@robosystems/client 1.13.0 → 1.13.2

package/artifacts/InvestorClient.d.ts

@@ -30,6 +30,13 @@ interface InvestorClientConfig {
     tokenProvider?: TokenProvider;
     /** GraphQL request timeout in milliseconds (default 60s). */
     timeout?: number;
+    /**
+     * Replays of a rate-limited (429) request. Defaults to
+     * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection immediately.
+     */
+    maxRetries?: number;
+    /** Base of the retry backoff, in milliseconds. */
+    retryDelay?: number;
 }
 export declare class InvestorClient {
     private config;

package/artifacts/InvestorClient.ts

@@ -101,6 +101,13 @@ interface InvestorClientConfig {
   tokenProvider?: TokenProvider
   /** GraphQL request timeout in milliseconds (default 60s). */
   timeout?: number
+  /**
+   * Replays of a rate-limited (429) request. Defaults to
+   * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection immediately.
+   */
+  maxRetries?: number
+  /** Base of the retry backoff, in milliseconds. */
+  retryDelay?: number
 }
 
 export class InvestorClient {

package/artifacts/LedgerClient.d.ts

@@ -227,6 +227,13 @@ interface LedgerClientConfig {
     tokenProvider?: TokenProvider;
     /** GraphQL request timeout in milliseconds (default 60s). */
     timeout?: number;
+    /**
+     * Replays of a rate-limited (429) request. Defaults to
+     * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection immediately.
+     */
+    maxRetries?: number;
+    /** Base of the retry backoff, in milliseconds. */
+    retryDelay?: number;
 }
 export declare class LedgerClient {
     private config;

package/artifacts/LedgerClient.ts

@@ -576,6 +576,13 @@ interface LedgerClientConfig {
   tokenProvider?: TokenProvider
   /** GraphQL request timeout in milliseconds (default 60s). */
   timeout?: number
+  /**
+   * Replays of a rate-limited (429) request. Defaults to
+   * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection immediately.
+   */
+  maxRetries?: number
+  /** Base of the retry backoff, in milliseconds. */
+  retryDelay?: number
 }
 
 export class LedgerClient {

package/artifacts/LibraryClient.d.ts

@@ -71,6 +71,13 @@ interface LibraryClientConfig {
     tokenProvider?: TokenProvider;
     /** GraphQL request timeout in milliseconds (default 60s). */
     timeout?: number;
+    /**
+     * Replays of a rate-limited (429) request. Defaults to
+     * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection immediately.
+     */
+    maxRetries?: number;
+    /** Base of the retry backoff, in milliseconds. */
+    retryDelay?: number;
 }
 export declare class LibraryClient {
     private config;

package/artifacts/LibraryClient.ts

@@ -150,6 +150,13 @@ interface LibraryClientConfig {
   tokenProvider?: TokenProvider
   /** GraphQL request timeout in milliseconds (default 60s). */
   timeout?: number
+  /**
+   * Replays of a rate-limited (429) request. Defaults to
+   * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection immediately.
+   */
+  maxRetries?: number
+  /** Base of the retry backoff, in milliseconds. */
+  retryDelay?: number
 }
 
 export class LibraryClient {

package/artifacts/graphql/client.d.ts

@@ -93,6 +93,14 @@ export interface GraphQLClientConfig {
      * client). Applied per request via `AbortSignal.timeout(...)`.
      */
     timeout?: number;
+    /**
+     * Replays of a rate-limited (429) request. Defaults to
+     * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection
+     * immediately. See `../retry`.
+     */
+    maxRetries?: number;
+    /** Base of the retry backoff, in milliseconds. */
+    retryDelay?: number;
 }
 /**
  * Build a new GraphQL client for the given graph. Prefer

