@salesforce/lds-runtime-one-app 1.453.0 → 1.455.0

package/dist/oneAppLdsEngineCreator.js

@@ -48,7 +48,7 @@ import { createStorage, clearStorages } from 'force/ldsDurableStorage';
 import { registerSubRequestNetworkAdapter } from 'force/ldsNetwork';
 
 const { create: create$1, freeze, keys: keys$2, entries: entries$1 } = Object;
-const { isArray: isArray$3 } = Array;
+const { isArray: isArray$4 } = Array;
 const { stringify: stringify$3, parse: parse$2 } = JSON;
 const WeakSetConstructor = WeakSet;
 const LogLevelMap = {
@@ -190,7 +190,7 @@ function stableJSONStringify$2(node) {
   }
   let i;
   let out;
-  if (isArray$3(node)) {
+  if (isArray$4(node)) {
     out = "[";
     for (i = 0; i < node.length; i++) {
       if (i) {
@@ -298,7 +298,7 @@ function deepFreeze(value) {
     return;
   }
   deeplyFrozen.add(value);
-  if (isArray$3(value)) {
+  if (isArray$4(value)) {
     for (let i = 0, len = value.length; i < len; i += 1) {
       deepFreeze(value[i]);
     }
@@ -525,7 +525,7 @@ function buildServiceDescriptor$p() {
   };
 }
 
-const { isArray: isArray$2 } = Array;
+const { isArray: isArray$3 } = Array;
 let Ok$1 = class Ok {
   constructor(value) {
     this.value = value;
@@ -605,8 +605,8 @@ function deepEquals$1(x, y) {
     return y === null;
   } else if (y === null) {
     return x === null;
-  } else if (isArray$2(x)) {
-    if (!isArray$2(y) || x.length !== y.length) {
+  } else if (isArray$3(x)) {
+    if (!isArray$3(y) || x.length !== y.length) {
       return false;
     }
     for (let i = 0; i < x.length; ++i) {
@@ -2588,7 +2588,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.453.0-725e09cf25
+// version: 1.455.0-c53c97de2a
 
 class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheControlCommand {
   constructor(config, documentRootType, services) {
@@ -2927,7 +2927,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.453.0-725e09cf25
+// version: 1.455.0-c53c97de2a
 
 class RetryService {
   constructor(defaultRetryPolicy) {
@@ -4640,9 +4640,10 @@ var TypeCheckShapes;
     TypeCheckShapes[TypeCheckShapes["Integer"] = 3] = "Integer";
     TypeCheckShapes[TypeCheckShapes["Unsupported"] = 4] = "Unsupported";
 })(TypeCheckShapes || (TypeCheckShapes = {}));
-// engine version: 0.161.0-fe06f180
+// engine version: 0.161.2-bd1bd38a
 
 const { keys: keys$1 } = Object;
+const { isArray: isArray$2 } = Array;
 
 // we're going to intentionally bundle this small bit of luvio engine code into
 // this module to keep it runtime dependency-free
@@ -4715,7 +4716,14 @@ const fetchNetworkAdapter = async (resourceRequest, _resourceRequestContext) =>
 function generateQueryString(params) {
     const searchParams = new URLSearchParams();
     for (const key of keys$1(params)) {
-        searchParams.append(key, String(params[key]));
+        const value = params[key];
+        // omit undefined and empty-array values entirely: String(undefined) === 'undefined'
+        // and String([]) === '', both of which would otherwise serialize as a valueless
+        // `key=` or literal `key=undefined` query param that servers can reject.
+        if (value === undefined || (isArray$2(value) && value.length === 0)) {
+            continue;
+        }
+        searchParams.append(key, String(value));
     }
     const queryString = searchParams.toString();
     if (queryString.length > 0) {
@@ -5732,7 +5740,7 @@ class PrioritizedConfigService {
       get: (_, property) => {
         const propertyPath = [...path, property];
         const value = this.valueFor(propertyPath);
-        return typeof value === "object" && value !== null && !isArray$3(value) ? this.buildReadonlyObjectProxy(propertyPath) : value;
+        return typeof value === "object" && value !== null && !isArray$4(value) ? this.buildReadonlyObjectProxy(propertyPath) : value;
       },
       getOwnPropertyDescriptor: (target, property) => {
         const propertyPath = [...path, property];
@@ -5740,7 +5748,7 @@ class PrioritizedConfigService {
         return {
           value: (
             // TODO - need to wrap arrays in a Proxy as well
-            typeof value === "object" && value !== null && !isArray$3(value) ? this.buildReadonlyObjectProxy(propertyPath) : value
+            typeof value === "object" && value !== null && !isArray$4(value) ? this.buildReadonlyObjectProxy(propertyPath) : value
           ),
           writable: false,
           configurable: true,
@@ -5841,7 +5849,7 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.453.0-e6dc0c039a
+// version: 1.455.0-96e9b41a18
 
