@keboola/api-client 48.0.0 → 50.0.0

package/dist/index.cjs

@@ -1,64 +1,105 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
-const require_project = require("./project-CpgplgCr.cjs");
-const require_collectByOffset = require("./collectByOffset-DQsqtmJg.cjs");
-const require_authClient = require("./authClient-DfkKlc-2.cjs");
-const require_concurrent = require("./concurrent-CdVfR1N5.cjs");
-const require_dedupe = require("./dedupe-OSnnst2u.cjs");
-const require_transientRetries = require("./transientRetries-DdJfH9QK.cjs");
-const require_store = require("./store-xS-Cu_VS.cjs");
-const require_storage = require("./storage-CVBXivpB.cjs");
-const require_tag = require("./tag-DHS_soa7.cjs");
-const require_generateUUID = require("./generateUUID-C6qKBPIv.cjs");
-const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_configurations = require("./configurations-B2O8AAy0.cjs");
-const require_UserError = require("./UserError-CSGO1qII.cjs");
-const require_createFetchClient = require("./createFetchClient-lZ_93Yrb.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-BalWEyRk.cjs");
-const require_ManagementSessionMintError = require("./ManagementSessionMintError-Cu9beG7j.cjs");
-const require_QueryJobError = require("./QueryJobError-irGiP5zh.cjs");
-const require_QueueJobError = require("./QueueJobError-6qSEizWo.cjs");
-const require_SyncActionError = require("./SyncActionError-BG0zwchi.cjs");
-const require_ValidationError = require("./ValidationError-D65QU0uq.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-MOx97wi-.cjs");
-const require_import = require("./import-BahNYv91.cjs");
-const require_management = require("./management-CXHnxVaZ.cjs");
-const require_constants = require("./constants-a0jswUeK.cjs");
-const require_storageTable = require("./storageTable-BNOR2FCh.cjs");
-const require_kaiMemory = require("./kaiMemory-Qch09f-m.cjs");
-const require_semanticLayer = require("./semanticLayer-7BejcMj_.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-CmQyd0Gu.cjs");
+const require_UserError = require("./UserError-D4P9Tbhf.cjs");
+const require_createFetchClient = require("./createFetchClient-DEkUH662.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-BjemGI1e.cjs");
+const require_storage = require("./storage-KJ5Ki_ma.cjs");
+const require_ManagementSessionMintError = require("./ManagementSessionMintError-ByOulHQH.cjs");
+const require_QueryJobError = require("./QueryJobError-Oy0fl4aw.cjs");
+const require_QueueJobError = require("./QueueJobError-DruZK3tc.cjs");
+const require_SyncActionError = require("./SyncActionError-mbpVg63X.cjs");
+const require_ValidationError = require("./ValidationError-BXcFX4nD.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-2oU-PXVo.cjs");
+const require_import = require("./import-CABlFMQX.cjs");
+const require_authClient = require("./authClient-DcKBpMcU.cjs");
+const require_collectByOffset = require("./collectByOffset-DgxJ3zT9.cjs");
+const require_concurrent = require("./concurrent-DnTV_ppY.cjs");
+const require_dedupe = require("./dedupe-Bf0gl9TJ.cjs");
+const require_transientRetries = require("./transientRetries-CM7rAEXQ.cjs");
+const require_store = require("./store-2OyH1XOP.cjs");
+const require_tag = require("./tag-A5z4tJn1.cjs");
+const require_generateUUID = require("./generateUUID-DbSTmvVP.cjs");
+const require_isPlainObject = require("./isPlainObject-CcvQt0qB.cjs");
+const require_schemaGuidedMerge = require("./schemaGuidedMerge-C8CqrNGe.cjs");
+const require_management = require("./management-BEGOEQxM.cjs");
+const require_constants = require("./constants-DhFQWQgy.cjs");
+const require_kaiMemory = require("./kaiMemory-CkLQfJXD.cjs");
+const require_semanticLayer = require("./semanticLayer-djom-J78.cjs");
 const require_sdk_vault_index = require("./sdk/vault/index.cjs");
 const require_ai_index = require("./ai/index.cjs");
-const require_appLogs = require("./appLogs-Cix2KWra.cjs");
+const require_appLogs = require("./appLogs-CoAWQGxs.cjs");
 const require_apps_index = require("./apps/index.cjs");
 const require_billing_index = require("./billing/index.cjs");
 const require_chat_index = require("./chat/index.cjs");
-const require_componentsMcp = require("./componentsMcp-pG-PcQrg.cjs");
-const require_dataScience = require("./dataScience-BjS1p8WO.cjs");
+const require_componentsMcp = require("./componentsMcp-BaHy5iLr.cjs");
+const require_dataScience = require("./dataScience-CufjHPSd.cjs");
 const require_editor_index = require("./editor/index.cjs");
 const require_encryption_index = require("./encryption/index.cjs");
-const require_kaiAgent = require("./kaiAgent-N2qbUFZm.cjs");
-const require_metastore = require("./metastore-BXHg33ku.cjs");
+const require_kaiAgent = require("./kaiAgent-gaA7dqki.cjs");
+const require_metastore = require("./metastore-DeRQ2VIv.cjs");
 const require_notifications_index = require("./notifications/index.cjs");
-const require_oauth = require("./oauth-DKZPuUlt.cjs");
+const require_oauth = require("./oauth-B5Biqz21.cjs");
 const require_omnisearch_index = require("./omnisearch/index.cjs");
-const require_queryService = require("./queryService-CzK53q94.cjs");
-const require_queue = require("./queue-BJvDWriM.cjs");
+const require_queryService = require("./queryService-Cg-eMysa.cjs");
+const require_queue = require("./queue-CBi9Q8vp.cjs");
 const require_scheduler_index = require("./scheduler/index.cjs");
 const require_stream_index = require("./stream/index.cjs");
-const require_syncActions = require("./syncActions-C1rE4R3f.cjs");
+const require_syncActions = require("./syncActions-BcX3jm2E.cjs");
 const require_telemetry_index = require("./telemetry/index.cjs");
 const require_vault_index = require("./vault/index.cjs");
-const require_middleware = require("./middleware-CEP6uu_D.cjs");
+const require_middleware = require("./middleware-B9RNuLfD.cjs");
+const require_project = require("./project-Onf-IcPW.cjs");
 const require_sdk_queryService_index = require("./sdk/queryService/index.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
-//#region src/utils/assert.ts
+// src/keboola/errors.ts
+/**
+* The single error the keboola client / session throws. It carries a stable `type` (the switchable
+* contract) and a human-readable message derived from that type — no per-call message strings.
+*/
+const KeboolaErrorType = {
+	Unconfigured: "unconfigured",
+	NotAuthenticated: "not-authenticated",
+	SignInEnded: "sign-in-ended",
+	AlreadyAuthenticated: "already-authenticated",
+	NoStorageToken: "no-storage-token",
+	NoManagementToken: "no-management-token",
+	MissingProject: "missing-project",
+	NotBearer: "not-bearer",
+	NotReady: "not-ready",
+	InvalidBuildTransition: "invalid-build-transition"
+};
+const MESSAGES = {
+	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
+	[KeboolaErrorType.NotAuthenticated]: "The session is not authenticated — sign in first.",
+	[KeboolaErrorType.SignInEnded]: "The sign-in this operation started under has ended — its result belongs to nobody.",
+	[KeboolaErrorType.AlreadyAuthenticated]: "The session is already authenticated — reset before authenticating again.",
+	[KeboolaErrorType.NoStorageToken]: "No storage token — authenticate the storage realm first.",
+	[KeboolaErrorType.NoManagementToken]: "No management token — authenticate the management realm first.",
+	[KeboolaErrorType.MissingProject]: "A bearer storage session requires a project — call setProject(projectId) first.",
+	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
+	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
+	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed."
+};
+var KeboolaError = class KeboolaError extends Error {
+	type;
+	constructor(type) {
+		super(MESSAGES[type]);
+		this.type = type;
+		this.name = "KeboolaError";
+		Object.setPrototypeOf(this, KeboolaError.prototype);
+	}
+};
+const isKeboolaError = (error) => error instanceof KeboolaError;
+/** Throw a {@link KeboolaError} of `type` when `value` is null/undefined; otherwise narrow it. */
+function assert$1(value, type) {
+	if (value == null) throw new KeboolaError(type);
+}
+// src/utils/assert.ts
 function assert(value, message) {
 	if (value == null) throw new Error(message);
 }
-//#endregion
-//#region src/utils/ensure.ts
+// src/utils/ensure.ts
 /**
 * Read a key, or build its value and keep it.
 *
@@ -73,8 +114,7 @@ const ensure = (map, key, build) => {
 	map.set(key, created);
 	return created;
 };
-//#endregion
-//#region src/utils/async/coalesce.ts
+// src/utils/async/coalesce.ts
 /**
 * Coalesces concurrent triggers onto a single, never-parallel run of `task`.
 *
@@ -104,8 +144,7 @@ const coalesce = (task) => {
 		return waiter.promise;
 	};
 };
-//#endregion
-//#region src/utils/store/derivedStore.ts
+// src/utils/store/derivedStore.ts
 const isPlainObjectOrArray = (value) => {
 	if (Array.isArray(value)) return true;
 	const proto = Object.getPrototypeOf(value);
@@ -140,8 +179,7 @@ const createDerivedStore = ({ source, dependsOn, build, keyEquals = shallowEqual
 		dispose
 	};
 };
-//#endregion
-//#region src/utils/store/derivedAsyncStore.ts
+// src/utils/store/derivedAsyncStore.ts
 const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallowEqual }) => {
 	const store = require_store.createStore({ state: "idle" });
 	let currentKey = null;
@@ -209,8 +247,7 @@ const createDerivedAsyncStore = ({ source, dependsOn, build, keyEquals = shallow
 		settled
 	};
 };
-//#endregion
-//#region src/utils/async/poll/registry.ts
+// src/utils/async/poll/registry.ts
 const DEFAULT_LIMIT = 50;
 const isFinished = ({ snapshot }) => snapshot.state !== "idle" && snapshot.state !== "requesting" && snapshot.state !== "polling";
 const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
@@ -262,8 +299,7 @@ const createPollRegistry = ({ limit = DEFAULT_LIMIT } = {}) => {
 		stopAll: (reason) => entries.get().forEach((entry) => entry.stop(reason))
 	};
 };
-//#endregion
-//#region src/utils/async/queueSeries.ts
+// src/utils/async/queueSeries.ts
 const isPromiseLike = (value) => (typeof value === "object" && value !== null || typeof value === "function") && "then" in value && typeof value.then === "function";
 /**
 * Queues tasks added over time so a slower earlier task cannot finish after and overwrite a later one.
