@ethlete/query 6.0.0-next.4 → 6.0.0-next.40

package/CHANGELOG.md

@@ -1,5 +1,588 @@
 # @ethlete/query
 
+## 6.0.0-next.40
+
+### Minor Changes
+
+- [#3069](https://github.com/ethlete-io/ethdk/pull/3069) [`a9113cb`](https://github.com/ethlete-io/ethdk/commit/a9113cb6ce63942ffce0e26ca7df7f0556a14838) Thanks [@github-actions](https://github.com/apps/github-actions)! - The legacy `QueryStateType` and `AuthBearerRefreshStrategy` are const objects instead of
+  `const enum`s, so a transpile-only build can consume them.
+
+- [#3069](https://github.com/ethlete-io/ethdk/pull/3069) [`56e301f`](https://github.com/ethlete-io/ethdk/commit/56e301f6e3b455b1e7e2de54f101206bb890b557) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query: harden auth, caching, forms, GraphQL, WebSockets and legacy lifecycle behavior; add lifecycle-scoped form branches and secure host-only auth cookies.
+
+### Patch Changes
+
+- [#3069](https://github.com/ethlete-io/ethdk/pull/3069) [`0c324b0`](https://github.com/ethlete-io/ethdk/commit/0c324b0d765fb6a07ec9a5766638bd5b52006651) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: list a query's request headers in their own section, so a secure query's `Authorization` is readable however its args reached it.
+
+- [#3069](https://github.com/ethlete-io/ethdk/pull/3069) [`55736ec`](https://github.com/ethlete-io/ethdk/commit/55736ec21189efa86fd107043579fc4c65e4452e) Thanks [@github-actions](https://github.com/apps/github-actions)! - Correct reactive state mutability declarations across Query, Contentful and Query Devtools.
+
+## 6.0.0-next.39
+
+### Minor Changes
+
+- [`194e668`](https://github.com/ethlete-io/ethdk/commit/194e668efec08272b5a6fc82c16f1593b03d4584) Thanks [@TomTomB](https://github.com/TomTomB)! - Queries: omit response metadata from request args and expose retained responses on loading and failed execution states.
+
+### Patch Changes
+
+- [`a9bf390`](https://github.com/ethlete-io/ethdk/commit/a9bf390952d78d436bd23d33c86b57369a990fce) Thanks [@TomTomB](https://github.com/TomTomB)! - Auth multi-tab sync: a tab the browser froze now gives the leadership up instead of holding it while it refreshes nothing, and a follower whose token goes stale takes the refresh over when the leader does not answer.
+
+- [`4c97b3e`](https://github.com/ethlete-io/ethdk/commit/4c97b3e584aed96f905ec48e409f90ab8e334af8) Thanks [@TomTomB](https://github.com/TomTomB)! - The bearer auth leadership now follows the visible tab: a hidden leader gives way, and one that stopped running has the lock taken off it, so a sleeping tab no longer strands the others on a dead token.
+
+- [`78e46fa`](https://github.com/ethlete-io/ethdk/commit/78e46fa8643d37c11e13d3f50065dea29f5c3e46) Thanks [@TomTomB](https://github.com/TomTomB)! - `defineQueryForm().observe()` now merges the URL onto the form's live model, so a value written
+  before `observe()` survives and only the fields the URL names are overwritten.
+
+## 6.0.0-next.38
+
+### Minor Changes
+
+- [`9c64031`](https://github.com/ethlete-io/ethdk/commit/9c64031cb39f6ac9f5932cb32b31ab98742a9391) Thanks [@TomTomB](https://github.com/TomTomB)! - A query batch registers itself with the devtools, and each item's query is attributed to the run that
+  created it. Batch tombstones are capped per batch, so a bulk run cannot evict the others.
+
+- [`9c64031`](https://github.com/ethlete-io/ethdk/commit/9c64031cb39f6ac9f5932cb32b31ab98742a9391) Thanks [@TomTomB](https://github.com/TomTomB)! - A query batch reports `itemsPerSecond()` and `remainingTime()`, so a long bulk edit can show an ETA
+  next to its progress. Both are `null` until the run has settled enough items to measure.
+
+- [`9c64031`](https://github.com/ethlete-io/ethdk/commit/9c64031cb39f6ac9f5932cb32b31ab98742a9391) Thanks [@TomTomB](https://github.com/TomTomB)! - `createQueryBatch` runs one mutation over a list of items with bounded concurrency, a per-item
+  outcome and a `retryFailed()` that resends only what did not succeed.
+
+- [`3bc10d1`](https://github.com/ethlete-io/ethdk/commit/3bc10d12430def3315a17a3051b14624edc591cc) Thanks [@TomTomB](https://github.com/TomTomB)! - `createQuerySubmission` submits a signal form through a mutation, mapping a failed request's
+  violations back onto the fields that caused them.
+
+- [`5cb3e5e`](https://github.com/ethlete-io/ethdk/commit/5cb3e5e6ff61aea87dbca0481fbf48b8634183f6) Thanks [@TomTomB](https://github.com/TomTomB)! - `querySequence` now reports `completed()` and `progress()` (`0`-`100`), so a waterfall can drive a
+  progress bar or a determinate button spinner without deriving it from `currentStep()`.
+
+## 6.0.0-next.37
+
+### Minor Changes
+
+- [#3058](https://github.com/ethlete-io/ethdk/pull/3058) [`b6c106e`](https://github.com/ethlete-io/ethdk/commit/b6c106e17d8925fd881eb94974782e94ae03686d) Thanks [@github-actions](https://github.com/apps/github-actions)! - The Mocks tab seeds a body in a placeholder, realistic or stress value style, and `provideQueryDevtools({ schema })` takes one API description per query client.
+
+## 6.0.0-next.36
+
+### Patch Changes
+
+- [#3056](https://github.com/ethlete-io/ethdk/pull/3056) [`3595aa0`](https://github.com/ethlete-io/ethdk/commit/3595aa0e847afcd23b294027fc5daaceb8fcf0f2) Thanks [@github-actions](https://github.com/apps/github-actions)! - A tab that adopts its session from another tab now reports it as a token seed, so its secure queries and anything else waiting on a login no longer wait forever.
+
+## 6.0.0-next.35
+
+### Major Changes
+
+- [#3055](https://github.com/ethlete-io/ethdk/pull/3055) [`695c2e9`](https://github.com/ethlete-io/ethdk/commit/695c2e9d08f2e283816488938b446009acd4ad99) Thanks [@github-actions](https://github.com/apps/github-actions)! - `withArgs`: return `null` to park a query. `CLEAR_QUERY_ARGS` is removed, and `null` no longer means "keep the previous args".
+
+### Minor Changes
+
+- [`8e175ba`](https://github.com/ethlete-io/ethdk/commit/8e175bae730ea171a4f9e5727c9a5a4b4739f230) Thanks [@TomTomB](https://github.com/TomTomB)! - Retries: the default policy now backs off exponentially with jitter and gives up after
+  `maxAttempts` instead of retrying a connection failure every 5s forever, is configurable via
+  `withDefaultRetry({ … })` / `createDefaultRetryFn()`, and stops once the last consumer is gone.
