@keboola/api-client 46.0.0 → 48.0.0

package/dist/index.js

@@ -1,52 +1,53 @@
 import { t as createProject } from "./project-BXLFrWJ6.js";
-import { t as collect } from "./collect-97WhfEpt.js";
+import { t as collectByOffset } from "./collectByOffset-2XzJqmvr.js";
+import { t as createAuthClient, v as collectByCursor, y as nextCursorOf } from "./authClient-2e8ZmzSP.js";
 import { t as concurrent } from "./concurrent-BacWxPwi.js";
 import { t as dedupe } from "./dedupe-Cky1gSUu.js";
-import { a as poller, c as Result, d as delay, i as poll, l as asError, n as emitter, o as clamp, r as failureOf, s as finiteOr, t as jobStatus, u as lazy } from "./jobStatus-BJdbZ72V.js";
+import { a as poller, c as Result, d as delay, i as failureOf, l as asError, n as jobStatus, o as clamp, r as emitter, s as finiteOr, u as lazy } from "./transientRetries-B4iusp69.js";
 import { n as createEmitter, t as createStore } from "./store-C9FQCHGe.js";
-import { a as readableReason, i as ServiceUnavailableError, o as series, t as createStorageClient } from "./storage-RkNaOFJ-.js";
+import { a as StorageJobError, c as readableReason, l as series, o as isStorageJobError, s as ServiceUnavailableError, t as createStorageClient } from "./storage-BR-Kgi-6.js";
 import { n as keboolaUID, t as createTagSdk } from "./tag-hh-1nhNr.js";
 import { t as generateUUID } from "./generateUUID-Dr8l-aoc.js";
 import { t as isPlainObject } from "./isPlainObject-LYW-03uB.js";
-import { n as schemaGuidedMerge, r as isEmptyDeep, t as createConfigurationSdk } from "./configurations-DcpUlC8I.js";
+import { n as schemaGuidedMerge, r as isEmptyDeep, t as createConfigurationSdk } from "./configurations-DKINmjA3.js";
 import { t as UserError } from "./UserError-By_Zckmc.js";
-import { _ as KeboolaHttpHeader, a as isTimeoutError, d as normalizeBaseUrl, g as HttpStatus, i as isFetchClientError, m as CREDENTIAL_HEADERS, n as isAbortError, o as HttpContentType, p as ApiError, r as isApiError, s as HttpHeader, v as REDACTED, y as redactHeaders } from "./createFetchClient-DITkTV2k.js";
-import { n as HtmlResponseError, r as isHtmlResponseError } from "./validateConnectionStatus-CdTV3gsP.js";
-import { n as ManagementClientAuthError, t as ManagementSessionMintError } from "./ManagementSessionMintError-5FFyvBZi.js";
-import { i as isQueryJobError, n as isQueryJobTimeoutError, r as QueryJobError, t as QueryJobTimeoutError } from "./QueryJobTimeoutError-C7JbNGOM.js";
+import { _ as KeboolaHttpHeader, a as isTimeoutError, d as normalizeBaseUrl, g as HttpStatus, i as isFetchClientError, m as CREDENTIAL_HEADERS, n as isAbortError, o as HttpContentType, p as ApiError, r as isApiError, s as HttpHeader, v as REDACTED, y as redactHeaders } from "./createFetchClient-CkHdS_IG.js";
+import { n as HtmlResponseError, r as isHtmlResponseError } from "./validateConnectionStatus-DyrYpn0G.js";
+import { n as ManagementClientAuthError, t as ManagementSessionMintError } from "./ManagementSessionMintError-4Pkn5Oob.js";
+import { n as isQueryJobError, t as QueryJobError } from "./QueryJobError-ZZZ043Nm.js";
+import { n as isQueueJobError, t as QueueJobError } from "./QueueJobError-8bThS_Mc.js";
 import { n as isSyncActionError, t as SyncActionError } from "./SyncActionError-CoZFsdUk.js";
 import { i as parseOrThrow, n as formatValidationIssues, r as isValidationError, t as ValidationError } from "./ValidationError-DjhtNMfZ.js";
-import { t as createGenericFetchClient } from "./createGenericFetchClient-KqiJhw8G.js";
-import { t as createImportClient } from "./import-JlH_QaDd.js";
-import { t as createAuthClient } from "./authClient-CACOwVt0.js";
-import { n as isManagementClientAuthError, r as isManagementSessionMintError, t as createManagementClient } from "./management-eg4Ig-Cx.js";
-import { s as ProjectFeature } from "./constants-Cifrqsls.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-CQdNcPC3.js";
+import { t as createImportClient } from "./import-FWy_wQZ1.js";
+import { n as isManagementClientAuthError, r as isManagementSessionMintError, t as createManagementClient } from "./management-NYAD6ej4.js";
+import { o as ServiceId, s as ProjectFeature } from "./constants-CA4UN2Xv.js";
 import { t as createStorageTable } from "./storageTable-BldTNyEk.js";
-import { i as createKaiMemorySdk } from "./kaiMemory-DaOh0zVn.js";
+import { i as createKaiMemorySdk } from "./kaiMemory-C9di17bd.js";
 import { i as createSemanticLayerSdk } from "./semanticLayer-DvjS_nzo.js";
-import { createStorageSdk } from "./sdk/storage/index.js";
 import { createVaultSdk } from "./sdk/vault/index.js";
 import { createAiClient } from "./ai/index.js";
-import { t as parseLogLines } from "./appLogs-CEKz68bE.js";
+import { t as parseLogLines } from "./appLogs-KslK7qHr.js";
 import { createAppsClient } from "./apps/index.js";
 import { createBillingClient } from "./billing/index.js";
 import { createChatClient } from "./chat/index.js";
-import { t as createDataScienceClient } from "./dataScience-BwHmDoQb.js";
+import { t as createComponentsMcpClient } from "./componentsMcp-CHobIsuU.js";
+import { t as createDataScienceClient } from "./dataScience-AwPMeGfz.js";
 import { createEditorClient } from "./editor/index.js";
 import { createEncryptionClient } from "./encryption/index.js";
-import { t as createKaiAgentClient } from "./kaiAgent-CUeT53-K.js";
-import { t as createMetastoreClient } from "./metastore-D0C6uaPX.js";
+import { t as createKaiAgentClient } from "./kaiAgent-CYvrS8oZ.js";
+import { t as createMetastoreClient } from "./metastore-Ywq08DBz.js";
 import { createNotificationsClient } from "./notifications/index.js";
-import { t as createOauthClient } from "./oauth-Ck_Fe14o.js";
+import { t as createOauthClient } from "./oauth-GXmZ9agP.js";
 import { createOmnisearchClient } from "./omnisearch/index.js";
-import { t as createQueryServiceClient } from "./queryService-Blfz59Ms.js";
-import { t as createQueueClient } from "./queue-CNvR-M23.js";
+import { t as createQueryServiceClient } from "./queryService-C-pZha5p.js";
+import { t as createQueueClient } from "./queue-D6-x4OGF.js";
 import { createSchedulerClient } from "./scheduler/index.js";
 import { createStreamClient } from "./stream/index.js";
-import { t as createSyncActionsClient } from "./syncActions-BvFUa9xV.js";
+import { t as createSyncActionsClient } from "./syncActions-DM8vP7p3.js";
 import { createTelemetryClient } from "./telemetry/index.js";
 import { createVaultClient } from "./vault/index.js";
-import { n as isUnauthorized, t as createBearerAuthMiddleware } from "./middleware-DmR6OhTY.js";
+import { n as isUnauthorized, t as createBearerAuthMiddleware } from "./middleware-GOfx8Apu.js";
 import { createQueryServiceSdk } from "./sdk/queryService/index.js";
 import * as z$1 from "zod";
 //#region src/utils/assert.ts
@@ -208,7 +209,7 @@ const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallow
 //#endregion
 //#region src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
-const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "polling";
+const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "requesting" && snapshot.state !== "polling";
 const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
 	const entries = createStore([]);
 	const unsubscribes = /* @__PURE__ */ new Map();
@@ -259,6 +260,47 @@ const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
 	};
 };
 //#endregion
+//#region src/utils/async/queueSeries.ts
+const isPromiseLike = (value) => (typeof value === "object" && value !== null || typeof value === "function") && "then" in value && typeof value.then === "function";
+/**
+* Queues tasks added over time so a slower earlier task cannot finish after and overwrite a later one.