@@ -303,8 +339,7 @@ const queueSeries = () => {
 		onIdle
 	};
 };
-//#endregion
-//#region src/utils/deepMerge.ts
+// src/utils/deepMerge.ts
 /**
 * Recursively merge `patch` into `base`. Plain-object values are merged key-by-key; every
 * other value (primitives, arrays, or a type mismatch between the two sides) replaces the
@@ -320,8 +355,7 @@ const deepMerge = (base, patch) => {
 	}
 	return out;
 };
-//#endregion
-//#region src/utils/persistor/adapters.ts
+// src/utils/persistor/adapters.ts
 const createNullStorage = () => ({
 	getItem: () => null,
 	setItem: () => {},
@@ -370,8 +404,7 @@ const createWebStorage = (pick) => {
 };
 const createLocalStorage = () => createWebStorage(() => "localStorage" in globalThis ? globalThis.localStorage : null);
 const createSessionStorage = () => createWebStorage(() => "sessionStorage" in globalThis ? globalThis.sessionStorage : null);
-//#endregion
-//#region src/utils/persistor/persistor.ts
+// src/utils/persistor/persistor.ts
 const createPersistor = ({ storage = createNullStorage(), key, schema, defaultValue, encode = JSON.stringify, decode = JSON.parse }) => {
 	const writes = queueSeries();
 	const _load = async () => {
@@ -425,82 +458,7 @@ const createPersistor = ({ storage = createNullStorage(), key, schema, defaultVa
 		locked
 	};
 };
-//#endregion
-//#region src/keboola/createLiveProject.ts
-const STORAGE_TOKEN_MUTATING_PATTERNS = [/\/buckets(\/[^/]+)?$/, /\/projects\/[^/]+\/features(\/[^/]+)?$/];
-const isStorageTokenMutatingRequest = (request) => {
-	if (request.method === "GET") return false;
-	const { pathname } = new URL(request.url);
-	return STORAGE_TOKEN_MUTATING_PATTERNS.some((pattern) => pattern.test(pathname));
-};
-const createProjectRefreshMiddleware = (shouldRefresh, requestRefresh) => (next) => async (request) => {
-	const response = await next(request);
-	if (shouldRefresh(request.request)) await requestRefresh();
-	return response;
-};
-/**
-* The live project store, re-verified (coalesced) after a token-mutating request or a re-scope.
-*/
-const createLiveProject = ({ initialToken, verify }) => {
-	const store = require_store.createStore(require_project.createProject({ sapiToken: initialToken }));
-	const refresh = coalesce(async () => store.set(require_project.createProject({ sapiToken: await verify() })));
-	const middleware = createProjectRefreshMiddleware(isStorageTokenMutatingRequest, refresh);
-	return {
-		store,
-		getProject: () => store.get(),
-		subscribe: store.subscribe,
-		middleware,
-		refresh
-	};
-};
-//#endregion
-//#region src/keboola/errors.ts
-/**
-* The single error the keboola client / session throws. It carries a stable `type` (the switchable
-* contract) and a human-readable message derived from that type — no per-call message strings.
-*/
-const KeboolaErrorType = {
-	Unconfigured: "unconfigured",
-	NotAuthenticated: "not-authenticated",
-	SignInEnded: "sign-in-ended",
-	AlreadyAuthenticated: "already-authenticated",
-	NoStorageToken: "no-storage-token",
-	NoManagementToken: "no-management-token",
-	MissingProject: "missing-project",
-	NotBearer: "not-bearer",
-	NotReady: "not-ready",
-	InvalidBuildTransition: "invalid-build-transition",
-	StackActive: "stack-active"
-};
-const MESSAGES = {
-	[KeboolaErrorType.Unconfigured]: "The session is not configured — set a baseUrl first.",
-	[KeboolaErrorType.NotAuthenticated]: "The session is not authenticated — sign in first.",
-	[KeboolaErrorType.SignInEnded]: "The sign-in this operation started under has ended — its result belongs to nobody.",
-	[KeboolaErrorType.AlreadyAuthenticated]: "The session is already authenticated — reset before authenticating again.",
-	[KeboolaErrorType.NoStorageToken]: "No storage token — authenticate the storage realm first.",
-	[KeboolaErrorType.NoManagementToken]: "No management token — authenticate the management realm first.",
-	[KeboolaErrorType.MissingProject]: "A bearer storage session requires a project — call setProject(projectId) first.",
-	[KeboolaErrorType.NotBearer]: "This operation requires a bearer (OAuth) session.",
-	[KeboolaErrorType.NotReady]: "The client is not ready — authenticate the storage realm first.",
-	[KeboolaErrorType.InvalidBuildTransition]: "Invalid storage build transition — the build goes idle → initializing → ready | failed.",
-	[KeboolaErrorType.StackActive]: "The active stack cannot be closed — select another first."
-};
-var KeboolaError = class KeboolaError extends Error {
-	type;
-	constructor(type) {
-		super(MESSAGES[type]);
-		this.type = type;
-		this.name = "KeboolaError";
-		Object.setPrototypeOf(this, KeboolaError.prototype);
-	}
-};
-const isKeboolaError = (error) => error instanceof KeboolaError;
-/** Throw a {@link KeboolaError} of `type` when `value` is null/undefined; otherwise narrow it. */
-function assert$1(value, type) {
-	if (value == null) throw new KeboolaError(type);
-}
-//#endregion
-//#region src/serviceClientRegistry/utils.ts
+// src/serviceClientRegistry/utils.ts
 const isBuiltInProperty = (property) => typeof property === "symbol" || property === "then" || property === "constructor" || property === "toString" || property === "valueOf";
 /**
 * Creates a dummy client that intercepts method calls and invokes the provided onCall callback.
@@ -515,8 +473,7 @@ const createDummyClient = ({ onCall }) => {
 	});
 	return createProxy();
 };
-//#endregion
-//#region src/serviceClientRegistry/createServiceClientRegistry.ts
+// src/serviceClientRegistry/createServiceClientRegistry.ts
 const createServiceClientRegistry = () => ({ getServiceBaseUrl, onUnavailable }) => {
 	const dummy = (serviceId, clientName) => createDummyClient({ onCall: (path, args) => {
 		onUnavailable?.({
@@ -555,8 +512,7 @@ const createServiceClientRegistry = () => ({ getServiceBaseUrl, onUnavailable })
 	};
 	return registry;
 };
-//#endregion
-//#region src/keboola/createApi.ts
+// src/keboola/createApi.ts
 const createApi = (state) => new Proxy({}, { get(_target, property) {
 	if (isBuiltInProperty(property)) return void 0;
 	if (property === "auth") {
@@ -573,8 +529,7 @@ const createApi = (state) => new Proxy({}, { get(_target, property) {
 	assert$1(clients, KeboolaErrorType.NotReady);
 	return clients[property];
 } });
-//#endregion
-//#region src/keboola/createMiddlewareFor.ts
+// src/keboola/createMiddlewareFor.ts
 const createMiddlewareFor = (middlewares) => {
 	return (target, baseline = []) => {
 		if (Array.isArray(middlewares)) return [...baseline, ...middlewares];
@@ -587,8 +542,7 @@ const createMiddlewareFor = (middlewares) => {
 		];
 	};
 };
-//#endregion
-//#region src/keboola/legacy/createConfig.ts
+// src/keboola/legacy/createConfig.ts
 const createConfig = () => {
 	const store = require_store.createStore({
 		baseUrl: null,
@@ -625,25 +579,7 @@ const createConfig = () => {
 		debug
 	};
 };
-//#endregion
-//#region src/domain/defaultBranch.ts
-const createDefaultBranch = ({ devBranches }) => {
-	const defaultBranch = devBranches.find((branch) => branch.isDefault);
-	assert(defaultBranch, "No default branch found for the project.");
-	const getType = (branchId) => {
-		if (branchId == null || branchId === "default") return "default";
-		return Number(branchId) === defaultBranch.id ? "default" : "dev";
-	};
-	return {
-		id: defaultBranch.id,
-		name: defaultBranch.name,
-		getType,
-		isDev: (branchId) => getType(branchId) === "dev",
-		isDefault: (branchId) => getType(branchId) === "default"
-	};
-};
-//#endregion
-//#region src/domain/stack.ts
+// src/domain/stack.ts
 const isServiceId = (id) => Object.values(require_constants.ServiceId).includes(id);
 const SERVICE_URL_OVERRIDES = { "kai-assistant": (url) => `${url}/api` };
 const createStack = ({ stackInfo, clientServiceUrls }) => {
@@ -680,8 +616,7 @@ const createStack = ({ stackInfo, clientServiceUrls }) => {
 		hasComponent
 	};
 };
-//#endregion
-//#region src/sdks/variables/variablesSdk.ts
+// src/sdks/variables/variablesSdk.ts
 const VARIABLES_COMPONENT_ID = "keboola.variables";
 /** Union the definitions by name; on a name conflict the target's definition is kept. */
 const mergeVariableDefinitions = (target, source) => {
@@ -762,14 +697,8 @@ const createVariablesSdk = ({ storageClient }) => {
 		}
 	};
 };
-//#endregion
-//#region src/keboola/createSdk.ts
-const createSdk = ({ storage, services, context }) => ({
-	configuration: require_configurations.createConfigurationSdk({
-		storageClient: storage,
-		encryptionClient: services.encryption,
-		context
-	}),
+// src/keboola/createSdk.ts
+const createSdk = ({ storage, services }) => ({
 	tag: require_tag.createTagSdk({ metastoreClient: services.metastore }),
 	semanticLayer: require_semanticLayer.createSemanticLayerSdk({ metastoreClient: services.metastore }),
 	kaiMemory: require_kaiMemory.createKaiMemorySdk({ metastoreClient: services.metastore }),
@@ -779,8 +708,7 @@ const createSdk = ({ storage, services, context }) => ({
 	}),
 	variables: createVariablesSdk({ storageClient: storage })
 });
-//#endregion
-//#region src/keboola/createServiceClients.ts
+// src/keboola/createServiceClients.ts
 const withPath = (serviceBaseUrl, path) => typeof serviceBaseUrl === "string" ? `${serviceBaseUrl}${path}` : async () => `${await serviceBaseUrl()}${path}`;
 const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor, attachTokenMiddleware }) => createServiceClientRegistry()({
 	getServiceBaseUrl,
@@ -956,8 +884,7 @@ const createServiceClients = ({ baseUrl, auth, getServiceBaseUrl, middlewareFor,
 		auth
 	})
 }).build();
-//#endregion
-//#region src/keboola/legacy/createProjectClients.ts
+// src/keboola/legacy/createProjectClients.ts
 const createAttachStorageToken = (getToken) => (next) => (request) => {
 	request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN, getToken());
 	return next(request);
@@ -968,72 +895,41 @@ const createProjectClients = async ({ baseUrl, getStorageToken, onStorageTokenRe
 		token: getStorageToken()
 	};
 	const attach = createAttachStorageToken(getStorageToken);
-	const _storage = require_storage.createStorageClient({
+	const stackInfo = await require_storage.createStorageClient({
 		baseUrl,
 		auth,
 		middlewares: [attach]
-	});
-	const [stackInfo, sapiToken, devBranches] = await Promise.all([
-		_storage.getStackInfo({ exclude: "componentDetails" }),
-		_storage.tokens.verify(),
-		_storage.branches.getDevBranches()
-	]);
+	}).getStackInfo({ exclude: "componentDetails" });
 	const stack = createStack({
 		stackInfo,
 		clientServiceUrls
 	});
-	const defaultBranch = createDefaultBranch({ devBranches });
-	const liveProject = createLiveProject({
-		initialToken: sapiToken,
-		verify: () => _storage.tokens.verify()
-	});
-	const storageTableStore = createDerivedStore({
-		source: liveProject.store,
-		build: require_storageTable.createStorageTable,
-		dependsOn: (project) => ({
-			useLegacyBucketPrefix: !project.hasFeature(require_constants.ProjectFeature.DisableLegacyBucketPrefix),
-			hasProtectedDefaultBranch: project.hasFeature(require_constants.ProjectFeature.SoxProtectedDefaultBranch),
-			hasStorageBranches: project.hasFeature(require_constants.ProjectFeature.StorageBranches)
-		})
-	});
-	const context = {
-		baseUrl: require_createFetchClient.normalizeBaseUrl(baseUrl),
-		stack,
-		defaultBranch,
-		get project() {
-			return liveProject.getProject();
-		},
-		get st() {
-			return storageTableStore.get();
-		}
-	};
 	const storage = require_storage.createStorageClient({
 		baseUrl,
 		auth,
-		middlewares: middlewareFor("storage", [liveProject.middleware]),
+		middlewares: middlewareFor("storage", []),
 		onRefreshToken: onStorageTokenRefreshed
 	});
 	const { client: services, meta: serviceMeta } = createServiceClients({
 		baseUrl,
 		auth,
-		getServiceBaseUrl: context.stack.getServiceUrl,
+		getServiceBaseUrl: stack.getServiceUrl,
 		middlewareFor,
 		attachTokenMiddleware: attach
 	});
 	return {
-		context,
+		baseUrl: require_createFetchClient.normalizeBaseUrl(baseUrl),
+		stack,
 		serviceMeta,
 		storage,
 		...services,
 		sdk: createSdk({
 			storage,
-			services,
-			context
+			services
 		})
 	};
 };
-//#endregion
-//#region src/keboola/legacy/keboola.ts
+// src/keboola/legacy/keboola.ts
 const createLegacyKeboola = (options = {}) => {
 	const config = createConfig();
 	const middlewareFor = createMiddlewareFor(options.middlewares);
@@ -1113,160 +1009,74 @@ const createLegacyKeboola = (options = {}) => {
 		session
 	};
 };
-//#endregion
-//#region src/keboola/bearer/state/factories.ts
-/**
-* Everything the table constructs: the entries themselves, and the failures reading them produces.