+
+- [`bf291f9`](https://github.com/ethlete-io/ethdk/commit/bf291f95d69d1aa4c8e07952ad8b55432a921936) Thanks [@TomTomB](https://github.com/TomTomB)! - Add the `withLongPolling` query feature: each round starts once the previous one settled, with args derived from its response, and a failed round is repeated with a growing delay.
+
+### Patch Changes
+
+- [#3055](https://github.com/ethlete-io/ethdk/pull/3055) [`6776ec2`](https://github.com/ethlete-io/ethdk/commit/6776ec282ae9513d36fdfb199958728af083dc8f) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth multi-tab fixes: a follower no longer duplicates the leader's scheduled refresh, a joining tab
+  adopts the live session instead of auto-logging in, and a tab coming back to the foreground rechecks
+  a refresh its throttled timer missed.
+
+- [#3055](https://github.com/ethlete-io/ethdk/pull/3055) [`cd8072e`](https://github.com/ethlete-io/ethdk/commit/cd8072e58977194422cf86e4b52c40b3f5d4f35b) Thanks [@github-actions](https://github.com/apps/github-actions)! - `withInactivityLogout` now times out on the session being idle rather than one tab being idle, so a forgotten tab no longer logs the user out of the one they are working in.
+
+## 6.0.0-next.34
+
+### Minor Changes
+
+- [`d9dada4`](https://github.com/ethlete-io/ethdk/commit/d9dada4189ece040a7b5c6423ad802228ace0e88) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: override an auth provider's access-token lifetime from the Auth tab, so the proactive refresh, the expiration warning and the logout behind them happen in seconds instead of hours.
+
+- [#3054](https://github.com/ethlete-io/ethdk/pull/3054) [`9bd94f6`](https://github.com/ethlete-io/ethdk/commit/9bd94f62d01ff000c5e3e84c4f010bd109422e4c) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: arm every designed mock in one click, and keep armed mocks or faults across a reload
+  with two new Settings scopes.
+
+- [#3054](https://github.com/ethlete-io/ethdk/pull/3054) [`3b0f1ea`](https://github.com/ethlete-io/ethdk/commit/3b0f1ea09f2539091a1f3da091f94cbd4e2cbec5) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: export designed mocks as OpenAPI 3.1 - one route to the clipboard, or the whole library as
+  one YAML or JSON document.
+
+### Patch Changes
+
+- [`1d77cb9`](https://github.com/ethlete-io/ethdk/commit/1d77cb960587005bb97fde4825a21e09f6980caf) Thanks [@TomTomB](https://github.com/TomTomB)! - Auth: a 401 from a request sent with an already-replaced access token no longer triggers another token refresh - with rotating refresh tokens this looped refreshes indefinitely; the query now just retries with the current token.
+
+## 6.0.0-next.33
+
+### Minor Changes
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`4f6e1df`](https://github.com/ethlete-io/ethdk/commit/4f6e1df7b43d0a2805aed555acfff65634c2cbe8) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth: `withPersistentAuth`'s `autoLogin` takes a `shouldAutoLogin(url)` predicate alongside `excludeRoutes`, so route policy can be an exact match rather than a prefix.
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`d3f1b2b`](https://github.com/ethlete-io/ethdk/commit/d3f1b2b8d3c2a6a0e68013ba130bd833ac72d7fe) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: a "Keep across reloads" toggle stores armed response overrides in `sessionStorage` and replays them on the next load, announcing in a banner what came back and what matched no query.
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`f426563`](https://github.com/ethlete-io/ethdk/commit/f4265630749f162d097b147da55256e8bfa056ad) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: an About tab reporting the loaded `@ethlete/*` and Angular versions plus `provideQueryDevtools({ about })`, mirrored on `window.ethlete` and in the session export.
+
+- [`908f35a`](https://github.com/ethlete-io/ethdk/commit/908f35a7a68445467cfe6fe60393f9dc9b140503) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: design a mock's body in the value explorer, and seed it from your API description via
+  `provideQueryDevtools({ schema })`.
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`d14fcf0`](https://github.com/ethlete-io/ethdk/commit/d14fcf0cf4537bca49aee2671b178c1af0df5d39) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: a Mocks tab that answers a route with a designed response instead of sending the request, and copies that route back out as a typed query definition.
+
+- [`5feb1dc`](https://github.com/ethlete-io/ethdk/commit/5feb1dcc9b5428357faba170acfce1101fa29150) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: copy a query's whole armed override set and paste it onto another, and edit response
+  values with `Set to null`, `Empty this array`, `Paste as new item` and delete.
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`a51e919`](https://github.com/ethlete-io/ethdk/commit/a51e9192e7166ea22ff3cfcabdbd96ae4cb94e54) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: a Settings panel behind the header's gear - a storage scope per kind of panel state, runtime limits, a reset, and every panel-wide switch in one place.
+
+### Patch Changes
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`b20c79c`](https://github.com/ethlete-io/ethdk/commit/b20c79cca0e3c2ebca96ca103d27fbe3628e9402) Thanks [@github-actions](https://github.com/apps/github-actions)! - Fix the proactive token refresh never firing, and re-arm a scheduled refresh that came
+  due while it could not run.
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`bb32533`](https://github.com/ethlete-io/ethdk/commit/bb3253307d958abd70a103aa14a542df7a0cab51) Thanks [@github-actions](https://github.com/apps/github-actions)! - Carry the cause a logout ended the session with across multi-tab sync, so a receiving
+  tab reports `'expired'` or `'inactivity'` instead of always `'otherTab'`.
+
+- [#3053](https://github.com/ethlete-io/ethdk/pull/3053) [`2192f8d`](https://github.com/ethlete-io/ethdk/commit/2192f8d400df006525dba488248c45b5f09fc24d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Secure queries now send the current access token after a token refresh instead of the one they were first built with, which used to `401` and could loop refresh-and-retry forever.
+
+## 6.0.0-next.32
+
+### Patch Changes
+
+- [`fcdf018`](https://github.com/ethlete-io/ethdk/commit/fcdf01864995a23bc850a748455357685ae90b6d) Thanks [@TomTomB](https://github.com/TomTomB)! - Fix token refresh causing an infinite loop
+
+## 6.0.0-next.31
+
+### Minor Changes
+
+- [`458f5b7`](https://github.com/ethlete-io/ethdk/commit/458f5b7ecfe9b4360fc220a8465d46833f831ffd) Thanks [@TomTomB](https://github.com/TomTomB)! - Add `buildArgs` to `withRefreshQuery`, so an API that does not name the refresh field `token` can be
+  refreshed at all.
+
+## 6.0.0-next.30
+
+### Minor Changes
+
+- [`70a0602`](https://github.com/ethlete-io/ethdk/commit/70a06025c2f919bd1582b2d0adbf80b21a25696a) Thanks [@TomTomB](https://github.com/TomTomB)! - `withBearerAuthMultiTabSync` exposes `leadership` (`election` / `off` / `unsupported`), so a tab reading `isLeader: true` can tell a won election from one that never ran.