 /**
  * Helpers for reaching the Aura framework from the LDS Aura runtime.
@@ -6414,6 +6422,45 @@ function getCsrfTokenManager() {
     return cached;
 }
 
+/**
+ * Extracts the HTTP method from FetchParameters, matching the Fetch API's own
+ * precedence: an options.method override wins over a Request object's method
+ * (e.g. `fetch(new Request(url, { method: 'GET' }), { method: 'POST' })`
+ * resolves to `POST`).
+ */
+function getFetchMethod([urlOrRequest, options]) {
+    if (options && 'method' in options) {
+        return options.method;
+    }
+    if (typeof urlOrRequest !== 'string' && 'method' in urlOrRequest) {
+        return urlOrRequest.method;
+    }
+    return undefined;
+}
+/**
+ * Only GET requests are safe to replay automatically on 429/503 — replaying a
+ * write (POST/PUT/PATCH/DELETE) risks executing a mutation more than once.
+ * Shared by both the Luvio and generic-fetch throttling retry policies so the
+ * write-guard rule lives in exactly one place.
+ */
+function isRetryableMethod(method) {
+    return method?.toLowerCase() === 'get';
+}
+/**
+ * Determines if the HTTP method requires CSRF protection.
+ * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
+ */
+function isCsrfMethod(method) {
+    if (!method) {
+        return false;
+    }
+    const normalizedMethod = method.toLowerCase();
+    return (normalizedMethod === 'post' ||
+        normalizedMethod === 'put' ||
+        normalizedMethod === 'patch' ||
+        normalizedMethod === 'delete');
+}
+
 const CSRF_TOKEN_HEADER = 'X-CSRF-Token';
 /**
  * Resolves the CSRF token manager and returns the current token. Returns
@@ -6446,23 +6493,6 @@ function areCsrfGatesEnabled() {
         return false;
     }
 }
-/**
- * Determines if the HTTP method requires CSRF protection.
- * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
- *
- * @param method - The HTTP method to check
- * @returns true if the method requires CSRF protection
- */
-function isCsrfMethod(method) {
-    if (!method) {
-        return false;
-    }
-    const normalizedMethod = method.toLowerCase();
-    return (normalizedMethod === 'post' ||
-        normalizedMethod === 'put' ||
-        normalizedMethod === 'patch' ||
-        normalizedMethod === 'delete');
-}
 /**
  * Builds a request interceptor that adds CSRF token headers to mutating requests.
  * The CSRF token is fetched once and cached for subsequent requests.
@@ -6476,17 +6506,8 @@ function buildCsrfTokenInterceptor() {
         if (!areCsrfGatesEnabled()) {
             return resolvedPromiseLike$2(fetchArgs);
         }
-        const [urlOrRequest, options] = fetchArgs;
-        // Determine the method from either Request object or options
-        let method;
-        if (typeof urlOrRequest !== 'string' && 'method' in urlOrRequest) {
-            method = urlOrRequest.method;
-        }
-        else if (options && 'method' in options) {
-            method = options.method;
-        }
         // Only add CSRF token for mutating operations
-        if (isCsrfMethod(method)) {
+        if (isCsrfMethod(getFetchMethod(fetchArgs))) {
             const token = await getCsrfToken();
             if (token) {
                 // eslint-disable-next-line no-param-reassign
@@ -6894,12 +6915,14 @@ const DEFAULT_CONFIG$2 = {
     jitterPercent: 0.5,
 };
 class LuvioFetchThrottlingRetryPolicy extends RetryPolicy {
-    constructor(config = DEFAULT_CONFIG$2) {
+    constructor(config = DEFAULT_CONFIG$2, method) {
         super();
         this.config = config;
+        this.method = method;
     }
     async shouldRetry(result, context) {
-        return ((result.status === 429 || result.status === 503) &&
+        return (isRetryableMethod(this.method) &&
+            (result.status === 429 || result.status === 503) &&
             context.attempt < this.config.maxRetries &&
             context.totalElapsedMs <= this.config.maxTimeToRetry);
     }
@@ -6962,7 +6985,7 @@ function buildLuvioFetchRetryInterceptor() {
     return (request, doFetch) => {
         const csrfPolicy = new LuvioCsrfTokenRetryPolicy();
         const composedPolicy = new ComposedRetryPolicy([
-            new LuvioFetchThrottlingRetryPolicy(),
+            new LuvioFetchThrottlingRetryPolicy(undefined, request.method),
             csrfPolicy,
         ]);
         const retryService = new RetryService(composedPolicy);
@@ -7512,28 +7535,118 @@ async function isCsrfError(response) {
     }
 }
 