-*
-* Nothing here touches the store — a factory takes what it is told and returns a value, so the
-* namespaces the tables build on can be read without following a dependency.
-*/
-const projectEntryId = (baseUrl, projectId) => `${baseUrl}#${projectId}`;
-/** What every project entry of one stack shares — the one thing a per-stack teardown matches on. */
-const projectEntryPrefix = (baseUrl) => `${baseUrl}#`;
-const isUnderStack = (baseUrl) => (id) => id.startsWith(projectEntryPrefix(baseUrl));
-const anonymousAuth = () => ({ status: "anonymous" });
-const restoringAuth = () => ({ status: "restoring" });
-const authenticatedAuth = (credential) => ({
-	status: "authenticated",
-	credential
-});
-const credential = (input) => ({
-	...input,
-	issuedAt: Date.now()
-});
-const grant = (credential) => credential.type === "token" ? {
+// src/keboola/bearer/state/auth.ts
+const grantOf = (credential) => credential.type === "token" ? {
 	type: "token",
 	refreshToken: credential.refreshToken
 } : {
 	type: "cookie",
 	sessionId: credential.sessionId
 };
-const expiredCredential = (credential) => ({
-	...credential,
-	issuedAt: Date.now() - credential.expiresIn * 1e3
-});
-const stack = (baseUrl) => ({
-	baseUrl,
-	context: "idle",
-	epoch: 0,
-	auth: anonymousAuth(),
-	retained: null
-});
-const project = (baseUrl, projectId) => ({
-	id: projectEntryId(baseUrl, projectId),
-	baseUrl,
-	projectId,
-	context: "idle"
-});
-const stackAddress = (baseUrl) => ({
-	baseUrl,
-	projectId: null
-});
-const projectAddress = (baseUrl, projectId) => ({
-	baseUrl,
-	projectId
-});
-const table = (defaultBaseUrl) => ({
-	active: stackAddress(defaultBaseUrl),
-	stacks: { [defaultBaseUrl]: stack(defaultBaseUrl) },
-	projects: {}
+const stamped = (input) => ({
+	...input,
+	issuedAt: Date.now()
 });
-const Entry = {
-	projectEntryId,
-	isUnderStack,
-	stack,
-	project,
-	stackAddress,
-	projectAddress,
-	table,
-	anonymousAuth,
-	restoringAuth,
-	authenticatedAuth,
-	credential,
-	grant,
-	expiredCredential
-};
-/**
-* Every failure the table can produce.
-*
-* - The typed ones carry a `KeboolaErrorType` a consumer branches on; the rest are plain `Error`s
-*   whose message names the entry, because nothing branches on them.
-*/
-const Errors = {
-	notAuthenticated: () => new KeboolaError(KeboolaErrorType.NotAuthenticated),
-	stackActive: () => new KeboolaError(KeboolaErrorType.StackActive),
-	/** A stack that was never opened — nothing has been configured for it. */
-	unconfigured: () => new KeboolaError(KeboolaErrorType.Unconfigured),
-	alreadyAuthenticated: () => new KeboolaError(KeboolaErrorType.AlreadyAuthenticated),
-	notReady: () => new KeboolaError(KeboolaErrorType.NotReady),
-	alreadyRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`),
-	notRestoring: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`),
-	grantTypeChanged: (from, to) => /* @__PURE__ */ new Error(`A ${from} grant cannot become ${to}`),
-	nothingRetained: (baseUrl) => /* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`),
-	missingProject: (id) => /* @__PURE__ */ new Error(`No project "${id}"`)
-};
-const authenticated = (auth) => auth.status === "authenticated" ? require_transientRetries.Result.success(auth.credential) : require_transientRetries.Result.failure(Errors.notAuthenticated());
-//#endregion
-//#region src/keboola/bearer/state/auth.ts
-/**
-* Fire-once per sign-in: the first report of a dead credential returns `true`, the rest `false`,
-* and `authenticate` re-arms it. Held beside the table because it is not state anyone restores.
-*/
-const createExpiryLatch = () => {
-	const notified = /* @__PURE__ */ new Map();
-	return {
-		arm: (baseUrl) => notified.set(baseUrl, false),
-		forget: (baseUrl) => notified.delete(baseUrl),
-		report: (baseUrl) => {
-			if (notified.get(baseUrl)) return false;
-			notified.set(baseUrl, true);
-			return true;
-		}
-	};
-};
+const credentialOf = (auth) => auth.status === "authenticated" ? require_transientRetries.Result.success(auth.credential) : require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.NotAuthenticated));
 /**
 * The stack's credential and its sign-in pin.
 *
 * - `epoch` moves on `authenticate` and `signOut` and never on a rotation, so it is exactly "which
 *   sign-in is this" — what an in-flight exchange compares itself against.
 */
-const createAuth = ({ stacks, projects, expiry }) => {
-	const requireUnauthenticated = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_transientRetries.Result.failure(Errors.alreadyAuthenticated()) : require_transientRetries.Result.success(stack));
-	const requireAnonymous = (baseUrl) => require_transientRetries.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.failure(Errors.alreadyRestoring(baseUrl)) : require_transientRetries.Result.success(stack));
-	const requireRestoring = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(Errors.notRestoring(baseUrl)));
+const createAuth = (stacks) => {
+	const expired = /* @__PURE__ */ new Set();
+	const requireCredential = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => credentialOf(stack.auth));
+	const requireUnauthenticated = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "authenticated" ? require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.AlreadyAuthenticated)) : require_transientRetries.Result.success(stack));
+	const requireAnonymous = (baseUrl) => require_transientRetries.Result.andThen(requireUnauthenticated(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is already being restored`)) : require_transientRetries.Result.success(stack));
+	const requireRestoring = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.auth.status === "restoring" ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" is not being restored`)));
 	const startRestore = (baseUrl) => require_transientRetries.Result.map(requireAnonymous(baseUrl), (stack) => stacks.set({
 		...stack,
-		auth: Entry.restoringAuth()
+		auth: { status: "restoring" }
 	}));
 	const cancelRestore = (baseUrl) => require_transientRetries.Result.map(requireRestoring(baseUrl), (stack) => stacks.set({
 		...stack,
-		auth: Entry.anonymousAuth()
+		auth: { status: "anonymous" }
 	}));
 	const authenticate = (baseUrl, input) => require_transientRetries.Result.map(requireUnauthenticated(baseUrl), (stack) => {
-		expiry.arm(baseUrl);
+		expired.delete(baseUrl);
 		return stacks.set({
 			...stack,
 			epoch: stack.epoch + 1,
-			auth: Entry.authenticatedAuth(Entry.credential(input)),
+			auth: {
+				status: "authenticated",
+				credential: stamped(input)
+			},
 			retained: null
 		});
 	});
-	const applyRefresh = (baseUrl, input) => require_transientRetries.Result.andThen(stacks.requireCredential(baseUrl), (credential) => credential.type !== input.type ? require_transientRetries.Result.failure(Errors.grantTypeChanged(credential.type, input.type)) : require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+	const applyRefresh = (baseUrl, input) => require_transientRetries.Result.andThen(requireCredential(baseUrl), (credential) => credential.type !== input.type ? require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`A ${credential.type} grant cannot become ${input.type}`)) : require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
 		...stack,
-		auth: Entry.authenticatedAuth(Entry.credential(input))
+		auth: {
+			status: "authenticated",
+			credential: stamped(input)
+		}
 	})));
-	const forceExpire = (baseUrl) => require_transientRetries.Result.andThen(stacks.requireCredential(baseUrl), (credential) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
+	const forceExpire = (baseUrl) => require_transientRetries.Result.andThen(requireCredential(baseUrl), (credential) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stacks.set({
 		...stack,
-		auth: Entry.authenticatedAuth(Entry.expiredCredential(credential))
+		auth: {
+			status: "authenticated",
+			credential: {
+				...credential,
+				issuedAt: Date.now() - credential.expiresIn * 1e3
+			}
+		}
 	})));
 	const signOut = (baseUrl, { retain = false } = {}) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => {
-		projects.closeAll(baseUrl);
-		const retained = retain ? require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(authenticated(stack.auth), (credential) => ({ grant: Entry.grant(credential) })), stack.retained) : null;
+		const retained = retain ? require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(credentialOf(stack.auth), (credential) => ({ grant: grantOf(credential) })), stack.retained) : null;
 		return stacks.set({
 			...stack,
 			epoch: stack.epoch + 1,
-			auth: Entry.anonymousAuth(),
+			auth: { status: "anonymous" },
 			retained
 		});
 	});
@@ -1278,9 +1088,14 @@ const createAuth = ({ stacks, projects, expiry }) => {
 		...stack,
 		retained: null
 	}));
-	const requireRetained = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? require_transientRetries.Result.success(stack.retained) : require_transientRetries.Result.failure(Errors.nothingRetained(baseUrl)));
+	const requireRetained = (baseUrl) => require_transientRetries.Result.andThen(stacks.get(baseUrl), (stack) => stack.retained ? require_transientRetries.Result.success(stack.retained) : require_transientRetries.Result.failure(/* @__PURE__ */ new Error(`Stack "${baseUrl}" retains no credential`)));
+	const notifyExpired = (baseUrl) => {
+		if (expired.has(baseUrl)) return false;
+		expired.add(baseUrl);
+		return true;
+	};
 	const getEpoch = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => stack.epoch);
-	const getAccessToken = (baseUrl) => require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(stacks.requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
+	const getAccessToken = (baseUrl) => require_transientRetries.Result.unwrapOr(require_transientRetries.Result.map(requireCredential(baseUrl), ({ accessToken }) => accessToken), null);
 	return {
 		startRestore,
 		cancelRestore,
@@ -1291,171 +1106,26 @@ const createAuth = ({ stacks, projects, expiry }) => {
 		retain,
 		dropRetained,
 		requireRetained,
-		notifyExpired: expiry.report,
-		requireCredential: stacks.requireCredential,
+		notifyExpired,
+		requireCredential,
 		getEpoch,
 		getAccessToken
 	};
 };
-//#endregion
-//#region src/keboola/bearer/state/projects.ts
-/** The projects open under a stack, and what authorizes a request to one. */
-const createProjects = ({ store, stacks }) => {
-	const has = (id) => id in store.get().projects;
-	const get = (id) => {
-		const project = store.get().projects[id];
-		return project ? require_transientRetries.Result.success(project) : require_transientRetries.Result.failure(Errors.missingProject(id));
-	};
-	const list = (baseUrl) => Object.values(store.get().projects).filter((project) => project.baseUrl === baseUrl);
-	/** Every open project with this id, whatever stack it sits on — a project number is not unique. */
-	const findAll = (projectId) => Object.values(store.get().projects).filter((project) => project.projectId === projectId);
-	const set = (project) => {
-		const state = store.get();
-		store.set({
-			...state,
-			projects: {
-				...state.projects,
-				[project.id]: project
-			}
-		});
-		return project;
-	};
-	const update = (id, updater) => require_transientRetries.Result.map(get(id), (project) => set(updater(project)));
-	const removeMany = (ids, nextActive) => {
-		const state = store.get();
-		const projects = { ...state.projects };
-		for (const id of ids) delete projects[id];
-		store.set({
-			...state,
-			active: nextActive,
-			projects
-		});
-	};
-	const requireCredential = (id) => require_transientRetries.Result.andThen(get(id), (project) => stacks.requireCredential(project.baseUrl));
-	const open = (baseUrl, projectId) => {
-		const id = Entry.projectEntryId(baseUrl, projectId);
-		if (has(id)) return get(id);
-		return require_transientRetries.Result.map(stacks.requireCredential(baseUrl), () => set(Entry.project(baseUrl, projectId)));
-	};
-	const close = (id) => require_transientRetries.Result.tap(get(id), ({ baseUrl, projectId }) => {
-		const { active } = store.get();
-		const isScoped = active.baseUrl === baseUrl && active.projectId === projectId;
-		removeMany([id], isScoped ? Entry.stackAddress(baseUrl) : active);
-	});
-	/** Every project under a stack, with the scope falling back to the stack itself. */
-	const closeAll = (baseUrl) => {
-		const ids = list(baseUrl).map((project) => project.id);
-		const { active } = store.get();
-		removeMany(ids, active.baseUrl === baseUrl ? Entry.stackAddress(baseUrl) : active);
-	};
-	const updateContext = (id, context) => update(id, (project) => ({
-		...project,
-		context
-	}));
-	return {
-		has,
-		get,
-		list,
-		findAll,
-		set,
-		update,
-		open,
-		close,
-		closeAll,
-		updateContext,
-		requireCredential
-	};
-};
-//#endregion
-//#region src/keboola/bearer/state/scope.ts
-/**
-* What `api.*` addresses: the `active` slot, and the address in it resolved against the tables it
-* points into.
