@salesforce/lds-network-fetch 1.461.0 → 1.463.0

package/dist/ldsNetworkFetch.js

@@ -909,13 +909,11 @@ function instrument(newInstrumentation) {
 }
 
 /**
- * Canonical registry of the UIAPI url paths LDS sends over HTTP and their
- * read/write nature — the single source of truth for every runtime's transport
- * allowlist and read-POST retry classifier. A leaf module (no local imports) so
- * both can consume it without an import cycle: `network-fetch.ts` imports the
- * retry interceptor, so the retry layer must import paths from here, not back
- * from `network-fetch.ts`. Templates use `{segment}` placeholders (see
- * `compilePathMatchers`); callers normalize trailing slashes.
+ * Canonical registry of UIAPI url paths LDS sends over HTTP, and their
+ * read/write nature — shared by every runtime's transport allowlist and
+ * read-POST retry classifier. A leaf module (no local imports), since
+ * `network-fetch.ts` imports the retry interceptor, which must import paths
+ * from here rather than back from `network-fetch.ts`.
  */
 /**
  * Public UIAPI paths verified for HTTP transport: no `UiTier` Connect
@@ -933,10 +931,13 @@ const UIAPI_PUBLIC_PATH_ENTRIES = [
     // getPicklistValuesByRecordType — IPicklistValuesByRecordTypeResource
     { path: '/ui-api/object-info/{objectApiName}/picklist-values/{recordTypeId}' },
     // ----- Records -----
-    // createRecord (POST) — IRecordDataCollectionResource
-    { path: '/ui-api/records' },
-    // getRecord / updateRecord (PATCH) / deleteRecord (DELETE) — IRecordDataResource
-    { path: '/ui-api/records/{recordId}' },
+    // createRecord (POST) — IRecordDataCollectionResource.
+    // Onboarded to the server Idempotency-Key feature: the interceptor mints a
+    // key for the POST so a throttled create can replay safely (dedupe by key).
+    { path: '/ui-api/records', idempotentWrite: true },
+    // getRecord / updateRecord (PATCH) / deleteRecord (DELETE) — IRecordDataResource.
+    // Onboarded to the server Idempotency-Key feature (PATCH/DELETE writes).
+    { path: '/ui-api/records/{recordId}', idempotentWrite: true },
     // getRecords (batch GET) — IBatchRecordDataResource
     { path: '/ui-api/records/batch/{recordIds}' },
     // executeBatchRecordOperations (POST, no recordIds segment) — IBatchRecordResource
@@ -1127,6 +1128,34 @@ function isRetryableReadPost(basePath) {
     }
     return RETRYABLE_READ_POST_MATCHERS.some((matcher) => matcher.test(path));
 }
+// The idempotent-write subset, precompiled once at module load from the same
+// entries so a flagged path is always also a registered transport path.
+const IDEMPOTENT_WRITE_MATCHERS = compilePathMatchers([...UIAPI_PUBLIC_PATH_ENTRIES, ...UIAPI_PRIVATE_PATH_ENTRIES]
+    .filter((entry) => entry.idempotentWrite)
+    .map((entry) => entry.path));
+// Non-flagged templates that structurally collide with a flagged one (e.g.
+// `/ui-api/records/batch` vs `/ui-api/records/{recordId}`) — a match here means
+// the concrete path is the sibling, not an idempotent write. Derived from the
+// registry so a new sibling can't silently inherit minting.
+const IDEMPOTENT_WRITE_EXCLUSION_MATCHERS = compilePathMatchers([...UIAPI_PUBLIC_PATH_ENTRIES, ...UIAPI_PRIVATE_PATH_ENTRIES]
+    .filter((entry) => !entry.idempotentWrite)
+    .map((entry) => entry.path));
+/**
+ * True when the request path is onboarded to the Idempotency-Key feature.
+ * Gates minting only; must match a flagged template and not a more-specific
+ * non-flagged sibling (see IDEMPOTENT_WRITE_EXCLUSION_MATCHERS).
+ */
+function isIdempotentWrite(basePath) {
+    if (!basePath) {
+        return false;
+    }
+    let path = basePath.trim();
+    if (path.endsWith('/')) {
+        path = path.substring(0, path.length - 1);
+    }
+    return (IDEMPOTENT_WRITE_MATCHERS.some((matcher) => matcher.test(path)) &&
+        !IDEMPOTENT_WRITE_EXCLUSION_MATCHERS.some((matcher) => matcher.test(path)));
+}
 