package/artifacts/graphql/client.js

@@ -25,6 +25,7 @@ exports.createGraphQLClient = createGraphQLClient;
  * from the query files in clients/graphql/queries/.
  */
 const graphql_request_1 = require("graphql-request");
+const retry_1 = require("../retry");
 /**
  * Default request timeout for GraphQL calls, in milliseconds.
  *
@@ -124,7 +125,13 @@ function createGraphQLClient(config, graphId) {
     const staticHeaders = {
         ...(config.headers ?? {}),
     };
-    const timeoutFetch = createTimeoutFetch(config.timeout ?? exports.DEFAULT_GRAPHQL_TIMEOUT_MS);
+    // Retry wraps timeout, not the other way round, so each replay gets
+    // its own full timeout rather than sharing one across attempts.
+    const timeoutFetch = (0, retry_1.createRetryingFetch)({
+        fetch: createTimeoutFetch(config.timeout ?? exports.DEFAULT_GRAPHQL_TIMEOUT_MS),
+        maxRetries: config.maxRetries ?? retry_1.DEFAULT_MAX_RETRIES,
+        retryDelay: config.retryDelay ?? retry_1.DEFAULT_RETRY_DELAY_MS,
+    });
     // Dynamic-token path: defer credential injection to a per-request
     // middleware so JWT refreshes are picked up without rebuilding or
     // clearing the client. This is the recommended path for browser

package/artifacts/graphql/client.ts

@@ -23,6 +23,8 @@
 
 import { ClientError, GraphQLClient } from 'graphql-request'
 
+import { createRetryingFetch, DEFAULT_MAX_RETRIES, DEFAULT_RETRY_DELAY_MS } from '../retry'
+
 /**
  * Default request timeout for GraphQL calls, in milliseconds.
  *
@@ -113,6 +115,14 @@ export interface GraphQLClientConfig {
    * client). Applied per request via `AbortSignal.timeout(...)`.
    */
   timeout?: number
+  /**
+   * Replays of a rate-limited (429) request. Defaults to
+   * `DEFAULT_MAX_RETRIES`; set `0` to surface the rejection
+   * immediately. See `../retry`.
+   */
+  maxRetries?: number
+  /** Base of the retry backoff, in milliseconds. */
+  retryDelay?: number
 }
 
 /**
@@ -175,7 +185,13 @@ export function createGraphQLClient(config: GraphQLClientConfig, graphId: string
   const staticHeaders: Record<string, string> = {
     ...(config.headers ?? {}),
   }
-  const timeoutFetch = createTimeoutFetch(config.timeout ?? DEFAULT_GRAPHQL_TIMEOUT_MS)
+  // Retry wraps timeout, not the other way round, so each replay gets
+  // its own full timeout rather than sharing one across attempts.
+  const timeoutFetch = createRetryingFetch({
+    fetch: createTimeoutFetch(config.timeout ?? DEFAULT_GRAPHQL_TIMEOUT_MS),
+    maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+    retryDelay: config.retryDelay ?? DEFAULT_RETRY_DELAY_MS,
+  })
 
   // Dynamic-token path: defer credential injection to a per-request
   // middleware so JWT refreshes are picked up without rebuilding or

package/artifacts/index.d.ts

@@ -12,6 +12,7 @@ import { QueryClient } from './QueryClient';
 import { SSEClient } from './SSEClient';
 export type { TokenProvider } from './graphql/client';
 export { DEFAULT_GRAPHQL_TIMEOUT_MS, GraphQLError } from './graphql/client';
+export { createRetryingFetch, DEFAULT_MAX_RETRIES, DEFAULT_RETRY_DELAY_MS, MAX_BACKOFF_MS, type RetryOptions, } from './retry';
 export interface RoboSystemsClientConfig {
     baseUrl?: string;
     credentials?: 'include' | 'same-origin' | 'omit';