+
+- [#3050](https://github.com/ethlete-io/ethdk/pull/3050) [`cab3d1a`](https://github.com/ethlete-io/ethdk/commit/cab3d1ae2f3ef37df63663b62edb842e8e4a8f9b) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth: add `createAuthGuard(providerRef, config)` - route guards that wait out a session restore, redirect to your login URL with the attempted URL attached, and navigate back afterwards.
+
+- [`33e705b`](https://github.com/ethlete-io/ethdk/commit/33e705bfb989ec80e245b4bd9e2091c57cd337b8) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: **Forget** shows only while the **Gone** chip is lit, drops exactly the tombstones the list is showing, and is styled as the destructive action it is instead of as a filter clear. `clearQueryDevtoolsTombstones()` takes optional ids.
+
+### Patch Changes
+
+- [#3050](https://github.com/ethlete-io/ethdk/pull/3050) [`e7ffcfc`](https://github.com/ethlete-io/ethdk/commit/e7ffcfc5049e81f27732bda7d71ba4e467778fed) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query persistence: a logout purge or `clearPersistedQueries()` can no longer be undone by a write that was already on its way to disk, and `maxEntries` is applied at startup as well.
+
+- [`4b8499d`](https://github.com/ethlete-io/ethdk/commit/4b8499dbd099b81a593ced27bd6df63b4047e173) Thanks [@TomTomB](https://github.com/TomTomB)! - `validateWithQuery` no longer throws `ET100` when the creator's route is a function - its args reach
+  the query at execute time, which the created query now declares.
+
+## 6.0.0-next.29
+
+### Minor Changes
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`4c6c06f`](https://github.com/ethlete-io/ethdk/commit/4c6c06f072830999cf9f06730181833090db4537) Thanks [@github-actions](https://github.com/apps/github-actions)! - A refresh that fails for good now ends the session instead of leaving it looking valid - override with `onRefreshFailure`. A 401 in a follower tab asks the leader to refresh, and is no longer throttled by `minRefreshInterval`.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`d17e79d`](https://github.com/ethlete-io/ethdk/commit/d17e79db20c93f3e04033feb8e88f0db9efce6b6) Thanks [@github-actions](https://github.com/apps/github-actions)! - The bearer auth provider now publishes `sessionStatus()` (`unknown | restoring | authenticated | anonymous`) and `sessionEndCause()`, and `logout()` takes a cause. Only the most recent token-issuing execution applies its tokens and writes `executionState()`, across registry keys.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`86659a1`](https://github.com/ethlete-io/ethdk/commit/86659a1adc3f90c8d8ce4b76ceb955c55aa61b62) Thanks [@github-actions](https://github.com/apps/github-actions)! - Auth: a tab receiving synced tokens now retries its failed queries, a cross-tab logout is a real logout, and the remember-me cookie survives startup. Query devtools: a failed run keeps its status and body.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`9fc5ec5`](https://github.com/ethlete-io/ethdk/commit/9fc5ec5ace959b50402c0688bebf721d69bd4945) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools overrides: type a custom value or paste a copied subtree as a replayed rule, and presets (including the new long-word one) now generate a varied sample per arm instead of one frozen value.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`1d181d7`](https://github.com/ethlete-io/ethdk/commit/1d181d7ecec575a2cae17f42f6914b70b4dd95ac) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: a destroyed query stays readable as a tombstone - a muted row the **Gone** chip narrows to - and the repository emits `entry-destroyed` so the panel can say why a cache entry disappeared.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`7081567`](https://github.com/ethlete-io/ethdk/commit/7081567496b2a6416b6c1a74223a278c6a2a2c1d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: pick both ends of a response diff instead of only comparing a run against its predecessor, and raise how many bodies are kept with `provideQueryDevtools({ responseHistory })`.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`089d41b`](https://github.com/ethlete-io/ethdk/commit/089d41bc3180d09a0d8c0cc0da1be1ba0219cd1b) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query stack: a custom `transform` is now typed with the `null` responses it actually receives (a compile-time break for callbacks that assumed otherwise), and `lastQuery` no longer points at a query `maxQueries` just evicted.
+
+### Patch Changes
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`b31de2f`](https://github.com/ethlete-io/ethdk/commit/b31de2ff3fa0ceaea22b3f314ee4ba5ef44a6cd8) Thanks [@github-actions](https://github.com/apps/github-actions)! - Bearer auth multi-tab sync: the broadcast channel and the leader lock are namespaced by the provider's `name`, so two providers on one origin no longer share a token channel and one leader.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`b31de2f`](https://github.com/ethlete-io/ethdk/commit/b31de2ff3fa0ceaea22b3f314ee4ba5ef44a6cd8) Thanks [@github-actions](https://github.com/apps/github-actions)! - Bearer auth: each registry key now reuses one query across executions, so logins and token refreshes stop leaking an injector, an effect and cached credentials per attempt.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`16e2f77`](https://github.com/ethlete-io/ethdk/commit/16e2f77e9ae9c89bda41f744195c4233e62bc06d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Bearer auth: a response the `extractTokens` step rejects now puts `executionState` into `error` instead of reporting a `success` that never authenticated the tab.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`c984b8c`](https://github.com/ethlete-io/ethdk/commit/c984b8cc7e71596b0218763f90e1411d3afaf3e4) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: a `null`/`undefined` value can now be overridden instead of showing an empty menu, and **Reset** appears only where something is armed and clears the whole subtree.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`089d41b`](https://github.com/ethlete-io/ethdk/commit/089d41bc3180d09a0d8c0cc0da1be1ba0219cd1b) Thanks [@github-actions](https://github.com/apps/github-actions)! - Paged query stack: `canFetchNextPage` / `canFetchPreviousPage` are now false while a page is loading, and `isFirstPageLoaded` reports whether page 1 is loaded instead of always being true.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`69823ed`](https://github.com/ethlete-io/ethdk/commit/69823ed509254101c31df0ffd429171a40f7325b) Thanks [@github-actions](https://github.com/apps/github-actions)! - `defineQueryForm`: `isResetBy` resets now cascade transitively, so changing `country` clears `league` **and** the `team` that depends on it, in one committed change.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`fd41d42`](https://github.com/ethlete-io/ethdk/commit/fd41d42d1f7c2858b7ea19e1936ec13ada4570bc) Thanks [@github-actions](https://github.com/apps/github-actions)! - `refreshQueriesInUse()` and `invalidateQueries()` now only re-fire reads, so a cached auth `POST` is never replayed. GraphQL queries over `POST` keep refreshing.
+
+- [#3048](https://github.com/ethlete-io/ethdk/pull/3048) [`8847481`](https://github.com/ethlete-io/ethdk/commit/8847481e6ef505754c56b5c1ab9d3ca19ed4f784) Thanks [@github-actions](https://github.com/apps/github-actions)! - Web socket rooms: joins are counted, so one subscriber unmounting no longer leaves a room the others still hold - they used to silently stop receiving messages.