+* Each `add` returns its task's result; a rejection does not stop the remaining queue.
+*/
+const queueSeries = () => {
+	let tail = null;
+	const add = (task) => {
+		if (tail !== null) {
+			const result = tail.then(task);
+			tail = result.then(() => void 0, () => void 0);
+			return result;
+		}
+		let value;
+		try {
+			value = task();
+		} catch (error) {
+			return Promise.reject(error);
+		}
+		if (!isPromiseLike(value)) return Promise.resolve(value);
+		const result = Promise.resolve(value);
+		tail = result.then(() => void 0, () => void 0);
+		return result;
+	};
+	const onIdle = async () => {
+		while (tail !== null) {
+			const current = tail;
+			await current;
+			if (tail === current) {
+				tail = null;
+				return;
+			}
+		}
+	};
+	return {
+		add,
+		onIdle
+	};
+};
+//#endregion
 //#region src/utils/deepMerge.ts
 /**
 * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every
@@ -316,6 +358,10 @@ const createWebStorage = (pick) => {
 		},
 		removeItem: (key) => {
 			storage.removeItem(key);
+		},
+		withLock: async (name, task) => {
+			if (typeof navigator === "undefined" || !("locks" in navigator)) return task();
+			return navigator.locks.request(`keboola:${name}`, { mode: "exclusive" }, task);
 		}
 	};
 };
@@ -324,62 +370,56 @@ const createSessionStorage = () => createWebStorage(() => "sessionStorage" in gl
 //#endregion
 //#region src/utils/persistor/persistor.ts
 const createPersistor = ({ storage = createNullStorage(), key, schema, defaultValue, encode = JSON.stringify, decode = JSON.parse }) => {
-	const clear = () => {
-		try {
-			storage.removeItem(key);
-		} catch (err) {
-			console.warn(`createPersistor: failed to clear "${key}"`, err);
-		}
-	};
-	const hasPersistedValue = () => {
-		try {
-			return !!storage.getItem(key);
-		} catch (err) {
-			console.warn(`createPersistor: failed to read "${key}", assuming empty`, err);
-			return false;
-		}
-	};
-	const hydrate = () => {
-		let raw;
-		try {
-			raw = storage.getItem(key);
-		} catch (err) {
-			console.warn(`createPersistor: failed to read "${key}", using default`, err);
-			return defaultValue;
-		}
-		if (raw === null) return defaultValue;
+	const writes = queueSeries();
+	const _load = async () => {
+		const raw = await storage.getItem(key);
+		if (raw === null) return {
+			value: defaultValue,
+			corrupt: false
+		};
 		let decoded;
 		try {
 			decoded = decode(raw);
 		} catch (err) {
-			console.warn(`createPersistor: failed to decode "${key}", resetting`, err);
-			clear();
-			return defaultValue;
+			console.warn(`createPersistor: failed to decode "${key}"`, err);
+			return {
+				value: defaultValue,
+				corrupt: true
+			};
 		}
 		const parsed = schema.safeParse(decoded);
-		if (parsed.success) return parsed.data;
-		clear();
-		return defaultValue;
+		return parsed.success ? {
+			value: parsed.data,
+			corrupt: false
+		} : {
+			value: defaultValue,
+			corrupt: true
+		};
 	};
-	const persist = (value) => {
-		let raw;
-		try {
-			raw = encode(value);
-		} catch (err) {
-			console.warn(`createPersistor: failed to encode "${key}", not persisting`, err);
-			return;
-		}
-		try {
-			storage.setItem(key, raw);
-		} catch (err) {
-			console.warn(`createPersistor: failed to write "${key}"`, err);
-		}
+	const remove = () => writes.add(() => storage.removeItem(key));
+	const write = (value) => writes.add(() => storage.setItem(key, encode(value)));
+	const read = async () => {
+		await writes.onIdle();
+		const parsed = await _load();
+		if (parsed.corrupt) remove().catch((err) => {
+			console.warn(`createPersistor: failed to drop the corrupt "${key}"`, err);
+		});
+		return parsed.value;
 	};
+	const modify = (change) => writes.add(async () => {
+		const next = change((await _load()).value);
+		await storage.setItem(key, encode(next));
+	});
+	const cell = {
+		read,
+		write,
+		modify,
+		remove
+	};
+	const locked = (task) => storage.withLock ? storage.withLock(key, () => task(cell)) : task(cell);
 	return {
-		hydrate,
-		persist,
-		clear,
-		hasPersistedValue
+		...cell,
+		locked
 	};
 };
 //#endregion
@@ -427,8 +467,7 @@ const KeboolaErrorType = {
 	NotBearer: "not-bearer",
 	NotReady: "not-ready",
 	InvalidBuildTransition: "invalid-build-transition",
-	StackActive: "stack-active",
-	CredentialKindMismatch: "credential-kind-mismatch"
+	StackActive: "stack-active"
 };
 const MESSAGES = {
 	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
@@ -441,8 +480,7 @@ const MESSAGES = {
 	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
 	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
 	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed.",
-	[KeboolaErrorType.StackActive]: "The active stack cannot be closed — select another first.",
-	[KeboolaErrorType.CredentialKindMismatch]: "This client renews the other credential kind — log in the way its `credentials` mode expects."
