = require("./configurations-zkNjr73Q.cjs");
 const require_UserError = require("./UserError-CSGO1qII.cjs");
-const require_createFetchClient = require("./createFetchClient-BRfTjBLV.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-V9q6Nl6u.cjs");
-const require_ManagementClientAuthError = require("./ManagementClientAuthError-B-tyPlyG.cjs");
+const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-CsvYmCOI.cjs");
+const require_ManagementClientAuthError = require("./ManagementClientAuthError-DD4u0EU7.cjs");
 const require_QueryJobTimeoutError = require("./QueryJobTimeoutError-CVNPdCWX.cjs");
 const require_SyncActionError = require("./SyncActionError-BG0zwchi.cjs");
-const require_ValidationError = require("./ValidationError-h5qvwahi.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-DHs-i7_O.cjs");
-const require_import = require("./import-C0-y1GQK.cjs");
-const require_authClient = require("./authClient-b7uec7sw.cjs");
-const require_management = require("./management-DfjwQo7z.cjs");
-const require_constants = require("./constants-lIfSdTzS.cjs");
+const require_ValidationError = require("./ValidationError-CLVJCCwH.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-o3cPJeRn.cjs");
+const require_import = require("./import-C83w7BKz.cjs");
+const require_authClient = require("./authClient-_PpvGgZJ.cjs");
+const require_management = require("./management-BoxlRNg2.cjs");
+const require_constants = require("./constants-C4DlsF_M.cjs");
 const require_storageTable = require("./storageTable-C9crh4Ef.cjs");
-const require_sdk_semanticLayer_index = require("./sdk/semanticLayer/index.cjs");
+const require_semanticLayer = require("./semanticLayer-E0Vilu8u.cjs");
 const require_sdk_storage_index = require("./sdk/storage/index.cjs");
 const require_sdk_vault_index = require("./sdk/vault/index.cjs");
 const require_ai_index = require("./ai/index.cjs");
-const require_appLogs = require("./appLogs-NIEDTDHf.cjs");
+const require_appLogs = require("./appLogs-BjfUoWzs.cjs");
 const require_apps_index = require("./apps/index.cjs");
+const require_billing_index = require("./billing/index.cjs");
 const require_chat_index = require("./chat/index.cjs");
-const require_dataScience = require("./dataScience-wexHEIue.cjs");
+const require_dataScience = require("./dataScience-0Rl_EuV_.cjs");
 const require_editor_index = require("./editor/index.cjs");
 const require_encryption_index = require("./encryption/index.cjs");
-const require_kaiAgent = require("./kaiAgent-4OiIK1C2.cjs");
-const require_metastore = require("./metastore-Dq2NS6jb.cjs");
+const require_kaiAgent = require("./kaiAgent-B_TaUPRt.cjs");
+const require_metastore = require("./metastore-BYYWTb3m.cjs");
 const require_notifications_index = require("./notifications/index.cjs");
-const require_oauth = require("./oauth-CkW5gln-.cjs");
+const require_oauth = require("./oauth-B8yqG6Sy.cjs");
 const require_omnisearch_index = require("./omnisearch/index.cjs");
-const require_queryService = require("./queryService-BLaGbpm-.cjs");
+const require_queryService = require("./queryService-BVtjkXy1.cjs");
 const require_scheduler_index = require("./scheduler/index.cjs");
 const require_stream_index = require("./stream/index.cjs");
-const require_syncActions = require("./syncActions-CevF_TEb.cjs");
-const require_telemetry = require("./telemetry-DwlSLVAU.cjs");
+const require_syncActions = require("./syncActions-OEZdVffK.cjs");
+const require_telemetry_index = require("./telemetry/index.cjs");
 const require_vault_index = require("./vault/index.cjs");
-const require_credential = require("./credential-DOXH7XRS.cjs");
+const require_credential = require("./credential-DVWvJFJs.cjs");
