@mcp-abap-adt/auth-broker 4.0.0 → 5.0.0

package/dist/DestinationConfigError.d.ts

@@ -7,21 +7,50 @@
  *
  * **It carries names, never values.** `missingFields` holds store field names
  * (`authType`, `username`, `sncQop`) or broker option names
- * (`serviceKeyStore`, `provider`); the message is fixed wording plus the
- * destination's name and those names. A stored value — a password, a token,
- * even an `authType` that is not one of the four — never reaches it. There is
- * no `cause`: a provider's own error quotes the value it refused (`qop … got
- * '7'`), so it is not carried; its field names are mapped instead.
+ * (`serviceKeyStore`, `provider`, `renewal`); the message is fixed wording plus
+ * the destination's name and those names. A stored value — a password, a
+ * token, even an `authType` that is not one of the four — never reaches it.
+ *
+ * **When a provider or a strategy caused the refusal, its error is carried**
+ * as auth-errors read it (`readFailure`): `error` — kind, facts, the words
+ * auth-errors rendered and the diagnostics it admitted, nothing more. There is
+ * no `cause`: no message of any thrown value reaches the broker's error. The
+ * message then ends with `: <error.reason>`, the rendered words, never copied.
  */
+import type { IAuthProviderError } from '@mcp-abap-adt/interfaces-auth';
 export declare class DestinationConfigError extends Error {
     readonly code: "DESTINATION_CONFIG";
     readonly destination: string;
     readonly missingFields: string[];
+    /**
+     * Present when the refusal was caused by a provider's or a strategy's
+     * failure: that error as auth-errors read it (`readFailure`), its
+     * diagnostics kept when it came from this copy of auth-errors. An own
+     * property only when present.
+     */
+    readonly error?: IAuthProviderError | undefined;
     /**
      * @param destination The destination's name, as the caller passed it.
      * @param missingFields Field or option names only.
      * @param reason Fixed wording: what is wrong, never a stored value.
+     * @param error The provider's or strategy's error, read by `readFailure`.
      */
-    constructor(destination: string, missingFields: string[], reason: string);
+    constructor(destination: string, missingFields: string[], reason: string, error?: IAuthProviderError);
 }
+/** What `isDestinationConfigError` vouches for: the fields, by structure. */
+export interface DestinationConfigErrorLike {
+    readonly name: 'DestinationConfigError';
+    readonly code: 'DESTINATION_CONFIG';
+    readonly destination: string;
+    readonly missingFields: readonly string[];
+}
+/**
+ * Whether a value is a `DestinationConfigError` — or its JSON copy, or one
+ * of another installed copy of this package — by structure only: own data
+ * properties `name === 'DestinationConfigError'`, `code === 'DESTINATION_CONFIG'`,
+ * a string `destination` and an array of strings `missingFields`. No
+ * `instanceof`, no getter invoked; total — a Proxy whose traps throw answers
+ * false.
+ */
+export declare function isDestinationConfigError(value: unknown): value is DestinationConfigErrorLike;
 //# sourceMappingURL=DestinationConfigError.d.ts.map

package/dist/DestinationConfigError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DestinationConfigError.d.ts","sourceRoot":"","sources":["../src/DestinationConfigError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IAEjC;;;;OAIG;gBACS,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM;CASzE"}
+{"version":3,"file":"DestinationConfigError.d.ts","sourceRoot":"","sources":["../src/DestinationConfigError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IACjC;;;;;OAKG;IACH,SAAiB,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAExD;;;;;OAKG;gBAED,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,kBAAkB;CAY7B;AAED,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAUD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,0BAA0B,CAcrC"}

package/dist/DestinationConfigError.js

@@ -1,6 +1,4 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DestinationConfigError = void 0;
 /**
  * A destination that lacks what its type needs.
  *
@@ -10,12 +8,19 @@ exports.DestinationConfigError = void 0;
  *
  * **It carries names, never values.** `missingFields` holds store field names
  * (`authType`, `username`, `sncQop`) or broker option names
- * (`serviceKeyStore`, `provider`); the message is fixed wording plus the
- * destination's name and those names. A stored value — a password, a token,
- * even an `authType` that is not one of the four — never reaches it. There is
- * no `cause`: a provider's own error quotes the value it refused (`qop … got
- * '7'`), so it is not carried; its field names are mapped instead.