-*
-* The tables never write here — they read `active` through the pure helpers in `address.ts`, so
-* that this can depend on them rather than the other way round.
-*/
-const createScope = ({ store, stacks, projects }) => {
-	const get = () => store.get().active;
-	const isSame = (a, b) => a === b || a.baseUrl === b.baseUrl && a.projectId === b.projectId;
-	const set = (active) => {
-		if (isSame(store.get().active, active)) return;
-		store.set({
-			...store.get(),
-			active
-		});
-	};
-	const locate = (active) => {
-		const stack = stacks.get(active.baseUrl);
-		if (!stack.success) return null;
-		if (active.projectId === null) return {
-			stack: stack.data,
-			project: null
-		};
-		const project = projects.get(Entry.projectEntryId(active.baseUrl, active.projectId));
-		if (!project.success) return null;
-		return {
-			stack: stack.data,
-			project: project.data
-		};
-	};
-	const getActive = () => {
-		const location = locate(get());
-		if (!location) throw new Error(`The scope names no row: ${JSON.stringify(get())}`);
-		return location;
-	};
-	const getActiveStack = () => getActive().stack;
-	const activateStack = (baseUrl) => require_transientRetries.Result.map(stacks.get(baseUrl), (stack) => {
-		const next = Entry.stackAddress(stack.baseUrl);
-		set(next);
-		return next;
-	});
-	const activateProject = (baseUrl, projectId) => require_transientRetries.Result.map(projects.requireCredential(Entry.projectEntryId(baseUrl, projectId)), () => {
-		const next = Entry.projectAddress(baseUrl, projectId);
-		set(next);
-		return next;
-	});
-	const selectStack = (baseUrl) => {
-		const stack = stacks.ensure(baseUrl);
-		return require_transientRetries.Result.map(activateStack(stack.baseUrl), () => stack);
-	};
-	const selectProject = (projectId) => {
-		const { baseUrl } = getActiveStack();
-		const project = projects.open(baseUrl, projectId);
-		if (!project.success) return project;
-		return require_transientRetries.Result.map(activateProject(baseUrl, projectId), () => project.data);
-	};
-	const deactivate = () => {
-		const active = get();
-		if (active.projectId === null) return;
-		set(Entry.stackAddress(active.baseUrl));
-	};
-	const requireActiveProject = () => {
-		const { project } = getActive();
-		return project ? require_transientRetries.Result.success(project) : require_transientRetries.Result.failure(Errors.notReady());
-	};
-	return {
-		get,
-		getActive,
-		activateStack,
-		activateProject,
-		selectStack,
-		selectProject,
-		deactivate,
-		getActiveStack,
-		requireActiveProject
-	};
-};
-//#endregion
-//#region src/keboola/bearer/state/stacks.ts
-/** One entry per stack: the entries, and the verbs that open and close them. */
-const createStacks = ({ store, forgetExpiry }) => {
-	const has = (baseUrl) => baseUrl in store.get().stacks;
+// src/keboola/bearer/state/stacks.ts
+const newStack = (baseUrl) => ({
+	baseUrl,
+	context: "idle",
+	epoch: 0,
+	auth: { status: "anonymous" },
+	retained: null
+});
+/** One entry per stack, and the verbs that open and select them. */
+const createStacks = (store) => {
 	const get = (baseUrl) => {
 		const stack = store.get().stacks[baseUrl];
-		return stack ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(Errors.unconfigured());
+		return stack ? require_transientRetries.Result.success(stack) : require_transientRetries.Result.failure(new KeboolaError(KeboolaErrorType.Unconfigured));
 	};
-	const list = () => Object.values(store.get().stacks);
 	const set = (stack) => {
 		const state = store.get();
 		store.set({
@@ -1468,26 +1138,24 @@ const createStacks = ({ store, forgetExpiry }) => {
 		return stack;
 	};
 	const update = (baseUrl, updater) => require_transientRetries.Result.map(get(baseUrl), (stack) => set(updater(stack)));
-	const requireCredential = (baseUrl) => require_transientRetries.Result.andThen(get(baseUrl), (stack) => authenticated(stack.auth));
 	const ensure = (baseUrl) => {
 		const existing = get(baseUrl);
 		if (existing.success) return existing.data;
-		return set(Entry.stack(baseUrl));
+		return set(newStack(baseUrl));
+	};
+	const getActive = () => {
+		const { active } = store.get();
+		const stack = get(active);
+		if (!stack.success) throw new Error(`The active stack has no row: ${active}`);
+		return stack.data;
 	};
-	const close = (baseUrl) => {
-		const stack = get(baseUrl);
-		if (!stack.success) return stack;
+	const select = (baseUrl) => {
+		const stack = ensure(baseUrl);
 		const state = store.get();
-		if (state.active.baseUrl === baseUrl) return require_transientRetries.Result.failure(Errors.stackActive());
-		const stacks = { ...state.stacks };
-		delete stacks[baseUrl];
-		const projects = Object.fromEntries(Object.entries(state.projects).filter(([, project]) => project.baseUrl !== baseUrl));
-		store.set({
-			active: state.active,
-			stacks,
-			projects
+		if (state.active !== baseUrl) store.set({
+			...state,
+			active: baseUrl
 		});
-		forgetExpiry(baseUrl);
 		return stack;
 	};
 	const updateContext = (baseUrl, context) => update(baseUrl, (stack) => ({
@@ -1495,56 +1163,42 @@ const createStacks = ({ store, forgetExpiry }) => {
 		context
 	}));
 	return {
-		has,
 		get,
-		list,
 		set,
 		update,
 		ensure,
-		close,
-		updateContext,
-		requireCredential
+		getActive,
+		select,
+		updateContext
 	};
 };
-//#endregion
-//#region src/keboola/bearer/state/state.ts
+// src/keboola/bearer/state/state.ts
 /**
 * The stack table and the rules over it, one namespace per concern.
 *
-* - Built in dependency order: a project reads its stack's credential, and the scope resolves
-*   the active address against both tables.
+* - Starts active on its default stack, which is its one row.
 */
 const createState = (defaultBaseUrl) => {
-	const store = require_store.createStore(Entry.table(defaultBaseUrl));
-	const expiry = createExpiryLatch();
-	const stacks = createStacks({
-		store,
-		forgetExpiry: expiry.forget
-	});
-	const projects = createProjects({
-		store,
-		stacks
-	});
-	const scope = createScope({
-		store,
-		stacks,
-		projects
-	});
-	const auth = createAuth({
-		stacks,
-		projects,
-		expiry
+	const store = require_store.createStore({
+		active: defaultBaseUrl,
+		stacks: { [defaultBaseUrl]: newStack(defaultBaseUrl) }
 	});
+	const stacks = createStacks(store);
+	const auth = createAuth(stacks);
 	return {
 		store: store.asReadable(),
 		stacks,
-		projects,
-		auth,
-		scope
+		auth
 	};
 };
-//#endregion
-//#region src/keboola/bearer/credentials/renewal.ts
+// src/keboola/bearer/credentials/credentials.ts
+const DEFAULT_REFRESH_THRESHOLD = .9;
+const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
+const toRestoreStatus = (outcome) => {
+	if (outcome === void 0 || outcome === "skipped") return "empty";
+	if (outcome === "refused") return "expired";
+	return outcome;
+};
 const renew = async (client, grant) => {
 	if (grant.type === "cookie") {
 		const { accessToken, expiresIn, sessionId } = await client.token.refreshWithSession({ sessionId: grant.sessionId });
@@ -1564,55 +1218,29 @@ const renew = async (client, grant) => {
 		refreshToken
 	};
 };
-//#endregion
-//#region src/keboola/bearer/credentials/credentials.ts
-const DEFAULT_REFRESH_THRESHOLD = .9;
-const signInEnded = () => new KeboolaError(KeboolaErrorType.SignInEnded);
-const toRestoreStatus = (outcome) => {
-	if (outcome === void 0 || outcome === "skipped") return "empty";
-	if (outcome === "refused") return "expired";
-	return outcome;
-};
 const createCredentials = ({ state, persistor, middlewares, refreshThreshold = DEFAULT_REFRESH_THRESHOLD, onSignedOut, onExpired }) => {
 	const rotationMap = /* @__PURE__ */ new Map();
-	const generations = /* @__PURE__ */ new Map();
-	const generationOf = (baseUrl) => generations.get(baseUrl) ?? 0;
+	const markSignIn = (baseUrl) => {
+		const epoch = require_transientRetries.Result.unwrap(state.auth.getEpoch(baseUrl));
+		return () => require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epoch;
+	};
 	const refresh = async (baseUrl, grant) => {
 		const client = require_authClient.createAuthClient({
 			baseUrl,
 			middlewares
 		});
-		const epochBefore = require_transientRetries.Result.unwrap(state.auth.getEpoch(baseUrl));
-		const generationBefore = generationOf(baseUrl);
+		const isSameSignIn = markSignIn(baseUrl);
 		const refreshed = await require_transientRetries.Result.tryCatchAsync(() => renew(client, grant));
-		return require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) === epochBefore && generationOf(baseUrl) === generationBefore ? refreshed : require_transientRetries.Result.failure(signInEnded());
-	};
-	/**
-	* A stack's teardown, from the credential's side.