+
+## 6.0.0-next.28
+
+### Minor Changes
+
+- [#3047](https://github.com/ethlete-io/ethdk/pull/3047) [`e266740`](https://github.com/ethlete-io/ethdk/commit/e266740c41f1eae06e2ddf16fae6cda29c6ed5a6) Thanks [@github-actions](https://github.com/apps/github-actions)! - The prerelease's `createQueryForm()` is now `defineQueryForm()` and returns a plain object rather than a class instance (`CreateQueryFormConfig` → `DefineQueryFormConfig`).
+
+### Patch Changes
+
+- [`53cd2a5`](https://github.com/ethlete-io/ethdk/commit/53cd2a5d0a618c298bd9f631ea4dea32f6f9f590) Thanks [@TomTomB](https://github.com/TomTomB)! - Secure queries that outlive a logout now run again once the user logs back in, instead of staying idle for the rest of the page load.
+
+## 6.0.0-next.27
+
+### Patch Changes
+
+- [#3046](https://github.com/ethlete-io/ethdk/pull/3046) [`291e8a9`](https://github.com/ethlete-io/ethdk/commit/291e8a9c6ecb9c51c191b4ed6e40d41465ff4cfa) Thanks [@github-actions](https://github.com/apps/github-actions)! - Secure queries executed after `setTokens()` (SSO/OIDC callbacks, native shells) no longer wait forever - they now also proceed once `executionState` reports a successful token seed.
+
+## 6.0.0-next.26
+
+### Minor Changes
+
+- [#3045](https://github.com/ethlete-io/ethdk/pull/3045) [`b2ac74b`](https://github.com/ethlete-io/ethdk/commit/b2ac74b0fad22ba656d7b2028d19dd25f06e57d8) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: add a persistent, path-addressed response-override registry that replays edits (value presets, array/pagination duplication, resets) against a query's response on every fetch.
+
+### Patch Changes
+
+- [#3045](https://github.com/ethlete-io/ethdk/pull/3045) [`5c676cf`](https://github.com/ethlete-io/ethdk/commit/5c676cf29dbe18d5ca81e8a5c45144a4ec93d712) Thanks [@github-actions](https://github.com/apps/github-actions)! - `BearerAuthProvider.setTokens()` now sets `executionState` to `{ type: 'tokenSeed', state: 'success' }`, so SSO/OIDC callback and native-shell logins work with the same `executionState`-driven redirect logic as a query-driven login.
+
+- [#3045](https://github.com/ethlete-io/ethdk/pull/3045) [`321da6a`](https://github.com/ethlete-io/ethdk/commit/321da6a9d1b97dc34204011d1372fe1c7bfadb3d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Internal: route-building and legacy query-state errors now throw `RuntimeError` (from `@ethlete/core`) instead of the ad hoc `QueryError` class, which is removed.
+
+## 6.0.0-next.25
+
+### Major Changes
+
+- [`e9fbdab`](https://github.com/ethlete-io/ethdk/commit/e9fbdab00dfe50a20c1b7fe284ab29fd91a25e77) Thanks [@TomTomB](https://github.com/TomTomB)! - `createWebSocketClient` now takes socket.io's `io` as a required option, so `@ethlete/query` no longer
+  pulls `socket.io-client` (~13 kB gz) into apps that never open a socket. New:
+  `createWebSocketTestDouble()` in `@ethlete/query/testing`.
+
+### Minor Changes
+
+- [`fb32936`](https://github.com/ethlete-io/ethdk/commit/fb32936caa749895fc77348a6213d0d3ab6bd056) Thanks [@TomTomB](https://github.com/TomTomB)! - Web socket devtools now record outgoing traffic and can emit test messages, and a request reports how long its last execution took via `subtle.lastDurationMs`.
+
+### Patch Changes
+
+- [`a50a6a0`](https://github.com/ethlete-io/ethdk/commit/a50a6a01e722746cf74fe6181d2da301912528ab) Thanks [@TomTomB](https://github.com/TomTomB)! - Fix `HttpRequestLoadingProgressState.speed`, which reported 1000x the actual rate (and
+  `Infinity` on a stalled or re-executed request), and show it in the query devtools.
+
+## 6.0.0-next.24
+
+### Minor Changes
+
+- [`41354e7`](https://github.com/ethlete-io/ethdk/commit/41354e7c64ad713caa2393e6a3df592a410b53be) Thanks [@TomTomB](https://github.com/TomTomB)! - Legacy interop: containers accept `{ injector }` like `prepare()` does and default their cleanup by
+  request method again, and `provideLegacyPrepareFallback()` lets `prepare()` use the root injector instead
+  of throwing ET950 (browser only).
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`cf41b4e`](https://github.com/ethlete-io/ethdk/commit/cf41b4e64268eef05bbd69b501e9d08581d09697) Thanks [@github-actions](https://github.com/apps/github-actions)! - Mark every legacy (v2) query export as `@deprecated`, including the `createLegacyQueryCreator`
+  interop, and add `nx g @ethlete/query:deprecate-legacy-queries` to tag wrappers already in source.
+  Removal is v7.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`156659d`](https://github.com/ethlete-io/ethdk/commit/156659de868ff8a66f9b0b6acbb59c637979500d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: count what every query cost - how often it refreshed, how many refreshes reached
+  the network, and how much payload they moved - as activity tiles per query plus totals per client.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`ebc94d4`](https://github.com/ethlete-io/ethdk/commit/ebc94d456176f350a02a29d8b23c1c6fbb573cd5) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: a new **Faults** tab arms real request failures per query client - latency before
+  every attempt, fail-the-next-N, fail-N%, and the response status - resolved per attempt inside the
+  pipeline, so the retry policy re-rolls it.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`156659d`](https://github.com/ethlete-io/ethdk/commit/156659de868ff8a66f9b0b6acbb59c637979500d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: list every query, auth and client feature with the options it was configured with,
+  not just its name.
+
+- [`6c6213b`](https://github.com/ethlete-io/ethdk/commit/6c6213b48f8e5c5ccf0fcb526dd50884e768fb82) Thanks [@TomTomB](https://github.com/TomTomB)! - Query devtools: add a **Forms** tab covering `createQueryForm` - its fields, URL params and the query it drives - and log each invalidation with every query it refetched.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`9f5f9ec`](https://github.com/ethlete-io/ethdk/commit/9f5f9ecc64a0290f753b9979e2667fbe3de238a0) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: the Insomnia export now includes the auth provider's token refresh, and secure
+  requests read their bearer token out of its response instead of shipping one that goes stale.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`156659d`](https://github.com/ethlete-io/ethdk/commit/156659de868ff8a66f9b0b6acbb59c637979500d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: list queries with their path params filled in from args (`/post/12` instead of
+  `/post/:param`), and export requests as an Insomnia v4 collection.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`8b665a3`](https://github.com/ethlete-io/ethdk/commit/8b665a39bccf09e51fac34c6d05b9b9d2793d4e5) Thanks [@github-actions](https://github.com/apps/github-actions)! - Surface retries and transfer progress in the query devtools: `request.subtle.attempts()` and
+  `request.subtle.retryState()` report what a retry policy is doing, and the panel shows backoff
+  countdowns, attempt counts and a progress bar for `reportProgress` requests.
