@keboola/api-client 46.0.0 → 48.0.0

package/dist/index.cjs

@@ -1,54 +1,55 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_project = require("./project-CpgplgCr.cjs");
-const require_collect = require("./collect-B5TCNiT1.cjs");
+const require_collectByOffset = require("./collectByOffset-DQsqtmJg.cjs");
+const require_authClient = require("./authClient-DfkKlc-2.cjs");
 const require_concurrent = require("./concurrent-CdVfR1N5.cjs");
 const require_dedupe = require("./dedupe-OSnnst2u.cjs");
-const require_jobStatus = require("./jobStatus-B0E-MZ9I.cjs");
+const require_transientRetries = require("./transientRetries-DdJfH9QK.cjs");
 const require_store = require("./store-xS-Cu_VS.cjs");
-const require_storage = require("./storage-76Sf_z_H.cjs");
+const require_storage = require("./storage-CVBXivpB.cjs");
 const require_tag = require("./tag-DHS_soa7.cjs");
 const require_generateUUID = require("./generateUUID-C6qKBPIv.cjs");
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-D_Rbs0Wl.cjs");
+const require_configurations = require("./configurations-B2O8AAy0.cjs");
 const require_UserError = require("./UserError-CSGO1qII.cjs");
-const require_createFetchClient = require("./createFetchClient-ClWD4ua3.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-DR-0h35y.cjs");
-const require_ManagementSessionMintError = require("./ManagementSessionMintError-Bm8s6yDB.cjs");
-const require_QueryJobTimeoutError = require("./QueryJobTimeoutError-CVNPdCWX.cjs");
+const require_createFetchClient = require("./createFetchClient-lZ_93Yrb.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-BalWEyRk.cjs");
+const require_ManagementSessionMintError = require("./ManagementSessionMintError-Cu9beG7j.cjs");
+const require_QueryJobError = require("./QueryJobError-irGiP5zh.cjs");
+const require_QueueJobError = require("./QueueJobError-6qSEizWo.cjs");
 const require_SyncActionError = require("./SyncActionError-BG0zwchi.cjs");
 const require_ValidationError = require("./ValidationError-D65QU0uq.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-B81Iezpb.cjs");
-const require_import = require("./import-B5DcJGMI.cjs");
-const require_authClient = require("./authClient-DZcAR-eW.cjs");
-const require_management = require("./management-0cWVLHei.cjs");
-const require_constants = require("./constants-BDGRQqij.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-MOx97wi-.cjs");
+const require_import = require("./import-BahNYv91.cjs");
+const require_management = require("./management-CXHnxVaZ.cjs");
+const require_constants = require("./constants-a0jswUeK.cjs");
 const require_storageTable = require("./storageTable-BNOR2FCh.cjs");
-const require_kaiMemory = require("./kaiMemory-Cf81ghNd.cjs");
+const require_kaiMemory = require("./kaiMemory-Qch09f-m.cjs");
 const require_semanticLayer = require("./semanticLayer-7BejcMj_.cjs");
-const require_sdk_storage_index = require("./sdk/storage/index.cjs");
 const require_sdk_vault_index = require("./sdk/vault/index.cjs");
 const require_ai_index = require("./ai/index.cjs");
-const require_appLogs = require("./appLogs-BG9ueGxA.cjs");
+const require_appLogs = require("./appLogs-Cix2KWra.cjs");
 const require_apps_index = require("./apps/index.cjs");
 const require_billing_index = require("./billing/index.cjs");
 const require_chat_index = require("./chat/index.cjs");
-const require_dataScience = require("./dataScience-Hhoqoql_.cjs");
+const require_componentsMcp = require("./componentsMcp-pG-PcQrg.cjs");
+const require_dataScience = require("./dataScience-BjS1p8WO.cjs");
 const require_editor_index = require("./editor/index.cjs");
 const require_encryption_index = require("./encryption/index.cjs");
-const require_kaiAgent = require("./kaiAgent-BhcUsBDk.cjs");
-const require_metastore = require("./metastore-YPHUK3jJ.cjs");
+const require_kaiAgent = require("./kaiAgent-N2qbUFZm.cjs");
+const require_metastore = require("./metastore-BXHg33ku.cjs");
 const require_notifications_index = require("./notifications/index.cjs");
-const require_oauth = require("./oauth-DyUwTqHJ.cjs");
+const require_oauth = require("./oauth-DKZPuUlt.cjs");
 const require_omnisearch_index = require("./omnisearch/index.cjs");
-const require_queryService = require("./queryService-RlNYw7LG.cjs");
-const require_queue = require("./queue-BrgRdtOr.cjs");
+const require_queryService = require("./queryService-CzK53q94.cjs");
+const require_queue = require("./queue-BJvDWriM.cjs");
 const require_scheduler_index = require("./scheduler/index.cjs");
 const require_stream_index = require("./stream/index.cjs");
-const require_syncActions = require("./syncActions-DlNPhZY4.cjs");
+const require_syncActions = require("./syncActions-C1rE4R3f.cjs");
 const require_telemetry_index = require("./telemetry/index.cjs");
 const require_vault_index = require("./vault/index.cjs");
-const require_middleware = require("./middleware-D_p5TctO.cjs");
+const require_middleware = require("./middleware-CEP6uu_D.cjs");
 const require_sdk_queryService_index = require("./sdk/queryService/index.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
@@ -211,11 +212,11 @@ const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallow
 //#endregion
 //#region src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
-const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "polling";
+const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "requesting" && snapshot.state !== "polling";
 const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
 	const entries = require_store.createStore([]);
 	const unsubscribes = /* @__PURE__ */ new Map();
-	const maxEntries = require_jobStatus.clamp(require_jobStatus.finiteOr(limit, DEFAULT_LIMIT), 1);
+	const maxEntries = require_transientRetries.clamp(require_transientRetries.finiteOr(limit, DEFAULT_LIMIT), 1);
 	let nextKey = 1;
 	const forget = (key) => {
 		unsubscribes.get(key)?.();
@@ -248,7 +249,7 @@ const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
 		entries.set(trim([entry, ...entries.get()]));
 	};
 	const collect = () => {
-		require_jobStatus.emitter.subscribe(register);
+		require_transientRetries.emitter.subscribe(register);
 	};
 	return {
 		list: entries.get,
@@ -262,6 +263,47 @@ const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
 	};
 };
 //#endregion
+//#region src/utils/async/queueSeries.ts
+const isPromiseLike = (value) => (typeof value === "object" && value !== null || typeof value === "function") && "then" in value && typeof value.then === "function";
+/**
+* Queues tasks added over time so a slower earlier task cannot finish after and overwrite a later one.
+* Each `add` returns its task's result; a rejection does not stop the remaining queue.