package/artifacts/index.js

@@ -18,7 +18,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.operatorQuery = exports.streamQuery = exports.executeQuery = exports.monitorOperation = exports.clients = exports.useStreamingQuery = exports.useSDKClients = exports.useQuery = exports.useOperation = exports.useMultipleOperations = exports.SSEClient = exports.QueryClient = exports.OperatorClient = exports.OperationClient = exports.LibraryClient = exports.LedgerClient = exports.InvestorClient = exports.RoboSystemsClients = exports.GraphQLError = exports.DEFAULT_GRAPHQL_TIMEOUT_MS = void 0;
+exports.operatorQuery = exports.streamQuery = exports.executeQuery = exports.monitorOperation = exports.clients = exports.useStreamingQuery = exports.useSDKClients = exports.useQuery = exports.useOperation = exports.useMultipleOperations = exports.SSEClient = exports.QueryClient = exports.OperatorClient = exports.OperationClient = exports.LibraryClient = exports.LedgerClient = exports.InvestorClient = exports.RoboSystemsClients = exports.MAX_BACKOFF_MS = exports.DEFAULT_RETRY_DELAY_MS = exports.DEFAULT_MAX_RETRIES = exports.createRetryingFetch = exports.GraphQLError = exports.DEFAULT_GRAPHQL_TIMEOUT_MS = void 0;
 const client_gen_1 = require("../client.gen");
 const config_1 = require("./config");
 const InvestorClient_1 = require("./InvestorClient");
@@ -33,6 +33,7 @@ const OperatorClient_1 = require("./OperatorClient");
 Object.defineProperty(exports, "OperatorClient", { enumerable: true, get: function () { return OperatorClient_1.OperatorClient; } });
 const QueryClient_1 = require("./QueryClient");
 Object.defineProperty(exports, "QueryClient", { enumerable: true, get: function () { return QueryClient_1.QueryClient; } });
+const retry_1 = require("./retry");
 const SSEClient_1 = require("./SSEClient");
 Object.defineProperty(exports, "SSEClient", { enumerable: true, get: function () { return SSEClient_1.SSEClient; } });
 // Structured GraphQL error thrown by facade reads (LedgerClient /
@@ -40,10 +41,31 @@ Object.defineProperty(exports, "SSEClient", { enumerable: true, get: function ()
 var client_1 = require("./graphql/client");
 Object.defineProperty(exports, "DEFAULT_GRAPHQL_TIMEOUT_MS", { enumerable: true, get: function () { return client_1.DEFAULT_GRAPHQL_TIMEOUT_MS; } });
 Object.defineProperty(exports, "GraphQLError", { enumerable: true, get: function () { return client_1.GraphQLError; } });
+// A `fetch` that replays rate-limited (429) requests. The facade
+// clients install it themselves; export it so callers reaching for the
+// raw generated SDK can opt in with
+// `client.setConfig({ fetch: createRetryingFetch() })`.
+var retry_2 = require("./retry");
+Object.defineProperty(exports, "createRetryingFetch", { enumerable: true, get: function () { return retry_2.createRetryingFetch; } });
+Object.defineProperty(exports, "DEFAULT_MAX_RETRIES", { enumerable: true, get: function () { return retry_2.DEFAULT_MAX_RETRIES; } });
+Object.defineProperty(exports, "DEFAULT_RETRY_DELAY_MS", { enumerable: true, get: function () { return retry_2.DEFAULT_RETRY_DELAY_MS; } });
+Object.defineProperty(exports, "MAX_BACKOFF_MS", { enumerable: true, get: function () { return retry_2.MAX_BACKOFF_MS; } });
 class RoboSystemsClients {
     constructor(config = {}) {
         // Get base URL from SDK client config or use provided/default
         const sdkConfig = client_gen_1.client.getConfig();
+        // Facade REST calls run through the generated ops, which share this
+        // module-level client — its `fetch` is the only interception point,
+        // since the ops take no per-call transport. A caller that already
+        // supplied one keeps it; we never override an explicit choice.
+        if (!sdkConfig.fetch) {
+            client_gen_1.client.setConfig({
+                fetch: (0, retry_1.createRetryingFetch)({
+                    maxRetries: config.maxRetries ?? retry_1.DEFAULT_MAX_RETRIES,
+                    retryDelay: config.retryDelay ?? retry_1.DEFAULT_RETRY_DELAY_MS,
+                }),
+            });
+        }
         // Extract JWT token using centralized logic
         const token = config.token || (0, config_1.extractTokenFromSDKClient)();
         // `tokenProvider` falls back to the global SDK clients config so
@@ -94,6 +116,8 @@ class RoboSystemsClients {
             tokenProvider: this.config.tokenProvider,
             headers: this.config.headers,
             timeout: this.config.timeout,
+            maxRetries: this.config.maxRetries,
+            retryDelay: this.config.retryDelay,
         });
         this.investor = new InvestorClient_1.InvestorClient({
             baseUrl: this.config.baseUrl,
@@ -102,6 +126,8 @@ class RoboSystemsClients {
             tokenProvider: this.config.tokenProvider,
             headers: this.config.headers,
             timeout: this.config.timeout,
+            maxRetries: this.config.maxRetries,
+            retryDelay: this.config.retryDelay,
         });
         // Library uses GraphQL and accepts graphId per-call — pass either
         // the `"library"` sentinel (canonical) or any tenant graph_id
@@ -113,6 +139,8 @@ class RoboSystemsClients {
             tokenProvider: this.config.tokenProvider,
             headers: this.config.headers,
             timeout: this.config.timeout,
+            maxRetries: this.config.maxRetries,
+            retryDelay: this.config.retryDelay,
         });
         // Reports consolidated into LedgerClient — alias for backward compat
         this.reports = this.ledger;