+
+- [#3043](https://github.com/ethlete-io/ethdk/pull/3043) [`37a74ae`](https://github.com/ethlete-io/ethdk/commit/37a74aec9c149a00f493894a75499c7e86d83cf7) Thanks [@github-actions](https://github.com/apps/github-actions)! - Record what a query did per run: its last 25 runs land on the devtools stats handle, feeding a new
+  **Timeline** tab that draws every request on one axis and a **History** section that diffs responses.
+
+### Patch Changes
+
+- [`41354e7`](https://github.com/ethlete-io/ethdk/commit/41354e7c64ad713caa2393e6a3df592a410b53be) Thanks [@TomTomB](https://github.com/TomTomB)! - Legacy interop fixes: `destroyOnResponse` no longer strands its watcher on an aborted query, an `entity`
+  config no longer syncs a `null` response on `prepare()`, and a falsy `body` is sent instead of dropped.
+
+- [`41354e7`](https://github.com/ethlete-io/ethdk/commit/41354e7c64ad713caa2393e6a3df592a410b53be) Thanks [@TomTomB](https://github.com/TomTomB)! - `migrate-to-query-v3` now threads an injector into `prepare()` calls inside callbacks (`computed`,
+  `effect`, RxJS operators) and adds `destroyOnResponse` when the prepared query is discarded.
+
+## 6.0.0-next.23
+
+### Major Changes
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`53fcc97`](https://github.com/ethlete-io/ethdk/commit/53fcc97ef5b982fa8a3c5912c0800de1416feca6) Thanks [@github-actions](https://github.com/apps/github-actions)! - Bearer auth multi-tab sync and leader election are opt-in: `createBearerAuthProvider`'s `multiTabSync`
+  option is replaced by `withBearerAuthMultiTabSync()` in `features` (~1.4 kB gz off the secure entry
+  without it), read back as `provider.features.multiTabSync.isLeader()`. Election runs on the Web Locks
+  API now rather than a `localStorage` heartbeat, so a tab that closes or crashes hands over at once.
+  `setupAuthTest()` lost its `multiTabSync` option. Migrate with
+  `npx nx g @ethlete/query:migrate-query-opt-in-features`.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`8b13854`](https://github.com/ethlete-io/ethdk/commit/8b13854aa079196c84fc08da0aee685f728a441d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query client: multi-tab sync and response persistence are opt-in `features` instead of defaults - the
+  `multiTabSync` / `persistence` client options are gone and a client without the features ships neither
+  engine. Migrate with `nx g @ethlete/query:migrate-query-client-features`.
+
+  - `withMultiTabSync()` shares reads, polls a cache key in one tab for all of them and refreshes the
+    others after a mutation; per-query `multiTabSync: false` keeps a query tab-local.
+  - `withQueryPersistence()` keeps public reads in IndexedDB, so a reload renders the last known data
+    while it revalidates. Secure responses need an explicit opt-in and are removed on logout.
+  - `refreshQueriesInUse()` also refreshes GraphQL queries transported over POST; devtools gain Sync
+    and Disk columns.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`53fcc97`](https://github.com/ethlete-io/ethdk/commit/53fcc97ef5b982fa8a3c5912c0800de1416feca6) Thanks [@github-actions](https://github.com/apps/github-actions)! - Error-response parsing and the default retry policy are opt-in query client features - without them a
+  client reads the plain `string` / `{ message }` / `{ detail }` / `string[]` ladder and retries
+  nothing, which takes ~1.4 kB gz out of an app that needs neither. Pick from `withHtmlErrorParsing()`,
+  `withSymfonyErrors()`, `withDefaultRetry()`, `withEthleteApiErrors()` (all three, the previous
+  behavior) and `registerQueryErrorParser()` for a body shape the SDK does not know. Run
+  `npx nx g @ethlete/query:migrate-query-opt-in-features` to keep the old behavior.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`42ec970`](https://github.com/ethlete-io/ethdk/commit/42ec970d6963bb5a3aa3af4e207ef2cac801c915) Thanks [@github-actions](https://github.com/apps/github-actions)! - DI: `createProvider` / `createRootProvider` / `createStaticProvider` / `createStaticRootProvider` /
+  `createLabels` are replaced by `defineProvider` & co., which return a definition you read with
+  `toProvideFn` / `toInjectFn` / `toToken`; `createQueryClient`, `createBearerAuthProvider` and
+  `createWebSocketClient` return that definition instead of a tuple. Every `provideX` / `injectX` /
+  token export keeps its name - run `nx g @ethlete/core:migrate-provider-shape` for your own call sites.
+  Cuts the `@ethlete/components` import floor from 89.9 to 2.4 kB gz.
+
+### Minor Changes
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`e040432`](https://github.com/ethlete-io/ethdk/commit/e040432bdfdce6b46073589bc66fd3a8bdf66111) Thanks [@github-actions](https://github.com/apps/github-actions)! - New `client.invalidateQueries()` re-runs the queries this client has on screen whose data went stale -
+  after a mutation, or a push message saying something changed server-side - and tells the user's other
+  tabs to do the same. Narrow it with `url` (resolved against `baseUrl`, matched on path boundaries) and
+  `filter`, or keep it local with `otherTabs: false`; reaching other tabs needs `withMultiTabSync()`.
+  See [Invalidating after a change](https://ethlete-sdk-docs.web.app/query/caching#invalidating-after-a-change).