+*/
+const queueSeries = () => {
+	let tail = null;
+	const add = (task) => {
+		if (tail !== null) {
+			const result = tail.then(task);
+			tail = result.then(() => void 0, () => void 0);
+			return result;
+		}
+		let value;
+		try {
+			value = task();
+		} catch (error) {
+			return Promise.reject(error);
+		}
+		if (!isPromiseLike(value)) return Promise.resolve(value);
+		const result = Promise.resolve(value);
+		tail = result.then(() => void 0, () => void 0);
+		return result;
+	};
+	const onIdle = async () => {
+		while (tail !== null) {
+			const current = tail;
+			await current;
+			if (tail === current) {
+				tail = null;
+				return;
+			}
+		}
+	};
+	return {
+		add,
+		onIdle
+	};
+};
+//#endregion
 //#region src/utils/deepMerge.ts
 /**
 * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every
@@ -319,6 +361,10 @@ const createWebStorage = (pick) => {
 		},
 		removeItem: (key) => {
 			storage.removeItem(key);
+		},
+		withLock: async (name, task) => {
+			if (typeof navigator === "undefined" || !("locks" in navigator)) return task();
+			return navigator.locks.request(`keboola:${name}`, { mode: "exclusive" }, task);
 		}
 	};
 };
@@ -327,62 +373,56 @@ const createSessionStorage = () => createWebStorage(() => "sessionStorage" in gl
 //#endregion
 //#region src/utils/persistor/persistor.ts
 const createPersistor = ({ storage = createNullStorage(), key, schema, defaultValue, encode = JSON.stringify, decode = JSON.parse }) => {
-	const clear = () => {
-		try {
-			storage.removeItem(key);
-		} catch (err) {
-			console.warn(`createPersistor: failed to clear "${key}"`, err);
-		}
-	};
-	const hasPersistedValue = () => {
-		try {
-			return !!storage.getItem(key);
-		} catch (err) {
-			console.warn(`createPersistor: failed to read "${key}", assuming empty`, err);
-			return false;
-		}
-	};
-	const hydrate = () => {
-		let raw;
-		try {
-			raw = storage.getItem(key);
-		} catch (err) {
-			console.warn(`createPersistor: failed to read "${key}", using default`, err);
-			return defaultValue;
-		}
-		if (raw === null) return defaultValue;
+	const writes = queueSeries();
+	const _load = async () => {
+		const raw = await storage.getItem(key);
+		if (raw === null) return {
+			value: defaultValue,
+			corrupt: false
+		};
 		let decoded;
 		try {
 			decoded = decode(raw);
 		} catch (err) {
-			console.warn(`createPersistor: failed to decode "${key}", resetting`, err);
-			clear();
-			return defaultValue;
+			console.warn(`createPersistor: failed to decode "${key}"`, err);
+			return {
+				value: defaultValue,
+				corrupt: true
+			};
 		}
 		const parsed = schema.safeParse(decoded);
-		if (parsed.success) return parsed.data;
-		clear();
-		return defaultValue;
+		return parsed.success ? {
+			value: parsed.data,
+			corrupt: false
+		} : {
+			value: defaultValue,
+			corrupt: true
+		};
 	};
-	const persist = (value) => {
-		let raw;
-		try {
-			raw = encode(value);
-		} catch (err) {
-			console.warn(`createPersistor: failed to encode "${key}", not persisting`, err);
-			return;
-		}
-		try {
-			storage.setItem(key, raw);
-		} catch (err) {
-			console.warn(`createPersistor: failed to write "${key}"`, err);
-		}
+	const remove = () => writes.add(() => storage.removeItem(key));
+	const write = (value) => writes.add(() => storage.setItem(key, encode(value)));
+	const read = async () => {
+		await writes.onIdle();
+		const parsed = await _load();
+		if (parsed.corrupt) remove().catch((err) => {
+			console.warn(`createPersistor: failed to drop the corrupt "${key}"`, err);
+		});
+		return parsed.value;
 	};
+	const modify = (change) => writes.add(async () => {
+		const next = change((await _load()).value);
+		await storage.setItem(key, encode(next));
+	});
+	const cell = {
+		read,
+		write,
+		modify,
+		remove
+	};
+	const locked = (task) => storage.withLock ? storage.withLock(key, () => task(cell)) : task(cell);
 	return {
-		hydrate,
-		persist,
-		clear,
-		hasPersistedValue
+		...cell,
+		locked
 	};
 };
 //#endregion
@@ -430,8 +470,7 @@ const KeboolaErrorType = {
 	NotBearer: "not-bearer",
 	NotReady: "not-ready",
 	InvalidBuildTransition: "invalid-build-transition",
-	StackActive: "stack-active",
-	CredentialKindMismatch: "credential-kind-mismatch"
+	StackActive: "stack-active"
 };
 const MESSAGES = {
 	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
@@ -444,8 +483,7 @@ const MESSAGES = {
 	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
 	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
 	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed.",
-	[KeboolaErrorType.StackActive]: "The active stack cannot be closed — select another first.",
-	[KeboolaErrorType.CredentialKindMismatch]: "This client renews the other credential kind — log in the way its `credentials` mode expects."
+	[KeboolaErrorType.StackActive]: "The active stack cannot be closed — select another first."
 };
 var KeboolaError = class KeboolaError extends Error {
 	type;
@@ -606,10 +644,12 @@ const createDefaultBranch = ({ devBranches }) => {
 };
 //#endregion
 //#region src/domain/stack.ts
+const isServiceId = (id) => Object.values(require_constants.ServiceId).includes(id);
 const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
 const createStack = ({ stackInfo, clientServiceUrls }) => {
 	const { services, components, features, ...infoRest } = stackInfo;
 	const serviceMap = new Map(services.map((service) => {
+		if (!isServiceId(service.id)) return [service.id, service.url];
 		const devOverride = clientServiceUrls?.[service.id]?.(service.url);
 		const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
 		const url = devOverride ?? prodOverride ?? service.url;
@@ -733,7 +773,6 @@ const createSdk = ({ storage, services, context }) => ({
 	tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
 	semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
 	kaiMemory: require_kaiMemory.createKaiMemorySdk({ metastoreClient: services.metastore }),
-	storage: require_sdk_storage_index.createStorageSdk({ storageClient: storage }),
 	vault: require_sdk_vault_index.createVaultSdk({
 		vaultClient: services.vault,
 		encryptionClient: services.encryption
@@ -860,6 +899,14 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
 		auth
 	})
+}).add({
+	serviceId: "components-mcp",
+	clientName: "componentsMcp",
+	clientFn: (serviceBaseUrl) => require_componentsMcp.createComponentsMcpClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("componentsMcp", [attachTokenMiddleware]),
+		auth
+	})
 }).add({
 	serviceId: "oauth",
 	clientName: "oauth",
@@ -1067,154 +1114,6 @@ const createLegacyKeboola = (options = {}) => {
 	};
 };
 //#endregion
-//#region src/keboola/bearer/credentials/renewal.ts
-const renewalGrant = (credential) => credential.type === "token" ? {
-	type: "token",
-	refreshToken: credential.refreshToken
-} : {
-	type: "cookie",
-	sessionId: credential.sessionId
-};
-const renew = async (client, grant) => {
-	if (grant.type === "cookie") {
-		const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({ sessionId: grant.sessionId });
-		return {
-			type: "cookie",
-			accessToken,
-			expiresIn,
-			sessionId
-		};
-	}
-	const { accessToken, expiresIn, refreshToken } = await client.token.refreshWithToken({ refreshToken: grant.refreshToken });
-	if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-	return {
-		type: "token",
-		accessToken,
-		expiresIn,
-		refreshToken
-	};
-};
-//#endregion
-//#region src/keboola/bearer/credentials/credentials.ts
-const DEFAULT_REFRESH_THRESHOLD = .9;
-const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
-const createCredentials = ({ state, persistor, middlewares, mode = "token", refreshThreshold = DEFAULT_REFRESH_THRESHOLD, onSignedOut }) => {
-	const rotationMap = /* @__PURE__ */ new Map();
-	const generations = /* @__PURE__ */ new Map();
-	const generationOf = (baseUrl) => generations.get(baseUrl) ?? 0;
-	const refresh = async (baseUrl, grant) => {
-		const client = require_authClient.createAuthClient({
-			baseUrl,
-			middlewares
-		});
-		const epochBefore = require_jobStatus.Result.unwrap(state.auth.getEpoch(baseUrl));
-		const generationBefore = generationOf(baseUrl);
-		const refreshed = await require_jobStatus.Result.tryCatchAsync(() => renew(client, grant));
-		return require_jobStatus.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epochBefore && generationOf(baseUrl) === generationBefore ? refreshed : require_jobStatus.Result.failure(signInEnded());
-	};
-	/**
-	* A stack's teardown, from the credential's side.
-	*
-	* - Bumps the generation, so an in-flight rotation can no longer write.
-	* - Drops the deduped entry, so nothing joins that rotation.
-	*/
-	const forget = (baseUrl) => {
-		generations.set(baseUrl, generationOf(baseUrl) + 1);
-		rotationMap.delete(baseUrl);
-	};
-	/**
-	* The rotation, and the one place a credential is declared dead.
-	*
-	* - A refused refresh token or session is unambiguous.
-	* - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.
-	*/
-	const rotateOnce = async (baseUrl) => {
-		const credential = state.auth.requireCredentialOf(baseUrl, mode);
-		if (!credential.success) return credential;
-		const refreshed = await refresh(baseUrl, renewalGrant(credential.data));
-		if (!refreshed.success) {
-			if (require_middleware.isUnauthorized(refreshed.error)) expire(baseUrl);
-			return refreshed;
-		}
-		return require_jobStatus.Result.map(state.auth.applyRefresh(baseUrl, refreshed.data), () => refreshed.data.accessToken);
-	};
-	const rotate = (baseUrl) => ensure(rotationMap, baseUrl, () => require_dedupe.dedupe(() => rotateOnce(baseUrl)))();
-	const restoreStack = async (baseUrl, grant) => {
-		if (!state.auth.startRestore(baseUrl).success) return "unreachable";
-		const refreshed = await refresh(baseUrl, grant);
-		if (!refreshed.success) {
-			state.auth.cancelRestore(baseUrl);
-			return require_middleware.isUnauthorized(refreshed.error) ? "refused" : "unreachable";
-		}
-		state.auth.authenticate(baseUrl, refreshed.data);
-		return "restored";
-	};
-	const restoreProjects = (baseUrl, projects) => {
-		for (const { projectId } of projects) state.projects.open(baseUrl, projectId);
-	};
-	/**
-	* Every persisted stack back into the table, with whatever credential it can hand back.