+	[KeboolaErrorType.StackActive]: "The active stack cannot be closed — select another first."
 };
 var KeboolaError = class KeboolaError extends Error {
 	type;
@@ -603,10 +641,12 @@ const createDefaultBranch = ({ devBranches }) => {
 };
 //#endregion
 //#region src/domain/stack.ts
+const isServiceId = (id) => Object.values(ServiceId).includes(id);
 const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
 const createStack = ({ stackInfo, clientServiceUrls }) => {
 	const { services, components, features, ...infoRest } = stackInfo;
 	const serviceMap = new Map(services.map((service) => {
+		if (!isServiceId(service.id)) return [service.id, service.url];
 		const devOverride = clientServiceUrls?.[service.id]?.(service.url);
 		const prodOverride = SERVICE_URL_OVERRIDES[service.id]?.(service.url);
 		const url = devOverride ?? prodOverride ?? service.url;
@@ -730,7 +770,6 @@ const createSdk = ({ storage, services, context }) => ({
 	tag: createTagSdk({ metastoreClient: services.metastore }),
 	semanticLayer: createSemanticLayerSdk({ metastoreClient: services.metastore }),
 	kaiMemory: createKaiMemorySdk({ metastoreClient: services.metastore }),
-	storage: createStorageSdk({ storageClient: storage }),
 	vault: createVaultSdk({
 		vaultClient: services.vault,
 		encryptionClient: services.encryption
@@ -857,6 +896,14 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 		middlewares: middlewareFor("kaiAgent", [attachTokenMiddleware]),
 		auth
 	})
+}).add({
+	serviceId: "components-mcp",
+	clientName: "componentsMcp",
+	clientFn: (serviceBaseUrl) => createComponentsMcpClient({
+		baseUrl: serviceBaseUrl,
+		middlewares: middlewareFor("componentsMcp", [attachTokenMiddleware]),
+		auth
+	})
 }).add({
 	serviceId: "oauth",
 	clientName: "oauth",
@@ -1064,154 +1111,6 @@ const createLegacyKeboola = (options = {}) => {
 	};
 };
 //#endregion
-//#region src/keboola/bearer/credentials/renewal.ts
-const renewalGrant = (credential) => credential.type === "token" ? {
-	type: "token",
-	refreshToken: credential.refreshToken
-} : {
-	type: "cookie",
-	sessionId: credential.sessionId
-};
-const renew = async (client, grant) => {
-	if (grant.type === "cookie") {
-		const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({ sessionId: grant.sessionId });
-		return {
-			type: "cookie",
-			accessToken,
-			expiresIn,
-			sessionId
-		};
-	}
-	const { accessToken, expiresIn, refreshToken } = await client.token.refreshWithToken({ refreshToken: grant.refreshToken });
-	if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-	return {
-		type: "token",
-		accessToken,
-		expiresIn,
-		refreshToken
-	};
-};
-//#endregion
-//#region src/keboola/bearer/credentials/credentials.ts
-const DEFAULT_REFRESH_THRESHOLD = .9;
-const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
-const createCredentials = ({ state, persistor, middlewares, mode = "token", refreshThreshold = DEFAULT_REFRESH_THRESHOLD, onSignedOut }) => {
-	const rotationMap = /* @__PURE__ */ new Map();
-	const generations = /* @__PURE__ */ new Map();
-	const generationOf = (baseUrl) => generations.get(baseUrl) ?? 0;
-	const refresh = async (baseUrl, grant) => {
-		const client = createAuthClient({
-			baseUrl,
-			middlewares
-		});
-		const epochBefore = Result.unwrap(state.auth.getEpoch(baseUrl));
-		const generationBefore = generationOf(baseUrl);
-		const refreshed = await Result.tryCatchAsync(() => renew(client, grant));
-		return Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epochBefore && generationOf(baseUrl) === generationBefore ? refreshed : Result.failure(signInEnded());
-	};
-	/**
-	* A stack's teardown, from the credential's side.
-	*
-	* - Bumps the generation, so an in-flight rotation can no longer write.
-	* - Drops the deduped entry, so nothing joins that rotation.
-	*/
-	const forget = (baseUrl) => {
-		generations.set(baseUrl, generationOf(baseUrl) + 1);
-		rotationMap.delete(baseUrl);
-	};
-	/**
-	* The rotation, and the one place a credential is declared dead.
-	*
-	* - A refused refresh token or session is unambiguous.
-	* - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.
-	*/
-	const rotateOnce = async (baseUrl) => {
-		const credential = state.auth.requireCredentialOf(baseUrl, mode);
-		if (!credential.success) return credential;
-		const refreshed = await refresh(baseUrl, renewalGrant(credential.data));
-		if (!refreshed.success) {
-			if (isUnauthorized(refreshed.error)) expire(baseUrl);
-			return refreshed;
-		}
-		return Result.map(state.auth.applyRefresh(baseUrl, refreshed.data), () => refreshed.data.accessToken);
-	};
-	const rotate = (baseUrl) => ensure(rotationMap, baseUrl, () => dedupe(() => rotateOnce(baseUrl)))();
-	const restoreStack = async (baseUrl, grant) => {
-		if (!state.auth.startRestore(baseUrl).success) return "unreachable";
-		const refreshed = await refresh(baseUrl, grant);
-		if (!refreshed.success) {
-			state.auth.cancelRestore(baseUrl);
-			return isUnauthorized(refreshed.error) ? "refused" : "unreachable";
-		}
-		state.auth.authenticate(baseUrl, refreshed.data);
-		return "restored";
-	};
-	const restoreProjects = (baseUrl, projects) => {
-		for (const { projectId } of projects) state.projects.open(baseUrl, projectId);
-	};
-	/**
-	* Every persisted stack back into the table, with whatever credential it can hand back.
-	*
-	* - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the
-	*   caller to select.
-	* - `status` reports what became of `lastActive`'s credential; the client reads it to decide
-	*   when persistence may start.
