@arcforgelabs/flow 2026.10.39 → 2026.10.40

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.39",
+  "version": "2026.10.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arcforgelabs/flow",
-      "version": "2026.10.39",
+      "version": "2026.10.40",
       "license": "MIT",
       "dependencies": {
         "@clerk/backend": "3.25.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.39",
+  "version": "2026.10.40",
   "description": "Invoicing, bill entry and a financial dashboard for labs, with Seazona and Xero integrations.",
   "license": "MIT",
   "repository": {

package/server/integrations/call-guard.js

@@ -9,7 +9,10 @@ import { sql } from 'drizzle-orm';
 //   - a refused credential halts every call until a person acts (saves the
 //     settings or connects again, which calls resume());
 //   - a 401 or 403 on one resource, when the adapter's auth failures stop a
-//     resource only, stops that resource until a person acts;
+//     resource only, stops that resource; after `resourceRetryMs` one probe
+//     call may go, and a refused probe stops it again for twice as long, to
+//     at most `maxResourceRetryMs`. A good call, or a person connecting
+//     again, starts it again;
 //   - `circuitFailures` failed calls inside `circuitWindowMs` open the
 //     circuit: no call for `circuitPauseMs`, then a probe; a failed probe opens
 //     it again for twice as long, to at most `maxCircuitPauseMs`, and a
@@ -34,6 +37,8 @@ export const CALL_GUARD_POLICY = Object.freeze({
   // 'all': a 401 or 403 halts every call. 'resource': it stops only the
   // resource it came from; halt() still stops everything.
   authStops: 'all',
+  resourceRetryMs: 6 * 60 * 60_000,
+  maxResourceRetryMs: 24 * 60 * 60_000,
   telemetryRetentionMs: 35 * 24 * 60 * 60_000,
 });
 
@@ -68,12 +73,31 @@ export function circuitPauseMs(opens, policy = CALL_GUARD_POLICY) {
   return Math.min(policy.maxCircuitPauseMs, policy.circuitPauseMs * 2 ** Math.min(Math.max(0, opens), 10));
 }
 
+// The wait before the next probe of a stopped resource, after `probes`
+// refused probes.
+export function resourceRetryMs(probes, policy = CALL_GUARD_POLICY) {
+  return Math.min(policy.maxResourceRetryMs, policy.resourceRetryMs * 2 ** Math.min(Math.max(0, probes), 10));
+}
+
+// When a stopped resource may be probed again (ms). An entry written before
+// probes existed has no `retryAt`: it is due `resourceRetryMs` after `at`.
+export function resourceRetryAt(entry, policy = CALL_GUARD_POLICY) {
+  const due = entry?.retryAt ? new Date(entry.retryAt).getTime() : NaN;
+  if (Number.isFinite(due)) return due;
+  const at = entry?.at ? new Date(entry.at).getTime() : NaN;
+  return Number.isFinite(at) ? at + resourceRetryMs(0, policy) : Infinity;
+}
+
 // Why no call may go now, or null. `state` is the guard row
 // ({ haltedReason, circuitOpenUntil, stoppedResources }); `failedToday`
 // counts failed calls since the start of the UTC day.
 export function stoppedReason(state, { nowMs, failedToday, resource = null }, policy = CALL_GUARD_POLICY) {
   if (state?.haltedReason) return { reason: 'halted', retryAfterMs: null };
-  if (resource && state?.stoppedResources?.[resource]) return { reason: 'resource_stopped', retryAfterMs: null, resource };
+  const entry = resource ? state?.stoppedResources?.[resource] : null;
+  if (entry) {
+    const due = resourceRetryAt(entry, policy);
+    if (due > nowMs) return { reason: 'resource_stopped', retryAfterMs: due - nowMs, resource };
+  }
   const openUntil = state?.circuitOpenUntil ? new Date(state.circuitOpenUntil).getTime() : 0;
   if (openUntil > nowMs) return { reason: 'circuit_open', retryAfterMs: openUntil - nowMs };
   const dayStart = startOfUtcDay(nowMs);
@@ -95,7 +119,7 @@ export function circuitAfterFailure(state, { nowMs, recentFailures }, policy = C
 