-	*
-	* - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the
-	*   caller to select.
-	* - `status` reports what became of `lastActive`'s credential; the client reads it to decide
-	*   when persistence may start.
-	*/
-	const restore = async () => {
-		const hydrated = persistor.hydrate();
-		const stacks = hydrated.stacks.map((stack) => stack.credential && stack.credential.type !== "static" && stack.credential.type !== mode ? {
-			...stack,
-			credential: null
-		} : stack);
-		const { current } = hydrated;
-		const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);
-		const restored = stacks.map(async ({ baseUrl, credential, projects }) => {
-			state.stacks.ensure(baseUrl);
-			if (!credential) return "unreachable";
-			if (require_jobStatus.Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return "skipped";
-			const outcome = credential.type === "static" ? state.auth.authenticate(baseUrl, credential).success ? "restored" : "refused" : await restoreStack(baseUrl, credential);
-			if (outcome === "restored") restoreProjects(baseUrl, projects);
-			return outcome;
-		});
-		const results = await Promise.all(restored);
-		const outcome = scoped?.credential ? results[stacks.indexOf(scoped)] : void 0;
-		return {
-			lastActive: current,
-			status: outcome === void 0 || outcome === "skipped" ? "empty" : outcome === "restored" ? "restored" : outcome === "unreachable" ? "unreachable" : "expired"
-		};
-	};
-	const isStale = (baseUrl) => {
-		const ageing = require_jobStatus.Result.map(state.auth.requireCredentialOf(baseUrl, mode), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
-		return require_jobStatus.Result.unwrapOr(ageing, false);
-	};
-	const signOut = (baseUrl) => {
-		rotationMap.delete(baseUrl);
-		const signedOut = state.auth.signOut(baseUrl);
-		onSignedOut?.(baseUrl);
-		return signedOut;
-	};
-	const expire = (baseUrl) => {
-		if (state.auth.notifyExpired(baseUrl)) signOut(baseUrl);
-	};
-	const canRefresh = (baseUrl) => state.auth.requireCredentialOf(baseUrl, mode).success;
-	const renewIfStale = async (baseUrl) => {
-		if (isStale(baseUrl)) await rotate(baseUrl);
-	};
-	const middleware = (baseUrl) => require_middleware.createBearerAuthMiddleware({ getAccessToken: async ({ forceRefresh = false } = {}) => {
-		if (forceRefresh) return canRefresh(baseUrl) ? require_jobStatus.Result.unwrap(await rotate(baseUrl)) : null;
-		await renewIfStale(baseUrl);
-		return state.auth.getAccessToken(baseUrl);
-	} });
-	return {
-		middleware,
-		rotate,
-		renewIfStale,
-		restore,
-		signOut,
-		forget
-	};
-};
-//#endregion
 //#region src/keboola/bearer/state/factories.ts
 /**
 * Everything the table constructs: the entries themselves, and the failures reading them produces.
@@ -1232,9 +1131,16 @@ const authenticatedAuth = (credential) => ({
 	status: "authenticated",
 	credential
 });
-const bearerCredential = (input) => input.type === "static" ? input : {
+const credential = (input) => ({
 	...input,
 	issuedAt: Date.now()
+});
+const grant = (credential) => credential.type === "token" ? {
+	type: "token",
+	refreshToken: credential.refreshToken
+} : {
+	type: "cookie",
+	sessionId: credential.sessionId
 };
 const expiredCredential = (credential) => ({
 	...credential,
@@ -1244,7 +1150,8 @@ const stack = (baseUrl) => ({
 	baseUrl,
 	context: "idle",
 	epoch: 0,
-	auth: anonymousAuth()
+	auth: anonymousAuth(),
+	retained: null
 });
 const project = (baseUrl, projectId) => ({
 	id: projectEntryId(baseUrl, projectId),
@@ -1276,7 +1183,8 @@ const Entry = {
 	anonymousAuth,
 	restoringAuth,
 	authenticatedAuth,
-	bearerCredential,
+	credential,
+	grant,
 	expiredCredential
 };
 /**
@@ -1294,12 +1202,11 @@ const Errors = {
 	notReady: () => new KeboolaError(KeboolaErrorType.NotReady),
 	alreadyRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`),
 	notRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`),
-	unexpectedCredentialKind: (baseUrl, kind) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" holds a ${kind} credential`),
-	notRotatingCredential: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" holds a static credential`),
-	credentialKindChanged: (from, to) => /* @__PURE__ */ new Error(`A ${from} credential cannot become ${to}`),
+	grantTypeChanged: (from, to) => /* @__PURE__ */ new Error(`A ${from} grant cannot become ${to}`),
+	nothingRetained: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`),
 	missingProject: (id) => /* @__PURE__ */ new Error(`No project "${id}"`)
 };
-const authenticated = (auth) => auth.status === "authenticated" ? require_jobStatus.Result.success(auth.credential) : require_jobStatus.Result.failure(Errors.notAuthenticated());
+const authenticated = (auth) => auth.status === "authenticated" ? require_transientRetries.Result.success(auth.credential) : require_transientRetries.Result.failure(Errors.notAuthenticated());
 //#endregion
 //#region src/keboola/bearer/state/auth.ts
 /**
@@ -1325,45 +1232,55 @@ const createExpiryLatch = () => {
 *   sign-in is this" — what an in-flight exchange compares itself against.
 */
 const createAuth = ({ stacks, projects, expiry }) => {
-	const requireUnauthenticated = (baseUrl) => require_jobStatus.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_jobStatus.Result.failure(Errors.alreadyAuthenticated()) : require_jobStatus.Result.success(stack));
-	const requireAnonymous = (baseUrl) => require_jobStatus.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_jobStatus.Result.failure(Errors.alreadyRestoring(baseUrl)) : require_jobStatus.Result.success(stack));
-	const requireRestoring = (baseUrl) => require_jobStatus.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_jobStatus.Result.success(stack) : require_jobStatus.Result.failure(Errors.notRestoring(baseUrl)));
-	const requireRotatingCredential = (baseUrl) => require_jobStatus.Result.andThen(stacks.requireCredential(baseUrl), (credential) => credential.type === "static" ? require_jobStatus.Result.failure(Errors.notRotatingCredential(baseUrl)) : require_jobStatus.Result.success(credential));
-	const requireCredentialOf = (baseUrl, mode) => require_jobStatus.Result.andThen(requireRotatingCredential(baseUrl), (credential) => credential.type === mode ? require_jobStatus.Result.success(credential) : require_jobStatus.Result.failure(Errors.unexpectedCredentialKind(baseUrl, credential.type)));
-	const startRestore = (baseUrl) => require_jobStatus.Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
+	const requireUnauthenticated = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_transientRetries.Result.failure(Errors.alreadyAuthenticated()) : require_transientRetries.Result.success(stack));
+	const requireAnonymous = (baseUrl) => require_transientRetries.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.failure(Errors.alreadyRestoring(baseUrl)) : require_transientRetries.Result.success(stack));
+	const requireRestoring = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(Errors.notRestoring(baseUrl)));
+	const startRestore = (baseUrl) => require_transientRetries.Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
 		...stack,
 		auth: Entry.restoringAuth()
 	}));
-	const cancelRestore = (baseUrl) => require_jobStatus.Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
+	const cancelRestore = (baseUrl) => require_transientRetries.Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
 		...stack,
 		auth: Entry.anonymousAuth()
 	}));
-	const authenticate = (baseUrl, input) => require_jobStatus.Result.map(requireUnauthenticated(baseUrl), (stack) => {
+	const authenticate = (baseUrl, input) => require_transientRetries.Result.map(requireUnauthenticated(baseUrl), (stack) => {
 		expiry.arm(baseUrl);
 		return stacks.set({
 			...stack,
 			epoch: stack.epoch + 1,
-			auth: Entry.authenticatedAuth(Entry.bearerCredential(input))
+			auth: Entry.authenticatedAuth(Entry.credential(input)),
+			retained: null
 		});
 	});
-	const applyRefresh = (baseUrl, input) => require_jobStatus.Result.andThen(requireRotatingCredential(baseUrl), (credential) => credential.type !== input.type ? require_jobStatus.Result.failure(Errors.credentialKindChanged(credential.type, input.type)) : require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+	const applyRefresh = (baseUrl, input) => require_transientRetries.Result.andThen(stacks.requireCredential(baseUrl), (credential) => credential.type !== input.type ? require_transientRetries.Result.failure(Errors.grantTypeChanged(credential.type, input.type)) : require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
 		...stack,
-		auth: Entry.authenticatedAuth(Entry.bearerCredential(input))
+		auth: Entry.authenticatedAuth(Entry.credential(input))
 	})));
-	const forceExpire = (baseUrl) => require_jobStatus.Result.andThen(requireRotatingCredential(baseUrl), (credential) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+	const forceExpire = (baseUrl) => require_transientRetries.Result.andThen(stacks.requireCredential(baseUrl), (credential) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
 		...stack,
 		auth: Entry.authenticatedAuth(Entry.expiredCredential(credential))
 	})));
-	const signOut = (baseUrl) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => {
+	const signOut = (baseUrl, { retain = false } = {}) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => {
 		projects.closeAll(baseUrl);
+		const retained = retain ? require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(authenticated(stack.auth), (credential) => ({ grant: Entry.grant(credential) })), stack.retained) : null;