-	*
-	* - Bumps the generation, so an in-flight rotation can no longer write.
-	* - Drops the deduped entry, so nothing joins that rotation.
-	*/
-	const forget = (baseUrl) => {
-		generations.set(baseUrl, generationOf(baseUrl) + 1);
-		rotationMap.delete(baseUrl);
+		return isSameSignIn() ? refreshed : require_transientRetries.Result.failure(signInEnded());
 	};
-	/**
-	* The rotation, and the one place a credential is declared dead.
-	*
-	* - Renews by the credential's grant: the refresh token, or the session id with the cookie.
-	* - A refused refresh token or session is unambiguous.
-	* - The triggering 401 is not (an unreachable project answers the same), so never sign out on a replay.
-	*/
 	const getGrantForRotation = async (store, baseUrl, credential) => {
-		const epochBefore = require_transientRetries.Result.unwrap(state.auth.getEpoch(baseUrl));
-		const generationBefore = generationOf(baseUrl);
+		const isSameSignIn = markSignIn(baseUrl);
 		const hydrated = await require_transientRetries.Result.tryCatchAsync(() => store.read());
 		if (!hydrated.success) return hydrated;
-		if (require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), -1) !== epochBefore || generationOf(baseUrl) !== generationBefore) return require_transientRetries.Result.failure(signInEnded());
+		if (!isSameSignIn()) return require_transientRetries.Result.failure(signInEnded());
 		const persistedStack = hydrated.data.stacks.find((stack) => stack.baseUrl === baseUrl);
 		if (persistedStack && persistedStack.credential === null) return require_transientRetries.Result.failure(signInEnded());
-		return require_transientRetries.Result.success(persistedStack?.credential ?? Entry.grant(credential));
+		return require_transientRetries.Result.success(persistedStack?.credential ?? grantOf(credential));
 	};
 	const rotateOnce = async (baseUrl) => persistor.locked(async (store) => {
 		const credential = state.auth.requireCredential(baseUrl);
@@ -1650,17 +1278,6 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		await store.persistStack(baseUrl, state.store.get());
 		return "restored";
 	});
-	const restoreProjects = (baseUrl, projects) => {
-		for (const { projectId } of projects) state.projects.open(baseUrl, projectId);
-	};
-	/**
-	* Every persisted stack back into the table, with whatever credential it can hand back.
-	*
-	* - Never writes the scope. `lastActive` is what was scoped when the session was stored, for the
-	*   caller to select.
-	* - `status` reports what became of `lastActive`'s credential; the client reads it to decide
-	*   when persistence may start.
-	*/
 	const restore = async () => {
 		const hydrated = await persistor.locked((store) => store.read()).catch((error) => {
 			console.warn("createCredentials: the stored session could not be read", error);
@@ -1672,15 +1289,13 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		};
 		const { stacks, current } = hydrated;
 		const scoped = stacks.find(({ baseUrl }) => baseUrl === current?.baseUrl);
-		const restored = stacks.map(async ({ baseUrl, credential, retained, projects }) => {
+		const restored = stacks.map(async ({ baseUrl, credential, retained }) => {
 			state.stacks.ensure(baseUrl);
 			if (!credential && !retained) return "unreachable";
 			if (require_transientRetries.Result.unwrapOr(state.auth.getEpoch(baseUrl), 0) > 0) return "skipped";
 			if (retained) state.auth.retain(baseUrl, retained);
 			if (!credential) return "unreachable";
-			const outcome = await restoreStack(baseUrl, credential);
-			if (outcome === "restored") restoreProjects(baseUrl, projects);
-			return outcome;
+			return restoreStack(baseUrl, credential);
 		});
 		const results = await Promise.all(restored);
 		const scopedOutcome = scoped?.credential ? results[stacks.indexOf(scoped)] : void 0;
@@ -1689,23 +1304,12 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 			status: toRestoreStatus(scopedOutcome)
 		};
 	};
-	/**
-	* Signs a retained stack back in from the grant it kept.
-	*
-	* - `restored` and `refused` empty the slot; `unreachable` keeps it for another try.
-	* - Throws when the stack retains nothing.
-	*/
 	const restoreRetained = async (baseUrl) => {
 		const { grant } = require_transientRetries.Result.unwrap(state.auth.requireRetained(baseUrl));
 		return restoreStack(baseUrl, grant, true);
 	};
-	const isStale = (baseUrl) => {
-		const ageing = require_transientRetries.Result.map(state.auth.requireCredential(baseUrl), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
-		return require_transientRetries.Result.unwrapOr(ageing, false);
-	};
 	/**
-	* Drops the slot so the next sign-in's requests don't join the dying rotation.
-	*
+	* - Drops the rotation, so the next sign-in's requests don't join the dying one.
 	* - Writes nothing: the caller persists the stack, under the lock it holds or takes.
 	*/
 	const signOut = (baseUrl, options) => {
@@ -1721,7 +1325,8 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		onExpired?.(baseUrl);
 	};
 	const renewIfStale = async (baseUrl) => {
-		if (isStale(baseUrl)) await rotate(baseUrl);
+		const isStale = require_transientRetries.Result.map(state.auth.requireCredential(baseUrl), ({ issuedAt, expiresIn }) => Date.now() >= issuedAt + expiresIn * 1e3 * refreshThreshold);
+		if (require_transientRetries.Result.unwrapOr(isStale, false)) await rotate(baseUrl);
 	};
 	const middleware = (baseUrl) => require_middleware.createBearerAuthMiddleware({ getAccessToken: async ({ forceRefresh = false } = {}) => {
 		if (forceRefresh) {
@@ -1737,186 +1342,18 @@ const createCredentials = ({ state, persistor, middlewares, refreshThreshold = D
 		renewIfStale,
 		restore,
 		restoreRetained,
-		signOut,
-		forget
+		signOut
 	};
 };
-//#endregion
-//#region src/keboola/bearer/context/resource.ts
+// src/keboola/bearer/perProject.ts
+const projectKey = ({ baseUrl, projectId }) => `${baseUrl}#${projectId}`;
 /**
-* Owns fetching one async value per key — a caller names what it needs and never orchestrates the
-* request. Backs the stack and project contexts.
+* One handle per project, and the one call that drops it.
 *
-* - One fetch per key: concurrent askers share it, a landed value is never refetched.
-* - A failure is held, not thrown away — nothing here needs a rejection handler.
-* - Status lives here and nowhere else; a consumer that has to mirror it subscribes.
+* Every client belongs to the credential that built it — a client set carries its middleware
+* chain — so the handle dies with the sign-in, and `forgetUnder` is the only thing that ends one.
 */
-const createResource = ({ key, fetch }) => {
-	const entries = /* @__PURE__ */ new Map();
-	const changes = require_store.createEmitter();
-	const set = (id, entry) => {
-		entries.set(id, entry);
-		changes.emit({
-			key: id,
-			status: entry.status
-		});
-	};
-	const run = (id, input) => {
-		const settle = (next) => {
-			if (entries.get(id) === entry) set(id, {
-				input,
-				...next
-			});
-			return next;
-		};
-		const attempt = async () => await fetch(input);
-		const entry = {
-			input,
-			status: "pending",
-			settled: attempt().then((value) => settle({
-				status: "ready",
-				value
-			}), (error) => settle({
-				status: "errored",
-				error
-			}))
-		};
-		set(id, entry);
-		return entry;
-	};
-	const get = (id) => {
-		const entry = entries.get(id);
-		return entry?.status === "ready" ? entry.value : null;
-	};
-	const getAsync = async (input) => {
-		const id = key(input);
-		const cached = entries.get(id);
-		const entry = cached === void 0 || cached.status === "errored" ? run(id, input) : cached;
-		const settled = entry.status === "pending" ? await entry.settled : entry;
-		if (settled.status === "errored") throw settled.error;
-		return settled.value;
-	};
-	const forget = (matches) => {
-		for (const id of entries.keys()) if (matches(id)) entries.delete(id);
-	};
-	const prefetch = (input) => {
-		const id = key(input);
-		if (!entries.has(id)) run(id, input);
-	};
-	const retry = (id) => {
-		const entry = entries.get(id);
-		if (entry !== void 0) run(id, entry.input);
-	};
-	return {
-		get,
-		getAsync,
-		prefetch,
-		retry,
-		forget,
-		subscribe: changes.subscribe
-	};
-};
-//#endregion
-//#region src/keboola/bearer/context/project.ts
-const createProjectContext = ({ state, credentials, stackContext }) => {
-	const resource = createResource({
-		key: (project) => project.id,
-		fetch: async ({ baseUrl, projectId }) => {
-			const withProjectId = (next) => (request) => {
-				request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.PROJECT_ID, String(projectId));
-				return next(request);
-			};
-			const client = require_storage.createStorageClient({
-				baseUrl,
-				auth: {
-					type: "bearer",
-					token: "",
-					projectId
-				},
-				middlewares: [(next) => withProjectId(credentials.middleware(baseUrl)(next))]
-			});
-			const [token, devBranches] = await Promise.all([
-				client.tokens.verify(),
-				client.branches.getDevBranches(),
-				stackContext.getAsync(baseUrl)
-			]);
-			return {
-				token,
-				defaultBranch: createDefaultBranch({ devBranches })
-			};
-		}
-	});
-	resource.subscribe(({ key, status }) => {
-		state.projects.updateContext(key, status);
-	});
-	const subscriber = ({ projects }) => {
-		for (const project of Object.values(projects)) resource.prefetch(project);
-	};
-	/**
-	* Dropped with the sign-in that fetched them: a verified token is what a credential answered
-	* for, so it belongs to that credential and not to the project id it was keyed by.