+
+### Patch Changes
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`a935328`](https://github.com/ethlete-io/ethdk/commit/a9353288d4e4ee41607005e8a1ab81921c21cf83) Thanks [@github-actions](https://github.com/apps/github-actions)! - `logout()` now abandons every unsaved-changes guard (`injectUnsavedChangesCoordinator().abandonAll('logout')`). Pressing logout with a dirty form used to leave a "discard your changes?" dialog floating over the login page the app had already redirected to, plus a tab still locked against closing - over edits that can no longer be saved. Guards created after a re-login work normally again.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`353777b`](https://github.com/ethlete-io/ethdk/commit/353777bb56e42ad1c02058a2ccf694f69c94b025) Thanks [@github-actions](https://github.com/apps/github-actions)! - Mark build-tooling peer dependencies (`vite`, `typescript`, `ts-morph`, `@nx/devkit`, `@analogjs/*`) and feature-scoped runtime peers (`date-fns` in components) as optional via `peerDependenciesMeta`. They are only needed when running the Nx generators or using the date/time components - consumers no longer have to install them just to use the libraries.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`53fcc97`](https://github.com/ethlete-io/ethdk/commit/53fcc97ef5b982fa8a3c5912c0800de1416feca6) Thanks [@github-actions](https://github.com/apps/github-actions)! - Devtools instrumentation is now registered through a hook that `provideQueryDevtools()` installs, so
+  an app without it drops the entry registry, the route stringifier and the client-name derivation
+  entirely - ~0.5 kB gz off every entry. No API change; `queryDevtoolsEntries` and the
+  `<et-query-devtools>` contract are unchanged.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`42ec970`](https://github.com/ethlete-io/ethdk/commit/42ec970d6963bb5a3aa3af4e207ef2cac801c915) Thanks [@github-actions](https://github.com/apps/github-actions)! - Internal: the current generation no longer imports anything from the legacy V2 tree - `buildRoute`,
+  `buildQueryString`, `buildTimestampFromSeconds`, `decryptBearer`, `QueryError` and the query-string
+  types now live in `http/internal/request-route`, and `legacy` re-exports them. Every public name is
+  unchanged. Also closes the `http ↔ gql` cycle.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`53fcc97`](https://github.com/ethlete-io/ethdk/commit/53fcc97ef5b982fa8a3c5912c0800de1416feca6) Thanks [@github-actions](https://github.com/apps/github-actions)! - `socket.io-client` is an optional peer dependency. It is only imported by `createWebSocketClient`,
+  and no non-`ws` public type surfaces it, so an app that does not use the realtime client no longer
+  has to install it.
+
+- [#3041](https://github.com/ethlete-io/ethdk/pull/3041) [`353777b`](https://github.com/ethlete-io/ethdk/commit/353777bb56e42ad1c02058a2ccf694f69c94b025) Thanks [@github-actions](https://github.com/apps/github-actions)! - Adopt the `@ethlete/eslint-plugin` styleguide flat configs in `core`, `query`, `contentful` and
+  `types`, and apply the resulting auto-fixes. Runtime behavior is unchanged; three fixes are visible to
+  TypeScript consumers: exported `types` shapes are `type` aliases rather than `interface` declarations
+  (so they can no longer be extended by declaration merging), `core`'s `PropsDirective.destroyRef` and
+  `SeoDirective.parent` are `private`, and `ConsentHandler` is a `type`. The theme name registries stay
+  interfaces so consumers can keep augmenting them.
+
+## 6.0.0-next.22
+
+### Minor Changes
+
+- [#3040](https://github.com/ethlete-io/ethdk/pull/3040) [`dcd8585`](https://github.com/ethlete-io/ethdk/commit/dcd8585423c4d0a66d968016a6e88b03c87b168a) Thanks [@github-actions](https://github.com/apps/github-actions)! - Error normalization: reduce an HTML error page (a proxy's `502`, a maintenance page) to its heading and message text instead of using the raw markup as the message. Exposes `isHtmlErrorPayload`, `htmlErrorPayload` and `extractHtmlErrorMessage`.
+
+### Patch Changes
+
+- [#3040](https://github.com/ethlete-io/ethdk/pull/3040) [`bc8aca7`](https://github.com/ethlete-io/ethdk/commit/bc8aca76900a47a3faed4ad2be2ce2ab7b70b27d) Thanks [@github-actions](https://github.com/apps/github-actions)! - Filter overlay: new `provideFilterOverlay` / `injectFilterOverlay` - a filter panel that drafts the page's query
+  form, reports how many results the draft would return on its submit button, and applies on submit or discards on
+  dismiss. Replaces cdk's `FilterOverlayService`, rebuilt on signal forms and the current query client.
+
+## 6.0.0-next.21
+
+### Patch Changes
+
+- [#3038](https://github.com/ethlete-io/ethdk/pull/3038) [`0be9397`](https://github.com/ethlete-io/ethdk/commit/0be939765c6074a518c5c05a7110513f1e3e8ef0) Thanks [@TomTomB](https://github.com/TomTomB)! - Fix `ET301` on every legacy interop mutation. `LegacyQuery.execute()` translates v2's single `skipCache` into
+  `allowCache: options.skipCache !== true` for **every** method, so any `legacyPost*` / `legacyPut*` /
+  `legacyPatch*` / `legacyDelete*` executed without an explicit `skipCache: true` reached the repository with
+  `allowCache: true` and threw "This request is uncacheable, but allowCache is set to true".
+
+  `allowCache` is never read on the uncacheable path - there is no cache entry to reuse - so the throw was purely a
+  guard against a mistake in hand-written code. It stays for that, and gains a
+  `silenceUncacheableAllowCacheError` opt-out on `QueryConfig`, which `createLegacyQueryCreator` sets alongside the
+  `silenceMissingWithArgsFeatureError` it already passed. The cache-key guard is unaffected.
+
+  Note that dropping `allowCache: true` in the interop instead would have silently made every legacy `GET` refetch,
+  since an absent `allowCache` means "do not reuse the entry" rather than "use the default".
+
+## 6.0.0-next.20
+
+### Minor Changes
+
+- [#3037](https://github.com/ethlete-io/ethdk/pull/3037) [`a83cfe4`](https://github.com/ethlete-io/ethdk/commit/a83cfe4b3e69c3e70ac20f81a5c287bdb6278a63) Thanks [@github-actions](https://github.com/apps/github-actions)! - Cache entries are now kept for `keepUnusedFor` (5 minutes by default) after their last consumer was destroyed, instead of being discarded immediately. A query that mounts again within that window - a list page reached via browser back navigation, for instance - binds to the existing entry and renders its previous response right away while revalidating in the background (`executionState()` reports `{ type: 'loading', hasCachedResponse: true }`).
+
+  - Configurable per client (`createQueryClient({ keepUnusedFor })`) and per query creator; `0` restores the previous release-immediately behavior.
+  - Independent of `cache-control`, so it also applies to private/authenticated responses.
+  - Only entries holding a response are kept - in-flight and errored ones are still aborted immediately. At most 50 unused entries per client are retained, and retention is disabled on the server.
+
+- [#3037](https://github.com/ethlete-io/ethdk/pull/3037) [`7ae9eaa`](https://github.com/ethlete-io/ethdk/commit/7ae9eaa878c6c3bfa80876c67ac1f9360a1c24ec) Thanks [@github-actions](https://github.com/apps/github-actions)! - Close the gaps found while migrating a real workspace from the legacy client to v3:
+
+  - **Client-level headers.** `createQueryClient({ headers })` takes `HttpHeaders` or a function
+    re-read on every request, so a signal can drive it. Per-query `args.headers` merge on top and win
+    per name. `client.refreshQueriesInUse()` re-runs every bound `GET`/`HEAD`/`OPTIONS` (in-flight ones
+    included) - the replacement for v2's `setDefaultHeaders({ refreshQueriesInUse: true })`.
+  - **`provider.setTokens(access, refresh)`** on the public bearer auth provider, for tokens issued
+    outside it (SSO callbacks, native shells). Previously reachable only from inside a custom feature.
+  - **`logout()` now resets bound secure queries.** It already unbound their cache entries, but the
+    query objects kept their `response()`, so a component mounted across a logout went on rendering the
+    previous user until something called `reset()`.