 const STOP_TEXT = {
   halted: (name) => `${name} calls are stopped until a person checks the connection (it was refused)`,
-  resource_stopped: (name, resource) => `${name} calls to ${resource} are stopped until a person checks the connection (they were refused)`,
+  resource_stopped: (name, resource) => `${name} calls to ${resource} are stopped (they were refused); Flow tries again later by itself`,
   circuit_open: (name) => `${name} calls are paused after repeated failures`,
   budget_spent: (name) => `${name} calls are stopped for today: the day's failed calls are spent`,
 };
@@ -138,12 +162,14 @@ export function guardAlerts(name, status, { fix = 'Check the connection, then co
       members: [`halted:${status.haltedAt ?? ''}`],
     });
   }
+  // One refused resource is a warning, not a stop: every other call still
+  // goes, and Flow probes the resource again by itself.
   const resources = status?.stoppedResources ?? [];
   if (resources.length) {
     alerts.push({
       id: 'resources-stopped',
-      tone: 'danger',
-      title: `${name} refused Flow for ${resources.map((r) => r.resource).join(', ')}. Flow stopped those calls. ${fix}`,
+      tone: 'warn',
+      title: `${name} refused Flow for ${resources.map((r) => r.resource).join(', ')}. Other ${name} calls still work. Flow tries again by itself. To fix it now, connect again.`,
       members: resources.map((r) => `${r.resource}:${r.at ?? ''}`),
     });
   }
@@ -233,7 +259,8 @@ export function createCallGuard({
   }
 