+ * (`serviceKeyStore`, `provider`, `renewal`); the message is fixed wording plus
+ * the destination's name and those names. A stored value — a password, a
+ * token, even an `authType` that is not one of the four — never reaches it.
+ *
+ * **When a provider or a strategy caused the refusal, its error is carried**
+ * as auth-errors read it (`readFailure`): `error` — kind, facts, the words
+ * auth-errors rendered and the diagnostics it admitted, nothing more. There is
+ * no `cause`: no message of any thrown value reaches the broker's error. The
+ * message then ends with `: <error.reason>`, the rendered words, never copied.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DestinationConfigError = void 0;
+exports.isDestinationConfigError = isDestinationConfigError;
 class DestinationConfigError extends Error {
     code = 'DESTINATION_CONFIG';
     destination;
@@ -24,13 +29,50 @@ class DestinationConfigError extends Error {
      * @param destination The destination's name, as the caller passed it.
      * @param missingFields Field or option names only.
      * @param reason Fixed wording: what is wrong, never a stored value.
+     * @param error The provider's or strategy's error, read by `readFailure`.
      */
-    constructor(destination, missingFields, reason) {
-        super(`Destination "${destination}": ${reason} (${missingFields.join(', ')})`);
+    constructor(destination, missingFields, reason, error) {
+        const words = error === undefined ? reason : `${reason}: ${error.reason}`;
+        super(`Destination "${destination}": ${words} (${missingFields.join(', ')})`);
         this.name = 'DestinationConfigError';
         this.destination = destination;
         this.missingFields = [...missingFields];
+        if (error !== undefined)
+            this.error = error;
         Object.setPrototypeOf(this, DestinationConfigError.prototype);
     }
 }
 exports.DestinationConfigError = DestinationConfigError;
+/** An own data property's value; `undefined` for an accessor or an absent key. */
+function ownData(value, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor !== undefined && 'value' in descriptor
+        ? descriptor.value
+        : undefined;
+}
+/**
+ * Whether a value is a `DestinationConfigError` — or its JSON copy, or one
+ * of another installed copy of this package — by structure only: own data
+ * properties `name === 'DestinationConfigError'`, `code === 'DESTINATION_CONFIG'`,
+ * a string `destination` and an array of strings `missingFields`. No
+ * `instanceof`, no getter invoked; total — a Proxy whose traps throw answers
+ * false.
+ */
+function isDestinationConfigError(value) {
+    try {
+        if (typeof value !== 'object' || value === null)
+            return false;
+        if (ownData(value, 'name') !== 'DestinationConfigError')
+            return false;
+        if (ownData(value, 'code') !== 'DESTINATION_CONFIG')
+            return false;
+        if (typeof ownData(value, 'destination') !== 'string')
+            return false;
+        const fields = ownData(value, 'missingFields');
+        return (Array.isArray(fields) &&
+            fields.every((field) => typeof field === 'string'));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/SessionWriter.d.ts

@@ -1,27 +1,53 @@
 /**
- * The broker's writes of a destination's session secret, retried until the
- * store takes them.
+ * The broker's writes of a destination's session secret: one plain queue per
+ * destination.
  *
- * A store failure is the storage's or a broker bug, never the token's, so it
- * does not fail the authentication: the result stays pending for its
- * destination and the writer tries again on its own — it does not wait for the
- * provider to be called again, since a request may be the process's last.
- *
- * - **One pending result per destination, the latest.** A newer result
- *   replaces the one waiting; an older one is never written after it.
- * - **Attempts for one destination never overlap.** Each runs after the
- *   previous one has settled.
- * - **A growing delay:** one second after the first failure, doubling, capped
- *   at one minute; reset once a write lands. The timer is `unref()`ed, so a
- *   pending write never keeps a process alive.
- * - **Failures are logged by class name** — never a message: the store holds
- *   tokens, and its errors are foreign text.
- * - **`flush()`** gives every pending result one more attempt and rejects,
- *   naming the destinations, if any is still not written.