package/artifacts/index.ts

@@ -12,6 +12,7 @@ import { LibraryClient } from './LibraryClient'
 import { OperationClient } from './OperationClient'
 import { OperatorClient } from './OperatorClient'
 import { QueryClient } from './QueryClient'
+import { createRetryingFetch, DEFAULT_MAX_RETRIES, DEFAULT_RETRY_DELAY_MS } from './retry'
 import { SSEClient } from './SSEClient'
 
 // Re-export the `TokenProvider` type so consumers who want to type
@@ -24,6 +25,18 @@ export type { TokenProvider } from './graphql/client'
 // InvestorClient / LibraryClient), plus the default request timeout.
 export { DEFAULT_GRAPHQL_TIMEOUT_MS, GraphQLError } from './graphql/client'
 
+// A `fetch` that replays rate-limited (429) requests. The facade
+// clients install it themselves; export it so callers reaching for the
+// raw generated SDK can opt in with
+// `client.setConfig({ fetch: createRetryingFetch() })`.
+export {
+  createRetryingFetch,
+  DEFAULT_MAX_RETRIES,
+  DEFAULT_RETRY_DELAY_MS,
+  MAX_BACKOFF_MS,
+  type RetryOptions,
+} from './retry'
+
 export interface RoboSystemsClientConfig {
   baseUrl?: string
   credentials?: 'include' | 'same-origin' | 'omit'
@@ -82,6 +95,19 @@ export class RoboSystemsClients {
     // Get base URL from SDK client config or use provided/default
     const sdkConfig = client.getConfig()
 
+    // Facade REST calls run through the generated ops, which share this
+    // module-level client — its `fetch` is the only interception point,
+    // since the ops take no per-call transport. A caller that already
+    // supplied one keeps it; we never override an explicit choice.
+    if (!sdkConfig.fetch) {
+      client.setConfig({
+        fetch: createRetryingFetch({
+          maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+          retryDelay: config.retryDelay ?? DEFAULT_RETRY_DELAY_MS,
+        }),
+      })
+    }
+
     // Extract JWT token using centralized logic
     const token = config.token || extractTokenFromSDKClient()
 
@@ -138,6 +164,8 @@ export class RoboSystemsClients {
       tokenProvider: this.config.tokenProvider,
       headers: this.config.headers,
       timeout: this.config.timeout,
+      maxRetries: this.config.maxRetries,
+      retryDelay: this.config.retryDelay,
     })
 
     this.investor = new InvestorClient({
@@ -147,6 +175,8 @@ export class RoboSystemsClients {
       tokenProvider: this.config.tokenProvider,
       headers: this.config.headers,
       timeout: this.config.timeout,
+      maxRetries: this.config.maxRetries,
+      retryDelay: this.config.retryDelay,
     })
 
     // Library uses GraphQL and accepts graphId per-call — pass either
@@ -159,6 +189,8 @@ export class RoboSystemsClients {
       tokenProvider: this.config.tokenProvider,
       headers: this.config.headers,
       timeout: this.config.timeout,
+      maxRetries: this.config.maxRetries,
+      retryDelay: this.config.retryDelay,
     })
 