 const require_sdk_queryService_index = require("./sdk/queryService/index.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
@@ -94,11 +95,116 @@ const coalesce = (task) => {
 	};
 };
 //#endregion
+//#region src/utils/store/derivedStore.ts
+const isPlainObjectOrArray = (value) => {
+	if (Array.isArray(value)) return true;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+};
+const shallowEqual = (a, b) => {
+	if (Object.is(a, b)) return true;
+	if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) return false;
+	if (!isPlainObjectOrArray(a) || !isPlainObjectOrArray(b)) return false;
+	const aKeys = Object.keys(a);
+	const bKeys = Object.keys(b);
+	return aKeys.length === bKeys.length && aKeys.every((key) => Object.is(a[key], b[key]));
+};
+const createDerivedStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
+	let key = dependsOn(source.get());
+	const store = require_store.createStore(build(key));
+	const unsubscribe = source.subscribe((state) => {
+		const next = dependsOn(state);
+		if (keyEquals(key, next)) return;
+		key = next;
+		store.set(build(next));
+	});
+	const get = store.get;
+	const subscribe = store.subscribe;
+	const dispose = () => {
+		unsubscribe();
+		store.dispose();
+	};
+	return {
+		get,
+		subscribe,
+		dispose
+	};
+};
+//#endregion
+//#region src/utils/store/derivedAsyncStore.ts
+const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
+	const store = require_store.createStore({ state: "idle" });
+	let currentKey = null;
+	let generation = 0;
+	let controller = null;
+	const run = (key) => {
+		controller?.abort();
+		controller = new AbortController();
+		const runGeneration = ++generation;
+		store.set({ state: "pending" });
+		build(key, controller.signal).then((value) => {
+			if (runGeneration === generation) store.set({
+				state: "ready",
+				value
+			});
+		}, (error) => {
+			if (runGeneration === generation) store.set({
+				state: "errored",
+				error
+			});
+		});
+	};
+	const sync = (state) => {
+		const next = dependsOn(state);
+		if (next === null) {
+			if (currentKey === null) return;
+			controller?.abort();
+			controller = null;
+			generation += 1;
+			currentKey = null;
+			store.set({ state: "idle" });
+			return;
+		}
+		if (currentKey !== null && keyEquals(currentKey, next)) return;
+		currentKey = next;
+		run(next);
+	};
+	sync(source.get());
+	const unsubscribe = source.subscribe(sync);
+	const get = store.get;
+	const subscribe = store.subscribe;
+	const dispose = () => {
+		controller?.abort();
+		unsubscribe();
+		store.dispose();
+	};
+	const readable = {
+		get,
+		subscribe,
+		dispose
+	};
+	const settled = () => new Promise((resolve) => {
+		let unsubscribeSettled = () => {};
+		const check = (state) => {
+			if (state.state === "ready" || state.state === "errored") {
+				unsubscribeSettled();
+				resolve(state);
+			}
+		};
+		unsubscribeSettled = store.subscribe(check);
+		check(store.get());
+	});
+	return {
+		store: readable,
+		settled
+	};
+};
+//#endregion
 //#region src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
 const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "polling";
 const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
-	const entries = require_createStore.createStore([]);
+	const entries = require_store.createStore([]);
 	const unsubscribes = /* @__PURE__ */ new Map();
 	const maxEntries = require_jobStatus.clamp(require_jobStatus.finiteOr(limit, DEFAULT_LIMIT), 1);
 	let nextKey = 1;
@@ -288,7 +394,7 @@ const createProjectRefreshMiddleware = (shouldRefresh, requestRefresh) => (next)
 * token-mutating request or an explicit re-scope. Its `middleware` drives the auto re-verify.
