@salesforce/graphiti 11.26.1 → 11.26.3

package/AGENT_GUIDE.md

@@ -37,6 +37,7 @@ Notes:
 
 - Concurrent refreshes (CLI + MCP) **coalesce** into a single introspection.
 - If the refresh fails (network/5xx) it is retried once. On terminal failure the **old cache is kept** and `sf_gql_connect` returns `refreshed: false` with a staleness `warnings[]` entry instead of erroring — keep working on the still-valid cached schema and retry the refresh shortly.
+- Exception: a **401/403 auth failure** during introspection (expired/unauthorized session) errors with an `Auth:` prefix instead of the soft staleness warning — a dead session makes even the cached schema unusable, so re-authenticate (`sf org login web --alias <org>`) rather than retrying.
 - ObjectInfo is keyed by org alias: refreshing alias `A` does not invalidate ObjectInfo cached under a different alias `B` for the same org (its 1-hour TTL heals it).
 
 ## Session Resolution

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [11.26.3](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.26.2...v11.26.3) (2026-07-14)
+
+**Note:** Version bump only for package @salesforce/graphiti
+
+## [11.26.2](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.26.1...v11.26.2) (2026-07-14)
+
+### Bug Fixes
+
+- **graphiti:** @W-23335328@ reclassify introspection 401/403 as Auth not Schema ([#739](https://github.com/salesforce-experience-platform-emu/webapps/issues/739)) ([d13ebbf](https://github.com/salesforce-experience-platform-emu/webapps/commit/d13ebbfa928cc60b822c03ebf6daaaf0a2f35aff))
+
 ## [11.26.1](https://github.com/salesforce-experience-platform-emu/webapps/compare/v11.26.0...v11.26.1) (2026-07-14)
 
 **Note:** Version bump only for package @salesforce/graphiti

package/dist/commands/mcp-mirror/run-mirror.js

@@ -3,14 +3,15 @@
  * All rights reserved.
  * For full license text, see the LICENSE.txt file
  */
+import { AuthError } from "../../lib/errors.js";
 import { SchemaRefreshError } from "../../lib/prime-schema.js";
 /**
  * Best-effort classification of a plain `Error` message into a more specific
  * code. The intent/auth layers throw plain `Error`s with no type signal, so the
  * only available hint is the message text. This is a NON-CONTRACT heuristic: a
  * reworded upstream message can fall through to `INTERNAL`. The verbatim message
- * is always preserved either way, and the typed `SchemaRefreshError` signal
- * (checked before this) takes precedence. Patterns mirror the MCP-CLI prior art.
+ * is always preserved either way, and the typed `AuthError` / `SchemaRefreshError`
+ * signals (checked before this) take precedence. Patterns mirror the MCP-CLI prior art.
  */
 function classifyErrorMessage(message) {
     if (/\bauth(?:entication|orization)?\b/i.test(message) ||
@@ -83,8 +84,8 @@ export async function runMirror(jsonArg, schema, build, deps = {}) {
         emitError("INVALID_ARGS", "Input failed schema validation.", result.error.issues);
         return;
     }
-    // 4. Build and emit. Classify failures: the typed SchemaRefreshError signal
-    //    first, then a best-effort message regex (AUTH_FAILED / SCHEMA_PRIME_FAILED),
+    // 4. Build and emit. Classify failures: the typed AuthError / SchemaRefreshError
+    //    signals first, then a best-effort message regex (AUTH_FAILED / SCHEMA_PRIME_FAILED),
     //    else INTERNAL. The verbatim message is always preserved.
     try {
         const output = await build(result.data);
@@ -92,8 +93,17 @@ export async function runMirror(jsonArg, schema, build, deps = {}) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        // Typed signal wins; otherwise fall back to the best-effort message regex.
-        const code = err instanceof SchemaRefreshError ? "SCHEMA_PRIME_FAILED" : classifyErrorMessage(message);
+        // Typed signals win; otherwise fall back to the best-effort message regex.
+        // AuthError is checked first because its message (W-23335328) reads "Schema
+        // priming failed … expired or unauthorized. Re-authenticate …" — that
+        // "priming" makes classifyErrorMessage return SCHEMA_PRIME_FAILED, so an
+        // untyped fallthrough would misclassify a 401/403 introspection failure as a
+        // schema problem (the exact Schema-vs-Auth confusion this WI fixes).
+        const code = err instanceof AuthError
+            ? "AUTH_FAILED"
+            : err instanceof SchemaRefreshError
+                ? "SCHEMA_PRIME_FAILED"
+                : classifyErrorMessage(message);
         // The stack is omitted by default so the envelope never leaks internals;
         // GRAPHITI_DEBUG=1 opts into attaching it under `details` for debugging.
         const details = process.env.GRAPHITI_DEBUG === "1" && err instanceof Error && err.stack

package/dist/commands/mcp-mirror/run-mirror.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-mirror.js","sourceRoot":"","sources":["../../../src/commands/mcp-mirror/run-mirror.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAkB/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC5C,IACC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;QACF,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAiBD,KAAK,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB,EAAE,OAAe,EAAE,OAAiB;IAC3E,MAAM,QAAQ,GAAwB;QACrC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;KAC7E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,kEAAkE;IAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAA2B,EAC3B,MAAoB,EACpB,KAAqC,EACrC,OAAsB,EAAE;IAExB,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,GAAG,CAAC;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,GAAG,GAAG,OAAiB,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QAClB,SAAS,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAC;QAC5F,OAAO;IACR,CAAC;SAAM,CAAC;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;QACjD,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,SAAS,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAC;YAC5F,OAAO;QACR,CAAC;IACF,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,cAAc,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,cAAc,EAAE,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO;IACR,CAAC;IAED,4EAA4E;IAC5E,kFAAkF;IAClF,8DAA8D;IAC9D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,2EAA2E;QAC3E,MAAM,IAAI,GACT,GAAG,YAAY,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC3F,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,OAAO,GACZ,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK;YACtE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YACtB,CAAC,CAAC,SAAS,CAAC;QACd,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;AACF,CAAC"}
+{"version":3,"file":"run-mirror.js","sourceRoot":"","sources":["../../../src/commands/mcp-mirror/run-mirror.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAkB/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC5C,IACC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;QACF,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAiBD,KAAK,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB,EAAE,OAAe,EAAE,OAAiB;IAC3E,MAAM,QAAQ,GAAwB;QACrC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;KAC7E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,kEAAkE;IAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAA2B,EAC3B,MAAoB,EACpB,KAAqC,EACrC,OAAsB,EAAE;IAExB,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,GAAG,CAAC;IAC5D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,GAAG,GAAG,OAAiB,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QAClB,SAAS,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAC;QAC5F,OAAO;IACR,CAAC;SAAM,CAAC;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;QACjD,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,SAAS,CAAC,cAAc,EAAE,gEAAgE,CAAC,CAAC;YAC5F,OAAO;QACR,CAAC;IACF,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,SAAS,CAAC,cAAc,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,cAAc,EAAE,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO;IACR,CAAC;IAED,iFAAiF;IACjF,0FAA0F;IAC1F,8DAA8D;IAC9D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,IAAI,GACT,GAAG,YAAY,SAAS;YACvB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,GAAG,YAAY,kBAAkB;gBAClC,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnC,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,OAAO,GACZ,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK;YACtE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YACtB,CAAC,CAAC,SAAS,CAAC;QACd,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;AACF,CAAC"}