   // Records how one call ended, and what that does to the guard. Answers
-  // what this call stopped ({ halted, resourceStopped, opened, budgetSpent }),
+  // what this call changed ({ halted, resourceStopped, resourceStillStopped,
+  // resourceResumed, opened, closed, budgetSpent }),
   // each of which was just reported once. `callId` names a call row the
   // adapter wrote when it admitted the call: that row is updated, not added.
   async function record(rawKey, { callId = null, resource = null, path = null, statusCode = null, failureKind = null, durationMs = null } = {}) {
@@ -256,22 +283,35 @@ export function createCallGuard({
       }
       const state = await readState(tx, key);
       if (!countsAsFailure({ statusCode: status, failureKind })) {
+        const result = {};
+        // A good probe: the resource is allowed again.
+        if (where && state.stoppedResources[where] && status !== null && status < 400) {
+          await tx.execute(sql`update ${T.state} set stopped_resources = stopped_resources - ${where}, updated_at = ${nowAt} where ${C.key} = ${key}`);
+          result.resourceResumed = where;
+        }
         if (state.circuitOpens > 0) {
           await tx.execute(sql`update ${T.state} set circuit_opens = 0, updated_at = ${nowAt} where ${C.key} = ${key}`);
-          return { closed: true };
+          result.closed = true;
         }
-        return {};
+        return result;
       }
       const result = {};
       const dayStart = startOfUtcDay(nowMs);
       if (await failuresSince(tx, key, dayStart) === policy.dailyFailureBudget) result.budgetSpent = { until: new Date(dayStart + DAY_MS).toISOString() };
       if (isAuthRefusal(status)) {
         if (policy.authStops === 'resource' && where) {
-          if (!state.stoppedResources[where]) {
-            await tx.execute(sql`update ${T.state} set stopped_resources = stopped_resources || ${JSON.stringify({ [where]: { statusCode: status, at: nowAt.toISOString() } })}::jsonb,
-              updated_at = ${nowAt} where ${C.key} = ${key}`);
-            result.resourceStopped = where;
-          }
+          const before = state.stoppedResources[where];
+          const probes = before ? (Number(before.probes) || 0) + 1 : 0;
+          const entry = {
+            statusCode: status,
+            at: before?.at ?? nowAt.toISOString(),
+            probes,
+            retryAt: new Date(nowMs + resourceRetryMs(probes, policy)).toISOString(),
+          };
+          await tx.execute(sql`update ${T.state} set stopped_resources = stopped_resources || ${JSON.stringify({ [where]: entry })}::jsonb,
+            updated_at = ${nowAt} where ${C.key} = ${key}`);
+          if (before) result.resourceStillStopped = { resource: where, retryAt: entry.retryAt };
+          else result.resourceStopped = where;
           return result;
         }
         if (!state.haltedReason) {
@@ -301,7 +341,9 @@ export function createCallGuard({
     if (!reports) return;
     const cause = status ? `HTTP ${status}` : failureKind;
     if (outcome.halted) log.error?.(`${tag} ${name} refused the connection (${cause}). Calls are stopped until a person checks the ${name} settings or connects again.`);
-    if (outcome.resourceStopped) log.error?.(`${tag} ${name} refused calls to ${where} (${cause}). Calls to ${where} are stopped until a person checks the connection.`);
+    if (outcome.resourceStopped) log.error?.(`${tag} ${name} refused calls to ${where} (${cause}). Calls to ${where} are stopped; Flow tries again by itself, or a person connects again.`);
+    if (outcome.resourceStillStopped) log.warn?.(`${tag} ${name} still refuses calls to ${where} (${cause}). Flow tries again at ${outcome.resourceStillStopped.retryAt}.`);
+    if (outcome.resourceResumed) log.info?.(`${tag} ${name} allows calls to ${outcome.resourceResumed} again.`);
     if (outcome.opened) {
       const line = `${tag} ${name} calls failed repeatedly (last: ${cause}${where ? ` on ${where}` : ''}). Calls pause until ${outcome.opened.until}.`;
       if (outcome.opened.opens === 1) log.error?.(line);
@@ -352,7 +394,7 @@ export function createCallGuard({
       circuitOpenUntil: openUntil > nowMs ? iso(openUntil) : null,
       haltedReason: state.haltedReason,
       haltedAt: iso(state.haltedAt),
-      stoppedResources: Object.entries(state.stoppedResources).map(([resource, entry]) => ({ resource, ...entry })),
+      stoppedResources: Object.entries(state.stoppedResources).map(([resource, entry]) => ({ resource, ...entry, retryAt: Number.isFinite(resourceRetryAt(entry, policy)) ? iso(resourceRetryAt(entry, policy)) : null })),
       failedToday: await failuresSince(db, key, startOfUtcDay(nowMs)),
       dailyFailureBudget: policy.dailyFailureBudget,
     };

package/server/integrations/xero/settings.js

@@ -27,7 +27,8 @@ export const XERO_ENDPOINTS = Object.freeze({
 });
 
 export const XERO_CALLBACK_PATH = '/api/xero/oauth/callback';
-export const DEFAULT_XERO_SCOPE = 'offline_access accounting.contacts accounting.invoices accounting.settings.read';
+// accounting.payments.read: Flow reads payments back (ledger.js, mirror.js).
+export const DEFAULT_XERO_SCOPE = 'offline_access accounting.contacts accounting.invoices accounting.payments.read accounting.settings.read';
 export const DEFAULT_XERO_DAY_LIMIT = 1000;
 export const DEFAULT_DUE_DAYS = 30;
 export const DEFAULT_MIRROR_PAGE_SIZE = 200;