 		return stacks.set({
 			...stack,
 			epoch: stack.epoch + 1,
-			auth: Entry.anonymousAuth()
+			auth: Entry.anonymousAuth(),
+			retained
 		});
 	});
-	const getEpoch = (baseUrl) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
-	const getAccessToken = (baseUrl) => require_jobStatus.Result.unwrapOr(require_jobStatus.Result.map(stacks.requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
+	const retain = (baseUrl, retained) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained
+	}));
+	const dropRetained = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained: null
+	}));
+	const requireRetained = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? require_transientRetries.Result.success(stack.retained) : require_transientRetries.Result.failure(Errors.nothingRetained(baseUrl)));
+	const getEpoch = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
+	const getAccessToken = (baseUrl) => require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(stacks.requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
 	return {
 		startRestore,
 		cancelRestore,
@@ -1371,10 +1288,11 @@ const createAuth = ({ stacks, projects, expiry }) => {
 		applyRefresh,
 		forceExpire,
 		signOut,
+		retain,
+		dropRetained,
+		requireRetained,
 		notifyExpired: expiry.report,
 		requireCredential: stacks.requireCredential,
-		requireRotatingCredential,
-		requireCredentialOf,
 		getEpoch,
 		getAccessToken
 	};
@@ -1386,7 +1304,7 @@ const createProjects = ({ store, stacks }) => {
 	const has = (id) => id in store.get().projects;
 	const get = (id) => {
 		const project = store.get().projects[id];
-		return project ? require_jobStatus.Result.success(project) : require_jobStatus.Result.failure(Errors.missingProject(id));
+		return project ? require_transientRetries.Result.success(project) : require_transientRetries.Result.failure(Errors.missingProject(id));
 	};
 	const list = (baseUrl) => Object.values(store.get().projects).filter((project) => project.baseUrl === baseUrl);
 	/** Every open project with this id, whatever stack it sits on — a project number is not unique. */
@@ -1402,7 +1320,7 @@ const createProjects = ({ store, stacks }) => {
 		});
 		return project;
 	};
-	const update = (id, updater) => require_jobStatus.Result.map(get(id), (project) => set(updater(project)));
+	const update = (id, updater) => require_transientRetries.Result.map(get(id), (project) => set(updater(project)));
 	const removeMany = (ids, nextActive) => {
 		const state = store.get();
 		const projects = { ...state.projects };
@@ -1413,13 +1331,13 @@ const createProjects = ({ store, stacks }) => {
 			projects
 		});
 	};
-	const requireCredential = (id) => require_jobStatus.Result.andThen(get(id), (project) => stacks.requireCredential(project.baseUrl));
+	const requireCredential = (id) => require_transientRetries.Result.andThen(get(id), (project) => stacks.requireCredential(project.baseUrl));
 	const open = (baseUrl, projectId) => {
 		const id = Entry.projectEntryId(baseUrl, projectId);
 		if (has(id)) return get(id);
-		return require_jobStatus.Result.map(stacks.requireCredential(baseUrl), () => set(Entry.project(baseUrl, projectId)));
+		return require_transientRetries.Result.map(stacks.requireCredential(baseUrl), () => set(Entry.project(baseUrl, projectId)));
 	};
-	const close = (id) => require_jobStatus.Result.tap(get(id), ({ baseUrl, projectId }) => {
+	const close = (id) => require_transientRetries.Result.tap(get(id), ({ baseUrl, projectId }) => {
 		const { active } = store.get();
 		const isScoped = active.baseUrl === baseUrl && active.projectId === projectId;
 		removeMany([id], isScoped ? Entry.stackAddress(baseUrl) : active);
@@ -1487,25 +1405,25 @@ const createScope = ({ store, stacks, projects }) => {
 		return location;
 	};
 	const getActiveStack = () => getActive().stack;
-	const activateStack = (baseUrl) => require_jobStatus.Result.map(stacks.get(baseUrl), (stack) => {
+	const activateStack = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => {
 		const next = Entry.stackAddress(stack.baseUrl);
 		set(next);
 		return next;
 	});
-	const activateProject = (baseUrl, projectId) => require_jobStatus.Result.map(projects.requireCredential(Entry.projectEntryId(baseUrl, projectId)), () => {
+	const activateProject = (baseUrl, projectId) => require_transientRetries.Result.map(projects.requireCredential(Entry.projectEntryId(baseUrl, projectId)), () => {
 		const next = Entry.projectAddress(baseUrl, projectId);
 		set(next);
 		return next;
 	});
 	const selectStack = (baseUrl) => {
 		const stack = stacks.ensure(baseUrl);
-		return require_jobStatus.Result.map(activateStack(stack.baseUrl), () => stack);
+		return require_transientRetries.Result.map(activateStack(stack.baseUrl), () => stack);
 	};
 	const selectProject = (projectId) => {
 		const { baseUrl } = getActiveStack();
 		const project = projects.open(baseUrl, projectId);
 		if (!project.success) return project;
-		return require_jobStatus.Result.map(activateProject(baseUrl, projectId), () => project.data);
+		return require_transientRetries.Result.map(activateProject(baseUrl, projectId), () => project.data);
 	};
 	const deactivate = () => {
 		const active = get();
@@ -1514,7 +1432,7 @@ const createScope = ({ store, stacks, projects }) => {
 	};
 	const requireActiveProject = () => {
 		const { project } = getActive();
-		return project ? require_jobStatus.Result.success(project) : require_jobStatus.Result.failure(Errors.notReady());
+		return project ? require_transientRetries.Result.success(project) : require_transientRetries.Result.failure(Errors.notReady());
 	};
 	return {
 		get,
@@ -1535,7 +1453,7 @@ const createStacks = ({ store, forgetExpiry }) => {
 	const has = (baseUrl) => baseUrl in store.get().stacks;
 	const get = (baseUrl) => {
 		const stack = store.get().stacks[baseUrl];
-		return stack ? require_jobStatus.Result.success(stack) : require_jobStatus.Result.failure(Errors.unconfigured());
+		return stack ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(Errors.unconfigured());
 	};
 	const list = () => Object.values(store.get().stacks);
 	const set = (stack) => {
@@ -1549,8 +1467,8 @@ const createStacks = ({ store, forgetExpiry }) => {
 		});
 		return stack;
 	};
-	const update = (baseUrl, updater) => require_jobStatus.Result.map(get(baseUrl), (stack) => set(updater(stack)));
-	const requireCredential = (baseUrl) => require_jobStatus.Result.andThen(get(baseUrl), (stack) => authenticated(stack.auth));
+	const update = (baseUrl, updater) => require_transientRetries.Result.map(get(baseUrl), (stack) => set(updater(stack)));
+	const requireCredential = (baseUrl) => require_transientRetries.Result.andThen(get(baseUrl), (stack) => authenticated(stack.auth));
 	const ensure = (baseUrl) => {
 		const existing = get(baseUrl);
 		if (existing.success) return existing.data;
@@ -1560,7 +1478,7 @@ const createStacks = ({ store, forgetExpiry }) => {
 		const stack = get(baseUrl);
 		if (!stack.success) return stack;
 		const state = store.get();
-		if (state.active.baseUrl === baseUrl) return require_jobStatus.Result.failure(Errors.stackActive());
+		if (state.active.baseUrl === baseUrl) return require_transientRetries.Result.failure(Errors.stackActive());
 		const stacks = { ...state.stacks };
 		delete stacks[baseUrl];
 		const projects = Object.fromEntries(Object.entries(state.projects).filter(([, project]) => project.baseUrl !== baseUrl));
@@ -1626,6 +1544,204 @@ const createState = (defaultBaseUrl) => {
 	};
 };
 //#endregion
+//#region src/keboola/bearer/credentials/renewal.ts
+const renew = async (client, grant) => {
+	if (grant.type === "cookie") {
+		const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({ sessionId: grant.sessionId });
+		return {
+			type: "cookie",
+			accessToken,
+			expiresIn,
+			sessionId
+		};
+	}
+	const { accessToken, expiresIn, refreshToken } = await client.token.refreshWithToken({ refreshToken: grant.refreshToken });
+	if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+	return {
+		type: "token",
+		accessToken,
+		expiresIn,
+		refreshToken
+	};
+};
+//#endregion
+//#region src/keboola/bearer/credentials/credentials.ts
+const DEFAULT_REFRESH_THRESHOLD = .9;
+const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
+const toRestoreStatus = (outcome) => {
+	if (outcome === void 0 || outcome === "skipped") return "empty";
+	if (outcome === "refused") return "expired";
+	return outcome;
+};
+const createCredentials = ({ state, persistor, middlewares, refreshThreshold = DEFAULT_REFRESH_THRESHOLD, onSignedOut, onExpired }) => {
+	const rotationMap = /* @__PURE__ */ new Map();
+	const generations = /* @__PURE__ */ new Map();
+	const generationOf = (baseUrl) => generations.get(baseUrl) ?? 0;
+	const refresh = async (baseUrl, grant) => {
+		const client = require_authClient.createAuthClient({
+			baseUrl,
+			middlewares
+		});
+		const epochBefore = require_transientRetries.Result.unwrap(state.auth.getEpoch(baseUrl));
+		const generationBefore = generationOf(baseUrl);
+		const refreshed = await require_transientRetries.Result.tryCatchAsync(() => renew(client, grant));
+		return require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epochBefore && generationOf(baseUrl) === generationBefore ? refreshed : require_transientRetries.Result.failure(signInEnded());
+	};
+	/**
+	* A stack's teardown, from the credential's side.