package/dist/lib/errors.d.ts

@@ -55,6 +55,28 @@ export type RetryHint = "now" | "backoff" | "no";
  * is a defensive backstop, not a live path; a throw simply falls back to `"no"`.
  */
 export declare function classifyCause(cause: unknown): RetryHint;
+/**
+ * Detect whether an introspection/download `cause` is a 401/403-class auth failure
+ * that should surface as `Auth:` (re-authenticate) rather than `Schema:` (W-23335328).
+ *
+ * Mirrors {@link classifyCause}'s defensive shape-reading. A real jsforce /
+ * `@salesforce/core` HTTP failure carries a string `errorCode`/`name` — jsforce-node's
+ * `HttpApiError` sets `ERROR_HTTP_401`/`ERROR_HTTP_403` for a status-only failure, or
+ * the body's code (e.g. `INVALID_SESSION_ID`) for an expired session — but NOT a numeric
+ * `statusCode`; so the `ERROR_HTTP_<nnn>` regex on `errorCode`/`name` and the
+ * `AUTH_ERROR_CODES` check are the load-bearing paths, and the `statusCode` branch is a
+ * defensive fallback for other cause shapes (and the contract tests' status-bearing
+ * doubles). Every property read is wrapped so a `cause` with a throwing accessor falls
+ * back to `false` (this runs on the priming-failure path; an escaped throw would drop the
+ * classification). Returns false for a null/undefined/non-object cause and for any
+ * non-auth status — we never over-broaden: a 4xx that is not 401/403 stays `Schema:`.
+ *
+ * Note (W-23148365 N3): callers must key the Auth reclassification off THIS cause-shape
+ * inspection, never off retry-token absence or schema-cache survival — a forced refresh
+ * that keeps a usable cache emits no token regardless of the cause, so "no token" is not a
+ * reliable signal that a 401/403 occurred.
+ */
+export declare function isAuthError(cause: unknown): boolean;
 /** Credential/auth resolution failure (e.g. unknown org, expired token). → `Auth:` */
 export declare class AuthError extends Error {
     constructor(message: string, opts?: {

package/dist/lib/errors.js

@@ -74,7 +74,11 @@ export function classifyCause(cause) {
         }
         const codeStr = typeof c.errorCode === "string" ? c.errorCode : "";
         const nameStr = typeof c.name === "string" ? c.name : "";
-        const httpMatch = /ERROR_HTTP_(\d{3})/.exec(`${codeStr} ${nameStr}`);
+        // `(?!\d)` anchors the status to EXACTLY three digits: without it the greedy
+        // `\d{3}` would capture the first three digits of a 4-digit tail (e.g. a
+        // hypothetical `ERROR_HTTP_5001` → `500`), misreading the class. jsforce only
+        // emits canonical 3-digit codes today, so this is defensive hardening.
+        const httpMatch = /ERROR_HTTP_(\d{3})(?!\d)/.exec(`${codeStr} ${nameStr}`);
         if (httpMatch) {
             const httpStatus = Number(httpMatch[1]);
             if (TRANSIENT_STATUS.has(httpStatus))
@@ -98,6 +102,71 @@ export function classifyCause(cause) {
     }
     return "no";
 }
+// HTTP statuses that mean the introspection POST failed to AUTHENTICATE/authorize
+// (W-23335328): the org session is missing, expired, or lacks access. The fix is
+// to re-authenticate, so these route to `Auth:` — not `Schema:` (re-prime) — at the
+// MCP boundary. A subset of PERMANENT_STATUS, so they stay non-retryable too.
+const AUTH_STATUS = new Set([401, 403]);
+// Salesforce error codes that ARE a 401 in disguise. jsforce-node collapses a 4xx
+// whose body parses as a Salesforce error array into an HttpApiError whose
+// `errorCode`/`name` is the body code (e.g. INVALID_SESSION_ID for an expired
+// session) and sets NO numeric statusCode — so the canonical expired-session case
+// never presents a 401 status here and must be matched by code. Deliberately kept
+// to the session-invalid code we can tie authoritatively to "re-authenticate fixes
+// it". A structured 403 body code such as INSUFFICIENT_ACCESS / API_DISABLED_FOR_ORG
+// is intentionally NOT here: those are org permission/config problems that a fresh
+// login does NOT resolve, so routing them to `Auth:` ("re-authenticate") would
+// misguide the agent — they correctly stay `Schema:`. Extend only with codes where
+// re-auth is the right remedy (e.g. INVALID_AUTH_HEADER, MISSING_OAUTH_TOKEN) as
+// they are observed on this path.
+const AUTH_ERROR_CODES = new Set(["INVALID_SESSION_ID"]);
+/**
+ * Detect whether an introspection/download `cause` is a 401/403-class auth failure
+ * that should surface as `Auth:` (re-authenticate) rather than `Schema:` (W-23335328).
+ *
+ * Mirrors {@link classifyCause}'s defensive shape-reading. A real jsforce /
+ * `@salesforce/core` HTTP failure carries a string `errorCode`/`name` — jsforce-node's
+ * `HttpApiError` sets `ERROR_HTTP_401`/`ERROR_HTTP_403` for a status-only failure, or
+ * the body's code (e.g. `INVALID_SESSION_ID`) for an expired session — but NOT a numeric
+ * `statusCode`; so the `ERROR_HTTP_<nnn>` regex on `errorCode`/`name` and the
+ * `AUTH_ERROR_CODES` check are the load-bearing paths, and the `statusCode` branch is a
+ * defensive fallback for other cause shapes (and the contract tests' status-bearing
+ * doubles). Every property read is wrapped so a `cause` with a throwing accessor falls
+ * back to `false` (this runs on the priming-failure path; an escaped throw would drop the
+ * classification). Returns false for a null/undefined/non-object cause and for any
+ * non-auth status — we never over-broaden: a 4xx that is not 401/403 stays `Schema:`.
+ *
+ * Note (W-23148365 N3): callers must key the Auth reclassification off THIS cause-shape
+ * inspection, never off retry-token absence or schema-cache survival — a forced refresh
+ * that keeps a usable cache emits no token regardless of the cause, so "no token" is not a
+ * reliable signal that a 401/403 occurred.
+ */
+export function isAuthError(cause) {
+    if (typeof cause !== "object" || cause === null)
+        return false;
+    const c = cause;
+    try {
+        const status = typeof c.statusCode === "number" ? c.statusCode : undefined;
+        if (status !== undefined && AUTH_STATUS.has(status))
+            return true;
+        const codeStr = typeof c.errorCode === "string" ? c.errorCode : "";
+        const nameStr = typeof c.name === "string" ? c.name : "";
+        // `(?!\d)` anchors to EXACTLY three digits so a 4-digit tail can't be misread
+        // as a 401/403 (e.g. `ERROR_HTTP_4011` would otherwise capture `401` and
+        // wrongly route to Auth). Mirrors the same guard in classifyCause.
+        const httpMatch = /ERROR_HTTP_(\d{3})(?!\d)/.exec(`${codeStr} ${nameStr}`);
+        if (httpMatch && AUTH_STATUS.has(Number(httpMatch[1])))
+            return true;
+        if (AUTH_ERROR_CODES.has(codeStr) || AUTH_ERROR_CODES.has(nameStr))
+            return true;
+    }
+    catch {
+        // A throwing getter on the cause → treat as not-an-auth-error (fall through
+        // to the existing Schema classification, which is the conservative default).
+        return false;
+    }
+    return false;
+}
 /** Credential/auth resolution failure (e.g. unknown org, expired token). → `Auth:` */
 export class AuthError extends Error {
     constructor(message, opts) {