 */
 const createLiveProject = ({ initialToken, verify }) => {
-	const store = require_createStore.createStore(require_project.createProject({ sapiToken: initialToken }));
+	const store = require_store.createStore(require_project.createProject({ sapiToken: initialToken }));
 	const refresh = coalesce(async () => store.set(require_project.createProject({ sapiToken: await verify() })));
 	const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);
 	return {
@@ -602,8 +708,9 @@ const stamp = (tokens) => ({
 	issuedAt: Date.now()
 });
 const createConfig$1 = (initial = INITIAL) => {
-	const store = require_createStore.createStore(initial);
+	const store = require_store.createStore(initial);
 	let expiredNotified = false;
+	let epoch = 0;
 	const setBaseUrl = (baseUrl) => {
 		if (store.get().status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
 		store.set({
@@ -616,6 +723,7 @@ const createConfig$1 = (initial = INITIAL) => {
 		if (state.status !== "anonymous") throw new KeboolaError(KeboolaErrorType.AlreadyAuthenticated);
 		if (!state.baseUrl) throw new KeboolaError(KeboolaErrorType.Unconfigured);
 		expiredNotified = false;
+		epoch += 1;
 		store.set({
 			status: "authenticated",
 			baseUrl: state.baseUrl,
@@ -649,6 +757,7 @@ const createConfig$1 = (initial = INITIAL) => {
 	};
 	/** Drop the credential (sign out); keeps the configured baseUrl. */
 	const reset = () => {
+		epoch += 1;
 		store.set({
 			status: "anonymous",
 			baseUrl: store.get().baseUrl
@@ -690,6 +799,15 @@ const createConfig$1 = (initial = INITIAL) => {
 	};
 	const getBaseUrl = () => store.get().baseUrl;
 	/**
+	* Which sign-in this is — a counter, bumped by `authenticate` and `reset`.
+	*
+	* - For anything long-lived that must not outlive the credential it was built against: capture it,
+	*   compare it later. A rotation does not move it; only a new session or a sign-out does.
+	* - Distinct from `notifyExpired`'s latch, which answers "report this death once" rather than
+	*   "which session are we in".
+	*/
+	const getEpoch = () => epoch;
+	/**
 	* Session-expiry latch (fire-once):
 	* - why: concurrent 401s all report expiry, but the app must sign out once; and the credential /
 	*   auth middleware are long-lived singletons, so the latch can't live in them — it must reset
@@ -718,6 +836,7 @@ const createConfig$1 = (initial = INITIAL) => {
 		forceExpire,
 		requireCredential,
 		getBaseUrl,
+		getEpoch,
 		notifyExpired,
 		debug
 	};
@@ -914,7 +1033,7 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 }).add({
 	serviceId: "telemetry",
 	clientName: "telemetry",
-	clientFn: (serviceBaseUrl) => require_telemetry.createTelemetryClient({
+	clientFn: (serviceBaseUrl) => require_telemetry_index.createTelemetryClient({
 		baseUrl: serviceBaseUrl,
 		middlewares: middlewareFor("telemetry", [attachTokenMiddleware]),
 		auth
@@ -1008,6 +1127,14 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 		middlewares: middlewareFor("notifications", [attachTokenMiddleware]),
 		auth
 	})
+}).add({
+	serviceId: "billing",
+	clientName: "billing",
+	clientFn: (serviceBaseUrl) => require_billing_index.createBillingClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("billing", [attachTokenMiddleware]),
+		auth
+	})
 }).add({
 	serviceId: "metastore",
 	clientName: "metastore",
@@ -1057,7 +1184,7 @@ const createProjectClients$1 = async ({ baseUrl, projectId, authMiddleware, midd
 		initialToken: sapiToken,
 		verify: () => reader.tokens.verify()
 	});
-	const storageTableStore = require_createStore.createDerivedStore({
+	const storageTableStore = createDerivedStore({
 		source: liveProject.store,
 		build: require_storageTable.createStorageTable,
 		dependsOn: (project) => ({
@@ -1096,7 +1223,7 @@ const createProjectClients$1 = async ({ baseUrl, projectId, authMiddleware, midd
 			context
 		}),
 		tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
-		semanticLayer: require_sdk_semanticLayer_index.createSemanticLayerSdk({ metastoreClient: services.metastore }),
+		semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