-	*/
-	const restore = async () => {
-		const hydrated = persistor.hydrate();
-		const stacks = hydrated.stacks.map((stack) => stack.credential && stack.credential.type !== "static" && stack.credential.type !== mode ? {
-			...stack,
-			credential: null
-		} : stack);
-		const { current } = hydrated;
-		const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);
-		const restored = stacks.map(async ({ baseUrl, credential, projects }) => {
-			state.stacks.ensure(baseUrl);
-			if (!credential) return "unreachable";
-			if (Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return "skipped";
-			const outcome = credential.type === "static" ? state.auth.authenticate(baseUrl, credential).success ? "restored" : "refused" : await restoreStack(baseUrl, credential);
-			if (outcome === "restored") restoreProjects(baseUrl, projects);
-			return outcome;
-		});
-		const results = await Promise.all(restored);
-		const outcome = scoped?.credential ? results[stacks.indexOf(scoped)] : void 0;
-		return {
-			lastActive: current,
-			status: outcome === void 0 || outcome === "skipped" ? "empty" : outcome === "restored" ? "restored" : outcome === "unreachable" ? "unreachable" : "expired"
-		};
-	};
-	const isStale = (baseUrl) => {
-		const ageing = Result.map(state.auth.requireCredentialOf(baseUrl, mode), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
-		return Result.unwrapOr(ageing, false);
-	};
-	const signOut = (baseUrl) => {
-		rotationMap.delete(baseUrl);
-		const signedOut = state.auth.signOut(baseUrl);
-		onSignedOut?.(baseUrl);
-		return signedOut;
-	};
-	const expire = (baseUrl) => {
-		if (state.auth.notifyExpired(baseUrl)) signOut(baseUrl);
-	};
-	const canRefresh = (baseUrl) => state.auth.requireCredentialOf(baseUrl, mode).success;
-	const renewIfStale = async (baseUrl) => {
-		if (isStale(baseUrl)) await rotate(baseUrl);
-	};
-	const middleware = (baseUrl) => createBearerAuthMiddleware({ getAccessToken: async ({ forceRefresh = false } = {}) => {
-		if (forceRefresh) return canRefresh(baseUrl) ? Result.unwrap(await rotate(baseUrl)) : null;
-		await renewIfStale(baseUrl);
-		return state.auth.getAccessToken(baseUrl);
-	} });
-	return {
-		middleware,
-		rotate,
-		renewIfStale,
-		restore,
-		signOut,
-		forget
-	};
-};
-//#endregion
 //#region src/keboola/bearer/state/factories.ts
 /**
 * Everything the table constructs: the entries themselves, and the failures reading them produces.
@@ -1229,9 +1128,16 @@ const authenticatedAuth = (credential) => ({
 	status: "authenticated",
 	credential
 });
-const bearerCredential = (input) => input.type === "static" ? input : {
+const credential = (input) => ({
 	...input,
 	issuedAt: Date.now()
+});
+const grant = (credential) => credential.type === "token" ? {
+	type: "token",
+	refreshToken: credential.refreshToken
+} : {
+	type: "cookie",
+	sessionId: credential.sessionId
 };
 const expiredCredential = (credential) => ({
 	...credential,
@@ -1241,7 +1147,8 @@ const stack = (baseUrl) => ({
 	baseUrl,
 	context: "idle",
 	epoch: 0,
-	auth: anonymousAuth()
+	auth: anonymousAuth(),
+	retained: null
 });
 const project = (baseUrl, projectId) => ({
 	id: projectEntryId(baseUrl, projectId),
@@ -1273,7 +1180,8 @@ const Entry = {
 	anonymousAuth,
 	restoringAuth,
 	authenticatedAuth,
-	bearerCredential,
+	credential,
+	grant,
 	expiredCredential
 };
 /**
@@ -1291,9 +1199,8 @@ const Errors = {
 	notReady: () => new KeboolaError(KeboolaErrorType.NotReady),
 	alreadyRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`),
 	notRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`),
-	unexpectedCredentialKind: (baseUrl, kind) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" holds a ${kind} credential`),
-	notRotatingCredential: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" holds a static credential`),
-	credentialKindChanged: (from, to) => /* @__PURE__ */ new Error(`A ${from} credential cannot become ${to}`),
+	grantTypeChanged: (from, to) => /* @__PURE__ */ new Error(`A ${from} grant cannot become ${to}`),
+	nothingRetained: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`),
 	missingProject: (id) => /* @__PURE__ */ new Error(`No project "${id}"`)
 };
 const authenticated = (auth) => auth.status === "authenticated" ? Result.success(auth.credential) : Result.failure(Errors.notAuthenticated());
@@ -1325,8 +1232,6 @@ const createAuth = ({ stacks, projects, expiry }) => {
 	const requireUnauthenticated = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? Result.failure(Errors.alreadyAuthenticated()) : Result.success(stack));
 	const requireAnonymous = (baseUrl) => Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? Result.failure(Errors.alreadyRestoring(baseUrl)) : Result.success(stack));
 	const requireRestoring = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? Result.success(stack) : Result.failure(Errors.notRestoring(baseUrl)));
-	const requireRotatingCredential = (baseUrl) => Result.andThen(stacks.requireCredential(baseUrl), (credential) => credential.type === "static" ? Result.failure(Errors.notRotatingCredential(baseUrl)) : Result.success(credential));
-	const requireCredentialOf = (baseUrl, mode) => Result.andThen(requireRotatingCredential(baseUrl), (credential) => credential.type === mode ? Result.success(credential) : Result.failure(Errors.unexpectedCredentialKind(baseUrl, credential.type)));
 	const startRestore = (baseUrl) => Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
 		...stack,
 		auth: Entry.restoringAuth()
@@ -1340,25 +1245,37 @@ const createAuth = ({ stacks, projects, expiry }) => {
 		return stacks.set({
 			...stack,
 			epoch: stack.epoch + 1,
-			auth: Entry.authenticatedAuth(Entry.bearerCredential(input))
+			auth: Entry.authenticatedAuth(Entry.credential(input)),
+			retained: null
 		});
 	});
-	const applyRefresh = (baseUrl, input) => Result.andThen(requireRotatingCredential(baseUrl), (credential) => credential.type !== input.type ? Result.failure(Errors.credentialKindChanged(credential.type, input.type)) : Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+	const applyRefresh = (baseUrl, input) => Result.andThen(stacks.requireCredential(baseUrl), (credential) => credential.type !== input.type ? Result.failure(Errors.grantTypeChanged(credential.type, input.type)) : Result.map(stacks.get(baseUrl), (stack) => stacks.set({
 		...stack,
-		auth: Entry.authenticatedAuth(Entry.bearerCredential(input))
+		auth: Entry.authenticatedAuth(Entry.credential(input))
 	})));
-	const forceExpire = (baseUrl) => Result.andThen(requireRotatingCredential(baseUrl), (credential) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+	const forceExpire = (baseUrl) => Result.andThen(stacks.requireCredential(baseUrl), (credential) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