 /**
  * Extracts the HTTP method from FetchParameters, matching the Fetch API's own
@@ -1165,10 +1194,11 @@ function isRetryableOperationType(operationType) {
     return operationType === 'query';
 }
 /**
- * Determines if the HTTP method requires CSRF protection.
- * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
+ * True for a mutating HTTP method (POST/PUT/PATCH/DELETE) — gates both CSRF
+ * token attachment and Idempotency-Key minting, since both apply to the same
+ * set of methods.
  */
-function isCsrfMethod(method) {
+function isMutatingMethod(method) {
     if (!method) {
         return false;
     }
@@ -1178,6 +1208,48 @@ function isCsrfMethod(method) {
         normalizedMethod === 'patch' ||
         normalizedMethod === 'delete');
 }
+const HTTP_HEADER_RETRY_AFTER = 'retry-after';
+const IMF_FIXDATE = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+/**
+ * Parses a `Retry-After` header (case-insensitive lookup) into milliseconds.
+ * Accepts fractional delay-seconds — the idempotency handler and the mobile
+ * reference parser both emit them — or an IMF-fixdate. `Number.isFinite`
+ * rejects `Infinity`/`-Infinity`, which otherwise round-trip cleanly through
+ * `parseFloat` and would produce a non-finite delay.
+ */
+function parseRetryAfterMs(headers) {
+    if (!headers) {
+        return undefined;
+    }
+    let value;
+    for (const key in headers) {
+        if (key.toLowerCase() === HTTP_HEADER_RETRY_AFTER) {
+            value = headers[key];
+            break;
+        }
+    }
+    if (!value) {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    const seconds = parseFloat(trimmed);
+    if (Number.isFinite(seconds) && String(seconds) === trimmed) {
+        return seconds >= 0 ? Math.round(seconds * 1000) : undefined;
+    }
+    if (!IMF_FIXDATE.test(trimmed)) {
+        return undefined;
+    }
+    const millis = Date.parse(trimmed);
+    return Number.isFinite(millis) ? Math.max(0, millis - Date.now()) : undefined;
+}
+/**
+ * Reads the `errorCode` off a UiApiError body. UIAPI returns either a single
+ * `{ errorCode, message }` object or a `[{ errorCode }]` array; handle both.
+ */
+function readUiApiErrorCode(response) {
+    const body = response.body;
+    return Array.isArray(body) ? body[0]?.errorCode : body?.errorCode;
+}
 
-export { UIAPI_PRIVATE_PATHS, UIAPI_PUBLIC_PATHS, compilePathMatchers, getFetchMethod, instrument, isCsrfMethod, isRetryableMethod, isRetryableOperationType, isRetryableReadPost, setupFetchNetworkAdapter, setupLexNetworkAdapter };
-// version: 1.461.0-37b1c9d1cb
+export { UIAPI_PRIVATE_PATHS, UIAPI_PUBLIC_PATHS, compilePathMatchers, getFetchMethod, instrument, isIdempotentWrite, isMutatingMethod, isRetryableMethod, isRetryableOperationType, isRetryableReadPost, parseRetryAfterMs, readUiApiErrorCode, setupFetchNetworkAdapter, setupLexNetworkAdapter };
+// version: 1.463.0-ea9ecd17fc