 		storage: require_sdk_storage_index.createStorageSdk({ storageClient: storage }),
 		vault: require_sdk_vault_index.createVaultSdk({
 			vaultClient: services.vault,
@@ -1177,7 +1304,7 @@ const createKeboola = (options = {}) => {
 	const config = createConfig$1();
 	const middlewareFor = createMiddlewareFor(options.middlewares);
 	const retryContention = createRetryMiddleware({ shouldRetry: (error) => error instanceof require_createFetchClient.ApiError && error.response.status === require_createFetchClient.HttpStatus.SERVICE_UNAVAILABLE });
-	const authClientBare = require_createStore.createDerivedStore({
+	const authClientBare = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
@@ -1188,7 +1315,12 @@ const createKeboola = (options = {}) => {
 	const refresh = async () => {
 		const client = authClientBare.get();
 		assert$1(client, KeboolaErrorType.NotReady);
-		const refreshed = await client.token.refresh(config.requireCredential().refreshToken);
+		const epoch = config.getEpoch();
+		const refreshed = await client.token.refresh(config.requireCredential().refreshToken).catch((error) => {
+			if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+			throw error;
+		});
+		if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
 		config.applyRefresh(refreshed);
 		return refreshed.accessToken;
 	};
@@ -1204,8 +1336,49 @@ const createKeboola = (options = {}) => {
 			}
 		};
 	};
+	/**
+	* The session's state, once it is known to carry a credential.
+	*
+	* - Returns the state rather than nothing, so the caller reads `baseUrl` and `credential` off a
+	*   narrowed union instead of re-checking the status to get at them.
+	* - `NotAuthenticated`, the same refusal `requireScopedProject` opens with. The two differ only in
+	*   how far they go: this one stops at "somebody is signed in", which is all a request naming its
+	*   own project needs.
+	*/
+	const requireAuthenticated = () => {
+		const state = config.store.get();
+		if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+		return state;
+	};
+	/**
+	* The project this session is scoped to, right now.
+	*
+	* - Read at every point that stamps a project, never snapshotted across an `await`: the scope moves
+	*   with `setProject`/`clearProject`, and neither ends the session, so it is not in the epoch and
+	*   `assertSameSession` cannot see it change.
+	* - `NotReady` rather than `NotAuthenticated` when merely unscoped — the credential is fine, the
+	*   project is what is missing. A credential alone does not authorize a project request: kai-agent
+	*   reads the project from the header, not the token, and cannot attribute a call that omits it.
+	*/
+	const requireScopedProject = () => {
+		const state = requireAuthenticated();
+		if (state.status !== "scoped") throw new KeboolaError(KeboolaErrorType.NotReady);
+		return state.projectId;
+	};
+	/**
+	* The project client sets `forProject` has handed out, keyed by project id.
+	*
+	* - Not keyed by stack: `setBaseUrl` throws once authenticated and `signOut` empties this, so one
+	*   entry can never belong to a different `baseUrl` than the live session.
+	* - A `lazy` per key, not a bare promise: concurrent callers share one bootstrap, later ones replay
+	*   the resolved set, and a rejected build clears only its own slot — so a build orphaned by a
+	*   sign-out cannot evict the entry that replaced it.
+	*/
+	const extraProjects = /* @__PURE__ */ new Map();
 	const signOut = () => {
 		config.reset();
+		credential.abandonRefresh();
+		extraProjects.clear();
 		persistor.clear();
 	};
 	const onSessionExpired = () => {
@@ -1216,16 +1389,78 @@ const createKeboola = (options = {}) => {
 		getToken,
 		onSessionExpired
 	});
-	const authMiddleware = createBearerAuthMiddleware(credential);
-	const authClient = require_createStore.createDerivedStore({
+	const sessionGuard = (epoch) => () => {
+		if (config.getEpoch() !== epoch) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+	};
+	/**
+	* The auth middleware, refusing to carry a request across a change of session.