+	*
+	* - Bumps the generation, so an in-flight rotation can no longer write.
+	* - Drops the deduped entry, so nothing joins that rotation.
+	*/
+	const forget = (baseUrl) => {
+		generations.set(baseUrl, generationOf(baseUrl) + 1);
+		rotationMap.delete(baseUrl);
+	};
+	/**
+	* The rotation, and the one place a credential is declared dead.
+	*
+	* - Renews by the credential's grant: the refresh token, or the session id with the cookie.
+	* - A refused refresh token or session is unambiguous.
+	* - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.
+	*/
+	const getGrantForRotation = async (store, baseUrl, credential) => {
+		const epochBefore = require_transientRetries.Result.unwrap(state.auth.getEpoch(baseUrl));
+		const generationBefore = generationOf(baseUrl);
+		const hydrated = await require_transientRetries.Result.tryCatchAsync(() => store.read());
+		if (!hydrated.success) return hydrated;
+		if (require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) !== epochBefore || generationOf(baseUrl) !== generationBefore) return require_transientRetries.Result.failure(signInEnded());
+		const persistedStack = hydrated.data.stacks.find((stack) => stack.baseUrl === baseUrl);
+		if (persistedStack && persistedStack.credential === null) return require_transientRetries.Result.failure(signInEnded());
+		return require_transientRetries.Result.success(persistedStack?.credential ?? Entry.grant(credential));
+	};
+	const rotateOnce = async (baseUrl) => persistor.locked(async (store) => {
+		const credential = state.auth.requireCredential(baseUrl);
+		if (!credential.success) return credential;
+		const grant = await getGrantForRotation(store, baseUrl, credential.data);
+		if (!grant.success) return grant;
+		const refreshed = await refresh(baseUrl, grant.data);
+		if (!refreshed.success) {
+			if (require_middleware.isUnauthorized(refreshed.error)) await expire(baseUrl, store);
+			return refreshed;
+		}
+		const accessToken = require_transientRetries.Result.map(state.auth.applyRefresh(baseUrl, refreshed.data), () => refreshed.data.accessToken);
+		await store.persistStack(baseUrl, state.store.get());
+		return accessToken;
+	});
+	const rotate = (baseUrl) => ensure(rotationMap, baseUrl, () => require_dedupe.dedupe(() => rotateOnce(baseUrl)))();
+	const restoreStack = async (baseUrl, grant, retained = false) => persistor.locked(async (store) => {
+		const storedStack = (await store.read()).stacks.find((stack) => stack.baseUrl === baseUrl);
+		const latestGrant = retained ? storedStack?.retained?.grant : storedStack?.credential;
+		if (storedStack && !latestGrant) return "skipped";
+		if (!state.auth.startRestore(baseUrl).success) return "unreachable";
+		const refreshed = await refresh(baseUrl, latestGrant ?? grant);
+		if (!refreshed.success) {
+			state.auth.cancelRestore(baseUrl);
+			if (require_middleware.isUnauthorized(refreshed.error)) {
+				if (retained) state.auth.dropRetained(baseUrl);
+				await store.persistStack(baseUrl, state.store.get());
+				return "refused";
+			}
+			return "unreachable";
+		}
+		state.auth.authenticate(baseUrl, refreshed.data);
+		if (!state.auth.requireCredential(baseUrl).success) return "unreachable";
+		if (retained) state.auth.dropRetained(baseUrl);
+		await store.persistStack(baseUrl, state.store.get());
+		return "restored";
+	});
+	const restoreProjects = (baseUrl, projects) => {
+		for (const { projectId } of projects) state.projects.open(baseUrl, projectId);
+	};
+	/**
+	* Every persisted stack back into the table, with whatever credential it can hand back.
+	*
+	* - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the
+	*   caller to select.
+	* - `status` reports what became of `lastActive`'s credential; the client reads it to decide
+	*   when persistence may start.
+	*/
+	const restore = async () => {
+		const hydrated = await persistor.locked((store) => store.read()).catch((error) => {
+			console.warn("createCredentials: the stored session could not be read", error);
+			return null;
+		});
+		if (hydrated === null) return {
+			lastActive: null,
+			status: "unreachable"
+		};
+		const { stacks, current } = hydrated;
+		const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);
+		const restored = stacks.map(async ({ baseUrl, credential, retained, projects }) => {
+			state.stacks.ensure(baseUrl);
+			if (!credential && !retained) return "unreachable";
+			if (require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return "skipped";
+			if (retained) state.auth.retain(baseUrl, retained);
+			if (!credential) return "unreachable";
+			const outcome = await restoreStack(baseUrl, credential);
+			if (outcome === "restored") restoreProjects(baseUrl, projects);
+			return outcome;
+		});
+		const results = await Promise.all(restored);
+		const scopedOutcome = scoped?.credential ? results[stacks.indexOf(scoped)] : void 0;
+		return {
+			lastActive: current,
+			status: toRestoreStatus(scopedOutcome)
+		};
+	};
+	/**
+	* Signs a retained stack back in from the grant it kept.
+	*
+	* - `restored` and `refused` empty the slot; `unreachable` keeps it for another try.
+	* - Throws when the stack retains nothing.
+	*/
+	const restoreRetained = async (baseUrl) => {
+		const { grant } = require_transientRetries.Result.unwrap(state.auth.requireRetained(baseUrl));
+		return restoreStack(baseUrl, grant, true);
+	};
+	const isStale = (baseUrl) => {
+		const ageing = require_transientRetries.Result.map(state.auth.requireCredential(baseUrl), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
+		return require_transientRetries.Result.unwrapOr(ageing, false);
+	};
+	/**
+	* Drops the slot so the next sign-in's requests don't join the dying rotation.
+	*
+	* - Writes nothing: the caller persists the stack, under the lock it holds or takes.