-function buildCsrfRetryInterceptor() {
+const DEFAULT_CONFIG = {
+    maxRetries: 3,
+    maxTimeToRetry: 10000,
+    baseDelay: 250,
+    maxDelay: 5000,
+    exponentialFactor: 2,
+    jitterPercent: 0.5,
+};
+class FetchThrottlingRetryPolicy extends RetryPolicy {
+    constructor(config = DEFAULT_CONFIG, method) {
+        super();
+        this.config = config;
+        this.method = method;
+    }
+    async shouldRetry(result, context) {
+        return (isRetryableMethod(this.method) &&
+            (result.status === 429 || result.status === 503) &&
+            context.attempt < this.config.maxRetries &&
+            context.totalElapsedMs <= this.config.maxTimeToRetry);
+    }
+    async calculateDelay(result, context) {
+        let delay;
+        // If retry-after header is present and valid, use it
+        const retryAfterHeader = this.parseRetryAfterHeader(result);
+        if (retryAfterHeader !== undefined) {
+            delay = Math.min(retryAfterHeader, this.config.maxDelay);
+        }
+        else {
+            // Exponential backoff
+            delay = Math.min(this.config.baseDelay * Math.pow(this.config.exponentialFactor, context.attempt), this.config.maxDelay);
+        }
+        // Add jitter to prevent thundering herd
+        const jitter = delay * this.config.jitterPercent * (Math.random() - 0.5);
+        return Math.max(0, delay + jitter);
+    }
+    parseRetryAfterHeader(result) {
+        if (!result.headers) {
+            return undefined;
+        }
+        const value = result.headers.get('Retry-After');
+        if (!value) {
+            return undefined;
+        }
+        // The Retry-After header can be either a number of seconds or an HTTP-date (IMF-fixdate)
+        // Retry-After: <delay-seconds>
+        // Retry-After: <http-date>
+        const trimmed = value.trim();
+        // Strictly treat only all-digits as seconds
+        if (/^\d+$/.test(trimmed)) {
+            const seconds = Number(trimmed);
+            if (Number.isFinite(seconds) && seconds >= 0) {
+                return seconds * 1000; // Convert to milliseconds
+            }
+            return undefined;
+        }
+        // Strict RFC 7231 IMF-fixdate format (e.g., "Sun, 06 Nov 1994 08:49:37 GMT")
+        const IMF_FIXDATE = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
+        if (!IMF_FIXDATE.test(trimmed)) {
+            return undefined;
+        }
+        // Use Date.parse to avoid any engine-specific fallbacks
+        const millis = Date.parse(trimmed);
+        if (Number.isFinite(millis)) {
+            return Math.max(0, millis - Date.now());
+        }
+        return undefined;
+    }
+}
+
+/**
+ * A mutable holder for the current fetch args. CsrfTokenRetryPolicy's
+ * prepareRetry hook updates `args` in place (e.g. to swap in a refreshed CSRF
+ * token) so the retried fetch call picks up the change.
+ */
+function buildCsrfPolicy(mutableRequest) {
+    const csrfPolicy = new CsrfTokenRetryPolicy();
+    csrfPolicy.setRequestContext(mutableRequest);
+    return csrfPolicy;
+}
+/**
+ * Built fresh per request so the write-guard check sees this request's own
+ * HTTP method, rather than one method baked in for the life of the service.
+ */
+function buildThrottlingPolicy(fetchArgs) {
+    return new FetchThrottlingRetryPolicy(undefined, getFetchMethod(fetchArgs));
+}
+/**
+ * Builds the retry interceptor used by the generic Conduit fetch service.
+ *
+ * Composes two independent per-request retry policies — throttling (429/503,
+ * GET-only) and CSRF (401 token refresh) — built fresh per request rather
+ * than reused off a shared defaultRetryPolicy. This keeps concurrent requests
+ * from sharing mutable CSRF request-context state, and lets the throttling
+ * policy see this request's own HTTP method.
+ *
+ * The `retryService` handed in by the framework is used only as the runner for
+ * `applyRetry` — the real policy is always the per-request `composedPolicy`
+ * passed as the override, never the service's own `defaultRetryPolicy`. When no
+ * `retryService` is injected (e.g. the copilot/unauthorized descriptors, which
+ * intentionally opt out of retries), we fall through to a plain fetch.
+ */
+function buildFetchRetryInterceptor() {
     return async (fetchArgs, retryService, _context) => {
         if (retryService) {
-            // Create mutable context for CSRF retry policy
             const mutableRequest = { args: fetchArgs };
-            // Pass context to CSRF policy if it's being used
-            const policy = retryService.defaultRetryPolicy;
-            // Handle both direct CSRF policy and composed policy
-            if (policy instanceof CsrfTokenRetryPolicy) {
-                policy.setRequestContext(mutableRequest);
-            }
-            else if (policy instanceof ComposedRetryPolicy) {
-                // Extract CSRF policy from composed policy
-                const csrfPolicy = policy.getPolicyByType(CsrfTokenRetryPolicy);
-                if (csrfPolicy) {
-                    csrfPolicy.setRequestContext(mutableRequest);
-                }
-            }
-            // Retry service will call prepareRetry hook which updates mutableRequest.args
+            const composedPolicy = new ComposedRetryPolicy([
+                buildThrottlingPolicy(fetchArgs),
+                buildCsrfPolicy(mutableRequest),
+            ]);
             return retryService.applyRetry(async () => {
                 return fetch(...mutableRequest.args);
-            });
+            }, composedPolicy);
         }
         return fetch(...fetchArgs);
     };
@@ -7776,7 +7889,7 @@ function buildCopilotFetchServiceDescriptor(logger) {
                 },
                 buildJwtRequestInterceptor(logger),
             ],
-            retry: buildCsrfRetryInterceptor(),
+            retry: buildFetchRetryInterceptor(),
             finally: [buildThirdPartyTrackerFinishInterceptor()],
         }),
         tags: { specialHacksFor: 'copilot' },
@@ -7786,7 +7899,7 @@ function buildUnauthorizedFetchServiceDescriptor() {
     const fetchService = buildServiceDescriptor$2({
         createContext: createInstrumentationIdContext(),
         request: [buildThirdPartyTrackerRegisterInterceptor()],
-        retry: buildCsrfRetryInterceptor(),
+        retry: buildFetchRetryInterceptor(),
         finally: [buildThirdPartyTrackerFinishInterceptor()],
     });
     return {
@@ -10566,7 +10679,7 @@ function getLexRuntimeDefaultInterceptorConfig(logger) {
             buildEntityEncodingInterceptor(),
             buildFirstPartyHeaderInterceptor(),
         ],
-        retry: buildCsrfRetryInterceptor(),
+        retry: buildFetchRetryInterceptor(),
         response: [
             buildLexRuntime5xxStatusResponseInterceptor(logger),
             buildLexRuntimeSessionExpirationResponseInterceptor(logger),
@@ -10609,73 +10722,6 @@ function buildLexRuntimeCompressedFetchServiceDescriptor(logger, retryService) {
     };
 }
 