+ * - **One at a time, in order.** The writes of one destination run one after
+ *   another, in the order they were queued, each writing what it was given;
+ *   an older write never runs after, and so never overwrites, a newer one.
+ *   Destinations never wait on each other.
+ * - **Each write's own outcome.** A submission resolves with what its own
+ *   write came to — landed, or the store's error — never with another
+ *   submission's: no write is folded into another, so no caller is told
+ *   "landed" for a write that never ran.
+ * - **A failed write stays pending.** The destination then has a pending
+ *   write: the latest one that failed — every write is built from its
+ *   build's logical state, so the latest is the one that must land. It is
+ *   retried by the destination's next write, which carries the same state
+ *   and, once it lands, clears it; or by `retry()` / `flush()`, which write
+ *   the pending one again. **There is no retry timer:** nothing is retried on
+ *   its own, and nothing is scheduled.
+ * - **The store's contract:** `saveSession` settles — resolves or rejects. A
+ *   store that never settles holds its destination's queue; avoiding that is
+ *   the consumer's. The writer builds no machinery against it.
+ * - **Failures are logged once each, with `logFields`** of auth-errors'
+ *   classification (`persisting-tokens`) — never a message: the store holds
+ *   tokens, and its errors are foreign text. Each failed attempt is one
+ *   `warn` line, written here only: the row's persistence is given no logger.
+ *   A retry that fails again is a new attempt, and its own line.
+ * - **`flush()`** retries every pending write once, after everything queued
+ *   before it, and rejects naming the destinations still pending.
  */
+import type { IAuthProviderError } from '@mcp-abap-adt/interfaces-auth';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-/** A thrown value's class, for a log line: never its message. */
-export declare function classLabel(error: unknown): string;
+/** What one write came to: it landed, or the store's error. */
+export type WriteOutcome = {
+    readonly landed: true;
+} | {
+    readonly landed: false;
+    readonly error: unknown;
+};
+/**
+ * One destination whose session write still fails, in `flush()`'s
+ * `AggregateError`: the destination and the store's error as auth-errors
+ * classifies it (`persisting-tokens`) — never the store's message.
+ */
+export declare class SessionWriteFailure extends Error {
+    readonly destination: string;
+    /** `classify(storeError, 'persisting-tokens')`. */
+    readonly error: IAuthProviderError;
+    constructor(destination: string, storeError: unknown);
+}
 /** `T`: what one write takes — the result, with what the broker writes beside it. */
 export declare class SessionWriter<T> {
     private readonly write;
@@ -30,25 +56,36 @@ export declare class SessionWriter<T> {
     /**
      * @param write Writes one result for a destination; throws when the store
      *   does not take it.
+     * @param logger The broker's quiet logger (`quietLogger`): a line never
+     *   throws and never rejects, so what a write came to is the store's answer
+     *   alone, and `submit` / `retry` never reject.
      */
     constructor(write: (destination: string, result: T) => Promise<void>, logger: ILogger);
     /**
-     * Take a new result for the destination and try to write it now. Never
-     * throws: resolves once this attempt has settled, written or left pending.
+     * Queue `result` for the destination, after every write queued before it.
+     * Never rejects: resolves once this write has settled, with what it came
+     * to. Landed: the destination's pending write, if any — an older one — is
+     * replaced. Failed: this write is the destination's pending one.
+     */
+    submit(destination: string, result: T): Promise<WriteOutcome>;
+    /**
+     * Wait for every write of the destination queued before this call, then
+     * write its pending write once more, if one is left. Never rejects:
+     * resolves landed when, by its turn, nothing is pending — every write
+     * queued before it landed, or the latest of them did, replacing a failed
+     * older one — else with the attempt's own outcome. It writes the pending
+     * write as its turn finds it: the latest that failed.
      */
-    submit(destination: string, result: T): Promise<void>;
+    retry(destination: string): Promise<WriteOutcome>;
     /**
-     * One more attempt for every pending result; resolves when all are written,
-     * rejects naming the destinations still pending — each failure as its
-     * destination and its error's class only, never the store's message. The
-     * retries go on after a rejection.