+  - **Legacy `prepare()` failures are diagnosable.** Calling it without an injection context throws
+    `ET950` naming the creator instead of a bare `NG0203`; calling it with an already destroyed injector
+    returns an inert query and warns in dev mode instead of throwing `NG0205` from a view's cleanup
+    phase. `createLegacyQueryCreator` takes a `name` for those messages.
+  - **Query-collection consumers accept real legacy queries.** `AnyQueryCollection` no longer pins the
+    arguments type, so a `createQueryCollectionSignal` result is assignable to `*etQuery`,
+    `queryStateErrorSignal` and `switchQueryCollectionState` without a cast.
+  - **`queryErrorMessages(error)` / `queryErrorMessage(error)`** flatten a `QueryErrorResponse` into
+    displayable strings, and `emptyQueryArgs<TArgs>()` covers argless queries in generic code (auth
+    registry `execute()` now takes no argument either).
+  - **`BearerAuthProviderOf<typeof ref>`** derives the exact provider type; `AnyBearerAuthProvider` no
+    longer forces bracket access on `provider.queries` under `noPropertyAccessFromIndexSignature`.
+
+  `migrate-to-query-v3` got a precision pass:
+
+  - Renames are scoped to imports that actually resolve to the migrated symbol, so same-named type
+    members, config properties and exports from unrelated packages are left alone; import aliases are
+    preserved instead of dropped.
+  - `--projects` / `--include` migrate one app or library at a time.
+  - Unused imports (`def`, `AnyLegacyQuery*`, stale client symbols) are no longer left behind.
+  - Auth providers are scaffolded from the v2 `V2BearerAuthProvider` config instead of `queries: []`.
+  - Devtools are migrated rather than deleted: the per-client `provideQueryClientForDevtools` calls
+    collapse into one `provideQueryDevtools()`, `QueryDevtoolsComponent` is re-imported from
+    `@ethlete/components`, and `<et-query-devtools>` markup is left alone - both versions use that selector.
+  - New report tasks for dropped v2 client options, missing `provideHttpClient()`, `setDefaultHeaders`
+    call sites and the auth import-cycle layout.
+
+- [#3037](https://github.com/ethlete-io/ethdk/pull/3037) [`0c30546`](https://github.com/ethlete-io/ethdk/commit/0c30546c220bc40f5a167c9d5cbad2757e9c7108) Thanks [@github-actions](https://github.com/apps/github-actions)! - Add a signals-first query form: `createQueryForm({ fields, queryParamPrefix? })` alongside field creators `queryField`, `searchQueryField`, `sortQueryField`, `stringArrayQueryField`, `numberArrayQueryField`, `booleanArrayQueryField`, `dateQueryField`, `dateArrayQueryField`.
+
+  Built on Angular signal forms, so each field is bindable to the SDK's own controls with `[formField]` (e.g. `<input etInput [formField]="qf.fields.search" />`). Fields commit as a debounced signal `value`, sync to the URL query params (default elision, `ET_NULL__` sentinel, `active:direction` sort format, prefix namespacing), reset dependents via the `isResetBy` graph, expose `activeFilterCount` as a signal, and support a detached `branch()` for edit-then-apply filter flows.
+
+  Also adds a `withPageResetOnError` query feature that resets the page (a signal or a query-form field) when the current page goes out of range (HTTP `416`, or a dev-mode `500` Pagerfanta out-of-range error), plus the exported `isPageOutOfRangeError` predicate.
+
+  The existing reactive-forms `QueryForm` is unchanged and remains available.
+
+## 6.0.0-next.19
+
+### Minor Changes
+
+- [#3036](https://github.com/ethlete-io/ethdk/pull/3036) [`aa4bdde`](https://github.com/ethlete-io/ethdk/commit/aa4bdde586615ed13735ed9c970831b91323ebad) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query devtools: add `provideQueryDevtools()` and a registry that instruments
+  queries, query stacks, paged query stacks, `querySequence`, bearer auth providers
+  and web socket clients so they can be inspected by `<et-query-devtools>` (from
+  `@ethlete/components`). Instrumentation is a no-op unless the provider is added,
+  so there is no overhead when it is omitted.
+
+  Supporting devtools APIs added: `querySequence` exposes a `stepArgs` signal (the
+  resolved input args of each step); the query repository gains
+  `subtle.cacheEntries()` / `subtle.cacheVersion` / `subtle.evict()`; queries gain
+  `subtle.setLoading()` / `subtle.setError()` (force UI states for testing);
+  `HttpRequest` exposes `method`, `url` and `expiresAt`; `QueryClient` exposes its
+  `baseUrl`; `QuerySequence` exposes its step `queries`; and web socket clients
+  expose a devtools handle (connection state, rooms, recent messages).
+
+## 6.0.0-next.18
+
+### Minor Changes
+
+- [`5685798`](https://github.com/ethlete-io/ethdk/commit/56857988a9fb579a791950cd85d015dfd36921a3) Thanks [@TomTomB](https://github.com/TomTomB)! - Add `querySequence` for imperative waterfalls of dependent queries - chain mutations with `.then()`, thread each response into the next, and `run()` to a typed, discriminated result that aborts on the first error. Exposes `status`/`running`/`currentStep`/`error` progress signals for driving UI.
+
+## 6.0.0-next.17
+
+### Minor Changes
+
+- [#3030](https://github.com/ethlete-io/ethdk/pull/3030) [`47e4109`](https://github.com/ethlete-io/ethdk/commit/47e41097adf96788120840bdd03cad25306628f2) Thanks [@github-actions](https://github.com/apps/github-actions)! - Add `validateWithQuery` (v3) and `validateWithV2Query` (v2) - query-backed async
+  validators for Angular signal forms. They adapt an `@ethlete/query` query into
+  `validateAsync`, so server-side validation runs through the query client (auth,
+  base route, caching, error normalization) instead of a raw `httpResource`. A
+  `422 FormViolationListView` maps each violation onto its child field by
+  `propertyPath` (via `mapViolationsToFormErrors`); success reports no errors and
+  network/other errors surface as a form-level error.
+
+## 6.0.0-next.16
+
+### Minor Changes
+
+- [`a41491d`](https://github.com/ethlete-io/ethdk/commit/a41491db447152e69902020d19bfc30bccf3b01d) Thanks [@TomTomB](https://github.com/TomTomB)! - Server violations → signal-forms bridge:
+  - `@ethlete/query`: `mapViolationsToFormErrors({ fieldTree, error, rewritePath?, onUnmappedViolation? })` maps an API error's violation list onto a signal form's fields (unmapped violations become form-level errors, violation-free failures degrade to a form-level `etServerError`), plus `extractFormViolations(error)`, `executeUntilSettled(query, executeArgs?)` for awaiting one execution as a settled snapshot, and the `isQueryErrorResponse` guard.
+  - `@ethlete/components`: `provideFormErrorMessageResolver(resolver)` lets apps centralize/localize the text `et-form-error` renders by error `kind`; the error's own `message` stays the default.