+	*/
+	const signOut = (baseUrl, options) => {
+		rotationMap.delete(baseUrl);
+		const signedOut = state.auth.signOut(baseUrl, options);
+		onSignedOut?.(baseUrl);
+		return signedOut;
+	};
+	const expire = async (baseUrl, store) => {
+		if (!state.auth.notifyExpired(baseUrl)) return;
+		signOut(baseUrl);
+		await store.persistStack(baseUrl, state.store.get());
+		onExpired?.(baseUrl);
+	};
+	const renewIfStale = async (baseUrl) => {
+		if (isStale(baseUrl)) await rotate(baseUrl);
+	};
+	const middleware = (baseUrl) => require_middleware.createBearerAuthMiddleware({ getAccessToken: async ({ forceRefresh = false } = {}) => {
+		if (forceRefresh) {
+			if (!state.auth.requireCredential(baseUrl).success) return null;
+			return require_transientRetries.Result.unwrap(await rotate(baseUrl));
+		}
+		await renewIfStale(baseUrl);
+		return state.auth.getAccessToken(baseUrl);
+	} });
+	return {
+		middleware,
+		rotate,
+		renewIfStale,
+		restore,
+		restoreRetained,
+		signOut,
+		forget
+	};
+};
+//#endregion
 //#region src/keboola/bearer/context/resource.ts
 /**
 * Owns fetching one async value per key — a caller names what it needs and never orchestrates the
@@ -1942,61 +2058,86 @@ const createPerProject = ({ state, credentials, middlewareFor, stack, clientServ
 */
 const SESSION_STORAGE_KEY = "keboola:session";
 /**
-* What survives a reload, per credential kind.
+* What survives a reload, per grant type.
+*
+* - Written under `credential`: the key every blob already stored carries.
 *
 * - `token`: the refresh token. It rotates, is single-use and is server-revocable, so a leaked
 *   snapshot has limited and revocable value. The access token is never written.
-* - `static`: the token itself — a long-lived PAT the user pasted, which nothing can re-mint.
 * - `cookie`: the session id. The session cookie is the durable half and the browser keeps it;
 *   the id alone renews nothing.
 */
-const persistedCredentialSchema = zod.discriminatedUnion("type", [
-	zod.object({
-		type: zod.literal("token"),
-		refreshToken: zod.string()
-	}),
-	zod.object({
-		type: zod.literal("cookie"),
-		sessionId: zod.string()
-	}),
-	zod.object({
-		type: zod.literal("static"),
-		accessToken: zod.string()
-	})
-]);
+const persistedGrantSchema = zod.discriminatedUnion("type", [zod.object({
+	type: zod.literal("token"),
+	refreshToken: zod.string()
+}), zod.object({
+	type: zod.literal("cookie"),
+	sessionId: zod.string()
+})]);
 /** A record per project rather than a bare id, so a project can grow a field without a migration. */
 const persistedProjectSchema = zod.object({ projectId: zod.number() });
+const persistedStackSchema = zod.object({
+	baseUrl: zod.string(),
+	credential: persistedGrantSchema.nullable().catch(null),
+	retained: zod.object({ grant: persistedGrantSchema }).nullable().default(null).catch(null),
+	projects: zod.array(persistedProjectSchema)
+});
 const persistedSessionSchema = zod.object({
 	current: zod.object({
 		baseUrl: zod.string(),
 		projectId: zod.number().nullable()
 	}).nullable(),
-	stacks: zod.array(zod.object({
-		baseUrl: zod.string(),
-		credential: persistedCredentialSchema.nullable(),
-		projects: zod.array(persistedProjectSchema)
-	}))
+	stacks: zod.array(persistedStackSchema)
 });
 const EMPTY_PERSISTED_SESSION = {
 	current: null,
 	stacks: []
 };
-const durableCredential = (stack) => {
-	if (stack.auth.status !== "authenticated") return null;
-	const { credential } = stack.auth;
-	if (credential.type === "token") return {
-		type: "token",
-		refreshToken: credential.refreshToken
-	};
-	if (credential.type === "cookie") return {
-		type: "cookie",
-		sessionId: credential.sessionId
-	};
+const projectsOf = (projects, baseUrl) => Object.values(projects).filter((project) => project.baseUrl === baseUrl).map(({ projectId }) => ({ projectId }));
+const grantsOf = (stack) => ({
+	credential: stack.auth.status === "authenticated" ? Entry.grant(stack.auth.credential) : null,
+	retained: stack.retained
+});
+/**
+* The stored session, rewritten from the table except for the grants.
+*
+* - Scope, stack list and open projects come from memory.
+* - `credential` and `retained` stay as stored: a grant another document rotated must not be put
+*   back by a snapshot of this one's older table.
+*/
+const mergeSnapshot = (stored, { active, stacks, projects }) => ({
+	current: {
+		baseUrl: active.baseUrl,
+		projectId: active.projectId
+	},
+	stacks: Object.values(stacks).map(({ baseUrl }) => {
+		const kept = stored.stacks.find((stack) => stack.baseUrl === baseUrl);
+		return {
+			baseUrl,
+			credential: kept?.credential ?? null,
+			retained: kept?.retained ?? null,
+			projects: projectsOf(projects, baseUrl)
+		};
+	})
+});
+const upsertStack = (stored, baseUrl, update) => {
+	const index = stored.stacks.findIndex((stack) => stack.baseUrl === baseUrl);
+	const stacks = [...stored.stacks];
+	if (index < 0) stacks.push(update(void 0));
+	else stacks[index] = update(stacks[index]);
 	return {
-		type: "static",
-		accessToken: credential.accessToken
+		...stored,
+		stacks
 	};
 };
+/**
+* The stored session, reached in two ways.
+*
+* - `locked`: the only way to read, and the only way to a grant write. Rotation and restore hold
+*   it across the refresh; sign-in, sign-out and the boot restore open it for one step.
+* - `snapshot`: the table minus its grants, under the lock, coalesced; what the store subscription
+*   feeds, and what a scope change awaits before the document leaves.
+*/
 const createSessionPersistor = (storage) => {
 	const persistor = createPersistor({
 		storage,
@@ -2004,20 +2145,35 @@ const createSessionPersistor = (storage) => {
 		schema: persistedSessionSchema,
 		defaultValue: EMPTY_PERSISTED_SESSION
 	});
-	const persist = ({ active, stacks, projects }) => persistor.persist({
-		current: {
-			baseUrl: active.baseUrl,
-			projectId: active.projectId
-		},
-		stacks: Object.values(stacks).map((stack) => ({
-			baseUrl: stack.baseUrl,
-			credential: durableCredential(stack),
-			projects: Object.values(projects).filter((project) => project.baseUrl === stack.baseUrl).map(({ projectId }) => ({ projectId }))
-		}))
-	});
+	const persistStack = (cell, baseUrl, { stacks, projects }) => {
+		const stack = stacks[baseUrl];
+		if (stack === void 0) return Promise.resolve();
+		return cell.modify((stored) => upsertStack(stored, baseUrl, (existing) => ({
+			baseUrl,
+			...grantsOf(stack),
+			projects: existing?.projects ?? projectsOf(projects, baseUrl)
+		})));
+	};
+	const locked = (task) => persistor.locked((cell) => task({
+		read: cell.read,
+		persistStack: (baseUrl, state) => persistStack(cell, baseUrl, state)
+	}));
+	let latest = null;
+	let pending = null;
+	const snapshot = (state) => {
+		latest = state;
+		if (pending) return pending;
+		const write = persistor.locked((cell) => {
+			pending = null;
+			const table = latest ?? state;
+			return cell.modify((stored) => mergeSnapshot(stored, table));
+		});
+		pending = write;
+		return write;
+	};
 	return {
-		...persistor,
-		persist
+		locked,
+		snapshot
 	};
 };
 //#endregion
@@ -2062,7 +2218,7 @@ const createPerStack = ({ state, credentials, middlewareFor }) => {
 *
 * - Credential-derived state is owned by the scope whose end ends it (`perStack`, `perProject`).