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgCH,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACjE,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,oDAAoD;AACpD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,YAAY;IACZ,WAAW;IACX,WAAW;IACX,cAAc;IACd,OAAO;IACP,iBAAiB;CACjB,CAAC,CAAC;AACH,mFAAmF;AACnF,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,qFAAqF;AACrF,mFAAmF;AACnF,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvD,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,KAAK,wBAAwB,IAAI,OAAO,KAAK,wBAAwB,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,6EAA6E;QAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,YAAY,OAAe,EAAE,IAA0B;QACtD,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe,EAAE,IAA0B;QACtD,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC5B,KAAK,CAAY;IAC1B,YAAY,OAAe,EAAE,IAA6C;QACzE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAClC,CAAC;CACD"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgCH,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACjE,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,oDAAoD;AACpD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,YAAY;IACZ,WAAW;IACX,WAAW;IACX,cAAc;IACd,OAAO;IACP,iBAAiB;CACjB,CAAC,CAAC;AACH,mFAAmF;AACnF,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,qFAAqF;AACrF,mFAAmF;AACnF,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,6EAA6E;QAC7E,yEAAyE;QACzE,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvD,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,KAAK,wBAAwB,IAAI,OAAO,KAAK,wBAAwB,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,6EAA6E;QAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,kFAAkF;AAClF,iFAAiF;AACjF,oFAAoF;AACpF,8EAA8E;AAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACxC,kFAAkF;AAClF,2EAA2E;AAC3E,8EAA8E;AAC9E,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,qFAAqF;AACrF,mFAAmF;AACnF,+EAA+E;AAC/E,mFAAmF;AACnF,iFAAiF;AACjF,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,8EAA8E;QAC9E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpE,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACR,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,YAAY,OAAe,EAAE,IAA0B;QACtD,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe,EAAE,IAA0B;QACtD,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;CACD;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC5B,KAAK,CAAY;IAC1B,YAAY,OAAe,EAAE,IAA6C;QACzE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAClC,CAAC;CACD"}

package/dist/lib/prime-schema.js

@@ -6,7 +6,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getOrgAuth as realGetOrgAuth } from "./auth.js";
-import { classifyCause, SchemaError } from "./errors.js";
+import { AuthError, classifyCause, isAuthError, SchemaError } from "./errors.js";
 import { downloadSchema as realDownloadSchema, getSchemaMetadata, normalizeInstanceUrl, schemaCacheKeyForInstanceUrl, schemaDir, } from "./introspect.js";
 import { clearObjectInfoCache } from "./object-info.js";
 import { clearSchemaCacheByUrl } from "./walker.js";
@@ -240,6 +240,23 @@ export async function primeSchemaWithLock(orgAlias, deps = REAL_DEPS, opts = {})
             meta = await deps.downloadSchema(auth);
         }
         catch (cause) {
+            // A 401/403 from the introspection POST is an AUTH failure, not a
+            // schema/cache problem (W-23335328): surface it as AuthError so the MCP
+            // boundary emits `Auth:` (re-authenticate) and the agent re-auths instead
+            // of futilely re-priming. Applies to BOTH lazy prime and forced refresh,
+            // and — per the W-23148365 N3 note — is keyed off the cause SHAPE
+            // (isAuthError), never off retry-token absence or cache survival. On a
+            // forced refresh this INTENTIONALLY bypasses the SchemaRefreshError
+            // soft-surviving-cache path below: a cached schema is worthless once the
+            // session is dead (every subsequent live query 401s too), so a hard Auth
+            // error — not a silent soft-success warning — is the correct signal, and
+            // it is what makes the 401/403 actually route to `Auth:` rather than a
+            // non-erroring `refreshed:false` return. AuthError carries no retry token
+            // (Auth is uniformly non-retryable), preserving the existing contract.
+            if (isAuthError(cause)) {
+                const msg = cause instanceof Error ? cause.message : String(cause);
+                throw new AuthError(`Schema priming failed for "${orgAlias}" — the org session is expired or unauthorized. Re-authenticate with \`sf org login web --alias ${orgAlias}\`.\n${msg}`, { cause });
+            }
             // Lazy prime (no existing cache): no stale cache to keep, so surface
             // the underlying failure (FR-13.5/13.6). Wrap untyped causes (e.g. a
             // raw @salesforce/core/jsforce network error from connection.request)

package/dist/lib/prime-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"prime-schema.js","sourceRoot":"","sources":["../../src/lib/prime-schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,IAAI,cAAc,EAAgB,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,aAAa,EAAkB,WAAW,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACN,cAAc,IAAI,kBAAkB,EACpC,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,SAAS,GAET,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AACjC,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,SAAiB,EACjB,IAAsB,EACtB,OAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC;YACxD,MAAM;QACP,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,CAA0B,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAEnC,6EAA6E;YAC7E,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC;YAE7B,gEAAgE;YAChE,iEAAiE;YACjE,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,0CAA0C;YAC1C,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC/C,sDAAsD;oBACtD,wDAAwD;oBACxD,uDAAuD;oBACvD,mCAAmC;oBACnC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzC,SAAS;gBACV,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,gEAAgE;YACjE,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,WAAW,EAAE,CAAC;gBACjD,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,oEAAoE;gBACpE,MAAM,IAAI,WAAW,CACpB,qBAAqB,WAAW,iCAAiC,QAAQ,EAAE,EAC3E,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,IAAI,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC;YACJ,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,cAAc;QACf,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,IAAI,CAAC;YACJ,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,uBAAuB;QACxB,CAAC;IACF,CAAC;AACF,CAAC;AAmBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,UAAU,CAAU;IACpB,WAAW,CAAS;IACX,KAAK,CAAY;IAC1B,YACC,OAAe,EACf,IAAsF;QAEtF,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;CACD;AAED,SAAS,SAAS,CAAC,EAAU;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,GAAG,EAAE;QAAE,OAAO,GAAG,EAAE,OAAO,CAAC;IACjC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,SAAgC;IAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,uBAAuB,QAAQ,kGAAkG,QAAQ,WAAW,CAAC;IAC7J,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,uBAAuB,QAAQ,8DAA8D,GAAG,sEAAsE,CAAC;AAC/K,CAAC;AAWD,MAAM,SAAS,GAAc;IAC5B,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,kBAAkB;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,QAAgB,EAChB,OAAkB,SAAS,EAC3B,OAAmC,EAAE;IAErC,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAEzC,mEAAmE;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpF,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAA6B,CAAC;IAClC,MAAM,cAAc,CACnB,QAAQ,EACR,KAAK,IAAI,EAAE;QACV,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACJ,iEAAiE;YACjE,4DAA4D;YAC5D,oEAAoE;YACpE,WAAW;YACX,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,iDAAiD;YACjD,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,IAAI,KAAK,YAAY,WAAW;oBAAE,MAAM,KAAK,CAAC;gBAC9C,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,IAAI,WAAW,CAAC,8BAA8B,QAAQ,MAAM,GAAG,EAAE,EAAE;oBACxE,KAAK;oBACL,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACJ,CAAC;YACD,8DAA8D;YAC9D,iEAAiE;YACjE,aAAa;YACb,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACjD,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,mEAAmE;YACnE,0EAA0E;YAC1E,yEAAyE;YACzE,6EAA6E;YAC7E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE;gBACpE,UAAU,EAAE,SAAS,EAAE,YAAY;gBACnC,WAAW;gBACX,KAAK;gBACL,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,oDAAoD;QACpD,IAAI,YAAY,EAAE,CAAC;YAClB,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACnC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IACf,CAAC,EACD,YAAY;QACX,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,cAAc,EAAE;QAC7F,CAAC,CAAC,SAAS,CACZ,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;YAC/F,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACnC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;YACN,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,KAAK;YAChB,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,WAAW;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,YAAY;QACvB,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC9B,WAAW;QACX,SAAS;KACT,CAAC;AACH,CAAC"}
+{"version":3,"file":"prime-schema.js","sourceRoot":"","sources":["../../src/lib/prime-schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,IAAI,cAAc,EAAgB,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAkB,WAAW,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EACN,cAAc,IAAI,kBAAkB,EACpC,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,SAAS,GAET,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AACjC,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,SAAiB,EACjB,IAAsB,EACtB,OAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC;YACxD,MAAM;QACP,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,CAA0B,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAEnC,6EAA6E;YAC7E,IAAI,IAAI,EAAE;gBAAE,OAAO,SAAS,CAAC;YAE7B,gEAAgE;YAChE,iEAAiE;YACjE,iEAAiE;YACjE,6DAA6D;YAC7D,8DAA8D;YAC9D,0CAA0C;YAC1C,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC/C,sDAAsD;oBACtD,wDAAwD;oBACxD,uDAAuD;oBACvD,mCAAmC;oBACnC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzC,SAAS;gBACV,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,gEAAgE;YACjE,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,WAAW,EAAE,CAAC;gBACjD,kEAAkE;gBAClE,qEAAqE;gBACrE,qEAAqE;gBACrE,oEAAoE;gBACpE,MAAM,IAAI,WAAW,CACpB,qBAAqB,WAAW,iCAAiC,QAAQ,EAAE,EAC3E,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,IAAI,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC;YACJ,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,cAAc;QACf,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,IAAI,CAAC;YACJ,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,uBAAuB;QACxB,CAAC;IACF,CAAC;AACF,CAAC;AAmBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,UAAU,CAAU;IACpB,WAAW,CAAS;IACX,KAAK,CAAY;IAC1B,YACC,OAAe,EACf,IAAsF;QAEtF,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;CACD;AAED,SAAS,SAAS,CAAC,EAAU;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,GAAG,OAAO,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAChC,IAAI,EAAE,GAAG,EAAE;QAAE,OAAO,GAAG,EAAE,OAAO,CAAC;IACjC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,SAAgC;IAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,uBAAuB,QAAQ,kGAAkG,QAAQ,WAAW,CAAC;IAC7J,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,uBAAuB,QAAQ,8DAA8D,GAAG,sEAAsE,CAAC;AAC/K,CAAC;AAWD,MAAM,SAAS,GAAc;IAC5B,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,kBAAkB;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,QAAgB,EAChB,OAAkB,SAAS,EAC3B,OAAmC,EAAE;IAErC,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAEzC,mEAAmE;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpF,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAA6B,CAAC;IAClC,MAAM,cAAc,CACnB,QAAQ,EACR,KAAK,IAAI,EAAE;QACV,IAAI,IAAoB,CAAC;QACzB,IAAI,CAAC;YACJ,iEAAiE;YACjE,4DAA4D;YAC5D,oEAAoE;YACpE,WAAW;YACX,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,kEAAkE;YAClE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,IAAI,SAAS,CAClB,8BAA8B,QAAQ,mGAAmG,QAAQ,QAAQ,GAAG,EAAE,EAC9J,EAAE,KAAK,EAAE,CACT,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,iDAAiD;YACjD,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,IAAI,KAAK,YAAY,WAAW;oBAAE,MAAM,KAAK,CAAC;gBAC9C,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,IAAI,WAAW,CAAC,8BAA8B,QAAQ,MAAM,GAAG,EAAE,EAAE;oBACxE,KAAK;oBACL,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACJ,CAAC;YACD,8DAA8D;YAC9D,iEAAiE;YACjE,aAAa;YACb,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACjD,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,mEAAmE;YACnE,0EAA0E;YAC1E,yEAAyE;YACzE,6EAA6E;YAC7E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE;gBACpE,UAAU,EAAE,SAAS,EAAE,YAAY;gBACnC,WAAW;gBACX,KAAK;gBACL,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,mEAAmE;QACnE,oEAAoE;QACpE,8DAA8D;QAC9D,EAAE;QACF,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,oDAAoD;QACpD,IAAI,YAAY,EAAE,CAAC;YAClB,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACnC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IACf,CAAC,EACD,YAAY;QACX,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,cAAc,EAAE;QAC7F,CAAC,CAAC,SAAS,CACZ,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;YAC/F,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACnC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,OAAO;YACN,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,KAAK;YAChB,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,WAAW;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,YAAY;QACvB,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC9B,WAAW;QACX,SAAS;KACT,CAAC;AACH,CAAC"}