     // Reports consolidated into LedgerClient — alias for backward compat

package/artifacts/retry.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Rate-limit-aware `fetch` wrapper shared by the facade clients.
+ *
+ * The API rate-limits per user per endpoint category and answers an
+ * exhausted budget with `429` plus `Retry-After` / `X-RateLimit-*`
+ * headers. That rejection is raised by a request dependency *before*
+ * the endpoint handler runs, so the request had no effect and is always
+ * safe to replay — including a `POST` carrying no idempotency key.
+ * Nothing other than `429` is retried here, precisely because nothing
+ * else carries that guarantee.
+ *
+ * Mirrors `robosystems_client/clients/retry.py` in the Python client.
+ */
+/** The one status a rejected request is known to have had no effect for. */
+export declare const RETRY_STATUS_CODES: Set<number>;
+export declare const DEFAULT_MAX_RETRIES = 5;
+export declare const DEFAULT_RETRY_DELAY_MS = 1000;
+export declare const MAX_BACKOFF_MS = 30000;
+export interface RetryOptions {
+    /** Replays after the first attempt. `0` disables retrying entirely. */
+    maxRetries?: number;
+    /** Base of the exponential backoff, in milliseconds. */
+    retryDelay?: number;
+    /** Underlying fetch to wrap. Defaults to the global one, resolved per call. */
+    fetch?: typeof fetch;
+}
+/**
+ * Parse `Retry-After` as a delta-seconds value, in milliseconds.
+ *
+ * The API always sends the numeric form. The HTTP-date form is ignored
+ * rather than parsed, since treating an unreadable value as "no hint"
+ * degrades to plain backoff instead of to a wrong sleep.
+ */
+export declare function retryAfterMs(response: Response): number | null;
+/**
+ * Milliseconds to wait before replaying a rate-limited request.
+ *
+ * Exponential with full jitter, and `Retry-After` applied as a
+ * *ceiling* rather than as the delay itself. The limiter is a sliding
+ * window, so `Retry-After` reports the whole window — the worst case
+ * for a client that filled its budget instantaneously. A caller that
+ * merely ran at the sustained rate has slots freeing up within a second
+ * or two, and obeying the header literally would turn a handful of
+ * rejections into minutes of idling.
+ */
+export declare function backoffMs(attempt: number, retryDelay: number, retryAfter: number | null): number;
+/**
+ * Wrap a `fetch` so rate-limited requests are replayed.
+ *
+ * Composes over an existing fetch rather than replacing it, so a
+ * per-request timeout wrapper stays in place and each attempt gets its
+ * own timeout. The global `fetch` is resolved at call time (not
+ * captured) so test harnesses that swap `globalThis.fetch` keep
+ * working.
+ *
+ * Set `maxRetries: 0` to opt out — an interactive surface may well
+ * prefer to surface the rejection immediately rather than wait.
+ */
+export declare function createRetryingFetch(options?: RetryOptions): typeof fetch;