-	*/
-	const forgetUnder = (baseUrl) => resource.forget(Entry.isUnderStack(baseUrl));
-	/** One project, closed on purpose. */
-	const forget = (id) => resource.forget((key) => key === id);
-	return {
-		subscriber,
-		get: resource.get,
-		getAsync: resource.getAsync,
-		retry: resource.retry,
-		forget,
-		forgetUnder
-	};
-};
-//#endregion
-//#region src/keboola/bearer/context/stack.ts
-const createStackContext = (state) => {
-	const resource = createResource({
-		key: (baseUrl) => baseUrl,
-		fetch: (baseUrl) => require_storage.createStorageClient({
-			baseUrl,
-			auth: {
-				type: "sapi-token",
-				token: ""
-			}
-		}).getStackInfo({ exclude: "componentDetails" })
-	});
-	resource.subscribe(({ key, status }) => {
-		state.stacks.updateContext(key, status);
-	});
-	const subscriber = ({ stacks }) => {
-		for (const { baseUrl } of Object.values(stacks)) resource.prefetch(baseUrl);
-	};
-	/** Dropped with the stack itself — a stack that comes back re-reads its index. */
-	const forget = (baseUrl) => resource.forget((key) => key === baseUrl);
-	return {
-		subscriber,
-		get: resource.get,
-		getAsync: resource.getAsync,
-		retry: resource.retry,
-		forget
-	};
-};
-//#endregion
-//#region src/keboola/bearer/perProject.ts
-const once = (build) => {
-	let value = null;
-	return () => value ??= build();
-};
-/**
-* Everything one project derives, and the one call that drops it.
-*
-* Every field belongs to the credential that built it — a client set carries its middleware chain,
-* the storage client holds a `liveProject` seeded with its token, a fetched context *is* what it
-* answered for `tokens.verify` — so the record dies with the sign-in, and `forgetUnder` is the
-* only thing that ends one.
-*/
-const createPerProject = ({ state, credentials, middlewareFor, stack, clientServiceUrls, buildApi }) => {
-	const context = createProjectContext({
-		state,
-		credentials,
-		stackContext: stack.context
-	});
+const createPerProject = ({ state, credentials, middlewareFor, stack }) => {
 	const attachFor = ({ baseUrl, projectId }) => {
 		const withProjectId = (next) => (request) => {
 			request.request.headers.set(require_createFetchClient.KeboolaHttpHeader.PROJECT_ID, String(projectId));
@@ -1924,131 +1361,72 @@ const createPerProject = ({ state, credentials, middlewareFor, stack, clientServ
 		};
 		return (next) => withProjectId(credentials.middleware(baseUrl)(next));
 	};
-	const buildClients = ({ baseUrl, projectId }, attach) => createServiceClients({
-		baseUrl,
-		auth: {
-			type: "bearer",
-			token: "",
-			projectId
-		},
-		getServiceBaseUrl: (serviceId) => async () => {
-			const stackInfo = await stack.context.getAsync(baseUrl);
-			const serviceUrl = createStack({
-				stackInfo,
-				clientServiceUrls
-			}).getServiceUrl(serviceId);
-			assert$1(serviceUrl, KeboolaErrorType.NotReady);
-			return serviceUrl;
-		},
-		middlewareFor,
-		attachTokenMiddleware: attach
+	const authFor = ({ projectId }) => ({
+		type: "bearer",
+		token: "",
+		projectId
 	});
 	/**
-	* `api.storage` and `api.context`, built together: both read one live token — the storage client
-	* carries its re-verify middleware, the context reports the project it re-verifies.
+	* One project's surface: the stack's fields from `perStack`, the rest built for the project.
 	*
-	* - Both fetches it reads are already running. `NotReady` covers the window before they land,
-	*   which the table reports as `project.context`.
-	* - `storage` is gated on the stack index too, though it addresses the project's own `baseUrl`
-	*   and does not need it — that is the gate as it stands, not a requirement.
+	* - Checked per property read but `baseUrl`: `SignInEnded` once the sign-in it was built under
+	*   ends, and `NotAuthenticated` before one lands.
 	*/
-	const buildLive = (project, attach) => {
-		const stackInfo = stack.context.get(project.baseUrl);
-		assert$1(stackInfo, KeboolaErrorType.NotReady);
-		const fetched = context.get(project.id);
-		assert$1(fetched, KeboolaErrorType.NotReady);
-		const { baseUrl, projectId } = project;
-		const auth = {
-			type: "bearer",
-			token: "",
-			projectId
-		};
-		const reader = require_storage.createStorageClient({
-			baseUrl,
-			auth,
-			middlewares: [attach]
+	const build = (project) => {
+		let isLive = true;
+		const attach = attachFor(project);
+		const storage = require_storage.createStorageClient({
+			baseUrl: project.baseUrl,
+			auth: authFor(project),
+			middlewares: middlewareFor("storage", [attach])
 		});
-		const liveProject = createLiveProject({
-			initialToken: fetched.token,
-			verify: () => reader.tokens.verify()
+		const { client, meta } = createServiceClients({
+			baseUrl: project.baseUrl,
+			auth: authFor(project),
+			getServiceBaseUrl: (serviceId) => async () => {
+				const serviceUrl = (await stack.context.getAsync(project.baseUrl)).getServiceUrl(serviceId);
+				assert$1(serviceUrl, KeboolaErrorType.NotReady);
+				return serviceUrl;
+			},
+			middlewareFor,
+			attachTokenMiddleware: attach
 		});
-		const storageTableStore = createDerivedStore({
-			source: liveProject.store,
-			build: require_storageTable.createStorageTable,
-			dependsOn: (live) => ({
-				useLegacyBucketPrefix: !live.hasFeature(require_constants.ProjectFeature.DisableLegacyBucketPrefix),
-				hasProtectedDefaultBranch: live.hasFeature(require_constants.ProjectFeature.SoxProtectedDefaultBranch),
-				hasStorageBranches: live.hasFeature(require_constants.ProjectFeature.StorageBranches)
-			})
+		const sdk = createSdk({
+			storage,
+			services: client
 		});
 		return {
-			storage: require_storage.createStorageClient({
-				baseUrl,
-				auth,
-				middlewares: middlewareFor("storage", [attach, liveProject.middleware])
-			}),
-			context: {
-				baseUrl,
-				stack: createStack({
-					stackInfo,
-					clientServiceUrls
-				}),
-				defaultBranch: fetched.defaultBranch,
-				get project() {
-					return liveProject.getProject();
-				},
-				get st() {
-					return storageTableStore.get();
-				}
-			}
-		};
-	};
-	const build = (project) => {
-		const attach = attachFor(project);
-		const live = once(() => buildLive(project, attach));
-		const clients = once(() => buildClients(project, attach));
-		const sdk = once(() => createSdk({
-			storage: live().storage,
-			services: clients().client,
-			context: live().context
-		}));
-		return {
-			api: buildApi(project),
-			get clients() {
-				return clients();
-			},
-			get storage() {
-				return live().storage;
-			},
-			get context() {
-				return live().context;
-			},
-			get sdk() {
-				return sdk();
+			api: new Proxy({}, { get: (_target, property) => {
+				if (isBuiltInProperty(property)) return void 0;
+				if (property === "baseUrl") return project.baseUrl;
+				if (!isLive) throw new KeboolaError(KeboolaErrorType.SignInEnded);
+				require_transientRetries.Result.unwrap(state.auth.requireCredential(project.baseUrl));
+				if (property === "stack" || property === "auth" || property === "management") return stack.get(project.baseUrl)[property];
+				if (property === "storage") return storage;
+				if (property === "sdk") return sdk;
+				if (property === "serviceMeta") return meta;
+				return client[property];
+			} }),
+			end: () => {
+				isLive = false;
 			}
 		};
 	};
 	const derived = /* @__PURE__ */ new Map();
-	const get = (project) => ensure(derived, project.id, () => build(project));
-	/** One project, closed on purpose — a handle for it stops answering from the next read. */
-	const forget = (id) => {
-		derived.delete(id);
-		context.forget(id);
-	};
+	const get = (project) => ensure(derived, projectKey(project), () => build(project)).api;
 	const forgetUnder = (baseUrl) => {
-		const isUnder = Entry.isUnderStack(baseUrl);
-		for (const id of derived.keys()) if (isUnder(id)) derived.delete(id);
-		context.forgetUnder(baseUrl);
+		for (const [key, record] of derived) {
+			if (!key.startsWith(`${baseUrl}#`)) continue;
+			record.end();
+			derived.delete(key);
+		}
 	};
 	return {
-		context,
 		get,
-		forget,
 		forgetUnder
 	};
 };
-//#endregion
-//#region src/keboola/bearer/persistor.ts
+// src/keboola/bearer/persistor.ts
 /**
 * Where a bearer session is persisted, under whichever adapter the client was given.
 *
@@ -2074,17 +1452,23 @@ const persistedGrantSchema = zod.discriminatedUnion("type", [zod.object({
 	type: zod.literal("cookie"),
 	sessionId: zod.string()
 })]);
-/** A record per project rather than a bare id, so a project can grow a field without a migration. */
-const persistedProjectSchema = zod.object({ projectId: zod.number() });
 const persistedStackSchema = zod.object({
 	baseUrl: zod.string(),
 	credential: persistedGrantSchema.nullable().catch(null),
 	retained: zod.object({ grant: persistedGrantSchema }).nullable().default(null).catch(null),
-	projects: zod.array(persistedProjectSchema)
+	/**
+	* Written empty, never read.
+	* - An older build parses a stack without it as corrupt, and signs out.
+	*/
+	projects: zod.array(zod.unknown())
 });
 const persistedSessionSchema = zod.object({
 	current: zod.object({
 		baseUrl: zod.string(),
+		/**
+		* Written `null`, never read: the project is the app's to keep.
+		* - An older build parses a `current` without it as corrupt, and signs out.
+		*/
 		projectId: zod.number().nullable()
 	}).nullable(),
 	stacks: zod.array(persistedStackSchema)
@@ -2093,22 +1477,21 @@ const EMPTY_PERSISTED_SESSION = {
 	current: null,
 	stacks: []
 };
-const projectsOf = (projects, baseUrl) => Object.values(projects).filter((project) => project.baseUrl === baseUrl).map(({ projectId }) => ({ projectId }));
 const grantsOf = (stack) => ({
-	credential: stack.auth.status === "authenticated" ? Entry.grant(stack.auth.credential) : null,
+	credential: stack.auth.status === "authenticated" ? grantOf(stack.auth.credential) : null,
 	retained: stack.retained
 });
 /**
 * The stored session, rewritten from the table except for the grants.
 *
-* - Scope, stack list and open projects come from memory.
+* - Scope and stack list come from memory.
 * - `credential` and `retained` stay as stored: a grant another document rotated must not be put
 *   back by a snapshot of this one's older table.