 		...stack,
 		auth: Entry.authenticatedAuth(Entry.expiredCredential(credential))
 	})));
-	const signOut = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => {
+	const signOut = (baseUrl, { retain = false } = {}) => Result.map(stacks.get(baseUrl), (stack) => {
 		projects.closeAll(baseUrl);
+		const retained = retain ? Result.unwrapOr(Result.map(authenticated(stack.auth), (credential) => ({ grant: Entry.grant(credential) })), stack.retained) : null;
 		return stacks.set({
 			...stack,
 			epoch: stack.epoch + 1,
-			auth: Entry.anonymousAuth()
+			auth: Entry.anonymousAuth(),
+			retained
 		});
 	});
+	const retain = (baseUrl, retained) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained
+	}));
+	const dropRetained = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+		...stack,
+		retained: null
+	}));
+	const requireRetained = (baseUrl) => Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? Result.success(stack.retained) : Result.failure(Errors.nothingRetained(baseUrl)));
 	const getEpoch = (baseUrl) => Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
 	const getAccessToken = (baseUrl) => Result.unwrapOr(Result.map(stacks.requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
 	return {
@@ -1368,10 +1285,11 @@ const createAuth = ({ stacks, projects, expiry }) => {
 		applyRefresh,
 		forceExpire,
 		signOut,
+		retain,
+		dropRetained,
+		requireRetained,
 		notifyExpired: expiry.report,
 		requireCredential: stacks.requireCredential,
-		requireRotatingCredential,
-		requireCredentialOf,
 		getEpoch,
 		getAccessToken
 	};
@@ -1623,6 +1541,204 @@ const createState = (defaultBaseUrl) => {
 	};
 };
 //#endregion
+//#region src/keboola/bearer/credentials/renewal.ts
+const renew = async (client, grant) => {
+	if (grant.type === "cookie") {
+		const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({ sessionId: grant.sessionId });
+		return {
+			type: "cookie",
+			accessToken,
+			expiresIn,
+			sessionId
+		};
+	}
+	const { accessToken, expiresIn, refreshToken } = await client.token.refreshWithToken({ refreshToken: grant.refreshToken });
+	if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
+	return {
+		type: "token",
+		accessToken,
+		expiresIn,
+		refreshToken
+	};
+};
+//#endregion
+//#region src/keboola/bearer/credentials/credentials.ts
+const DEFAULT_REFRESH_THRESHOLD = .9;
+const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
+const toRestoreStatus = (outcome) => {
+	if (outcome === void 0 || outcome === "skipped") return "empty";
+	if (outcome === "refused") return "expired";
+	return outcome;
+};
+const createCredentials = ({ state, persistor, middlewares, refreshThreshold = DEFAULT_REFRESH_THRESHOLD, onSignedOut, onExpired }) => {
+	const rotationMap = /* @__PURE__ */ new Map();
+	const generations = /* @__PURE__ */ new Map();
+	const generationOf = (baseUrl) => generations.get(baseUrl) ?? 0;
+	const refresh = async (baseUrl, grant) => {
+		const client = createAuthClient({
+			baseUrl,
+			middlewares
+		});
+		const epochBefore = Result.unwrap(state.auth.getEpoch(baseUrl));
+		const generationBefore = generationOf(baseUrl);
+		const refreshed = await Result.tryCatchAsync(() => renew(client, grant));
+		return Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epochBefore && generationOf(baseUrl) === generationBefore ? refreshed : Result.failure(signInEnded());
+	};
+	/**
+	* A stack's teardown, from the credential's side.
+	*
+	* - Bumps the generation, so an in-flight rotation can no longer write.
+	* - Drops the deduped entry, so nothing joins that rotation.
+	*/
+	const forget = (baseUrl) => {
+		generations.set(baseUrl, generationOf(baseUrl) + 1);
+		rotationMap.delete(baseUrl);
+	};
+	/**
+	* The rotation, and the one place a credential is declared dead.
+	*
+	* - Renews by the credential's grant: the refresh token, or the session id with the cookie.
+	* - A refused refresh token or session is unambiguous.
+	* - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.
+	*/
+	const getGrantForRotation = async (store, baseUrl, credential) => {
+		const epochBefore = Result.unwrap(state.auth.getEpoch(baseUrl));
+		const generationBefore = generationOf(baseUrl);
+		const hydrated = await Result.tryCatchAsync(() => store.read());
+		if (!hydrated.success) return hydrated;
+		if (Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) !== epochBefore || generationOf(baseUrl) !== generationBefore) return Result.failure(signInEnded());
+		const persistedStack = hydrated.data.stacks.find((stack) => stack.baseUrl === baseUrl);
+		if (persistedStack && persistedStack.credential === null) return Result.failure(signInEnded());
+		return Result.success(persistedStack?.credential ?? Entry.grant(credential));
+	};
+	const rotateOnce = async (baseUrl) => persistor.locked(async (store) => {
+		const credential = state.auth.requireCredential(baseUrl);
+		if (!credential.success) return credential;
+		const grant = await getGrantForRotation(store, baseUrl, credential.data);
+		if (!grant.success) return grant;
+		const refreshed = await refresh(baseUrl, grant.data);
+		if (!refreshed.success) {
+			if (isUnauthorized(refreshed.error)) await expire(baseUrl, store);
+			return refreshed;
+		}
+		const accessToken = Result.map(state.auth.applyRefresh(baseUrl, refreshed.data), () => refreshed.data.accessToken);
+		await store.persistStack(baseUrl, state.store.get());
+		return accessToken;
+	});
+	const rotate = (baseUrl) => ensure(rotationMap, baseUrl, () => dedupe(() => rotateOnce(baseUrl)))();
+	const restoreStack = async (baseUrl, grant, retained = false) => persistor.locked(async (store) => {
+		const storedStack = (await store.read()).stacks.find((stack) => stack.baseUrl === baseUrl);
+		const latestGrant = retained ? storedStack?.retained?.grant : storedStack?.credential;
+		if (storedStack && !latestGrant) return "skipped";
+		if (!state.auth.startRestore(baseUrl).success) return "unreachable";
+		const refreshed = await refresh(baseUrl, latestGrant ?? grant);
+		if (!refreshed.success) {
+			state.auth.cancelRestore(baseUrl);
+			if (isUnauthorized(refreshed.error)) {
+				if (retained) state.auth.dropRetained(baseUrl);
+				await store.persistStack(baseUrl, state.store.get());
+				return "refused";
+			}
+			return "unreachable";
+		}
+		state.auth.authenticate(baseUrl, refreshed.data);
+		if (!state.auth.requireCredential(baseUrl).success) return "unreachable";
+		if (retained) state.auth.dropRetained(baseUrl);
+		await store.persistStack(baseUrl, state.store.get());
+		return "restored";
+	});
+	const restoreProjects = (baseUrl, projects) => {
+		for (const { projectId } of projects) state.projects.open(baseUrl, projectId);
+	};
+	/**
+	* Every persisted stack back into the table, with whatever credential it can hand back.