+     * One more attempt for every pending write, each after everything queued
+     * for its destination before it; resolves when all landed, rejects naming
+     * the destinations still pending — one `SessionWriteFailure` per
+     * destination, never the store's message. What still fails stays pending.
      */
     flush(): Promise<void>;
-    private queueOf;
-    /** Runs after the destination's previous attempt; never rejects. */
-    private attempt;
-    private writePending;
-    private schedule;
-    private cancelTimer;
+    /** Runs `job` after the destination's last queued write has settled. */
+    private enqueue;
+    private logFailure;
 }
 //# sourceMappingURL=SessionWriter.d.ts.map

package/dist/SessionWriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionWriter.d.ts","sourceRoot":"","sources":["../src/SessionWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAgB9D,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKjD;AAED,qFAAqF;AACrF,qBAAa,aAAa,CAAC,CAAC;IAQxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD;;;OAGG;gBAEgB,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EACxD,MAAM,EAAE,OAAO;IAGlC;;;OAGG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3D;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB5B,OAAO,CAAC,OAAO;IASf,oEAAoE;IACpE,OAAO,CAAC,OAAO;YAMD,YAAY;IAgC1B,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"SessionWriter.d.ts","sourceRoot":"","sources":["../src/SessionWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAe9D,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAIxD;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;gBAEvB,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO;CAQrD;AAED,qFAAqF;AACrF,qBAAa,aAAa,CAAC,CAAC;IAWxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD;;;;;;OAMG;gBAEgB,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EACxD,MAAM,EAAE,OAAO;IAGlC;;;;;OAKG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAgB7D;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAiBjD;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB5B,wEAAwE;IACxE,OAAO,CAAC,OAAO;IAmBf,OAAO,CAAC,UAAU;CAMnB"}

package/dist/SessionWriter.js

@@ -1,37 +1,57 @@
 "use strict";
 /**
- * The broker's writes of a destination's session secret, retried until the
- * store takes them.
+ * The broker's writes of a destination's session secret: one plain queue per
+ * destination.
  *
- * A store failure is the storage's or a broker bug, never the token's, so it
- * does not fail the authentication: the result stays pending for its
- * destination and the writer tries again on its own — it does not wait for the
- * provider to be called again, since a request may be the process's last.
- *
- * - **One pending result per destination, the latest.** A newer result
- *   replaces the one waiting; an older one is never written after it.
- * - **Attempts for one destination never overlap.** Each runs after the
- *   previous one has settled.
- * - **A growing delay:** one second after the first failure, doubling, capped
- *   at one minute; reset once a write lands. The timer is `unref()`ed, so a
- *   pending write never keeps a process alive.
- * - **Failures are logged by class name** — never a message: the store holds
- *   tokens, and its errors are foreign text.
- * - **`flush()`** gives every pending result one more attempt and rejects,
- *   naming the destinations, if any is still not written.
+ * - **One at a time, in order.** The writes of one destination run one after
+ *   another, in the order they were queued, each writing what it was given;
+ *   an older write never runs after, and so never overwrites, a newer one.
+ *   Destinations never wait on each other.
+ * - **Each write's own outcome.** A submission resolves with what its own
+ *   write came to — landed, or the store's error — never with another
+ *   submission's: no write is folded into another, so no caller is told
+ *   "landed" for a write that never ran.
+ * - **A failed write stays pending.** The destination then has a pending
+ *   write: the latest one that failed — every write is built from its
+ *   build's logical state, so the latest is the one that must land. It is
+ *   retried by the destination's next write, which carries the same state
+ *   and, once it lands, clears it; or by `retry()` / `flush()`, which write
+ *   the pending one again. **There is no retry timer:** nothing is retried on
+ *   its own, and nothing is scheduled.
+ * - **The store's contract:** `saveSession` settles — resolves or rejects. A
+ *   store that never settles holds its destination's queue; avoiding that is
+ *   the consumer's. The writer builds no machinery against it.
+ * - **Failures are logged once each, with `logFields`** of auth-errors'
+ *   classification (`persisting-tokens`) — never a message: the store holds
+ *   tokens, and its errors are foreign text. Each failed attempt is one
+ *   `warn` line, written here only: the row's persistence is given no logger.