+	*
+	* - The middleware holds no token — it reads the credential live — so anything built on it acts as
+	*   whoever is signed in *at request time*, not whoever built it. Rebuilding a store on sign-out
+	*   only stops new reads; a request already in flight completes as the next user, still stamped
+	*   with the old project. `config`'s epoch moves on `authenticate` and `reset` and never on a
+	*   rotation, so it is exactly "which sign-in is this".
+	* - `epochFor` says which sign-in a request answers to, resolved per request:
+	*   1. a client set pins to the sign-in that *built* it (`pinToSession`) — a set the caller still
+	*      holds must not ride the session that replaced it;
+	*   2. `api.auth` pins to the sign-in the request *started* on, because its store is keyed on
+	*      `baseUrl` alone: it is built once, while anonymous, so a build-time pin would freeze at that
+	*      epoch and refuse every authenticated call.
+	* - The guard covers every credential read, not only the wire request, so it wraps the credential
+	*   rather than sitting beside it. The 401 path rotates the token by calling the credential
+	*   directly: a straggler from a dead session would otherwise spend the *live* session's
+	*   single-use refresh token, and sign that session out if the rotation itself came back 401.
+	* - `expiresSession` decides whether a 401 that survives a rotation means the session is dead.
+	*   True for this session's own realms; false where the 401 may be about the project instead of
+	*   the credential (see `forProject`).
+	* - `inner` is for middleware that **re-invokes `next`** — a retry. Composed outside the pin it
+	*   would re-enter it per attempt, and with a per-request `epochFor` each attempt would re-pin to
+	*   whoever is signed in by then: a 503 backoff is exactly long enough for a sign-out to land, and
+	*   the retry then goes out as the next user. Inside, one epoch covers every attempt and each
+	*   attempt still passes the guard. Anything new that retries belongs here, not in the array.
+	*/
+	const createPinnedAuthMiddleware = (epochFor, { expiresSession = true, inner = [] } = {}) => {
+		return (next) => (request) => {
+			const assertSameSession = sessionGuard(epochFor());
+			const pinnedCredential = {
+				...credential,
+				getAccessToken: async (options) => {
+					assertSameSession();
+					return credential.getAccessToken(options);
+				},
+				notifyExpired: expiresSession ? credential.notifyExpired : () => {}
+			};
+			const guarded = (wire) => (repeated) => {
+				assertSameSession();
+				return wire(repeated);
+			};
+			const chain = inner.reduceRight((acc, middleware) => middleware(acc), guarded(next));
+			return createBearerAuthMiddleware(pinnedCredential)(chain)(request);
+		};
+	};
+	/**
+	* Pin something long-lived to the sign-in live right now.
+	*
+	* - `assertSameSession` is for whatever no middleware chain covers: a bootstrap whose every
+	*   request passed the guard before the sign-out resolves anyway and must not be handed back, and
+	*   `getAuthHeaders`, which emits the credential by hand.