 */
-const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls, credentials: mode = "token" }) => {
+const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls, onExpired }) => {
 	const state = createState(require_createFetchClient.normalizeBaseUrl(defaultBaseUrl));
 	const persistor = createSessionPersistor(storage);
 	const middlewareFor = createMiddlewareFor(middlewares);
@@ -2070,8 +2226,8 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		state,
 		persistor,
 		middlewares: middlewareFor("auth"),
-		mode,
-		onSignedOut: (baseUrl) => perProject.forgetUnder(baseUrl)
+		onSignedOut: (baseUrl) => perProject.forgetUnder(baseUrl),
+		onExpired
 	});
 	const perStack = createPerStack({
 		state,
@@ -2086,33 +2242,33 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		clientServiceUrls,
 		buildApi: (project) => createApiFor({
 			stackUrl: () => project.baseUrl,
-			project: () => require_jobStatus.Result.unwrap(state.projects.get(project.id)),
+			project: () => require_transientRetries.Result.unwrap(state.projects.get(project.id)),
 			pinned: true
 		})
 	});
 	state.store.subscribe(perStack.context.subscriber);
 	perStack.context.subscriber(state.store.get());
 	state.store.subscribe(perProject.context.subscriber);
-	const selectStack = (baseUrl) => require_jobStatus.Result.unwrap(state.scope.selectStack(require_createFetchClient.normalizeBaseUrl(baseUrl)));
-	const selectProject = (projectId) => require_jobStatus.Result.unwrap(state.scope.selectProject(projectId));
+	const selectStack = (baseUrl) => require_transientRetries.Result.unwrap(state.scope.selectStack(require_createFetchClient.normalizeBaseUrl(baseUrl)));
+	const selectProject = (projectId) => require_transientRetries.Result.unwrap(state.scope.selectProject(projectId));
 	/** The scoped stack, or a named one — normalised to key like `select`. */
 	const requireStackUrl = (baseUrl) => baseUrl === void 0 ? state.scope.getActiveStack().baseUrl : require_createFetchClient.normalizeBaseUrl(baseUrl);
 	/** The scoped project, or the row a table id names — on whichever stack that is. */
-	const requireProjectEntry = (id) => id === void 0 ? require_jobStatus.Result.unwrap(state.scope.requireActiveProject()) : require_jobStatus.Result.unwrap(state.projects.get(id));
+	const requireProjectEntry = (id) => id === void 0 ? require_transientRetries.Result.unwrap(state.scope.requireActiveProject()) : require_transientRetries.Result.unwrap(state.projects.get(id));
 	/**
 	* The scoped project, or a named open one.
 	*
 	* - An id is ambiguous across stacks: the active stack decides, else the single one open elsewhere.
 	*/
 	const requireProject = (projectId) => {
-		if (projectId === void 0) return require_jobStatus.Result.unwrap(state.scope.requireActiveProject());
+		if (projectId === void 0) return require_transientRetries.Result.unwrap(state.scope.requireActiveProject());
 		const scoped = state.projects.get(Entry.projectEntryId(requireStackUrl(), projectId));
 		if (scoped.success) return scoped.data;
 		const [only, ...rest] = state.projects.findAll(projectId);
-		return only !== void 0 && rest.length === 0 ? only : require_jobStatus.Result.unwrap(scoped);
+		return only !== void 0 && rest.length === 0 ? only : require_transientRetries.Result.unwrap(scoped);
 	};
 	const headersFor = (project) => {
-		const credential = require_jobStatus.Result.unwrap(state.auth.requireCredential(project.baseUrl));
+		const credential = require_transientRetries.Result.unwrap(state.auth.requireCredential(project.baseUrl));
 		return {
 			[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${credential.accessToken}`,
 			[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(project.projectId)
@@ -2133,18 +2289,24 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	const getAuthHeadersAsync = async (projectId) => {
 		const project = requireProject(projectId);
 		await credentials.renewIfStale(project.baseUrl);
-		return headersFor(require_jobStatus.Result.unwrap(state.projects.get(project.id)));
+		return headersFor(require_transientRetries.Result.unwrap(state.projects.get(project.id)));
 	};
-	const authenticate = (input) => {
-		const stack = state.scope.getActiveStack();
-		if (input.type !== "static" && input.type !== mode) throw new KeboolaError(KeboolaErrorType.CredentialKindMismatch);
-		if (input.type !== "token") return require_jobStatus.Result.unwrap(state.auth.authenticate(stack.baseUrl, input));
+	const toCredential = (input) => {
+		if (input.type !== "token") return input;
 		const { refreshToken } = input;
 		if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-		return require_jobStatus.Result.unwrap(state.auth.authenticate(stack.baseUrl, {
+		return {
 			...input,
 			refreshToken
-		}));
+		};
+	};
+	const authenticate = (input) => {
+		const { baseUrl } = state.scope.getActiveStack();
+		const signedIn = require_transientRetries.Result.unwrap(state.auth.authenticate(baseUrl, toCredential(input)));
+		persistor.locked((store) => store.persistStack(baseUrl, state.store.get())).catch((error) => {
+			console.warn("createKeboola: the sign-in could not be stored", error);
+		});
+		return signedIn;
 	};
 	/**
 	* The flat product surface: `auth` and `management` per stack, the rest per project.
@@ -2168,7 +2330,7 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	} });
 	const activeApi = createApiFor({
 		stackUrl: () => state.scope.getActiveStack().baseUrl,
-		project: () => require_jobStatus.Result.unwrap(state.scope.requireActiveProject())
+		project: () => require_transientRetries.Result.unwrap(state.scope.requireActiveProject())
 	});
 	/** The scoped project's surface. Re-points when the scope moves. */
 	const getActiveApi = () => activeApi;
@@ -2181,14 +2343,24 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	const getApi = (projectId) => {
 		const { baseUrl } = state.scope.getActiveStack();
 		const project = Entry.project(baseUrl, projectId);
-		require_jobStatus.Result.unwrapOr(state.projects.open(baseUrl, projectId), null);
+		require_transientRetries.Result.unwrapOr(state.projects.open(baseUrl, projectId), null);
 		return perProject.get(project).api;
 	};
-	/** The scope's sign-in, or a named stack's — and everything that sign-in derived. */
-	const signOut = (baseUrl) => {
+	/**
+	* The scope's sign-in, or a named stack's — and everything that sign-in derived.
+	*
+	* - `retain` keeps the grant on the stack, persisted beside the sign-in it ended, for
+	*   `restoreRetained`; the next sign-in on the stack replaces it.
+	* - The table is signed out on return; the promise resolves once that is stored, so a caller
+	*   leaving the document waits for it.
+	*/
+	const signOut = ({ baseUrl, ...options } = {}) => {
 		const target = requireStackUrl(baseUrl);
-		return require_jobStatus.Result.unwrap(credentials.signOut(target));
+		const signedOut = require_transientRetries.Result.unwrap(credentials.signOut(target, options));
+		return persistor.locked((store) => store.persistStack(target, state.store.get())).then(() => signedOut);
 	};
+	/** Signs a stack back in from what a retained sign-out kept; `unreachable` leaves it to retry. */
+	const restoreRetained = (baseUrl) => credentials.restoreRetained(require_createFetchClient.normalizeBaseUrl(baseUrl));
 	/**
 	* `input` replaces the active stack's sign-in, whatever it holds.
 	*
@@ -2200,26 +2372,13 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		return authenticate(input);
 	};
 	/**
-	* A server-injected `token` credential, adopted whatever this client's mode.
-	*
-	* @deprecated Temporary, for the agent-project claim page only: Connection injects an API-mode
-	* session through `UiConfig.programmaticAuth`. Remove together with that injection.
-	*
-	* - Replaces the active stack's sign-in, like `replace`.
-	* - A cookie-mode client never rotates it, so it lasts as long as its access token.
-	*/
-	const adoptInjected = (input) => {
-		signOut();
-		return require_jobStatus.Result.unwrap(state.auth.authenticate(getActiveStack().baseUrl, input));
-	};
-	/**
 	* Leave one project: its row and everything built for it; its handles stop answering.
 	*
 	* - Counterpart of `getApi(projectId)`; without it the project is held and persisted until sign-out.
 	*/
 	const closeProject = (projectId) => {
 		const id = Entry.projectEntryId(requireStackUrl(), projectId);
-		const closed = require_jobStatus.Result.unwrapOr(state.projects.close(id), null);
+		const closed = require_transientRetries.Result.unwrapOr(state.projects.close(id), null);
 		if (closed === null) return null;
 		perProject.forget(id);
 		return closed;
@@ -2227,7 +2386,7 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	const closeStack = (baseUrl) => {
 		const target = require_createFetchClient.normalizeBaseUrl(baseUrl);
 		if (state.scope.get().baseUrl === target) throw new KeboolaError(KeboolaErrorType.StackActive);
-		const closed = require_jobStatus.Result.unwrapOr(state.stacks.close(target), null);
+		const closed = require_transientRetries.Result.unwrapOr(state.stacks.close(target), null);
 		if (closed === null) return null;
 		perProject.forgetUnder(target);
 		perStack.forget(target);
@@ -2238,16 +2397,22 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	/**
 	* Persistence starts only once the restore has settled.
 	*
-	* - Mid-hydration an unexchanged stack is `anonymous`; `durableCredential` would erase the
+	* - Mid-hydration an unexchanged stack is `anonymous`; the persistor would erase the
 	*   refresh token the exchange is about to spend.
 	* - Writes the settled table once: the subscription fires only on the next change.