package/artifacts/retry.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Rate-limit-aware `fetch` wrapper shared by the facade clients.
+ *
+ * The API rate-limits per user per endpoint category and answers an
+ * exhausted budget with `429` plus `Retry-After` / `X-RateLimit-*`
+ * headers. That rejection is raised by a request dependency *before*
+ * the endpoint handler runs, so the request had no effect and is always
+ * safe to replay — including a `POST` carrying no idempotency key.
+ * Nothing other than `429` is retried here, precisely because nothing
+ * else carries that guarantee.
+ *
+ * Mirrors `robosystems_client/clients/retry.py` in the Python client.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_BACKOFF_MS = exports.DEFAULT_RETRY_DELAY_MS = exports.DEFAULT_MAX_RETRIES = exports.RETRY_STATUS_CODES = void 0;
+exports.retryAfterMs = retryAfterMs;
+exports.backoffMs = backoffMs;
+exports.createRetryingFetch = createRetryingFetch;
+/** The one status a rejected request is known to have had no effect for. */
+exports.RETRY_STATUS_CODES = new Set([429]);
+exports.DEFAULT_MAX_RETRIES = 5;
+exports.DEFAULT_RETRY_DELAY_MS = 1000;
+exports.MAX_BACKOFF_MS = 30000;
+/**
+ * Parse `Retry-After` as a delta-seconds value, in milliseconds.
+ *
+ * The API always sends the numeric form. The HTTP-date form is ignored
+ * rather than parsed, since treating an unreadable value as "no hint"
+ * degrades to plain backoff instead of to a wrong sleep.
+ */
+function retryAfterMs(response) {
+    const raw = response.headers.get('retry-after');
+    if (!raw) {
+        return null;
+    }
+    const seconds = Number(raw.trim());
+    if (!Number.isFinite(seconds) || seconds < 0) {
+        return null;
+    }
+    return seconds * 1000;
+}
+/**
+ * Milliseconds to wait before replaying a rate-limited request.
+ *
+ * Exponential with full jitter, and `Retry-After` applied as a
+ * *ceiling* rather than as the delay itself. The limiter is a sliding
+ * window, so `Retry-After` reports the whole window — the worst case
+ * for a client that filled its budget instantaneously. A caller that
+ * merely ran at the sustained rate has slots freeing up within a second
+ * or two, and obeying the header literally would turn a handful of
+ * rejections into minutes of idling.
+ */
+function backoffMs(attempt, retryDelay, retryAfter) {
+    let ceiling = Math.min(retryDelay * 2 ** attempt, exports.MAX_BACKOFF_MS);
+    if (retryAfter !== null) {
+        ceiling = Math.min(ceiling, retryAfter);
+    }
+    return ceiling / 2 + Math.random() * (ceiling / 2);
+}
+/**
+ * Whether a request can be sent a second time.
+ *
+ * A `ReadableStream` body is consumed by the first attempt, so
+ * replaying it would send nothing. Strings, `FormData`, `Blob` and
+ * typed arrays — everything the SDK and the GraphQL client actually
+ * produce — are re-readable.
+ */
+function isReplayable(init) {
+    const body = init?.body;
+    return !(typeof ReadableStream !== 'undefined' && body instanceof ReadableStream);
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(signal?.reason ?? new DOMException('Aborted', 'AbortError'));
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Wrap a `fetch` so rate-limited requests are replayed.
+ *
+ * Composes over an existing fetch rather than replacing it, so a
+ * per-request timeout wrapper stays in place and each attempt gets its
+ * own timeout. The global `fetch` is resolved at call time (not
+ * captured) so test harnesses that swap `globalThis.fetch` keep
+ * working.
+ *
+ * Set `maxRetries: 0` to opt out — an interactive surface may well
+ * prefer to surface the rejection immediately rather than wait.
+ */
+function createRetryingFetch(options = {}) {
+    const maxRetries = Math.max(0, options.maxRetries ?? exports.DEFAULT_MAX_RETRIES);
+    const retryDelay = Math.max(1, options.retryDelay ?? exports.DEFAULT_RETRY_DELAY_MS);
+    const inner = options.fetch;
+    return async (input, init) => {
+        const send = () => (inner ?? fetch)(input, init);
+        let response = await send();
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            if (!exports.RETRY_STATUS_CODES.has(response.status) || !isReplayable(init)) {
+                return response;
+            }
+            if (init?.signal?.aborted) {
+                return response;
+            }
+            const delay = backoffMs(attempt, retryDelay, retryAfterMs(response));
+            // The rejection body goes unused, but leaving it undrained keeps
+            // the connection pinned in some runtimes.
+            await response.body?.cancel().catch(() => { });
+            await sleep(delay, init?.signal);
+            response = await send();
+        }
+        return response;
+    };
+}