package/dist/mcp/tools/sf-gql-connect.js

@@ -9,7 +9,7 @@ import { runTool } from "../../schemas/tool-adapter.js";
 const inputSchema = CONNECT_INPUT.shape;
 export function registerSfGqlConnectTool(server, opts = {}) {
     server.registerTool("sf_gql_connect", {
-        description: "Connect to a Salesforce org and prime its GraphQL schema cache. With forceRefresh, re-download the schema and coherently clear all caches so subsequent tools see freshly-deployed metadata. Concurrent refreshes coalesce into a single introspection. Returns { org, instanceUrl, refreshed, cached, durationMs, warnings? } — not the standard ToolOutput envelope. If a refresh fails but a usable cached schema survives, returns refreshed:false with a staleness warning instead of erroring. Error convention (all sf_gql_* tools): on failure the isError text is prefixed with a category — `UserInput:` (fix the request), `Auth:` (re-authenticate the org), `Schema:` (introspection/cache problem), or `Internal:` (unexpected) — so you can decide whether to fix inputs, re-auth, or retry. A `Schema:` error additionally ends with a retryability token: `[retry=now]` (retry immediately — e.g. a priming-lock timeout, where no live org round-trip occurred) or `[retry=backoff]` (the org was unreachable and an automatic retry already failed — wait with increasing backoff, e.g. 2^n seconds capped around 8s, and retry serially; do not fan out concurrent retries against an org that is already failing, and note some conditions such as an org API rate limit may take longer than a few seconds to clear); ABSENCE of any `[retry=...]` token means the failure is permanent (404, missing/malformed `__schema`, GraphQL errors in the body, or no cached schema) — do not retry, fix the request or re-prime via sf_gql_connect. This token convention applies to every sf_gql_* tool, not just this one. Example error text: `Schema: introspection request failed [retry=backoff]`; extract the disposition with the end-anchored regex ` /\\s\\[retry=(now|backoff)\\]$/` (no match ⇒ permanent).",
+        description: "Connect to a Salesforce org and prime its GraphQL schema cache. With forceRefresh, re-download the schema and coherently clear all caches so subsequent tools see freshly-deployed metadata. Concurrent refreshes coalesce into a single introspection. Returns { org, instanceUrl, refreshed, cached, durationMs, warnings? } — not the standard ToolOutput envelope. If a refresh fails transiently (network/5xx) but a usable cached schema survives, returns refreshed:false with a staleness warning instead of erroring; a 401/403 auth failure during refresh instead errors with `Auth:` (a dead session makes the cached schema unusable — re-authenticate). Error convention (all sf_gql_* tools): on failure the isError text is prefixed with a category — `UserInput:` (fix the request), `Auth:` (re-authenticate the org — e.g. an expired/unauthorized session on connect or introspection), `Schema:` (introspection/cache problem), or `Internal:` (unexpected) — so you can decide whether to fix inputs, re-auth, or retry. A `Schema:` error additionally ends with a retryability token: `[retry=now]` (retry immediately — e.g. a priming-lock timeout, where no live org round-trip occurred) or `[retry=backoff]` (the org was unreachable and an automatic retry already failed — wait with increasing backoff, e.g. 2^n seconds capped around 8s, and retry serially; do not fan out concurrent retries against an org that is already failing, and note some conditions such as an org API rate limit may take longer than a few seconds to clear); ABSENCE of any `[retry=...]` token means the failure is permanent (404, missing/malformed `__schema`, GraphQL errors in the body, or no cached schema) — do not retry, fix the request or re-prime via sf_gql_connect. This token convention applies to every sf_gql_* tool, not just this one. Example error text: `Schema: introspection request failed [retry=backoff]`; extract the disposition with the end-anchored regex ` /\\s\\[retry=(now|backoff)\\]$/` (no match ⇒ permanent).",
         inputSchema,
     }, async (args) => runTool(() => buildConnect(args, opts)));
 }