 	*/
 	const enablePersistence = () => {
 		if (persisting) return;
 		persisting = true;
-		persistor.persist(state.store.get());
-		state.store.subscribe(persistor.persist);
+		snapshot(state.store.get());
+		state.store.subscribe(snapshot);
+	};
+	const snapshot = (table) => {
+		persistor.snapshot(table).catch((error) => {
+			console.warn("createKeboola: the session could not be stored", error);
+		});
 	};
+	const persistScope = () => persisting ? persistor.snapshot(state.store.get()) : Promise.resolve();
 	/**
 	* The same, deferred until a sign-in.
 	*
@@ -2261,7 +2426,7 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			enablePersistence();
 		});
 	};
-	const restore = require_jobStatus.lazy(() => credentials.restore().then((restored) => {
+	const restore = require_transientRetries.lazy(() => credentials.restore().then((restored) => {
 		if (restored.status === "unreachable") enablePersistenceOnSignIn();
 		else enablePersistence();
 		return restored;
@@ -2281,7 +2446,7 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	* - Resolves with the stored credential's fate — only this tells `expired` from `empty`.
 	* - Other stacks still come back, persistence still starts; repeat calls share one promise.
 	*/
-	const resume = require_jobStatus.lazy(() => restore().then(({ lastActive, status }) => {
+	const resume = require_transientRetries.lazy(() => restore().then(({ lastActive, status }) => {
 		if (!lastActive || callerScoped) return status;
 		const stack = selectStack(lastActive.baseUrl);
 		if (lastActive.projectId !== null && stack.auth.status === "authenticated") selectProject(lastActive.projectId);
@@ -2301,14 +2466,22 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			resume,
 			stack: {
 				getActive: getActiveStack,
-				select: byCaller(selectStack),
+				/** Scoped on return; resolves once that is stored, for a caller leaving the document. */
+				select: byCaller((baseUrl) => {
+					const stack = selectStack(baseUrl);
+					return persistScope().then(() => stack);
+				}),
 				close: closeStack,
 				retryContext: perStack.context.retry,
 				getContext: (baseUrl) => perStack.context.get(requireStackUrl(baseUrl)),
 				getContextAsync: (baseUrl) => perStack.context.getAsync(requireStackUrl(baseUrl))
 			},
 			project: {
-				select: byCaller(selectProject),
+				/** Scoped on return; resolves once that is stored, for a caller leaving the document. */
+				select: byCaller((projectId) => {
+					const project = selectProject(projectId);
+					return persistScope().then(() => project);
+				}),
 				close: closeProject,
 				deactivate: state.scope.deactivate,
 				retryContext: perProject.context.retry,
@@ -2318,12 +2491,12 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			auth: {
 				authenticate: byCaller(authenticate),
 				replace: byCaller(replace),
-				adoptInjected: byCaller(adoptInjected),
 				signOut: byCaller(signOut),
+				restoreRetained: byCaller(restoreRetained),
 				/** Whether the active stack holds a credential — `restoring` is not one yet. */
 				isAuthenticated,
 				isAuthenticatedAsync: () => resume().then(isAuthenticated),
-				rotate: (baseUrl) => credentials.rotate(baseUrl).then(require_jobStatus.Result.unwrap),
+				rotate: (baseUrl) => credentials.rotate(baseUrl).then(require_transientRetries.Result.unwrap),
 				getHeaders: getAuthHeaders,
 				getHeadersAsync: getAuthHeadersAsync
 			}
@@ -2473,7 +2646,7 @@ const createRetryMiddleware = (options) => {
 		} catch (error) {
 			if (attempt === maxRetries || !shouldRetry(error, attempt)) throw error;
 			const delayMs = backoffFactor * 1e3 * Math.pow(2, attempt);
-			await require_jobStatus.delay(delayMs, request.request.signal ?? void 0);
+			await require_transientRetries.delay(delayMs, request.request.signal ?? void 0);
 		}
 		throw new Error("unreachable");
 	};
@@ -2522,18 +2695,20 @@ exports.KeboolaErrorType = KeboolaErrorType;
 exports.KeboolaHttpHeader = require_createFetchClient.KeboolaHttpHeader;
 exports.ManagementClientAuthError = require_ManagementSessionMintError.ManagementClientAuthError;
 exports.ManagementSessionMintError = require_ManagementSessionMintError.ManagementSessionMintError;
-exports.QueryJobError = require_QueryJobTimeoutError.QueryJobError;
-exports.QueryJobTimeoutError = require_QueryJobTimeoutError.QueryJobTimeoutError;
-exports.Result = require_jobStatus.Result;
+exports.QueryJobError = require_QueryJobError.QueryJobError;
+exports.QueueJobError = require_QueueJobError.QueueJobError;
+exports.Result = require_transientRetries.Result;
 exports.SESSION_STORAGE_KEY = SESSION_STORAGE_KEY;
 exports.ServiceUnavailableError = require_storage.ServiceUnavailableError;
+exports.StorageJobError = require_storage.StorageJobError;
 exports.SyncActionError = require_SyncActionError.SyncActionError;
 exports.UserError = require_UserError.UserError;
 exports.ValidationError = require_ValidationError.ValidationError;
-exports.asError = require_jobStatus.asError;
+exports.asError = require_transientRetries.asError;
 exports.assert = assert;
 exports.coalesce = coalesce;
-exports.collect = require_collect.collect;
+exports.collectByCursor = require_authClient.collectByCursor;
+exports.collectByOffset = require_collectByOffset.collectByOffset;
 exports.concurrent = require_concurrent.concurrent;
 exports.createAdminAccount = createAdminAccount;
 exports.createDerivedAsyncStore = createDerivedAsyncStore;
@@ -2551,15 +2726,14 @@ exports.createPollRegistry = createPollRegistry;
 exports.createQueryServiceSdk = require_sdk_queryService_index.createQueryServiceSdk;
 exports.createRetryMiddleware = createRetryMiddleware;
 exports.createSessionStorage = createSessionStorage;
-exports.createStorageSdk = require_sdk_storage_index.createStorageSdk;
 exports.createStore = require_store.createStore;
 exports.createUiVersionMiddleware = createUiVersionMiddleware;
 exports.dedupe = require_dedupe.dedupe;
 exports.deepMerge = deepMerge;
-exports.delay = require_jobStatus.delay;
-exports.emitter = require_jobStatus.emitter;
+exports.delay = require_transientRetries.delay;
+exports.emitter = require_transientRetries.emitter;
 exports.ensure = ensure;
-exports.failureOf = require_jobStatus.failureOf;
+exports.failureOf = require_transientRetries.failureOf;
 exports.formatValidationIssues = require_ValidationError.formatValidationIssues;
 exports.generateUUID = require_generateUUID.generateUUID;
 exports.isAbortError = require_createFetchClient.isAbortError;
@@ -2571,19 +2745,21 @@ exports.isKeboolaError = isKeboolaError;
 exports.isManagementClientAuthError = require_management.isManagementClientAuthError;
 exports.isManagementSessionMintError = require_management.isManagementSessionMintError;
 exports.isPlainObject = require_isPlainObject.isPlainObject;
-exports.isQueryJobError = require_QueryJobTimeoutError.isQueryJobError;
-exports.isQueryJobTimeoutError = require_QueryJobTimeoutError.isQueryJobTimeoutError;
+exports.isQueryJobError = require_QueryJobError.isQueryJobError;
+exports.isQueueJobError = require_QueueJobError.isQueueJobError;
+exports.isStorageJobError = require_storage.isStorageJobError;
 exports.isStorageTokenMutatingRequest = isStorageTokenMutatingRequest;
 exports.isSyncActionError = require_SyncActionError.isSyncActionError;
 exports.isTimeoutError = require_createFetchClient.isTimeoutError;
 exports.isValidationError = require_ValidationError.isValidationError;
-exports.jobStatus = require_jobStatus.jobStatus;
+exports.jobStatus = require_transientRetries.jobStatus;
 exports.keboolaUID = require_tag.keboolaUID;
-exports.lazy = require_jobStatus.lazy;
+exports.lazy = require_transientRetries.lazy;
+exports.nextCursorOf = require_authClient.nextCursorOf;
 exports.parseLogLines = require_appLogs.parseLogLines;
 exports.parseOrThrow = require_ValidationError.parseOrThrow;
-exports.poll = require_jobStatus.poll;
-exports.poller = require_jobStatus.poller;
+exports.poller = require_transientRetries.poller;
+exports.queueSeries = queueSeries;
 exports.readableReason = require_storage.readableReason;
 exports.schemaGuidedMerge = require_configurations.schemaGuidedMerge;
 exports.series = require_storage.series;