 */
-const mergeSnapshot = (stored, { active, stacks, projects }) => ({
+const mergeSnapshot = (stored, { active, stacks }) => ({
 	current: {
-		baseUrl: active.baseUrl,
-		projectId: active.projectId
+		baseUrl: active,
+		projectId: null
 	},
 	stacks: Object.values(stacks).map(({ baseUrl }) => {
 		const kept = stored.stacks.find((stack) => stack.baseUrl === baseUrl);
@@ -2116,15 +1499,15 @@ const mergeSnapshot = (stored, { active, stacks, projects }) => ({
 			baseUrl,
 			credential: kept?.credential ?? null,
 			retained: kept?.retained ?? null,
-			projects: projectsOf(projects, baseUrl)
+			projects: []
 		};
 	})
 });
-const upsertStack = (stored, baseUrl, update) => {
-	const index = stored.stacks.findIndex((stack) => stack.baseUrl === baseUrl);
+const upsertStack = (stored, row) => {
+	const index = stored.stacks.findIndex((stack) => stack.baseUrl === row.baseUrl);
 	const stacks = [...stored.stacks];
-	if (index < 0) stacks.push(update(void 0));
-	else stacks[index] = update(stacks[index]);
+	if (index < 0) stacks.push(row);
+	else stacks[index] = row;
 	return {
 		...stored,
 		stacks
@@ -2145,14 +1528,14 @@ const createSessionPersistor = (storage) => {
 		schema: persistedSessionSchema,
 		defaultValue: EMPTY_PERSISTED_SESSION
 	});
-	const persistStack = (cell, baseUrl, { stacks, projects }) => {
+	const persistStack = (cell, baseUrl, { stacks }) => {
 		const stack = stacks[baseUrl];
 		if (stack === void 0) return Promise.resolve();
-		return cell.modify((stored) => upsertStack(stored, baseUrl, (existing) => ({
+		return cell.modify((stored) => upsertStack(stored, {
 			baseUrl,
 			...grantsOf(stack),
-			projects: existing?.projects ?? projectsOf(projects, baseUrl)
-		})));
+			projects: []
+		}));
 	};
 	const locked = (task) => persistor.locked((cell) => task({
 		read: cell.read,
@@ -2176,18 +1559,92 @@ const createSessionPersistor = (storage) => {
 		snapshot
 	};
 };
-//#endregion
-//#region src/keboola/bearer/perStack.ts
+// src/keboola/bearer/context.ts
+const STACK_INDEX_TIMEOUT_MS = 3e4;
+/**
+* One parsed stack index per stack; `createStack` applies the dev and production overrides.
+*
+* - One fetch per stack: concurrent askers share it, a landed index is never refetched.
+* - A failure is held until a retry; nothing here needs a rejection handler.
+* - Every status change is copied onto the stack's row, for the consumers that render it.
+*/
+const createStackContext = ({ state, clientServiceUrls }) => {
+	const entries = /* @__PURE__ */ new Map();
+	const set = (baseUrl, entry) => {
+		entries.set(baseUrl, entry);
+		state.stacks.updateContext(baseUrl, entry.status);
+	};
+	const fetchStack = async (baseUrl) => {
+		const stackInfo = await require_storage.createStorageClient({
+			baseUrl,
+			auth: {
+				type: "sapi-token",
+				token: ""
+			}
+		}).getStackInfo({ exclude: "componentDetails" }, AbortSignal.timeout(STACK_INDEX_TIMEOUT_MS));
+		return createStack({
+			stackInfo,
+			clientServiceUrls
+		});
+	};
+	const run = (baseUrl) => {
+		const settle = (next) => {
+			set(baseUrl, next);
+			return next;
+		};
+		const entry = {
+			status: "pending",
+			settled: fetchStack(baseUrl).then((value) => settle({
+				status: "ready",
+				value
+			}), (error) => settle({
+				status: "errored",
+				error
+			}))
+		};
+		set(baseUrl, entry);
+		return entry;
+	};
+	const get = (baseUrl) => {
+		const entry = entries.get(baseUrl);
+		return entry?.status === "ready" ? entry.value : null;
+	};
+	const getAsync = async (baseUrl) => {
+		const cached = entries.get(baseUrl);
+		const entry = cached === void 0 || cached.status === "errored" ? run(baseUrl) : cached;
+		const settled = entry.status === "pending" ? await entry.settled : entry;
+		if (settled.status === "errored") throw settled.error;
+		return settled.value;
+	};
+	const subscriber = ({ stacks }) => {
+		for (const { baseUrl } of Object.values(stacks)) if (!entries.has(baseUrl)) run(baseUrl);
+	};
+	return {
+		subscriber,
+		get,
+		getAsync
+	};
+};
+// src/keboola/bearer/perStack.ts
 /**
-* Everything one stack derives, and the one call that drops it.
+* Everything one stack derives.
 *
 * Outlives a sign-out, unlike anything in `perProject`: both clients read the credential live per
 * request, so neither belongs to one sign-in, and the stack index is public.
 */
-const createPerStack = ({ state, credentials, middlewareFor }) => {
-	const context = createStackContext(state);
+const createPerStack = ({ state, credentials, middlewareFor, clientServiceUrls }) => {
+	const context = createStackContext({
+		state,
+		clientServiceUrls
+	});
 	const derived = /* @__PURE__ */ new Map();
 	const get = (baseUrl) => ensure(derived, baseUrl, () => ({
+		baseUrl,
+		get stack() {
+			const parsed = context.get(baseUrl);
+			assert$1(parsed, KeboolaErrorType.NotReady);
+			return parsed;
+		},
 		auth: require_authClient.createAuthClient({
 			baseUrl,
 			middlewares: middlewareFor("auth", [credentials.middleware(baseUrl)])
@@ -2201,18 +1658,12 @@ const createPerStack = ({ state, credentials, middlewareFor }) => {
 			middlewares: middlewareFor("management", [credentials.middleware(baseUrl)])
 		})
 	}));
-	const forget = (baseUrl) => {
-		derived.delete(baseUrl);
-		context.forget(baseUrl);
-	};
 	return {
 		context,
-		get,
-		forget
+		get
 	};
 };
-//#endregion
-//#region src/keboola/bearer/keboola.ts
+// src/keboola/bearer/keboola.ts
 /**
 * The bearer client: the session table, its two scopes, and the surface they back.
 *
@@ -2232,65 +1683,41 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	const perStack = createPerStack({
 		state,
 		credentials,
-		middlewareFor
+		middlewareFor,
+		clientServiceUrls
 	});
 	const perProject = createPerProject({
 		state,
 		credentials,
 		middlewareFor,
-		stack: perStack,
-		clientServiceUrls,
-		buildApi: (project) => createApiFor({
-			stackUrl: () => project.baseUrl,
-			project: () => require_transientRetries.Result.unwrap(state.projects.get(project.id)),
-			pinned: true
-		})
+		stack: perStack
 	});
 	state.store.subscribe(perStack.context.subscriber);
 	perStack.context.subscriber(state.store.get());
-	state.store.subscribe(perProject.context.subscriber);
-	const selectStack = (baseUrl) => require_transientRetries.Result.unwrap(state.scope.selectStack(require_createFetchClient.normalizeBaseUrl(baseUrl)));
-	const selectProject = (projectId) => require_transientRetries.Result.unwrap(state.scope.selectProject(projectId));
-	/** The scoped stack, or a named one — normalised to key like `select`. */
-	const requireStackUrl = (baseUrl) => baseUrl === void 0 ? state.scope.getActiveStack().baseUrl : require_createFetchClient.normalizeBaseUrl(baseUrl);
-	/** The scoped project, or the row a table id names — on whichever stack that is. */
-	const requireProjectEntry = (id) => id === void 0 ? require_transientRetries.Result.unwrap(state.scope.requireActiveProject()) : require_transientRetries.Result.unwrap(state.projects.get(id));
+	const selectStack = (baseUrl) => state.stacks.select(require_createFetchClient.normalizeBaseUrl(baseUrl));
+	/** The active stack, or a named one — normalised to key like `select`. */
+	const requireStackUrl = (baseUrl) => baseUrl === void 0 ? state.stacks.getActive().baseUrl : require_createFetchClient.normalizeBaseUrl(baseUrl);
+	/** A project id is unique only within its stack: it always names one on the active stack. */
+	const onActiveStack = (projectId) => ({
+		baseUrl: requireStackUrl(),
+		projectId
+	});
 	/**
-	* The scoped project, or a named open one.
+	* Auth headers for a non-fetch transport (the chat stream), renewed first once near expiry.
 	*
-	* - An id is ambiguous across stacks: the active stack decides, else the single one open elsewhere.
+	* - No middleware recovers a 401 there.
+	* - Pinned to the stack active at the call: a stack switch mid-renewal does not re-point it.
+	* - Throws `NotAuthenticated` if that stack signed out meanwhile.
 	*/
-	const requireProject = (projectId) => {
-		if (projectId === void 0) return require_transientRetries.Result.unwrap(state.scope.requireActiveProject());
-		const scoped = state.projects.get(Entry.projectEntryId(requireStackUrl(), projectId));
-		if (scoped.success) return scoped.data;
-		const [only, ...rest] = state.projects.findAll(projectId);
-		return only !== void 0 && rest.length === 0 ? only : require_transientRetries.Result.unwrap(scoped);
-	};
-	const headersFor = (project) => {
-		const credential = require_transientRetries.Result.unwrap(state.auth.requireCredential(project.baseUrl));
+	const getAuthHeadersAsync = async (projectId) => {
+		const { baseUrl } = onActiveStack(projectId);
+		await credentials.renewIfStale(baseUrl);
+		const credential = require_transientRetries.Result.unwrap(state.auth.requireCredential(baseUrl));
 		return {
 			[require_createFetchClient.HttpHeader.AUTHORIZATION]: `Bearer ${credential.accessToken}`,
-			[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(project.projectId)
+			[require_createFetchClient.KeboolaHttpHeader.PROJECT_ID]: String(projectId)
 		};
 	};
-	/**
-	* Auth headers for a non-fetch transport (the chat stream).
-	*
-	* - A read, not a rotation: no middleware recovers a 401 there; the fetch clients keep it fresh.
-	*/
-	const getAuthHeaders = (projectId) => headersFor(requireProject(projectId));
-	/**
-	* `getAuthHeaders`, with the token renewed first once it nears expiry.
-	*
-	* - Pinned to the project resolved at the call: a scope move during the renewal does not re-point it.
-	* - Throws like the read if that project closed, or its stack signed out, meanwhile.
-	*/
-	const getAuthHeadersAsync = async (projectId) => {
-		const project = requireProject(projectId);
-		await credentials.renewIfStale(project.baseUrl);
-		return headersFor(require_transientRetries.Result.unwrap(state.projects.get(project.id)));
-	};
 	const toCredential = (input) => {
 		if (input.type !== "token") return input;
 		const { refreshToken } = input;
@@ -2301,51 +1728,30 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		};
 	};
 	const authenticate = (input) => {
-		const { baseUrl } = state.scope.getActiveStack();
+		const { baseUrl } = state.stacks.getActive();
 		const signedIn = require_transientRetries.Result.unwrap(state.auth.authenticate(baseUrl, toCredential(input)));
 		persistor.locked((store) => store.persistStack(baseUrl, state.store.get())).catch((error) => {
 			console.warn("createKeboola: the sign-in could not be stored", error);
 		});
 		return signedIn;
 	};
-	/**
-	* The flat product surface: `auth` and `management` per stack, the rest per project.
-	*
-	* - Both resolvers run per property read: that re-points the active handle and makes a pinned
-	*   one throw once its project is gone.
-	*/
-	const createApiFor = (resolve) => new Proxy({}, { get: (_target, property) => {
-		if (isBuiltInProperty(property)) return void 0;
-		if (property === "auth" || property === "management") {
-			if (resolve.pinned) resolve.project();
-			return perStack.get(resolve.stackUrl())[property];
+	const active = () => perStack.get(state.stacks.getActive().baseUrl);
+	const stackApi = {
+		get baseUrl() {
+			return active().baseUrl;
+		},
+		get stack() {
+			return active().stack;
+		},
+		get auth() {
+			return active().auth;
+		},
+		get management() {
+			return active().management;
 		}
-		const derived = perProject.get(resolve.project());
-		if (property === "context") return derived.context;
-		if (property === "storage") return derived.storage;
-		if (property === "sdk") return derived.sdk;
-		const { client, meta } = derived.clients;
-		if (property === "serviceMeta") return meta;
-		return client[property];
-	} });
-	const activeApi = createApiFor({
-		stackUrl: () => state.scope.getActiveStack().baseUrl,
-		project: () => require_transientRetries.Result.unwrap(state.scope.requireActiveProject())
-	});
-	/** The scoped project's surface. Re-points when the scope moves. */
-	const getActiveApi = () => activeApi;
-	/**
-	* One project's surface, on the active stack — one credential serves all of them.