package/dist/mcp/tools/sf-gql-connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"sf-gql-connect.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-connect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAoB,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAIxD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC;AAExC,MAAM,UAAU,wBAAwB,CACvC,MAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,YAAY,CAClB,gBAAgB,EAChB;QACC,WAAW,EACV,wuDAAwuD;QACzuD,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"sf-gql-connect.js","sourceRoot":"","sources":["../../../src/mcp/tools/sf-gql-connect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAoB,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAIxD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC;AAExC,MAAM,UAAU,wBAAwB,CACvC,MAAiB,EACjB,OAAgC,EAAE;IAElC,MAAM,CAAC,YAAY,CAClB,gBAAgB,EAChB;QACC,WAAW,EACV,48DAA48D;QAC78D,WAAW;KACX,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACvD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/graphiti",
-  "version": "11.26.1",
+  "version": "11.26.3",
   "description": "Progressive GraphQL query builder CLI for Salesforce orgs",
   "license": "SEE LICENSE IN LICENSE.txt",
   "type": "module",

package/src/commands/mcp-mirror/__tests__/run-mirror.spec.ts

@@ -7,6 +7,7 @@
 import { beforeEach, describe, expect, it } from "vitest";
 import { z } from "zod";
 import { captureStdout } from "../../../__tests__/helpers/stdout.js";
+import { AuthError } from "../../../lib/errors.js";
 import { SchemaRefreshError } from "../../../lib/prime-schema.js";
 import { runMirror } from "../run-mirror.js";
 
@@ -114,6 +115,45 @@ describe("runMirror", () => {
 		expect(process.exitCode).toBe(1);
 	});
 
+	it("maps a typed AuthError to AUTH_FAILED (W-23335328)", async () => {
+		// A 401/403 introspection failure reclassified to AuthError must map to
+		// AUTH_FAILED via the typed check. Its message contains "Schema priming
+		// failed …", so classifyErrorMessage's message regex would return
+		// SCHEMA_PRIME_FAILED — an untyped fallthrough would mislabel a 401 as a
+		// schema problem, which is exactly the confusion W-23335328 fixes.
+		const authMessage =
+			'Schema priming failed for "o" — the org session is expired or unauthorized. Re-authenticate with `sf org login web --alias o`.';
+		const build = async () => {
+			throw new AuthError(authMessage);
+		};
+
+		const out = await captureStdout(() =>
+			runMirror('{"org":"o","object":"Account"}', SCHEMA, build),
+		);
+
+		const parsed = JSON.parse(out);
+		expect(parsed.error.code).toBe("AUTH_FAILED");
+		expect(parsed.error.message).toContain("Re-authenticate");
+		expect(process.exitCode).toBe(1);
+	});
+
+	it("the SAME message on a BARE Error would misclassify as SCHEMA_PRIME_FAILED — proves the typed check is load-bearing (W-23335328)", async () => {
+		// Regression guard for the trap the typed AuthError branch avoids: the auth
+		// message contains "Schema priming", which classifyErrorMessage's regex maps
+		// to SCHEMA_PRIME_FAILED. Only the `instanceof AuthError` check rescues it.
+		const build = async () => {
+			throw new Error(
+				'Schema priming failed for "o" — the org session is expired or unauthorized. Re-authenticate with `sf org login web --alias o`.',
+			);
+		};
+
+		const out = await captureStdout(() =>
+			runMirror('{"org":"o","object":"Account"}', SCHEMA, build),
+		);
+
+		expect(JSON.parse(out).error.code).toBe("SCHEMA_PRIME_FAILED");
+	});
+
 	it("maps SchemaRefreshError to SCHEMA_PRIME_FAILED", async () => {
 		const build = async () => {
 			throw new SchemaRefreshError("schema is stale", {

package/src/commands/mcp-mirror/run-mirror.ts

@@ -5,6 +5,7 @@
  */
 
 import { type z } from "zod";
+import { AuthError } from "../../lib/errors.js";
 import { SchemaRefreshError } from "../../lib/prime-schema.js";
 
 /**
@@ -28,8 +29,8 @@ export type MirrorErrorCode = "INVALID_ARGS" | "AUTH_FAILED" | "SCHEMA_PRIME_FAI
  * code. The intent/auth layers throw plain `Error`s with no type signal, so the
  * only available hint is the message text. This is a NON-CONTRACT heuristic: a
  * reworded upstream message can fall through to `INTERNAL`. The verbatim message
- * is always preserved either way, and the typed `SchemaRefreshError` signal
- * (checked before this) takes precedence. Patterns mirror the MCP-CLI prior art.
+ * is always preserved either way, and the typed `AuthError` / `SchemaRefreshError`
+ * signals (checked before this) take precedence. Patterns mirror the MCP-CLI prior art.
  */
 function classifyErrorMessage(message: string): MirrorErrorCode {
 	if (
@@ -127,17 +128,26 @@ export async function runMirror<T>(
 		return;
 	}
 
-	// 4. Build and emit. Classify failures: the typed SchemaRefreshError signal
-	//    first, then a best-effort message regex (AUTH_FAILED / SCHEMA_PRIME_FAILED),
+	// 4. Build and emit. Classify failures: the typed AuthError / SchemaRefreshError
+	//    signals first, then a best-effort message regex (AUTH_FAILED / SCHEMA_PRIME_FAILED),
 	//    else INTERNAL. The verbatim message is always preserved.
 	try {
 		const output = await build(result.data);
 		console.log(JSON.stringify(output));
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
-		// Typed signal wins; otherwise fall back to the best-effort message regex.
+		// Typed signals win; otherwise fall back to the best-effort message regex.
+		// AuthError is checked first because its message (W-23335328) reads "Schema
+		// priming failed … expired or unauthorized. Re-authenticate …" — that
+		// "priming" makes classifyErrorMessage return SCHEMA_PRIME_FAILED, so an
+		// untyped fallthrough would misclassify a 401/403 introspection failure as a
+		// schema problem (the exact Schema-vs-Auth confusion this WI fixes).
 		const code: MirrorErrorCode =
-			err instanceof SchemaRefreshError ? "SCHEMA_PRIME_FAILED" : classifyErrorMessage(message);
+			err instanceof AuthError
+				? "AUTH_FAILED"
+				: err instanceof SchemaRefreshError
+					? "SCHEMA_PRIME_FAILED"
+					: classifyErrorMessage(message);
 		// The stack is omitted by default so the envelope never leaks internals;
 		// GRAPHITI_DEBUG=1 opts into attaching it under `details` for debugging.
 		const details =

package/src/lib/__tests__/prime-schema.spec.ts

@@ -501,6 +501,115 @@ describe("lib/prime-schema", () => {
 		}
 	});
 