package/artifacts/retry.ts

@@ -0,0 +1,134 @@
+/**
+ * Rate-limit-aware `fetch` wrapper shared by the facade clients.
+ *
+ * The API rate-limits per user per endpoint category and answers an
+ * exhausted budget with `429` plus `Retry-After` / `X-RateLimit-*`
+ * headers. That rejection is raised by a request dependency *before*
+ * the endpoint handler runs, so the request had no effect and is always
+ * safe to replay — including a `POST` carrying no idempotency key.
+ * Nothing other than `429` is retried here, precisely because nothing
+ * else carries that guarantee.
+ *
+ * Mirrors `robosystems_client/clients/retry.py` in the Python client.
+ */
+
+/** The one status a rejected request is known to have had no effect for. */
+export const RETRY_STATUS_CODES = new Set([429])
+
+export const DEFAULT_MAX_RETRIES = 5
+export const DEFAULT_RETRY_DELAY_MS = 1000
+export const MAX_BACKOFF_MS = 30_000
+
+export interface RetryOptions {
+  /** Replays after the first attempt. `0` disables retrying entirely. */
+  maxRetries?: number
+  /** Base of the exponential backoff, in milliseconds. */
+  retryDelay?: number
+  /** Underlying fetch to wrap. Defaults to the global one, resolved per call. */
+  fetch?: typeof fetch
+}
+
+/**
+ * Parse `Retry-After` as a delta-seconds value, in milliseconds.
+ *
+ * The API always sends the numeric form. The HTTP-date form is ignored
+ * rather than parsed, since treating an unreadable value as "no hint"
+ * degrades to plain backoff instead of to a wrong sleep.
+ */
+export function retryAfterMs(response: Response): number | null {
+  const raw = response.headers.get('retry-after')
+  if (!raw) {
+    return null
+  }
+  const seconds = Number(raw.trim())
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    return null
+  }
+  return seconds * 1000
+}
+
+/**
+ * Milliseconds to wait before replaying a rate-limited request.
+ *
+ * Exponential with full jitter, and `Retry-After` applied as a
+ * *ceiling* rather than as the delay itself. The limiter is a sliding
+ * window, so `Retry-After` reports the whole window — the worst case
+ * for a client that filled its budget instantaneously. A caller that
+ * merely ran at the sustained rate has slots freeing up within a second
+ * or two, and obeying the header literally would turn a handful of
+ * rejections into minutes of idling.
+ */
+export function backoffMs(attempt: number, retryDelay: number, retryAfter: number | null): number {
+  let ceiling = Math.min(retryDelay * 2 ** attempt, MAX_BACKOFF_MS)
+  if (retryAfter !== null) {
+    ceiling = Math.min(ceiling, retryAfter)
+  }
+  return ceiling / 2 + Math.random() * (ceiling / 2)
+}
+
+/**
+ * Whether a request can be sent a second time.
+ *
+ * A `ReadableStream` body is consumed by the first attempt, so
+ * replaying it would send nothing. Strings, `FormData`, `Blob` and
+ * typed arrays — everything the SDK and the GraphQL client actually
+ * produce — are re-readable.
+ */
+function isReplayable(init: RequestInit | undefined): boolean {
+  const body = init?.body
+  return !(typeof ReadableStream !== 'undefined' && body instanceof ReadableStream)
+}
+
+function sleep(ms: number, signal?: AbortSignal | null): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort)
+      resolve()
+    }, ms)
+    function onAbort() {
+      clearTimeout(timer)
+      reject(signal?.reason ?? new DOMException('Aborted', 'AbortError'))
+    }
+    signal?.addEventListener('abort', onAbort, { once: true })
+  })
+}
+
+/**
+ * Wrap a `fetch` so rate-limited requests are replayed.
+ *
+ * Composes over an existing fetch rather than replacing it, so a
+ * per-request timeout wrapper stays in place and each attempt gets its
+ * own timeout. The global `fetch` is resolved at call time (not
+ * captured) so test harnesses that swap `globalThis.fetch` keep
+ * working.
+ *
+ * Set `maxRetries: 0` to opt out — an interactive surface may well
+ * prefer to surface the rejection immediately rather than wait.
+ */
+export function createRetryingFetch(options: RetryOptions = {}): typeof fetch {
+  const maxRetries = Math.max(0, options.maxRetries ?? DEFAULT_MAX_RETRIES)
+  const retryDelay = Math.max(1, options.retryDelay ?? DEFAULT_RETRY_DELAY_MS)
+  const inner = options.fetch
+
+  return async (input, init) => {
+    const send = () => (inner ?? fetch)(input, init)
+    let response = await send()
+
+    for (let attempt = 0; attempt < maxRetries; attempt++) {
+      if (!RETRY_STATUS_CODES.has(response.status) || !isReplayable(init)) {
+        return response
+      }
+      if (init?.signal?.aborted) {
+        return response
+      }
+      const delay = backoffMs(attempt, retryDelay, retryAfterMs(response))
+      // The rejection body goes unused, but leaving it undrained keeps
+      // the connection pinned in some runtimes.
+      await response.body?.cancel().catch(() => {})
+      await sleep(delay, init?.signal)
+      response = await send()
+    }
+
+    return response
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/client",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "description": "TypeScript client library for the RoboSystems financial intelligence platform",
   "main": "index.js",
   "types": "index.d.ts",