+ *   A retry that fails again is a new attempt, and its own line.
+ * - **`flush()`** retries every pending write once, after everything queued
+ *   before it, and rejects naming the destinations still pending.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionWriter = void 0;
-exports.classLabel = classLabel;
-const FIRST_DELAY_MS = 1_000;
-const MAX_DELAY_MS = 60_000;
-/** A thrown value's class, for a log line: never its message. */
-function classLabel(error) {
-    if (error instanceof Error) {
-        return error.constructor?.name || 'Error';
+exports.SessionWriter = exports.SessionWriteFailure = void 0;
+const auth_errors_1 = require("@mcp-abap-adt/auth-errors");
+const LANDED = Object.freeze({ landed: true });
+/**
+ * One destination whose session write still fails, in `flush()`'s
+ * `AggregateError`: the destination and the store's error as auth-errors
+ * classifies it (`persisting-tokens`) — never the store's message.
+ */
+class SessionWriteFailure extends Error {
+    destination;
+    /** `classify(storeError, 'persisting-tokens')`. */
+    error;
+    constructor(destination, storeError) {
+        const error = (0, auth_errors_1.classify)(storeError, 'persisting-tokens');
+        super(`"${destination}": ${error.reason}`);
+        this.name = 'SessionWriteFailure';
+        this.destination = destination;
+        this.error = error;
+        Object.setPrototypeOf(this, SessionWriteFailure.prototype);
     }
-    return typeof error;
 }
+exports.SessionWriteFailure = SessionWriteFailure;
 /** `T`: what one write takes — the result, with what the broker writes beside it. */
 class SessionWriter {
     write;
@@ -40,96 +60,100 @@ class SessionWriter {
     /**
      * @param write Writes one result for a destination; throws when the store
      *   does not take it.
+     * @param logger The broker's quiet logger (`quietLogger`): a line never
+     *   throws and never rejects, so what a write came to is the store's answer
+     *   alone, and `submit` / `retry` never reject.
      */
     constructor(write, logger) {
         this.write = write;
         this.logger = logger;
     }
     /**
-     * Take a new result for the destination and try to write it now. Never
-     * throws: resolves once this attempt has settled, written or left pending.
+     * Queue `result` for the destination, after every write queued before it.
+     * Never rejects: resolves once this write has settled, with what it came
+     * to. Landed: the destination's pending write, if any — an older one — is
+     * replaced. Failed: this write is the destination's pending one.
      */
-    async submit(destination, result) {
-        const queue = this.queueOf(destination);
-        queue.pending = result;
-        this.cancelTimer(queue);
-        await this.attempt(destination, queue);
+    submit(destination, result) {
+        return this.enqueue(destination, async (queue) => {
+            try {
+                await this.write(destination, result);
+            }
+            catch (error) {
+                queue.pending = { write: result, error };
+                this.logFailure(destination, error);
+                return Object.freeze({ landed: false, error });
+            }
+            // Every write queued before this one has settled: a pending write is
+            // older, and this one carries the state it was built from.
+            queue.pending = undefined;
+            return LANDED;
+        });
     }
     /**
-     * One more attempt for every pending result; resolves when all are written,
-     * rejects naming the destinations still pending — each failure as its
-     * destination and its error's class only, never the store's message. The
-     * retries go on after a rejection.
+     * Wait for every write of the destination queued before this call, then
+     * write its pending write once more, if one is left. Never rejects:
+     * resolves landed when, by its turn, nothing is pending — every write
+     * queued before it landed, or the latest of them did, replacing a failed
+     * older one — else with the attempt's own outcome. It writes the pending
+     * write as its turn finds it: the latest that failed.
+     */
+    retry(destination) {
+        return this.enqueue(destination, async (queue) => {
+            const pending = queue.pending;
+            if (pending === undefined)
+                return LANDED;
+            try {
+                await this.write(destination, pending.write);
+            }
+            catch (error) {
+                // Nothing else ran meanwhile: the queue runs one write at a time.