+	*
+	* - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the
+	*   caller to select.
+	* - `status` reports what became of `lastActive`'s credential; the client reads it to decide
+	*   when persistence may start.
+	*/
+	const restore = async () => {
+		const hydrated = await persistor.locked((store) => store.read()).catch((error) => {
+			console.warn("createCredentials: the stored session could not be read", error);
+			return null;
+		});
+		if (hydrated === null) return {
+			lastActive: null,
+			status: "unreachable"
+		};
+		const { stacks, current } = hydrated;
+		const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);
+		const restored = stacks.map(async ({ baseUrl, credential, retained, projects }) => {
+			state.stacks.ensure(baseUrl);
+			if (!credential && !retained) return "unreachable";
+			if (Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return "skipped";
+			if (retained) state.auth.retain(baseUrl, retained);
+			if (!credential) return "unreachable";
+			const outcome = await restoreStack(baseUrl, credential);
+			if (outcome === "restored") restoreProjects(baseUrl, projects);
+			return outcome;
+		});
+		const results = await Promise.all(restored);
+		const scopedOutcome = scoped?.credential ? results[stacks.indexOf(scoped)] : void 0;
+		return {
+			lastActive: current,
+			status: toRestoreStatus(scopedOutcome)
+		};
+	};
+	/**
+	* Signs a retained stack back in from the grant it kept.
+	*
+	* - `restored` and `refused` empty the slot; `unreachable` keeps it for another try.
+	* - Throws when the stack retains nothing.
+	*/
+	const restoreRetained = async (baseUrl) => {
+		const { grant } = Result.unwrap(state.auth.requireRetained(baseUrl));
+		return restoreStack(baseUrl, grant, true);
+	};
+	const isStale = (baseUrl) => {
+		const ageing = Result.map(state.auth.requireCredential(baseUrl), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
+		return Result.unwrapOr(ageing, false);
+	};
+	/**
+	* Drops the slot so the next sign-in's requests don't join the dying rotation.
+	*
+	* - Writes nothing: the caller persists the stack, under the lock it holds or takes.
+	*/
+	const signOut = (baseUrl, options) => {
+		rotationMap.delete(baseUrl);
+		const signedOut = state.auth.signOut(baseUrl, options);
+		onSignedOut?.(baseUrl);
+		return signedOut;
+	};
+	const expire = async (baseUrl, store) => {
+		if (!state.auth.notifyExpired(baseUrl)) return;
+		signOut(baseUrl);
+		await store.persistStack(baseUrl, state.store.get());
+		onExpired?.(baseUrl);
+	};
+	const renewIfStale = async (baseUrl) => {
+		if (isStale(baseUrl)) await rotate(baseUrl);
+	};
+	const middleware = (baseUrl) => createBearerAuthMiddleware({ getAccessToken: async ({ forceRefresh = false } = {}) => {
+		if (forceRefresh) {
+			if (!state.auth.requireCredential(baseUrl).success) return null;
+			return Result.unwrap(await rotate(baseUrl));
+		}
+		await renewIfStale(baseUrl);
+		return state.auth.getAccessToken(baseUrl);
+	} });
+	return {
+		middleware,
+		rotate,
+		renewIfStale,
+		restore,
+		restoreRetained,
+		signOut,
+		forget
+	};
+};
+//#endregion
 //#region src/keboola/bearer/context/resource.ts
 /**
 * Owns fetching one async value per key — a caller names what it needs and never orchestrates the
@@ -1939,61 +2055,86 @@ const createPerProject = ({ state, credentials, middlewareFor, stack, clientServ
 */
 const SESSION_STORAGE_KEY = "keboola:session";
 /**
-* What survives a reload, per credential kind.
+* What survives a reload, per grant type.
+*
+* - Written under `credential`: the key every blob already stored carries.
 *
 * - `token`: the refresh token. It rotates, is single-use and is server-revocable, so a leaked
 *   snapshot has limited and revocable value. The access token is never written.
-* - `static`: the token itself — a long-lived PAT the user pasted, which nothing can re-mint.
 * - `cookie`: the session id. The session cookie is the durable half and the browser keeps it;
 *   the id alone renews nothing.
 */
-const persistedCredentialSchema = z$1.discriminatedUnion("type", [
-	z$1.object({
-		type: z$1.literal("token"),
-		refreshToken: z$1.string()
-	}),
-	z$1.object({
-		type: z$1.literal("cookie"),
-		sessionId: z$1.string()
-	}),
-	z$1.object({
-		type: z$1.literal("static"),
-		accessToken: z$1.string()
-	})
-]);
+const persistedGrantSchema = z$1.discriminatedUnion("type", [z$1.object({
+	type: z$1.literal("token"),
+	refreshToken: z$1.string()
+}), z$1.object({
+	type: z$1.literal("cookie"),
+	sessionId: z$1.string()
+})]);
 /** A record per project rather than a bare id, so a project can grow a field without a migration. */
 const persistedProjectSchema = z$1.object({ projectId: z$1.number() });
+const persistedStackSchema = z$1.object({
+	baseUrl: z$1.string(),
+	credential: persistedGrantSchema.nullable().catch(null),
+	retained: z$1.object({ grant: persistedGrantSchema }).nullable().default(null).catch(null),
+	projects: z$1.array(persistedProjectSchema)
+});
 const persistedSessionSchema = z$1.object({
 	current: z$1.object({
 		baseUrl: z$1.string(),
 		projectId: z$1.number().nullable()
 	}).nullable(),
-	stacks: z$1.array(z$1.object({
-		baseUrl: z$1.string(),
-		credential: persistedCredentialSchema.nullable(),
-		projects: z$1.array(persistedProjectSchema)
-	}))
+	stacks: z$1.array(persistedStackSchema)
 });
 const EMPTY_PERSISTED_SESSION = {
 	current: null,
 	stacks: []
 };
-const durableCredential = (stack) => {
-	if (stack.auth.status !== "authenticated") return null;
-	const { credential } = stack.auth;
-	if (credential.type === "token") return {
-		type: "token",
-		refreshToken: credential.refreshToken
-	};
-	if (credential.type === "cookie") return {
-		type: "cookie",
-		sessionId: credential.sessionId
-	};
+const projectsOf = (projects, baseUrl) => Object.values(projects).filter((project) => project.baseUrl === baseUrl).map(({ projectId }) => ({ projectId }));
+const grantsOf = (stack) => ({
+	credential: stack.auth.status === "authenticated" ? Entry.grant(stack.auth.credential) : null,
+	retained: stack.retained
+});
+/**
+* The stored session, rewritten from the table except for the grants.
