@cosmicdrift/kumiko-dispatcher-live 0.105.2 → 0.109.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dispatcher-live",
-  "version": "0.105.2",
+  "version": "0.109.0",
   "description": "HTTP-only Dispatcher for Kumiko UIs. Always-online; failures surface immediately. Default client for web admin/cockpit apps.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -24,7 +24,7 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-headless": "0.105.2"
+    "@cosmicdrift/kumiko-headless": "0.109.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/__tests__/dispatcher-live.test.ts

@@ -46,7 +46,10 @@ describe("createLiveDispatcher", () => {
     expect(headers["Content-Type"]).toBe("application/json");
     expect(headers["X-CSRF-Token"]).toBe("csrf-abc");
     const body = JSON.parse(call?.init.body as string);
-    expect(body).toEqual({ type: "app:write:task:create", payload: { title: "hello" } });
+    expect(body).toMatchObject({ type: "app:write:task:create", payload: { title: "hello" } });
+    // Auto-generated idempotency key (#761) — always present.
+    expect(typeof body.requestId).toBe("string");
+    expect(body.requestId.length).toBeGreaterThan(8);
   });
 
   test("write: propagates requestId into body when provided", async () => {
@@ -59,6 +62,43 @@ describe("createLiveDispatcher", () => {
     expect(body.requestId).toBe("idem-99");
   });
 
+  test("write: generates a fresh requestId per invocation when none provided (#761)", async () => {
+    const { fetch, calls } = makeFetch({ body: { isSuccess: true, data: {} } });
+    const disp = createLiveDispatcher({ fetch, readCsrf: () => "t" });
+
+    await disp.write("app:write:x:create", { a: 1 });
+    await disp.write("app:write:x:create", { a: 1 });
+
+    const first = JSON.parse(calls[0]?.init.body as string).requestId;
+    const second = JSON.parse(calls[1]?.init.body as string).requestId;
+    expect(typeof first).toBe("string");
+    expect(typeof second).toBe("string");
+    expect(first).not.toBe(second);
+  });
+
+  test("batch: generates one requestId for the whole batch when none provided (#761)", async () => {
+    const { fetch, calls } = makeFetch({ body: { isSuccess: true, results: [] } });
+    const disp = createLiveDispatcher({ fetch, readCsrf: () => "t" });
+
+    await disp.batch([
+      { type: "a", payload: {} },
+      { type: "b", payload: {} },
+    ]);
+
+    const body = JSON.parse(calls[0]?.init.body as string);
+    expect(typeof body.requestId).toBe("string");
+  });
+
+  test("batch: propagates an explicit requestId (#761)", async () => {
+    const { fetch, calls } = makeFetch({ body: { isSuccess: true, results: [] } });
+    const disp = createLiveDispatcher({ fetch, readCsrf: () => "t" });
+
+    await disp.batch([{ type: "a", payload: {} }], { requestId: "batch-7" });
+
+    const body = JSON.parse(calls[0]?.init.body as string);
+    expect(body.requestId).toBe("batch-7");
+  });
+
   test("write: no CSRF token → header omitted, request still fires (server will 401/csrf-mismatch)", async () => {
     const { fetch, calls } = makeFetch({ body: { isSuccess: true, data: {} } });
     const disp = createLiveDispatcher({ fetch, readCsrf: () => undefined });

package/src/dispatcher-live.ts

@@ -154,7 +154,11 @@ export function createLiveDispatcher(options: LiveDispatcherOptions = {}): Dispa
       opts?: WriteOpts,
     ): Promise<WriteResult<TData>> {
       const body: Record<string, unknown> = { type, payload };
-      if (opts?.requestId) body["requestId"] = opts.requestId;
+      // Idempotency by default (#761): without a requestId the server-side
+      // dedup never engages and a transport-level double-send duplicates
+      // events. Callers with a logical-submit id (savable queue, form
+      // controllers) pass their own and keep it across their retries.
+      body["requestId"] = opts?.requestId ?? generateRequestId();
       const call = await callJson(PATH_WRITE, body, opts?.signal);
       return normalizeWriteResult<TData>(call);
     },
@@ -171,7 +175,10 @@ export function createLiveDispatcher(options: LiveDispatcherOptions = {}): Dispa
 
     async batch(commands: readonly Command[], opts?: WriteOpts): Promise<BatchResult> {
       const body: Record<string, unknown> = { commands };
-      if (opts?.requestId) body["requestId"] = opts.requestId;
+      // One id for the whole batch — the server caches the BatchResult
+      // under it, so a retried batch returns the cached outcome instead of
+      // re-executing the commands (#761).
+      body["requestId"] = opts?.requestId ?? generateRequestId();
       const call = await callJson(PATH_BATCH, body, opts?.signal);
       return normalizeBatchResponse(call);
     },
@@ -189,6 +196,16 @@ export function createLiveDispatcher(options: LiveDispatcherOptions = {}): Dispa
 const EMPTY_PENDING_WRITES: readonly PendingWrite[] = Object.freeze([]);
 const EMPTY_PENDING_FILES: readonly PendingFile[] = Object.freeze([]);
 
+// crypto.randomUUID where available (browser, Bun, Node); Math.random
+// fallback for React-Native runtimes without the WebCrypto polyfill.
+// Uniqueness only needs to hold per user within the server's dedup window —
+// this is an idempotency key, not a security token.
+function generateRequestId(): string {
+  const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto;
+  if (typeof c?.randomUUID === "function") return c.randomUUID();
+  return `req-${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+}
+
 type CallOutcome =
   | { readonly ok: true; readonly body: unknown; readonly status: number }
   | { readonly ok: false; readonly networkFailure: DispatcherError };