package/sdk/types.gen.d.ts

@@ -584,6 +584,10 @@ export type AvailableExtension = {
      * Name
      */
     name: string;
+    /**
+     * Display Name
+     */
+    display_name?: string | null;
     /**
      * Description
      */
@@ -4927,7 +4931,7 @@ export type EventBlockEnvelope = {
     /**
      * Status
      *
-     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
+     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged — retractable while its ledger rows are still drafts), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
      */
     status: string;
     /**
@@ -16455,7 +16459,7 @@ export type UpdateEventBlockRequest = {
     /**
      * Transition To
      *
-     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded. Terminal states (fulfilled, voided, superseded) accept no further transitions. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
+     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded; fulfilled → voided | superseded. A retraction (voided, superseded) is final and is refused from any status once the event's ledger rows have posted or it has published to QuickBooks — reverse the posted entries instead. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
      */
     transition_to?: 'committed' | 'pending' | 'fulfilled' | 'voided' | 'superseded' | null;
     /**

package/sdk/types.gen.ts

@@ -602,6 +602,10 @@ export type AvailableExtension = {
      * Name
      */
     name: string;
+    /**
+     * Display Name
+     */
+    display_name?: string | null;
     /**
      * Description
      */
@@ -5057,7 +5061,7 @@ export type EventBlockEnvelope = {
     /**
      * Status
      *
-     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
+     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged — retractable while its ledger rows are still drafts), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
      */
     status: string;
     /**
@@ -16868,7 +16872,7 @@ export type UpdateEventBlockRequest = {
     /**
      * Transition To
      *
-     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded. Terminal states (fulfilled, voided, superseded) accept no further transitions. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
+     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded; fulfilled → voided | superseded. A retraction (voided, superseded) is final and is refused from any status once the event's ledger rows have posted or it has published to QuickBooks — reverse the posted entries instead. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
      */
     transition_to?: 'committed' | 'pending' | 'fulfilled' | 'voided' | 'superseded' | null;
     /**

package/types.gen.d.ts

@@ -584,6 +584,10 @@ export type AvailableExtension = {
      * Name
      */
     name: string;
+    /**
+     * Display Name
+     */
+    display_name?: string | null;
     /**
      * Description
      */
@@ -4927,7 +4931,7 @@ export type EventBlockEnvelope = {
     /**
      * Status
      *
-     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
+     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged — retractable while its ledger rows are still drafts), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
      */
     status: string;
     /**
@@ -16455,7 +16459,7 @@ export type UpdateEventBlockRequest = {
     /**
      * Transition To
      *
-     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded. Terminal states (fulfilled, voided, superseded) accept no further transitions. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
+     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded; fulfilled → voided | superseded. A retraction (voided, superseded) is final and is refused from any status once the event's ledger rows have posted or it has published to QuickBooks — reverse the posted entries instead. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
      */
     transition_to?: 'committed' | 'pending' | 'fulfilled' | 'voided' | 'superseded' | null;
     /**

package/types.gen.ts

@@ -602,6 +602,10 @@ export type AvailableExtension = {
      * Name
      */
     name: string;
+    /**
+     * Display Name
+     */
+    display_name?: string | null;
     /**
      * Description
      */
@@ -5057,7 +5061,7 @@ export type EventBlockEnvelope = {
     /**
      * Status
      *
-     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
+     * Lifecycle state. One of: `captured` (raw, pre-classification), `classified` (handler ran, GL pending), `committed` (GL entries posted), `pending` (committed but awaiting fulfillment of an obligation), `fulfilled` (obligation discharged — retractable while its ledger rows are still drafts), `voided` (canceled — terminal), `superseded` (replaced by a corrected event — terminal). See `UpdateEventBlockRequest.transition_to` for the valid transition graph.
      */
     status: string;
     /**
@@ -16868,7 +16872,7 @@ export type UpdateEventBlockRequest = {
     /**
      * Transition To
      *
-     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded. Terminal states (fulfilled, voided, superseded) accept no further transitions. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
+     * Status transition. Valid moves depend on current status: captured → committed | voided | superseded; classified → committed | pending | fulfilled | voided | superseded; committed → pending | fulfilled | voided | superseded; pending → fulfilled | voided | superseded; fulfilled → voided | superseded. A retraction (voided, superseded) is final and is refused from any status once the event's ledger rows have posted or it has published to QuickBooks — reverse the posted entries instead. Note: classified and fulfilled are usually set by handlers, not by callers, but the transition is allowed for corrections.
      */
     transition_to?: 'committed' | 'pending' | 'fulfilled' | 'voided' | 'superseded' | null;
     /**