-const DEFAULT_CONFIG = {
-    maxRetries: 3,
-    maxTimeToRetry: 10000,
-    baseDelay: 250,
-    maxDelay: 5000,
-    exponentialFactor: 2,
-    jitterPercent: 0.5,
-};
-class FetchThrottlingRetryPolicy extends RetryPolicy {
-    constructor(config = DEFAULT_CONFIG) {
-        super();
-        this.config = config;
-    }
-    async shouldRetry(result, context) {
-        return ((result.status === 429 || result.status === 503) &&
-            context.attempt < this.config.maxRetries &&
-            context.totalElapsedMs <= this.config.maxTimeToRetry);
-    }
-    async calculateDelay(result, context) {
-        let delay;
-        // If retry-after header is present and valid, use it
-        const retryAfterHeader = this.parseRetryAfterHeader(result);
-        if (retryAfterHeader !== undefined) {
-            delay = Math.min(retryAfterHeader, this.config.maxDelay);
-        }
-        else {
-            // Exponential backoff
-            delay = Math.min(this.config.baseDelay * Math.pow(this.config.exponentialFactor, context.attempt), this.config.maxDelay);
-        }
-        // Add jitter to prevent thundering herd
-        const jitter = delay * this.config.jitterPercent * (Math.random() - 0.5);
-        return Math.max(0, delay + jitter);
-    }
-    parseRetryAfterHeader(result) {
-        if (!result.headers) {
-            return undefined;
-        }
-        const value = result.headers.get('Retry-After');
-        if (!value) {
-            return undefined;
-        }
-        // The Retry-After header can be either a number of seconds or an HTTP-date (IMF-fixdate)
-        // Retry-After: <delay-seconds>
-        // Retry-After: <http-date>
-        const trimmed = value.trim();
-        // Strictly treat only all-digits as seconds
-        if (/^\d+$/.test(trimmed)) {
-            const seconds = Number(trimmed);
-            if (Number.isFinite(seconds) && seconds >= 0) {
-                return seconds * 1000; // Convert to milliseconds
-            }
-            return undefined;
-        }
-        // Strict RFC 7231 IMF-fixdate format (e.g., "Sun, 06 Nov 1994 08:49:37 GMT")
-        const IMF_FIXDATE = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
-        if (!IMF_FIXDATE.test(trimmed)) {
-            return undefined;
-        }
-        // Use Date.parse to avoid any engine-specific fallbacks
-        const millis = Date.parse(trimmed);
-        if (Number.isFinite(millis)) {
-            return Math.max(0, millis - Date.now());
-        }
-        return undefined;
-    }
-}
-
 const CSRF_TOKEN_KEY = 'salesforce_csrf_token';
 const CSRF_STORAGE_NAME = 'ldsCSRFToken';
 const BASE_URI = '/services/data/v68.0';
@@ -10819,6 +10865,35 @@ function buildCsrfTokenManager() {
     });
 }
 