+	*/
+	const pinToSession = (options) => {
+		const epoch = config.getEpoch();
+		return {
+			assertSameSession: sessionGuard(epoch),
+			pinnedAuthMiddleware: createPinnedAuthMiddleware(() => epoch, options)
+		};
+	};
+	const authClient = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
 			baseUrl,
-			middlewares: middlewareFor("auth", [retryContention, authMiddleware])
+			middlewares: middlewareFor("auth", [createPinnedAuthMiddleware(config.getEpoch, { inner: [retryContention] })])
 		}) : null
 	});
-	const management = require_createStore.createDerivedStore({
+	const management = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.status === "anonymous" ? null : state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_management.createManagementClient({
@@ -1234,10 +1469,10 @@ const createKeboola = (options = {}) => {
 				type: "bearer",
 				token: ""
 			},
-			middlewares: middlewareFor("management", [authMiddleware])
+			middlewares: middlewareFor("management", [pinToSession().pinnedAuthMiddleware])
 		}) : null
 	});
-	const projectClientsAsync = require_createStore.createDerivedAsyncStore({
+	const projectClientsAsync = createDerivedAsyncStore({
 		source: config.store,
 		dependsOn: (state) => state.status === "scoped" ? {
 			baseUrl: state.baseUrl,
@@ -1246,13 +1481,32 @@ const createKeboola = (options = {}) => {
 		build: ({ baseUrl, projectId }) => {
 			return createProjectClients$1({
 				baseUrl,
-				authMiddleware,
+				authMiddleware: pinToSession().pinnedAuthMiddleware,
 				projectId,
 				middlewareFor,
 				clientServiceUrls: options.clientServiceUrls
 			});
 		}
 	});
+	const forProject = async (projectId) => {
+		const state = requireAuthenticated();
+		const cached = extraProjects.get(projectId);
+		if (cached) return cached();
+		const { assertSameSession, pinnedAuthMiddleware } = pinToSession({ expiresSession: false });
+		const build = require_jobStatus.lazy(async () => {
+			const clients = await createProjectClients$1({
+				baseUrl: state.baseUrl,
+				authMiddleware: pinnedAuthMiddleware,
+				projectId,
+				middlewareFor,
+				clientServiceUrls: options.clientServiceUrls
+			});
+			assertSameSession();
+			return clients;
+		});
+		extraProjects.set(projectId, build);
+		return build();
+	};
 	if (options.baseUrl) config.setBaseUrl(options.baseUrl);
 	config.store.subscribe((state) => {
 		if (state.status === "anonymous") return;
@@ -1286,6 +1540,19 @@ const createKeboola = (options = {}) => {
 		* re-entering the project. Use `reset` to sign out instead.
 		*/
 		clearProject: config.clearProjectId,
+		/**
+		* The clients for one project, off this session — for reaching a second project without leaving
+		* the first.
+		*
+		* - `setProjectAsync` *moves* the session (and `api`) to another project; this *adds* one. The
+		*   returned set is the caller's to hold and never appears on `api`.
+		* - Every set shares this session's auth middleware, so one rotation serves all of them. A second
+		*   `createKeboola()` does not: both hold the same single-use refresh token, and the first to
+		*   rotate invalidates the other's, whose next refresh 401s and signs it out.
+		* - Independent of the scope, including for the scoped project itself — asking for that one
+		*   builds a second set with its own `liveProject`, so prefer `api.*` there.
+		*/
+		forProject,
 		reset: signOut,
 		/**
 		* Dev/test only: mark the current access token as expired so the bearer credential rotates it on
@@ -1302,18 +1569,42 @@ const createKeboola = (options = {}) => {
 		*   string, and `X-KBC-ProjectId` is composed here rather than in every consuming app.
 		* - Resolved per call, through the credential — so a near-expiry token rotates and a revoked
 		*   one is never re-sent. A snapshot held by the caller would do neither.
-		* - Throws rather than emitting a half-formed `Bearer null`: an unauthenticated or unscoped
-		*   session has nothing to authorize with.
+		* - Throws rather than emitting a half-formed `Bearer null`: a session with no credential has
+		*   nothing to authorize with.
+		* - Pinned to the sign-in it was called on, like every client here. This is the one
+		*   credential-emitting surface with no middleware chain for the guard to sit in, so the check
+		*   is written out around the `await` that rotates the token.
+		*
+		* `projectId` names the project the headers authorize, for a caller reaching a project the
+		* session is not scoped to:
+		*
+		* - **Omitted**, the session's own scope answers — unchanged, and re-read *after* the rotation
+		*   rather than carried across it. The epoch the pin compares moves on a sign-in and a sign-out
+		*   only, so a project switch mid-rotation is invisible to it.