package/server/ui/app.js

@@ -1001,16 +1001,20 @@ function xeroConnection(organisations, canChange) {
       let hint;
       let control = null;
       let stopped = false;
+      let refused = false;
       try {
         const status = await flow(`/api/xero/status?organisationId=${organisation.id}`);
         if (status.connected && status.calls?.stopped) {
           // A refused connection stopped calls (the call guard): say so, and
           // make Connect again the main button, which starts them again.
           const at = status.calls.since ? ` at ${new Date(status.calls.since).toLocaleString('en-AU', { dateStyle: 'medium', timeStyle: 'short' })}` : '';
+          // One refused resource stops only that resource, and Flow tries it
+          // again by itself: a calm note, not a stop.
           hint = status.calls.all
             ? `Xero refused Flow${at}. Flow stopped all calls.`
-            : `Xero refused Flow for ${status.calls.resources.join(', ')}${at}. Flow stopped those calls.`;
-          stopped = true;
+            : `Connected. Xero refused Flow for ${status.calls.resources.join(', ')}${at}. Other calls still work. Flow tries again by itself.`;
+          stopped = status.calls.all;
+          refused = !status.calls.all;
         } else if (status.connected) {
           const mirror = await flow(`/api/xero/mirror?organisationId=${organisation.id}`).catch(() => null);
           hint = `Connected to ${status.connection?.tenantName ?? 'Xero'}.${mirror ? ` ${mirror.counts.invoices} invoices copied.` : ''}`;
@@ -1018,7 +1022,7 @@ function xeroConnection(organisations, canChange) {
           hint = 'Not connected.';
         }
         if (canChange) {
-          control = h('button', { class: `fx-btn fx-btn--sm${status.connected && !stopped ? '' : ' fx-btn--primary'}`, type: 'button', onclick: async () => {
+          control = h('button', { class: `fx-btn fx-btn--sm${status.connected && !stopped && !refused ? '' : ' fx-btn--primary'}`, type: 'button', onclick: async () => {
             try {
               const { authorizeUrl } = await flow('/api/xero/connect', { method: 'POST', body: JSON.stringify({ organisationId: organisation.id }) });
               location.assign(authorizeUrl);

package/server/ui/monitoring.js

@@ -17,9 +17,10 @@ function loadScript({ src, integrity }) {
   });
 }
 
-// "Notify me": the form's email field (Sentry's own words) starts empty and
-// is optional. A person who types an address there asks to hear back; Flow
-// tags the report notify=yes, so the support desk sees it on the task.
+// "Notify me": the form's email field (Sentry's own words) starts with the
+// signed-in person's email. A report sent with an address asks to hear back;
+// Flow tags it notify=yes, so the support desk sees it on the task. A person
+// who clears the field sends notify=no.
 // Sentry's form has no tick box of its own; this keeps to its stock options.
 export function tagNotify(event) {
   if (event?.type !== 'feedback') return;
@@ -71,9 +72,8 @@ export async function startMonitoring({ flow, person }) {
     showBranding: false,
     // Flow already knows who is signed in (setUser below).
     showName: false,
-    // The email field is the opt-in (tagNotify), so it is not filled from
-    // the signed-in person: a key setUser never sets.
-    useSentryUser: { name: 'username', email: 'notify_email' },
+    // The form fills in the signed-in person's name and email (setUser).
+    useSentryUser: { name: 'username', email: 'email' },
     enableScreenshot: true,
     triggerLabel: 'Report a problem',
     formTitle: 'Report a problem',
@@ -102,16 +102,17 @@ export async function startMonitoring({ flow, person }) {
   });
   Sentry.getClient()?.on('beforeSendFeedback', tagNotify);
   // Who reported or met the error, so the lab can follow up.
-  Sentry.setUser({ id: person.id, email: person.email });
+  Sentry.setUser({ id: person.id, email: person.email, username: person.name || undefined });
   const feedback = config.feedback ? Sentry.getFeedback() : null;
   if (!feedback) return null;
-  // One form, made on first use and opened again after that.
+  // A new form each time. Sentry's form keeps a refused screenshot's error
+  // ("Permission denied by user") until the next click, so a reused form
+  // would show it before the person tries again.
   let form = null;
   return async () => {
-    if (!form) {
-      form = await feedback.createForm();
-      form.appendToDom();
-    }
+    form?.removeFromDom();
+    form = await feedback.createForm();
+    form.appendToDom();
     form.open();
   };
 }