+/**
+ * The default policy for the runtime's shared retry service.
+ *
+ * Every fetch-service descriptor wired with the retry service also supplies its
+ * own `retry:` interceptor, which passes a per-request policy as the override to
+ * `applyRetry` — so this default is never consulted on any real path. It is
+ * reachable only if a descriptor is registered with the retry service but omits
+ * its `retry:` interceptor; in that case service-fetch-network falls back to
+ * `retryService.applyRetry(fetch)` with no override, and this policy runs.
+ *
+ * That is a wiring mistake, not a runtime condition. We surface it loudly in
+ * development rather than silently degrading to never-retry (the behavior of a
+ * plain empty policy), following the repo convention for should-never-run paths.
+ */
+class UnconfiguredRetryPolicy extends RetryPolicy {
+    async shouldRetry(_result, _context) {
+        // istanbul ignore else: not exercised in NODE_ENV = production for test coverage
+        if (process.env.NODE_ENV !== 'production') {
+            throw new Error('A fetch-service descriptor was registered with the retry service but did ' +
+                'not supply a `retry:` interceptor. Retries would silently never run — ' +
+                'add a `retry:` interceptor (e.g. buildFetchRetryInterceptor()) to the descriptor.');
+        }
+        return false;
+    }
+    async calculateDelay(_result, _context) {
+        return 0;
+    }
+}
+
 /* eslint-disable no-console */
 /**
  * Default storage configuration for the durable cache
@@ -11420,11 +11495,15 @@ function initializeOneStore(luvio) {
         reader.unMarkMissing();
         return linkedData.data;
     });
-    // Compose both throttling and CSRF retry policies
-    const throttlingPolicy = new FetchThrottlingRetryPolicy();
-    const csrfPolicy = new CsrfTokenRetryPolicy();
-    const retryPolicy = new ComposedRetryPolicy([throttlingPolicy, csrfPolicy]);
-    const retryServiceDescriptor = buildServiceDescriptor$8(retryPolicy);
+    // The real throttling/CSRF policies are built fresh per request in
+    // buildFetchRetryInterceptor (retry-interceptors/fetch-retry.ts) so each
+    // request gets its own CSRF context and sees its own HTTP method. This
+    // default is never consulted by any current fetch-service descriptor (they
+    // all supply their own `retry` interceptor + override); UnconfiguredRetryPolicy
+    // exists so that if a future descriptor is wired with this retry service but
+    // forgets its `retry:` interceptor, the silent never-retry fallback surfaces
+    // loudly in development instead.
+    const retryServiceDescriptor = buildServiceDescriptor$8(new UnconfiguredRetryPolicy());
     const retryService = retryServiceDescriptor.service;
     const csrfTokenManagerServiceDescriptor = buildRenewableResourceManagerDescriptor(CSRF_TOKEN_MANAGER_SERVICE, buildCsrfTokenManager());
     const prefetchSfapJwtServiceDescriptor = {
@@ -11500,4 +11579,4 @@ function ldsEngineCreator() {
 }
 