-	*
-	* - Pinned: never re-points; stops once the project closes (`session.project.close`, sign-out).
-	* - Memoised per project: a React `key` or a hook dep compares handles by identity.
-	*/
-	const getApi = (projectId) => {
-		const { baseUrl } = state.scope.getActiveStack();
-		const project = Entry.project(baseUrl, projectId);
-		require_transientRetries.Result.unwrapOr(state.projects.open(baseUrl, projectId), null);
-		return perProject.get(project).api;
 	};
+	const getStackApi = () => stackApi;
+	const getProjectApi = (projectId) => perProject.get(onActiveStack(projectId));
 	/**
 	* The scope's sign-in, or a named stack's — and everything that sign-in derived.
 	*
@@ -2371,28 +1777,6 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		signOut();
 		return authenticate(input);
 	};
-	/**
-	* Leave one project: its row and everything built for it; its handles stop answering.
-	*
-	* - Counterpart of `getApi(projectId)`; without it the project is held and persisted until sign-out.
-	*/
-	const closeProject = (projectId) => {
-		const id = Entry.projectEntryId(requireStackUrl(), projectId);
-		const closed = require_transientRetries.Result.unwrapOr(state.projects.close(id), null);
-		if (closed === null) return null;
-		perProject.forget(id);
-		return closed;
-	};
-	const closeStack = (baseUrl) => {
-		const target = require_createFetchClient.normalizeBaseUrl(baseUrl);
-		if (state.scope.get().baseUrl === target) throw new KeboolaError(KeboolaErrorType.StackActive);
-		const closed = require_transientRetries.Result.unwrapOr(state.stacks.close(target), null);
-		if (closed === null) return null;
-		perProject.forgetUnder(target);
-		perStack.forget(target);
-		credentials.forget(target);
-		return closed;
-	};
 	let persisting = false;
 	/**
 	* Persistence starts only once the restore has settled.
@@ -2434,12 +1818,12 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		enablePersistenceOnSignIn();
 		throw error;
 	}));
-	const getActiveStack = state.scope.getActiveStack;
+	const getActiveStack = state.stacks.getActive;
 	const isAuthenticated = () => getActiveStack().auth.status === "authenticated";
 	/**
 	* Picks up where the stored session left off, once.
 	*
-	* 1. A stored stack becomes active again, with its project if its credential came back.
+	* 1. The stored stack becomes active again.
 	* 2. Nothing stored, or the restore failed: `defaultBaseUrl` stays active; a failure rethrows.
 	* 3. The caller got there first (a select, sign-in or sign-out): its scope and sign-ins stand.
 	*
@@ -2447,9 +1831,7 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 	* - Other stacks still come back, persistence still starts; repeat calls share one promise.
 	*/
 	const resume = require_transientRetries.lazy(() => restore().then(({ lastActive, status }) => {
-		if (!lastActive || callerScoped) return status;
-		const stack = selectStack(lastActive.baseUrl);
-		if (lastActive.projectId !== null && stack.auth.status === "authenticated") selectProject(lastActive.projectId);
+		if (lastActive && !callerScoped) selectStack(lastActive.baseUrl);
 		return status;
 	}));
 	let callerScoped = false;
@@ -2458,8 +1840,8 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 		return verb(...args);
 	};
 	return {
-		getActiveApi,
-		getApi,
+		getStackApi,
+		getProjectApi,
 		session: {
 			getState: state.store.get,
 			subscribe: state.store.subscribe,
@@ -2471,23 +1853,9 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 					const stack = selectStack(baseUrl);
 					return persistScope().then(() => stack);
 				}),
-				close: closeStack,
-				retryContext: perStack.context.retry,
 				getContext: (baseUrl) => perStack.context.get(requireStackUrl(baseUrl)),
 				getContextAsync: (baseUrl) => perStack.context.getAsync(requireStackUrl(baseUrl))
 			},
-			project: {
-				/** Scoped on return; resolves once that is stored, for a caller leaving the document. */
-				select: byCaller((projectId) => {
-					const project = selectProject(projectId);
-					return persistScope().then(() => project);
-				}),
-				close: closeProject,
-				deactivate: state.scope.deactivate,
-				retryContext: perProject.context.retry,
-				getContext: (id) => perProject.context.get(id ?? requireProjectEntry().id),
-				getContextAsync: (id) => perProject.context.getAsync(requireProjectEntry(id))
-			},
 			auth: {
 				authenticate: byCaller(authenticate),
 				replace: byCaller(replace),
@@ -2496,15 +1864,12 @@ const createKeboola = ({ defaultBaseUrl, storage, middlewares, clientServiceUrls
 				/** Whether the active stack holds a credential — `restoring` is not one yet. */
 				isAuthenticated,
 				isAuthenticatedAsync: () => resume().then(isAuthenticated),
-				rotate: (baseUrl) => credentials.rotate(baseUrl).then(require_transientRetries.Result.unwrap),
-				getHeaders: getAuthHeaders,
 				getHeadersAsync: getAuthHeadersAsync
 			}
 		}
 	};
 };
-//#endregion
-//#region src/middlewares/loggingMiddleware.ts
+// src/middlewares/loggingMiddleware.ts
 const CORRELATION_ID_HEADER = "X-Correlation-ID";
 const ALWAYS_REDACTED_HEADERS = [...require_createFetchClient.CREDENTIAL_HEADERS, "set-cookie"];
 const ALWAYS_REDACTED_QUERY_PARAMS = /* @__PURE__ */ new Set([
@@ -2622,8 +1987,7 @@ const createLoggingMiddleware = (options = {}) => {
 		}
 	};
 };
-//#endregion
-//#region src/middlewares/retryMiddleware.ts
+// src/middlewares/retryMiddleware.ts
 const DEFAULT_MAX_RETRIES = 5;
 const DEFAULT_RETRYABLE_STATUSES = [
 	require_createFetchClient.HttpStatus.INTERNAL_SERVER_ERROR,
@@ -2651,8 +2015,7 @@ const createRetryMiddleware = (options) => {
 		throw new Error("unreachable");
 	};
 };
-//#endregion
-//#region src/middlewares/uiVersionMiddleware.ts
+// src/middlewares/uiVersionMiddleware.ts
 /** Stamps `X-KBC-Ui-Version`; an empty `uiVersion` sends no header. */
 const createUiVersionMiddleware = (uiVersion) => {
 	if (!uiVersion) return (next) => next;
@@ -2661,8 +2024,7 @@ const createUiVersionMiddleware = (uiVersion) => {
 		return next(request);
 	};
 };
-//#endregion
-//#region src/domain/adminAccount.ts
+// src/domain/adminAccount.ts
 /**
 * The admin behind a Manage token: `GET /manage/tokens/verify`, with the admin-level helpers.
 *
@@ -2685,7 +2047,22 @@ const createAdminAccount = ({ managementToken }) => {
 		managementToken
 	};
 };
-//#endregion
+// src/domain/defaultBranch.ts
+const createDefaultBranch = ({ devBranches }) => {
+	const defaultBranch = devBranches.find((branch) => branch.isDefault);
+	assert(defaultBranch, "No default branch found for the project.");
+	const getType = (branchId) => {
+		if (branchId == null || branchId === "default") return "default";
+		return Number(branchId) === defaultBranch.id ? "default" : "dev";
+	};
+	return {
+		id: defaultBranch.id,
+		name: defaultBranch.name,
+		getType,
+		isDev: (branchId) => getType(branchId) === "dev",
+		isDefault: (branchId) => getType(branchId) === "default"
+	};
+};
 exports.ApiError = require_createFetchClient.ApiError;
 exports.HtmlResponseError = require_validateConnectionStatus.HtmlResponseError;
 exports.HttpContentType = require_createFetchClient.HttpContentType;
@@ -2711,6 +2088,7 @@ exports.collectByCursor = require_authClient.collectByCursor;
 exports.collectByOffset = require_collectByOffset.collectByOffset;
 exports.concurrent = require_concurrent.concurrent;
 exports.createAdminAccount = createAdminAccount;
+exports.createDefaultBranch = createDefaultBranch;
 exports.createDerivedAsyncStore = createDerivedAsyncStore;
 exports.createDerivedStore = createDerivedStore;
 exports.createEmitter = require_store.createEmitter;
@@ -2723,6 +2101,7 @@ exports.createMemoryStorage = createMemoryStorage;
 exports.createNullStorage = createNullStorage;
 exports.createPersistor = createPersistor;
 exports.createPollRegistry = createPollRegistry;
+exports.createProject = require_project.createProject;
 exports.createQueryServiceSdk = require_sdk_queryService_index.createQueryServiceSdk;
 exports.createRetryMiddleware = createRetryMiddleware;
 exports.createSessionStorage = createSessionStorage;
@@ -2738,30 +2117,32 @@ exports.formatValidationIssues = require_ValidationError.formatValidationIssues;
 exports.generateUUID = require_generateUUID.generateUUID;
 exports.isAbortError = require_createFetchClient.isAbortError;
 exports.isApiError = require_createFetchClient.isApiError;
-exports.isEmptyDeep = require_configurations.isEmptyDeep;
+exports.isEmptyDeep = require_schemaGuidedMerge.isEmptyDeep;
 exports.isFetchClientError = require_createFetchClient.isFetchClientError;
 exports.isHtmlResponseError = require_validateConnectionStatus.isHtmlResponseError;
 exports.isKeboolaError = isKeboolaError;
+exports.isManageError = require_storage.isManageError;
 exports.isManagementClientAuthError = require_management.isManagementClientAuthError;
 exports.isManagementSessionMintError = require_management.isManagementSessionMintError;
 exports.isPlainObject = require_isPlainObject.isPlainObject;
 exports.isQueryJobError = require_QueryJobError.isQueryJobError;
 exports.isQueueJobError = require_QueueJobError.isQueueJobError;
 exports.isStorageJobError = require_storage.isStorageJobError;
-exports.isStorageTokenMutatingRequest = isStorageTokenMutatingRequest;
 exports.isSyncActionError = require_SyncActionError.isSyncActionError;
 exports.isTimeoutError = require_createFetchClient.isTimeoutError;
 exports.isValidationError = require_ValidationError.isValidationError;
 exports.jobStatus = require_transientRetries.jobStatus;
 exports.keboolaUID = require_tag.keboolaUID;
 exports.lazy = require_transientRetries.lazy;
+exports.manageErrorCode = require_storage.manageErrorCode;
 exports.nextCursorOf = require_authClient.nextCursorOf;
 exports.parseLogLines = require_appLogs.parseLogLines;
 exports.parseOrThrow = require_ValidationError.parseOrThrow;
 exports.poller = require_transientRetries.poller;
 exports.queueSeries = queueSeries;
 exports.readableReason = require_storage.readableReason;
-exports.schemaGuidedMerge = require_configurations.schemaGuidedMerge;
+exports.retryAfterSeconds = require_storage.retryAfterSeconds;
+exports.schemaGuidedMerge = require_schemaGuidedMerge.schemaGuidedMerge;
 exports.series = require_storage.series;
 exports.shallowEqual = shallowEqual;