+	// ── 401/403 introspection auth reclassification (W-23335328) ───────────────
+	//
+	// A 401/403 from the introspection POST is an AUTH failure (expired/unauthorized
+	// session), not a schema/cache problem. It must surface as AuthError (→ `Auth:`),
+	// on BOTH the lazy-prime and forced-refresh paths, keyed off the cause shape.
+	// A real jsforce HttpApiError carries a string errorCode/name (ERROR_HTTP_401 or
+	// the body code INVALID_SESSION_ID) and NO numeric statusCode.
+	function jsforce401(errorCode = "ERROR_HTTP_401"): Error {
+		// Mirror jsforce-node's HttpApiError: name === errorCode, no numeric statusCode.
+		return Object.assign(new Error("Session expired or invalid"), {
+			name: errorCode,
+			errorCode,
+		});
+	}
+
+	it("primeSchemaWithLock: a lazy prime that 401s throws AuthError, not SchemaError", async () => {
+		const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "graphiti-prime-401-"));
+		process.env.GRAPHITI_HOME = tmpRoot;
+		try {
+			const { primeSchemaWithLock } = await import("../prime-schema.js");
+			const { AuthError } = await import("../errors.js");
+			const { deps } = makeStubDeps(tmpRoot, { throwOn: { 1: jsforce401() } });
+
+			const err = await primeSchemaWithLock("test-org", deps).catch((e) => e);
+			expect(err).toBeInstanceOf(AuthError);
+			expect(err.message).toMatch(/re-?authenticate/i);
+		} finally {
+			delete process.env.GRAPHITI_HOME;
+			fs.rmSync(tmpRoot, { recursive: true, force: true });
+		}
+	});
+
+	it("primeSchemaWithLock: a forced refresh WITH a surviving cache that 401s throws AuthError (not a soft SchemaRefreshError)", async () => {
+		// N3 regression: even though a usable cached schema survives on disk, a dead
+		// session must hard-fail as AuthError — NOT degrade to the soft-warning
+		// SchemaRefreshError path (which buildConnect would turn into a non-erroring
+		// success). The reclassification is keyed off the cause, not cache survival.
+		const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "graphiti-refresh-401-"));
+		process.env.GRAPHITI_HOME = tmpRoot;
+		try {
+			const { primeSchemaWithLock, SchemaRefreshError } = await import("../prime-schema.js");
+			const { AuthError } = await import("../errors.js");
+
+			const fp = await writeSchemaFile(tmpRoot);
+			const originalContent = fs.readFileSync(fp, "utf-8");
+			const past = new Date(Date.now() - 5_000);
+			fs.utimesSync(fp, past, past);
+
+			const { deps } = makeStubDeps(tmpRoot, { throwOn: { 1: jsforce401("INVALID_SESSION_ID") } });
+
+			const err = await primeSchemaWithLock("test-org", deps, { forceRefresh: true }).catch(
+				(e) => e,
+			);
+			expect(err).toBeInstanceOf(AuthError);
+			expect(err).not.toBeInstanceOf(SchemaRefreshError);
+			// The surviving cache is left untouched — clears only happen after a
+			// successful download, and the throw precedes any clear.
+			expect(fs.readFileSync(fp, "utf-8")).toBe(originalContent);
+		} finally {
+			delete process.env.GRAPHITI_HOME;
+			fs.rmSync(tmpRoot, { recursive: true, force: true });
+		}
+	});
+
+	it("primeSchemaWithLock: a forced refresh with NO prior cache that 401s throws AuthError", async () => {
+		const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "graphiti-refresh-401-nocache-"));
+		process.env.GRAPHITI_HOME = tmpRoot;
+		try {
+			const { primeSchemaWithLock } = await import("../prime-schema.js");
+			const { AuthError } = await import("../errors.js");
+			const { deps } = makeStubDeps(tmpRoot, { throwOn: { 1: jsforce401("ERROR_HTTP_403") } });
+
+			const err = await primeSchemaWithLock("test-org", deps, { forceRefresh: true }).catch(
+				(e) => e,
+			);
+			expect(err).toBeInstanceOf(AuthError);
+		} finally {
+			delete process.env.GRAPHITI_HOME;
+			fs.rmSync(tmpRoot, { recursive: true, force: true });
+		}
+	});
+
+	it("primeSchemaWithLock: a non-auth 4xx refresh failure STILL yields the soft SchemaRefreshError (no over-broadening)", async () => {
+		// Guard the boundary: only 401/403 reclassify. A 404 (or any other cause)
+		// with a surviving cache keeps the existing soft-warning SchemaRefreshError path.
+		const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "graphiti-refresh-404-"));
+		process.env.GRAPHITI_HOME = tmpRoot;
+		try {
+			const { primeSchemaWithLock, SchemaRefreshError } = await import("../prime-schema.js");
+
+			const fp = await writeSchemaFile(tmpRoot);
+			const past = new Date(Date.now() - 5_000);
+			fs.utimesSync(fp, past, past);
+
+			const { deps } = makeStubDeps(tmpRoot, {
+				throwOn: { 1: Object.assign(new Error("not found"), { statusCode: 404 }) },
+			});
+
+			const err = await primeSchemaWithLock("test-org", deps, { forceRefresh: true }).catch(
+				(e) => e,
+			);
+			expect(err).toBeInstanceOf(SchemaRefreshError);
+			expect(err.staleSince).toBeTruthy();
+		} finally {
+			delete process.env.GRAPHITI_HOME;
+			fs.rmSync(tmpRoot, { recursive: true, force: true });
+		}
+	});
+
 	it("primeSchemaWithLock: a coalesced refresh clears its OWN stale caches (R4, isolated from the winner)", async () => {
 		const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "graphiti-refresh-r4-"));
 		process.env.GRAPHITI_HOME = tmpRoot;

package/src/lib/errors.ts

@@ -105,7 +105,11 @@ export function classifyCause(cause: unknown): RetryHint {
 
 		const codeStr = typeof c.errorCode === "string" ? c.errorCode : "";
 		const nameStr = typeof c.name === "string" ? c.name : "";
-		const httpMatch = /ERROR_HTTP_(\d{3})/.exec(`${codeStr} ${nameStr}`);
+		// `(?!\d)` anchors the status to EXACTLY three digits: without it the greedy
+		// `\d{3}` would capture the first three digits of a 4-digit tail (e.g. a
+		// hypothetical `ERROR_HTTP_5001` → `500`), misreading the class. jsforce only
+		// emits canonical 3-digit codes today, so this is defensive hardening.
+		const httpMatch = /ERROR_HTTP_(\d{3})(?!\d)/.exec(`${codeStr} ${nameStr}`);
 		if (httpMatch) {
 			const httpStatus = Number(httpMatch[1]);
 			if (TRANSIENT_STATUS.has(httpStatus)) return "backoff";
@@ -127,6 +131,72 @@ export function classifyCause(cause: unknown): RetryHint {
 	return "no";
 }
 