+*
+* - Scope, stack list and open projects come from memory.
+* - `credential` and `retained` stay as stored: a grant another document rotated must not be put
+*   back by a snapshot of this one's older table.
+*/
+const mergeSnapshot = (stored, { active, stacks, projects }) => ({
+	current: {
+		baseUrl: active.baseUrl,
+		projectId: active.projectId
+	},
+	stacks: Object.values(stacks).map(({ baseUrl }) => {
+		const kept = stored.stacks.find((stack) => stack.baseUrl === baseUrl);
+		return {
+			baseUrl,
+			credential: kept?.credential ?? null,
+			retained: kept?.retained ?? null,
+			projects: projectsOf(projects, baseUrl)
+		};
+	})
+});
+const upsertStack = (stored, baseUrl, update) => {
+	const index = stored.stacks.findIndex((stack) => stack.baseUrl === baseUrl);
+	const stacks = [...stored.stacks];
+	if (index < 0) stacks.push(update(void 0));
+	else stacks[index] = update(stacks[index]);
 	return {
-		type: "static",
-		accessToken: credential.accessToken
+		...stored,
+		stacks
 	};
 };
+/**
+* The stored session, reached in two ways.
+*
+* - `locked`: the only way to read, and the only way to a grant write. Rotation and restore hold
+*   it across the refresh; sign-in, sign-out and the boot restore open it for one step.
+* - `snapshot`: the table minus its grants, under the lock, coalesced; what the store subscription
+*   feeds, and what a scope change awaits before the document leaves.
+*/
 const createSessionPersistor = (storage) => {
 	const persistor = createPersistor({
 		storage,
@@ -2001,20 +2142,35 @@ const createSessionPersistor = (storage) => {
 		schema: persistedSessionSchema,
 		defaultValue: EMPTY_PERSISTED_SESSION
 	});
-	const persist = ({ active, stacks, projects }) => persistor.persist({
-		current: {
-			baseUrl: active.baseUrl,
-			projectId: active.projectId
-		},
-		stacks: Object.values(stacks).map((stack) => ({
-			baseUrl: stack.baseUrl,
-			credential: durableCredential(stack),
-			projects: Object.values(projects).filter((project) => project.baseUrl === stack.baseUrl).map(({ projectId }) => ({ projectId }))
-		}))
-	});
+	const persistStack = (cell, baseUrl, { stacks, projects }) => {
+		const stack = stacks[baseUrl];
+		if (stack === void 0) return Promise.resolve();
+		return cell.modify((stored) => upsertStack(stored, baseUrl, (existing) => ({
+			baseUrl,
+			...grantsOf(stack),
+			projects: existing?.projects ?? projectsOf(projects, baseUrl)
+		})));
+	};
+	const locked = (task) => persistor.locked((cell) => task({
+		read: cell.read,
+		persistStack: (baseUrl, state) => persistStack(cell, baseUrl, state)
+	}));
+	let latest = null;
+	let pending = null;
+	const snapshot = (state) => {
+		latest = state;
+		if (pending) return pending;
+		const write = persistor.locked((cell) => {
+			pending = null;
+			const table = latest ?? state;
+			return cell.modify((stored) => mergeSnapshot(stored, table));
+		});
+		pending = write;
+		return write;
+	};
 	return {
-		...persistor,
-		persist
+		locked,
+		snapshot
 	};
 };
 //#endregion
@@ -2059,7 +2215,7 @@ const createPerStack = ({ state, credentials, middlewareFor }) => {
 *
 * - Credential-derived state is owned by the scope whose end ends it (`perStack`, `perProject`).
 */
-const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls, credentials: mode = "token" }) => {
+const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls, onExpired }) => {
 	const state = createState(normalizeBaseUrl(defaultBaseUrl));
 	const persistor = createSessionPersistor(storage);
 	const middlewareFor = createMiddlewareFor(middlewares);
@@ -2067,8 +2223,8 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		state,
 		persistor,
 		middlewares: middlewareFor("auth"),
-		mode,
-		onSignedOut: (baseUrl) => perProject.forgetUnder(baseUrl)
+		onSignedOut: (baseUrl) => perProject.forgetUnder(baseUrl),
+		onExpired
 	});
 	const perStack = createPerStack({
 		state,
@@ -2132,16 +2288,22 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		await credentials.renewIfStale(project.baseUrl);
 		return headersFor(Result.unwrap(state.projects.get(project.id)));
 	};
-	const authenticate = (input) => {
-		const stack = state.scope.getActiveStack();
-		if (input.type !== "static" && input.type !== mode) throw new KeboolaError(KeboolaErrorType.CredentialKindMismatch);
-		if (input.type !== "token") return Result.unwrap(state.auth.authenticate(stack.baseUrl, input));
+	const toCredential = (input) => {
+		if (input.type !== "token") return input;
 		const { refreshToken } = input;
 		if (!refreshToken) throw new KeboolaError(KeboolaErrorType.NotAuthenticated);
-		return Result.unwrap(state.auth.authenticate(stack.baseUrl, {
+		return {
 			...input,
 			refreshToken
-		}));
+		};
+	};
+	const authenticate = (input) => {
+		const { baseUrl } = state.scope.getActiveStack();
+		const signedIn = Result.unwrap(state.auth.authenticate(baseUrl, toCredential(input)));
+		persistor.locked((store) => store.persistStack(baseUrl, state.store.get())).catch((error) => {
+			console.warn("createKeboola: the sign-in could not be stored", error);
+		});
+		return signedIn;
 	};
 	/**
 	* The flat product surface: `auth` and `management` per stack, the rest per project.
@@ -2181,11 +2343,21 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		Result.unwrapOr(state.projects.open(baseUrl, projectId), null);
 		return perProject.get(project).api;
 	};
-	/** The scope's sign-in, or a named stack's — and everything that sign-in derived. */
-	const signOut = (baseUrl) => {
+	/**
+	* The scope's sign-in, or a named stack's — and everything that sign-in derived.
+	*
+	* - `retain` keeps the grant on the stack, persisted beside the sign-in it ended, for
+	*   `restoreRetained`; the next sign-in on the stack replaces it.
+	* - The table is signed out on return; the promise resolves once that is stored, so a caller
+	*   leaving the document waits for it.
+	*/
+	const signOut = ({ baseUrl, ...options } = {}) => {
 		const target = requireStackUrl(baseUrl);
-		return Result.unwrap(credentials.signOut(target));
+		const signedOut = Result.unwrap(credentials.signOut(target, options));
+		return persistor.locked((store) => store.persistStack(target, state.store.get())).then(() => signedOut);
 	};
+	/** Signs a stack back in from what a retained sign-out kept; `unreachable` leaves it to retry. */
+	const restoreRetained = (baseUrl) => credentials.restoreRetained(normalizeBaseUrl(baseUrl));
 	/**
 	* `input` replaces the active stack's sign-in, whatever it holds.