+                pending.error = error;
+                this.logFailure(destination, error);
+                return Object.freeze({ landed: false, error });
+            }
+            queue.pending = undefined;
+            return LANDED;
+        });
+    }
+    /**
+     * One more attempt for every pending write, each after everything queued
+     * for its destination before it; resolves when all landed, rejects naming
+     * the destinations still pending — one `SessionWriteFailure` per
+     * destination, never the store's message. What still fails stays pending.
      */
     async flush() {
-        const queues = [...this.queues];
-        await Promise.all(queues.map(([destination, queue]) => {
-            if (queue.pending === undefined)
-                return queue.tail;
-            this.cancelTimer(queue);
-            return this.attempt(destination, queue);
-        }));
-        const failed = queues.filter(([, queue]) => queue.pending !== undefined);
+        const destinations = [...this.queues.keys()];
+        await Promise.all(destinations.map((d) => this.retry(d)));
+        const failed = [];
+        for (const destination of destinations) {
+            const pending = this.queues.get(destination)?.pending;
+            if (pending !== undefined)
+                failed.push([destination, pending]);
+        }
         if (failed.length > 0) {
             // The stores' own errors are not carried: their messages, causes and
             // properties are foreign text that may quote what was being written.
-            throw new AggregateError(failed.map(([destination, queue]) => new Error(`"${destination}": ${classLabel(queue.lastError)}`)), `Session writes still failing for ${failed
+            throw new AggregateError(failed.map(([destination, pending]) => new SessionWriteFailure(destination, pending.error)), `Session writes still failing for ${failed
                 .map(([destination]) => `"${destination}"`)
-                .join(', ')}; the broker keeps retrying them`);
+                .join(', ')}; each stays pending until its destination's next write or flush()`);
         }
     }
-    queueOf(destination) {
+    /** Runs `job` after the destination's last queued write has settled. */
+    enqueue(destination, job) {
         let queue = this.queues.get(destination);
         if (!queue) {
-            queue = { tail: Promise.resolve(), failures: 0 };
+            queue = { tail: Promise.resolve() };
             this.queues.set(destination, queue);
         }
-        return queue;
-    }
-    /** Runs after the destination's previous attempt; never rejects. */
-    attempt(destination, queue) {
-        const run = queue.tail.then(() => this.writePending(destination, queue));
-        queue.tail = run;
+        const own = queue;
+        // `job` never rejects; the tail is chained whatever the previous came to.
+        const run = own.tail.then(() => job(own), () => job(own));
+        own.tail = run;
         return run;
     }
-    async writePending(destination, queue) {
-        const result = queue.pending;
-        if (result === undefined)
-            return;
-        try {
-            await this.write(destination, result);
-        }
-        catch (error) {
-            queue.failures += 1;
-            queue.lastError = error;
-            const delay = Math.min(FIRST_DELAY_MS * 2 ** (queue.failures - 1), MAX_DELAY_MS);
-            this.logger.warn(`[AuthBroker] Session write for ${destination} failed; the token stands, the write is retried in ${delay} ms`, { error: classLabel(error), attempt: queue.failures });
-            this.schedule(destination, queue, delay);
-            return;
-        }
-        queue.failures = 0;
-        queue.lastError = undefined;
-        // A newer result that arrived meanwhile stays pending: its own attempt is
-        // queued after this one.
-        if (queue.pending === result) {
-            queue.pending = undefined;
-            this.cancelTimer(queue);
-        }
-    }
-    schedule(destination, queue, delay) {
-        this.cancelTimer(queue);
-        const timer = setTimeout(() => {
-            queue.timer = undefined;
-            void this.attempt(destination, queue);
-        }, delay);
-        timer.unref();
-        queue.timer = timer;
-    }
-    cancelTimer(queue) {
-        if (queue.timer) {
-            clearTimeout(queue.timer);
-            queue.timer = undefined;
-        }
+    logFailure(destination, error) {
+        this.logger.warn(`[AuthBroker] Session write for ${destination} failed; it stays pending until the destination's next write or flush()`, (0, auth_errors_1.logFields)((0, auth_errors_1.classify)(error, 'persisting-tokens')));
     }
 }
 exports.SessionWriter = SessionWriter;