+// HTTP statuses that mean the introspection POST failed to AUTHENTICATE/authorize
+// (W-23335328): the org session is missing, expired, or lacks access. The fix is
+// to re-authenticate, so these route to `Auth:` — not `Schema:` (re-prime) — at the
+// MCP boundary. A subset of PERMANENT_STATUS, so they stay non-retryable too.
+const AUTH_STATUS = new Set([401, 403]);
+// Salesforce error codes that ARE a 401 in disguise. jsforce-node collapses a 4xx
+// whose body parses as a Salesforce error array into an HttpApiError whose
+// `errorCode`/`name` is the body code (e.g. INVALID_SESSION_ID for an expired
+// session) and sets NO numeric statusCode — so the canonical expired-session case
+// never presents a 401 status here and must be matched by code. Deliberately kept
+// to the session-invalid code we can tie authoritatively to "re-authenticate fixes
+// it". A structured 403 body code such as INSUFFICIENT_ACCESS / API_DISABLED_FOR_ORG
+// is intentionally NOT here: those are org permission/config problems that a fresh
+// login does NOT resolve, so routing them to `Auth:` ("re-authenticate") would
+// misguide the agent — they correctly stay `Schema:`. Extend only with codes where
+// re-auth is the right remedy (e.g. INVALID_AUTH_HEADER, MISSING_OAUTH_TOKEN) as
+// they are observed on this path.
+const AUTH_ERROR_CODES = new Set(["INVALID_SESSION_ID"]);
+
+/**
+ * Detect whether an introspection/download `cause` is a 401/403-class auth failure
+ * that should surface as `Auth:` (re-authenticate) rather than `Schema:` (W-23335328).
+ *
+ * Mirrors {@link classifyCause}'s defensive shape-reading. A real jsforce /
+ * `@salesforce/core` HTTP failure carries a string `errorCode`/`name` — jsforce-node's
+ * `HttpApiError` sets `ERROR_HTTP_401`/`ERROR_HTTP_403` for a status-only failure, or
+ * the body's code (e.g. `INVALID_SESSION_ID`) for an expired session — but NOT a numeric
+ * `statusCode`; so the `ERROR_HTTP_<nnn>` regex on `errorCode`/`name` and the
+ * `AUTH_ERROR_CODES` check are the load-bearing paths, and the `statusCode` branch is a
+ * defensive fallback for other cause shapes (and the contract tests' status-bearing
+ * doubles). Every property read is wrapped so a `cause` with a throwing accessor falls
+ * back to `false` (this runs on the priming-failure path; an escaped throw would drop the
+ * classification). Returns false for a null/undefined/non-object cause and for any
+ * non-auth status — we never over-broaden: a 4xx that is not 401/403 stays `Schema:`.
+ *
+ * Note (W-23148365 N3): callers must key the Auth reclassification off THIS cause-shape
+ * inspection, never off retry-token absence or schema-cache survival — a forced refresh
+ * that keeps a usable cache emits no token regardless of the cause, so "no token" is not a
+ * reliable signal that a 401/403 occurred.
+ */
+export function isAuthError(cause: unknown): boolean {
+	if (typeof cause !== "object" || cause === null) return false;
+	const c = cause as Record<string, unknown>;
+
+	try {
+		const status = typeof c.statusCode === "number" ? c.statusCode : undefined;
+		if (status !== undefined && AUTH_STATUS.has(status)) return true;
+
+		const codeStr = typeof c.errorCode === "string" ? c.errorCode : "";
+		const nameStr = typeof c.name === "string" ? c.name : "";
+		// `(?!\d)` anchors to EXACTLY three digits so a 4-digit tail can't be misread
+		// as a 401/403 (e.g. `ERROR_HTTP_4011` would otherwise capture `401` and
+		// wrongly route to Auth). Mirrors the same guard in classifyCause.
+		const httpMatch = /ERROR_HTTP_(\d{3})(?!\d)/.exec(`${codeStr} ${nameStr}`);
+		if (httpMatch && AUTH_STATUS.has(Number(httpMatch[1]))) return true;
+
+		if (AUTH_ERROR_CODES.has(codeStr) || AUTH_ERROR_CODES.has(nameStr)) return true;
+	} catch {
+		// A throwing getter on the cause → treat as not-an-auth-error (fall through
+		// to the existing Schema classification, which is the conservative default).
+		return false;
+	}
+
+	return false;
+}
+
 /** Credential/auth resolution failure (e.g. unknown org, expired token). → `Auth:` */
 export class AuthError extends Error {
 	constructor(message: string, opts?: { cause?: unknown }) {

package/src/lib/prime-schema.ts

@@ -7,7 +7,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getOrgAuth as realGetOrgAuth, type OrgAuth } from "./auth.js";
-import { classifyCause, type RetryHint, SchemaError } from "./errors.js";
+import { AuthError, classifyCause, isAuthError, type RetryHint, SchemaError } from "./errors.js";
 import {
 	downloadSchema as realDownloadSchema,
 	getSchemaMetadata,
@@ -296,6 +296,26 @@ export async function primeSchemaWithLock(
 				// through.
 				meta = await deps.downloadSchema(auth);
 			} catch (cause) {
+				// A 401/403 from the introspection POST is an AUTH failure, not a
+				// schema/cache problem (W-23335328): surface it as AuthError so the MCP
+				// boundary emits `Auth:` (re-authenticate) and the agent re-auths instead
+				// of futilely re-priming. Applies to BOTH lazy prime and forced refresh,
+				// and — per the W-23148365 N3 note — is keyed off the cause SHAPE
+				// (isAuthError), never off retry-token absence or cache survival. On a
+				// forced refresh this INTENTIONALLY bypasses the SchemaRefreshError
+				// soft-surviving-cache path below: a cached schema is worthless once the
+				// session is dead (every subsequent live query 401s too), so a hard Auth
+				// error — not a silent soft-success warning — is the correct signal, and
+				// it is what makes the 401/403 actually route to `Auth:` rather than a
+				// non-erroring `refreshed:false` return. AuthError carries no retry token
+				// (Auth is uniformly non-retryable), preserving the existing contract.
+				if (isAuthError(cause)) {
+					const msg = cause instanceof Error ? cause.message : String(cause);
+					throw new AuthError(
+						`Schema priming failed for "${orgAlias}" — the org session is expired or unauthorized. Re-authenticate with \`sf org login web --alias ${orgAlias}\`.\n${msg}`,
+						{ cause },
+					);
+				}
 				// Lazy prime (no existing cache): no stale cache to keep, so surface
 				// the underlying failure (FR-13.5/13.6). Wrap untyped causes (e.g. a
 				// raw @salesforce/core/jsforce network error from connection.request)

package/src/mcp/tools/__tests__/error-surface.contract.spec.ts

@@ -294,6 +294,36 @@ describe("mcp/tools error surface — category prefixes (contract)", () => {
 		}
 	});
 
+	it("Auth: a 401/403 introspection failure surfaces with the Auth prefix and NO retry token (W-23335328)", async () => {
+		// A real jsforce HttpApiError on a 401 carries a string errorCode/name
+		// (ERROR_HTTP_401, or the body code INVALID_SESSION_ID) and no numeric
+		// statusCode. primeSchemaWithLock reclassifies it to AuthError → `Auth:`,
+		// not `Schema:` — so the agent re-authenticates instead of re-priming.
+		const primeDeps: PrimeDeps = {
+			...makeNoopPrimeDeps(ORG, ORG_URL, SCHEMA),
+			downloadSchema: async () => {
+				throw Object.assign(new Error("Session expired or invalid"), {
+					name: "INVALID_SESSION_ID",
+					errorCode: "INVALID_SESSION_ID",
+				});
+			},
+		};
+		const { client, server } = await connectWith(primeDeps);
+		try {
+			const result = await client.callTool({
+				name: "sf_gql_list",
+				arguments: { org: ORG, object: "Account", fields: ["Id"] },
+			});
+			expect(result.isError).toBe(true);
+			expect(errorText(result)).toMatch(/^Auth: /);
+			// Auth is uniformly non-retryable — it never carries a [retry=...] token.
+			expect(errorText(result)).not.toMatch(/\[retry=/);
+		} finally {
+			await client.close();
+			await server.close();
+		}
+	});
+
 	it("Internal: an unexpected error is sanitized, prefixed, and logged to stderr", async () => {
 		const stderr = vi.spyOn(console, "error").mockImplementation(() => undefined);
 		const home = os.homedir();