+
+## 6.0.0-next.15
+
+### Patch Changes
+
+- [#3022](https://github.com/ethlete-io/ethdk/pull/3022) [`9431073`](https://github.com/ethlete-io/ethdk/commit/9431073bb693aa10bbb84d5196597cb2c4b7463f) Thanks [@github-actions](https://github.com/apps/github-actions)! - Overlays and menus now open on insecure origins (plain-HTTP pages on a LAN IP, not just `localhost`/HTTPS). Id generation used `crypto.randomUUID()`, which is `undefined` outside a secure context, so opening any dialog, sheet, anchored overlay or menu threw and only the backdrop appeared. A new `randomId()` helper in `@ethlete/core` uses `crypto.randomUUID()` when available and falls back to `getRandomValues` otherwise.
+
+## 6.0.0-next.14
+
+### Patch Changes
+
+- [#3019](https://github.com/ethlete-io/ethdk/pull/3019) [`b5655a9`](https://github.com/ethlete-io/ethdk/commit/b5655a9124b2ffc4d6982ca20be360b227a37107) Thanks [@github-actions](https://github.com/apps/github-actions)! - Query cache: a cached request now correctly becomes stale once its freshness
+  window (from `cache-control` / `expires`) elapses, so `execute({ allowCache: true })`
+  refetches instead of serving the cached response forever.
+
+## 6.0.0-next.13
+
+### Patch Changes
+
+- [`4e9f2b4`](https://github.com/ethlete-io/ethdk/commit/4e9f2b4d12335fafef192350aef8ffc584996a91) Thanks [@TomTomB](https://github.com/TomTomB)! - Remove the now-redundant `changeDetection: ChangeDetectionStrategy.OnPush` declaration (and its `ChangeDetectionStrategy` import) from all components. OnPush is the default change detection strategy since Angular 22, so this is a no-op cleanup with no behavioral change.
+
+## 6.0.0-next.12
+
+### Minor Changes
+
+- [`edea44b`](https://github.com/ethlete-io/ethdk/commit/edea44bf1c494420f02b545202f4b24db9a6395c) Thanks [@TomTomB](https://github.com/TomTomB)! - Update to angular 22
+
+## 6.0.0-next.11
+
+### Patch Changes
+
+- [#2995](https://github.com/ethlete-io/ethdk/pull/2995) [`9038da9`](https://github.com/ethlete-io/ethdk/commit/9038da9dba1af6597ce24056f45354b4073673aa) Thanks [@github-actions](https://github.com/apps/github-actions)! - Fix `withSuccessHandling`, `withErrorHandling` and `withLogging` callbacks sometimes being skipped when a query re-executes in quick succession (e.g. polling, auto-refresh, or fast repeated requests). Each execution's result now reliably triggers its handler.
+
+- [#2995](https://github.com/ethlete-io/ethdk/pull/2995) [`24b4fd7`](https://github.com/ethlete-io/ethdk/commit/24b4fd7e1aebda8a4844d4a8ec9700aa1a89a0ee) Thanks [@github-actions](https://github.com/apps/github-actions)! - Fix secure queries intermittently throwing `tokensNotAvailableInsideAuthAndExec` when the auth query completes on a different reactive timeline than the access token is set on (e.g. a cross-client / secure login query whose token is populated by a separate effect). The secure execute factory now waits for the access token to be available before running the request instead of assuming it is set the moment the auth query has a response, and recovers automatically once the token arrives.
+
+## 6.0.0-next.10
+
+### Patch Changes
+
+- [`256b1b0`](https://github.com/ethlete-io/ethdk/commit/256b1b02d7598a0a6540af55447799a8ced469c4) Thanks [@TomTomB](https://github.com/TomTomB)! - Bump only to implement fixes from 5.44.0
+
+## 5.44.0
+
+### Minor Changes
+
+- [`8d2efef`](https://github.com/ethlete-io/ethdk/commit/8d2efef2a367db82d44977a3fdfe56396bb46515) Thanks [@TomTomB](https://github.com/TomTomB)! - Minor bump only
+
+## 5.43.2
+
+### Patch Changes
+
+- [`830b987`](https://github.com/ethlete-io/ethdk/commit/830b987eba43a51252c3c55eee5590ceef8bf1cb) Thanks [@TomTomB](https://github.com/TomTomB)! - Fix query v3 features not reacting to 204 responses due to null checks
+
+## 5.44.0
+
+### Minor Changes
+
+- [`8d2efef`](https://github.com/ethlete-io/ethdk/commit/8d2efef2a367db82d44977a3fdfe56396bb46515) Thanks [@TomTomB](https://github.com/TomTomB)! - Minor bump only
+
+## 5.43.2
+
+### Patch Changes
+
+- [`830b987`](https://github.com/ethlete-io/ethdk/commit/830b987eba43a51252c3c55eee5590ceef8bf1cb) Thanks [@TomTomB](https://github.com/TomTomB)! - Fix query v3 features not reacting to 204 responses due to null checks
+
+## 6.0.0-next.9
+
+### Patch Changes
+
+- [`b73a127`](https://github.com/ethlete-io/ethdk/commit/b73a127002a06e3aa0c4e7e977b1ad1f3e04e7e6) Thanks [@TomTomB](https://github.com/TomTomB)! - Bump yet again, final one for sure, pinky promise
+
+## 6.0.0-beta.8
+
+### Patch Changes
+
+- [`ddb5d09`](https://github.com/ethlete-io/ethdk/commit/ddb5d09e4bc56e18cc8c228aa78a200441e7a766) Thanks [@TomTomB](https://github.com/TomTomB)! - Bump to beta
+
+- Updated dependencies [[`ddb5d09`](https://github.com/ethlete-io/ethdk/commit/ddb5d09e4bc56e18cc8c228aa78a200441e7a766)]:
+  - @ethlete/types@2.0.0-beta.4
+  - @ethlete/core@5.0.0-beta.11
+
+## 6.0.0-next.7
+
+### Patch Changes
+
+- [`a690217`](https://github.com/ethlete-io/ethdk/commit/a6902172efd9bd1956a16237e79acbfbd816d946) Thanks [@TomTomB](https://github.com/TomTomB)! - Version bump only
+
+## 6.0.0-next.6
+
+### Patch Changes
+
+- [`8d31d0b`](https://github.com/ethlete-io/ethdk/commit/8d31d0b0ea523c6f79680e3a2cbf5ceba109f5d9) Thanks [@TomTomB](https://github.com/TomTomB)! - Fix bearer token revocation not working
+
+## 6.0.0-next.5
+
+### Minor Changes
+
+- [#2959](https://github.com/ethlete-io/ethdk/pull/2959) [`5423369`](https://github.com/ethlete-io/ethdk/commit/542336985297868592cdb6a9732c5d161160730f) Thanks [@github-actions](https://github.com/apps/github-actions)! - Add executionState signal to auth provider
+
 ## 6.0.0-next.4
 
 ### Patch Changes