package/dist/types/http-utils.d.ts

@@ -1,4 +1,5 @@
 import type { FetchParameters } from '@conduit-client/service-fetch-network/v1';
+import type { FetchResponse } from '@luvio/engine';
 /**
  * Extracts the HTTP method from FetchParameters, matching the Fetch API's own
  * precedence: an options.method override wins over a Request object's method
@@ -24,7 +25,21 @@ export declare function isRetryableMethod(method: string | undefined): boolean;
  */
 export declare function isRetryableOperationType(operationType: string | undefined): boolean;
 /**
- * Determines if the HTTP method requires CSRF protection.
- * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
+ * True for a mutating HTTP method (POST/PUT/PATCH/DELETE) — gates both CSRF
+ * token attachment and Idempotency-Key minting, since both apply to the same
+ * set of methods.
  */
-export declare function isCsrfMethod(method: string | undefined): boolean;
+export declare function isMutatingMethod(method: string | undefined): boolean;
+/**
+ * Parses a `Retry-After` header (case-insensitive lookup) into milliseconds.
+ * Accepts fractional delay-seconds — the idempotency handler and the mobile
+ * reference parser both emit them — or an IMF-fixdate. `Number.isFinite`
+ * rejects `Infinity`/`-Infinity`, which otherwise round-trip cleanly through
+ * `parseFloat` and would produce a non-finite delay.
+ */
+export declare function parseRetryAfterMs(headers: Record<string, string> | undefined): number | undefined;
+/**
+ * Reads the `errorCode` off a UiApiError body. UIAPI returns either a single
+ * `{ errorCode, message }` object or a `[{ errorCode }]` array; handle both.
+ */
+export declare function readUiApiErrorCode(response: FetchResponse<any>): string | undefined;

package/dist/types/main.d.ts

@@ -2,5 +2,5 @@ export { setupFetchNetworkAdapter, setupLexNetworkAdapter } from './networkAdapt
 export type { RequestLogger } from './networkAdapter';
 export type { RequestInterceptor, ResponseInterceptor, LuvioRetryInterceptor, Interceptors, } from './utils';
 export { instrument, FetchNetworkInstrumentation } from './instrumentation';
-export { UIAPI_PUBLIC_PATHS, UIAPI_PRIVATE_PATHS, compilePathMatchers, isRetryableReadPost, } from './uiapi-http-paths';
-export { getFetchMethod, isRetryableMethod, isRetryableOperationType, isCsrfMethod, } from './http-utils';
+export { UIAPI_PUBLIC_PATHS, UIAPI_PRIVATE_PATHS, compilePathMatchers, isRetryableReadPost, isIdempotentWrite, } from './uiapi-http-paths';
+export { getFetchMethod, isRetryableMethod, isRetryableOperationType, isMutatingMethod, parseRetryAfterMs, readUiApiErrorCode, } from './http-utils';

package/dist/types/uiapi-http-paths.d.ts

@@ -1,11 +1,9 @@
 /**
- * Canonical registry of the UIAPI url paths LDS sends over HTTP and their
- * read/write nature — the single source of truth for every runtime's transport
- * allowlist and read-POST retry classifier. A leaf module (no local imports) so
- * both can consume it without an import cycle: `network-fetch.ts` imports the
- * retry interceptor, so the retry layer must import paths from here, not back
- * from `network-fetch.ts`. Templates use `{segment}` placeholders (see
- * `compilePathMatchers`); callers normalize trailing slashes.
+ * Canonical registry of UIAPI url paths LDS sends over HTTP, and their
+ * read/write nature — shared by every runtime's transport allowlist and
+ * read-POST retry classifier. A leaf module (no local imports), since
+ * `network-fetch.ts` imports the retry interceptor, which must import paths
+ * from here rather than back from `network-fetch.ts`.
  */
 /** Public transport paths, derived from the canonical registry above. */
 export declare const UIAPI_PUBLIC_PATHS: string[];
@@ -23,3 +21,9 @@ export declare function compilePathMatchers(paths: string[]): RegExp[];
  * the same way the transport allowlist does before matching.
  */
 export declare function isRetryableReadPost(basePath: string | undefined): boolean;
+/**
+ * True when the request path is onboarded to the Idempotency-Key feature.
+ * Gates minting only; must match a flagged template and not a more-specific
+ * non-flagged sibling (see IDEMPOTENT_WRITE_EXCLUSION_MATCHERS).
+ */
+export declare function isIdempotentWrite(basePath: string | undefined): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-network-fetch",
-    "version": "1.461.0",
+    "version": "1.463.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS Network Adapter using fetch",
     "main": "dist/ldsNetworkFetch.js",
@@ -34,12 +34,12 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-network-fetch"
     },
     "dependencies": {
-        "@conduit-client/service-fetch-network": "3.28.0",
+        "@conduit-client/service-fetch-network": "3.30.0",
         "@luvio/engine": "0.161.2",
         "@luvio/network-adapter-fetch": "0.161.2"
     },
     "devDependencies": {
-        "@salesforce/lds-network-aura": "^1.461.0"
+        "@salesforce/lds-network-aura": "^1.463.0"
     },
     "volta": {
         "extends": "../../package.json"