package/src/mcp/tools/sf-gql-connect.ts

@@ -21,7 +21,7 @@ export function registerSfGqlConnectTool(
 		"sf_gql_connect",
 		{
 			description:
-				"Connect to a Salesforce org and prime its GraphQL schema cache. With forceRefresh, re-download the schema and coherently clear all caches so subsequent tools see freshly-deployed metadata. Concurrent refreshes coalesce into a single introspection. Returns { org, instanceUrl, refreshed, cached, durationMs, warnings? } — not the standard ToolOutput envelope. If a refresh fails but a usable cached schema survives, returns refreshed:false with a staleness warning instead of erroring. Error convention (all sf_gql_* tools): on failure the isError text is prefixed with a category — `UserInput:` (fix the request), `Auth:` (re-authenticate the org), `Schema:` (introspection/cache problem), or `Internal:` (unexpected) — so you can decide whether to fix inputs, re-auth, or retry. A `Schema:` error additionally ends with a retryability token: `[retry=now]` (retry immediately — e.g. a priming-lock timeout, where no live org round-trip occurred) or `[retry=backoff]` (the org was unreachable and an automatic retry already failed — wait with increasing backoff, e.g. 2^n seconds capped around 8s, and retry serially; do not fan out concurrent retries against an org that is already failing, and note some conditions such as an org API rate limit may take longer than a few seconds to clear); ABSENCE of any `[retry=...]` token means the failure is permanent (404, missing/malformed `__schema`, GraphQL errors in the body, or no cached schema) — do not retry, fix the request or re-prime via sf_gql_connect. This token convention applies to every sf_gql_* tool, not just this one. Example error text: `Schema: introspection request failed [retry=backoff]`; extract the disposition with the end-anchored regex ` /\\s\\[retry=(now|backoff)\\]$/` (no match ⇒ permanent).",
+				"Connect to a Salesforce org and prime its GraphQL schema cache. With forceRefresh, re-download the schema and coherently clear all caches so subsequent tools see freshly-deployed metadata. Concurrent refreshes coalesce into a single introspection. Returns { org, instanceUrl, refreshed, cached, durationMs, warnings? } — not the standard ToolOutput envelope. If a refresh fails transiently (network/5xx) but a usable cached schema survives, returns refreshed:false with a staleness warning instead of erroring; a 401/403 auth failure during refresh instead errors with `Auth:` (a dead session makes the cached schema unusable — re-authenticate). Error convention (all sf_gql_* tools): on failure the isError text is prefixed with a category — `UserInput:` (fix the request), `Auth:` (re-authenticate the org — e.g. an expired/unauthorized session on connect or introspection), `Schema:` (introspection/cache problem), or `Internal:` (unexpected) — so you can decide whether to fix inputs, re-auth, or retry. A `Schema:` error additionally ends with a retryability token: `[retry=now]` (retry immediately — e.g. a priming-lock timeout, where no live org round-trip occurred) or `[retry=backoff]` (the org was unreachable and an automatic retry already failed — wait with increasing backoff, e.g. 2^n seconds capped around 8s, and retry serially; do not fan out concurrent retries against an org that is already failing, and note some conditions such as an org API rate limit may take longer than a few seconds to clear); ABSENCE of any `[retry=...]` token means the failure is permanent (404, missing/malformed `__schema`, GraphQL errors in the body, or no cached schema) — do not retry, fix the request or re-prime via sf_gql_connect. This token convention applies to every sf_gql_* tool, not just this one. Example error text: `Schema: introspection request failed [retry=backoff]`; extract the disposition with the end-anchored regex ` /\\s\\[retry=(now|backoff)\\]$/` (no match ⇒ permanent).",
 			inputSchema,
 		},
 		async (args) => runTool(() => buildConnect(args, opts)),

package/src/schemas/__tests__/tool-adapter.spec.ts

@@ -6,7 +6,13 @@
 
 import os from "node:os";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { AuthError, classifyCause, SchemaError, UserInputError } from "../../lib/errors.js";
+import {
+	AuthError,
+	classifyCause,
+	isAuthError,
+	SchemaError,
+	UserInputError,
+} from "../../lib/errors.js";
 import { SchemaRefreshError } from "../../lib/prime-schema.js";
 import { MutationContextError } from "../../lib/walker.js";
 import { classifyError, neutralizeControlChars, PATH_MARKERS, runTool } from "../tool-adapter.js";
@@ -506,6 +512,14 @@ describe("schemas/tool-adapter — Schema retryability hint (W-23148365)", () =>
 			expect(classifyCause({ errorCode: "REQUEST_LIMIT_EXCEEDED" })).toBe("backoff");
 		});
 
+		it("anchors ERROR_HTTP_<nnn> to exactly 3 digits — a 4-digit tail is not a status", () => {
+			// The `(?!\d)` guard stops the greedy `\d{3}` from reading the leading 3
+			// digits of a longer code (`ERROR_HTTP_5001` must NOT parse as 500/backoff).
+			// No such code exists in jsforce today; this pins the hardening.
+			expect(classifyCause({ errorCode: "ERROR_HTTP_5001" })).toBe("no");
+			expect(classifyCause({ name: "ERROR_HTTP_4291" })).toBe("no");
+		});
+
 		it("defaults to no for an absent/unrecognized cause (never invents retryability)", () => {
 			expect(classifyCause(undefined)).toBe("no");
 			expect(classifyCause(null)).toBe("no");
@@ -530,6 +544,64 @@ describe("schemas/tool-adapter — Schema retryability hint (W-23148365)", () =>
 		});
 	});
 
+	describe("isAuthError — 401/403 auth-failure detection (W-23335328)", () => {
+		// A 401/403 from the introspection POST must reclassify to Auth, not Schema.
+		// isAuthError detects it from the cause SHAPE (never from token absence /
+		// cache survival — the W-23148365 N3 note), mirroring classifyCause's reads.
+		it("detects a numeric 401/403 statusCode (contract-test / non-jsforce shape)", () => {
+			expect(isAuthError({ statusCode: 401 })).toBe(true);
+			expect(isAuthError({ statusCode: 403 })).toBe(true);
+		});
+
+		it("detects the load-bearing jsforce ERROR_HTTP_401/403 on errorCode/name", () => {
+			// jsforce-node's HttpApiError sets string errorCode/name, NOT a numeric
+			// statusCode — this regex path is the real production trigger.
+			expect(isAuthError({ errorCode: "ERROR_HTTP_401" })).toBe(true);
+			expect(isAuthError({ name: "ERROR_HTTP_403" })).toBe(true);
+		});
+
+		it("detects INVALID_SESSION_ID (the expired-session 401 jsforce reports by body code)", () => {
+			// A 401 whose body parses as a Salesforce error array collapses to an
+			// HttpApiError whose errorCode/name is the body code, not ERROR_HTTP_401.
+			expect(isAuthError({ errorCode: "INVALID_SESSION_ID" })).toBe(true);
+			expect(isAuthError({ name: "INVALID_SESSION_ID" })).toBe(true);
+		});
+
+		it("does NOT over-broaden: other 4xx / 5xx / network causes stay non-auth (Schema)", () => {
+			expect(isAuthError({ statusCode: 400 })).toBe(false);
+			expect(isAuthError({ statusCode: 404 })).toBe(false);
+			expect(isAuthError({ statusCode: 429 })).toBe(false);
+			expect(isAuthError({ statusCode: 500 })).toBe(false);
+			expect(isAuthError({ errorCode: "ERROR_HTTP_404" })).toBe(false);
+			expect(isAuthError({ errorCode: "ERROR_HTTP_500" })).toBe(false);
+			expect(isAuthError({ code: "ECONNRESET" })).toBe(false);
+			expect(isAuthError({ errorCode: "REQUEST_LIMIT_EXCEEDED" })).toBe(false);
+			// A 4-digit tail must NOT be truncated to a 401/403 by the `\d{3}` capture:
+			// the `(?!\d)` anchor keeps `ERROR_HTTP_4011`/`4030` out of Auth.
+			expect(isAuthError({ errorCode: "ERROR_HTTP_4011" })).toBe(false);
+			expect(isAuthError({ name: "ERROR_HTTP_4030" })).toBe(false);
+		});
+
+		it("returns false for absent / non-object / unrecognized causes (never invents auth)", () => {
+			expect(isAuthError(undefined)).toBe(false);
+			expect(isAuthError(null)).toBe(false);
+			expect(isAuthError("a bare string")).toBe(false);
+			expect(isAuthError({ unrelated: true })).toBe(false);
+		});
+
+		it("returns false for a cause whose accessor throws (no escape)", () => {
+			const booby = {};
+			Object.defineProperty(booby, "statusCode", {
+				get() {
+					throw new Error("boom");
+				},
+				enumerable: true,
+			});
+			expect(() => isAuthError(booby)).not.toThrow();
+			expect(isAuthError(booby)).toBe(false);
+		});
+	});
+
 	describe("classifyError().retry", () => {
 		it("reads the stamped retry off a typed SchemaError", () => {
 			expect(classifyError(new SchemaError("lock timeout", { retry: "now" })).retry).toBe("now");