+		* - **Given**, it is what the header says, and the scope is not consulted at all. A caller that
+		*   names a project has said everything the request needs: the credential is user-level and the
+		*   project is a header on top of it, so an authenticated session suffices where an unnamed call
+		*   requires a scoped one. Nothing about the session can change the answer, so there is nothing
+		*   to re-read after the `await`.
+		* - **Not checked against an access set**, because this session cannot acquire one:
+		*   `forProject` — the only other surface taking a caller-supplied project id — records that
+		*   connection collapses every bearer failure into a single `invalid_token` 401, so "no access
+		*   to this project" and "revoked token" are the same response. Whether the caller may reach a
+		*   project is the caller's own knowledge, from `token.introspect`. What is guaranteed here is
+		*   that the header names what was asked for and never something else — which is the failure
+		*   worth preventing: a turn sent somewhere the transcript above it did not come from.
 		*/
-		getAuthHeaders: async () => {
-			const state = config.store.get();
-			if (state.status === "anonymous") throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-			if (state.status !== "scoped") throw new KeboolaError(KeboolaErrorType.NotReady);
+		getAuthHeaders: async (projectId) => {
+			const { assertSameSession } = pinToSession();
+			if (projectId === void 0) requireScopedProject();
+			else requireAuthenticated();
 			const accessToken = await credential.getAccessToken();
+			assertSameSession();
+			const authorizedProjectId = projectId ?? requireScopedProject();
 			assert$1(accessToken, KeboolaErrorType.NotAuthenticated);
 			return {
 				[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${accessToken}`,
-				[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(state.projectId)
+				[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(authorizedProjectId)
 			};
 		},
 		restore: async () => {
@@ -1327,8 +1618,10 @@ const createKeboola = (options = {}) => {
 			if (!configured) config.setBaseUrl(persisted.baseUrl);
 			const client = authClientBare.get();
 			assert$1(client, KeboolaErrorType.NotReady);
+			const startedOn = config.getEpoch();
 			try {
 				const refreshed = await client.token.refresh(persisted.refreshToken);
+				if (config.getEpoch() !== startedOn) return { status: "empty" };
 				config.authenticate(refreshed);
 				if (persisted.projectId !== null) {
 					config.setProjectId(persisted.projectId);
@@ -1336,6 +1629,7 @@ const createKeboola = (options = {}) => {
 				}
 				return { status: "restored" };
 			} catch (err) {
+				if (config.getEpoch() !== startedOn) return { status: "empty" };
 				if (require_credential.isUnauthorized(err)) {
 					persistor.clear();
 					return { status: "expired" };
@@ -1368,7 +1662,7 @@ const createKeboola = (options = {}) => {
 //#endregion
 //#region src/keboola/legacy/createConfig.ts
 const createConfig = () => {
-	const store = require_createStore.createStore({
+	const store = require_store.createStore({
 		baseUrl: null,
 		sapiToken: null,
 		managementToken: null
@@ -1434,7 +1728,7 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 		initialToken: sapiToken,
 		verify: () => _storage.tokens.verify()
 	});
-	const storageTableStore = require_createStore.createDerivedStore({
+	const storageTableStore = createDerivedStore({
 		source: liveProject.store,
 		build: require_storageTable.createStorageTable,
 		dependsOn: (project) => ({
@@ -1474,7 +1768,7 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 			context
 		}),
 		tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
-		semanticLayer: require_sdk_semanticLayer_index.createSemanticLayerSdk({ metastoreClient: services.metastore }),
+		semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