 	*
@@ -2197,19 +2369,6 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		return authenticate(input);
 	};
 	/**
-	* A server-injected `token` credential, adopted whatever this client's mode.
-	*
-	* @deprecated Temporary, for the agent-project claim page only: Connection injects an API-mode
-	* session through `UiConfig.programmaticAuth`. Remove together with that injection.
-	*
-	* - Replaces the active stack's sign-in, like `replace`.
-	* - A cookie-mode client never rotates it, so it lasts as long as its access token.
-	*/
-	const adoptInjected = (input) => {
-		signOut();
-		return Result.unwrap(state.auth.authenticate(getActiveStack().baseUrl, input));
-	};
-	/**
 	* Leave one project: its row and everything built for it; its handles stop answering.
 	*
 	* - Counterpart of `getApi(projectId)`; without it the project is held and persisted until sign-out.
@@ -2235,16 +2394,22 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	/**
 	* Persistence starts only once the restore has settled.
 	*
-	* - Mid-hydration an unexchanged stack is `anonymous`; `durableCredential` would erase the
+	* - Mid-hydration an unexchanged stack is `anonymous`; the persistor would erase the
 	*   refresh token the exchange is about to spend.
 	* - Writes the settled table once: the subscription fires only on the next change.
 	*/
 	const enablePersistence = () => {
 		if (persisting) return;
 		persisting = true;
-		persistor.persist(state.store.get());
-		state.store.subscribe(persistor.persist);
+		snapshot(state.store.get());
+		state.store.subscribe(snapshot);
+	};
+	const snapshot = (table) => {
+		persistor.snapshot(table).catch((error) => {
+			console.warn("createKeboola: the session could not be stored", error);
+		});
 	};
+	const persistScope = () => persisting ? persistor.snapshot(state.store.get()) : Promise.resolve();
 	/**
 	* The same, deferred until a sign-in.
 	*
@@ -2298,14 +2463,22 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			resume,
 			stack: {
 				getActive: getActiveStack,
-				select: byCaller(selectStack),
+				/** Scoped on return; resolves once that is stored, for a caller leaving the document. */
+				select: byCaller((baseUrl) => {
+					const stack = selectStack(baseUrl);
+					return persistScope().then(() => stack);
+				}),
 				close: closeStack,
 				retryContext: perStack.context.retry,
 				getContext: (baseUrl) => perStack.context.get(requireStackUrl(baseUrl)),
 				getContextAsync: (baseUrl) => perStack.context.getAsync(requireStackUrl(baseUrl))
 			},
 			project: {
-				select: byCaller(selectProject),
+				/** Scoped on return; resolves once that is stored, for a caller leaving the document. */
+				select: byCaller((projectId) => {
+					const project = selectProject(projectId);
+					return persistScope().then(() => project);
+				}),
 				close: closeProject,
 				deactivate: state.scope.deactivate,
 				retryContext: perProject.context.retry,
@@ -2315,8 +2488,8 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 			auth: {
 				authenticate: byCaller(authenticate),
 				replace: byCaller(replace),
-				adoptInjected: byCaller(adoptInjected),
 				signOut: byCaller(signOut),
+				restoreRetained: byCaller(restoreRetained),
 				/** Whether the active stack holds a credential — `restoring` is not one yet. */
 				isAuthenticated,
 				isAuthenticatedAsync: () => resume().then(isAuthenticated),
@@ -2510,6 +2683,6 @@ const createAdminAccount = ({ managementToken }) => {
 	};
 };
 //#endregion
-export { ApiError, HtmlResponseError, HttpContentType, HttpHeader, KeboolaError, KeboolaErrorType, KeboolaHttpHeader, ManagementClientAuthError, ManagementSessionMintError, QueryJobError, QueryJobTimeoutError, Result, SESSION_STORAGE_KEY, ServiceUnavailableError, SyncActionError, UserError, ValidationError, asError, assert, coalesce, collect, concurrent, createAdminAccount, createDerivedAsyncStore, createDerivedStore, createEmitter, createGenericFetchClient, createKeboola, createLegacyKeboola, createLocalStorage, createLoggingMiddleware, createMemoryStorage, createNullStorage, createPersistor, createPollRegistry, createQueryServiceSdk, createRetryMiddleware, createSessionStorage, createStorageSdk, createStore, createUiVersionMiddleware, dedupe, deepMerge, delay, emitter, ensure, failureOf, formatValidationIssues, generateUUID, isAbortError, isApiError, isEmptyDeep, isFetchClientError, isHtmlResponseError, isKeboolaError, isManagementClientAuthError, isManagementSessionMintError, isPlainObject, isQueryJobError, isQueryJobTimeoutError, isStorageTokenMutatingRequest, isSyncActionError, isTimeoutError, isValidationError, jobStatus, keboolaUID, lazy, parseLogLines, parseOrThrow, poll, poller, readableReason, schemaGuidedMerge, series, shallowEqual };
+export { ApiError, HtmlResponseError, HttpContentType, HttpHeader, KeboolaError, KeboolaErrorType, KeboolaHttpHeader, ManagementClientAuthError, ManagementSessionMintError, QueryJobError, QueueJobError, Result, SESSION_STORAGE_KEY, ServiceUnavailableError, StorageJobError, SyncActionError, UserError, ValidationError, asError, assert, coalesce, collectByCursor, collectByOffset, concurrent, createAdminAccount, createDerivedAsyncStore, createDerivedStore, createEmitter, createGenericFetchClient, createKeboola, createLegacyKeboola, createLocalStorage, createLoggingMiddleware, createMemoryStorage, createNullStorage, createPersistor, createPollRegistry, createQueryServiceSdk, createRetryMiddleware, createSessionStorage, createStore, createUiVersionMiddleware, dedupe, deepMerge, delay, emitter, ensure, failureOf, formatValidationIssues, generateUUID, isAbortError, isApiError, isEmptyDeep, isFetchClientError, isHtmlResponseError, isKeboolaError, isManagementClientAuthError, isManagementSessionMintError, isPlainObject, isQueryJobError, isQueueJobError, isStorageJobError, isStorageTokenMutatingRequest, isSyncActionError, isTimeoutError, isValidationError, jobStatus, keboolaUID, lazy, nextCursorOf, parseLogLines, parseOrThrow, poller, queueSeries, readableReason, schemaGuidedMerge, series, shallowEqual };
 
 //# sourceMappingURL=index.js.map