 		storage: require_sdk_storage_index.createStorageSdk({ storageClient: storage }),
 		vault: require_sdk_vault_index.createVaultSdk({
 			vaultClient: services.vault,
@@ -1495,7 +1789,7 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 const createLegacyKeboola = (options = {}) => {
 	const config = createConfig();
 	const middlewareFor = createMiddlewareFor(options.middlewares);
-	const authClient = require_createStore.createDerivedStore({
+	const authClient = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => state.baseUrl,
 		build: (baseUrl) => baseUrl ? require_authClient.createAuthClient({
@@ -1503,7 +1797,7 @@ const createLegacyKeboola = (options = {}) => {
 			middlewares: middlewareFor("auth", [])
 		}) : null
 	});
-	const management = require_createStore.createDerivedStore({
+	const management = createDerivedStore({
 		source: config.store,
 		dependsOn: (state) => ({
 			baseUrl: state.baseUrl,
@@ -1518,7 +1812,7 @@ const createLegacyKeboola = (options = {}) => {
 			middlewares: middlewareFor("management", [])
 		}) : null
 	});
-	const build = require_createStore.createDerivedAsyncStore({
+	const build = createDerivedAsyncStore({
 		source: config.store,
 		dependsOn: (state) => state.sapiToken && state.baseUrl ? state.baseUrl : null,
 		build: (baseUrl) => createProjectClients({
@@ -1592,9 +1886,9 @@ exports.assert = assert;
 exports.coalesce = coalesce;
 exports.collect = require_queue.collect;
 exports.concurrent = require_concurrent.concurrent;
-exports.createDerivedAsyncStore = require_createStore.createDerivedAsyncStore;
-exports.createDerivedStore = require_createStore.createDerivedStore;
-exports.createEmitter = require_createStore.createEmitter;
+exports.createDerivedAsyncStore = createDerivedAsyncStore;
+exports.createDerivedStore = createDerivedStore;
+exports.createEmitter = require_store.createEmitter;
 exports.createGenericFetchClient = require_createGenericFetchClient.createGenericFetchClient;
 exports.createKeboola = createKeboola;
 exports.createLegacyKeboola = createLegacyKeboola;
@@ -1608,12 +1902,13 @@ exports.createQueryServiceSdk = require_sdk_queryService_index.createQueryServic
 exports.createRetryMiddleware = createRetryMiddleware;
 exports.createSessionStorage = createSessionStorage;
 exports.createStorageSdk = require_sdk_storage_index.createStorageSdk;
-exports.createStore = require_createStore.createStore;
+exports.createStore = require_store.createStore;
 exports.dedupe = require_dedupe.dedupe;
 exports.deepMerge = deepMerge;
 exports.delay = require_jobStatus.delay;
 exports.emitter = require_jobStatus.emitter;
 exports.failureOf = require_jobStatus.failureOf;
+exports.formatValidationIssues = require_ValidationError.formatValidationIssues;
 exports.generateUUID = require_generateUUID.generateUUID;
 exports.isAbortError = require_createFetchClient.isAbortError;
 exports.isApiError = require_createFetchClient.isApiError;
@@ -1627,6 +1922,7 @@ exports.isQueryJobError = require_QueryJobTimeoutError.isQueryJobError;
 exports.isQueryJobTimeoutError = require_QueryJobTimeoutError.isQueryJobTimeoutError;
 exports.isStorageTokenMutatingRequest = isStorageTokenMutatingRequest;
 exports.isSyncActionError = require_SyncActionError.isSyncActionError;
+exports.isTimeoutError = require_createFetchClient.isTimeoutError;
 exports.isValidationError = require_ValidationError.isValidationError;
 exports.jobStatus = require_jobStatus.jobStatus;
 exports.keboolaUID = require_tag.keboolaUID;
@@ -1637,6 +1933,6 @@ exports.poll = require_jobStatus.poll;
 exports.poller = require_jobStatus.poller;
 exports.schemaGuidedMerge = require_configurations.schemaGuidedMerge;
 exports.series = require_storage.series;
-exports.shallowEqual = require_createStore.shallowEqual;
+exports.shallowEqual = shallowEqual;
 
 //# sourceMappingURL=index.cjs.map