 export { LexRequestStrategy, PDL_ENGINE_REGISTRATION_ID, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.453.0-725e09cf25
+// version: 1.455.0-c53c97de2a

package/dist/types/http-utils.d.ts

@@ -0,0 +1,20 @@
+import type { FetchParameters } from '@conduit-client/service-fetch-network/v1';
+/**
+ * Extracts the HTTP method from FetchParameters, matching the Fetch API's own
+ * precedence: an options.method override wins over a Request object's method
+ * (e.g. `fetch(new Request(url, { method: 'GET' }), { method: 'POST' })`
+ * resolves to `POST`).
+ */
+export declare function getFetchMethod([urlOrRequest, options]: FetchParameters): string | undefined;
+/**
+ * Only GET requests are safe to replay automatically on 429/503 — replaying a
+ * write (POST/PUT/PATCH/DELETE) risks executing a mutation more than once.
+ * Shared by both the Luvio and generic-fetch throttling retry policies so the
+ * write-guard rule lives in exactly one place.
+ */
+export declare function isRetryableMethod(method: string | undefined): boolean;
+/**
+ * Determines if the HTTP method requires CSRF protection.
+ * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
+ */
+export declare function isCsrfMethod(method: string | undefined): boolean;

package/dist/types/retry-interceptors/fetch-retry.d.ts

@@ -0,0 +1,17 @@
+import type { RetryInterceptor } from '@conduit-client/service-fetch-network/v1';
+/**
+ * Builds the retry interceptor used by the generic Conduit fetch service.
+ *
+ * Composes two independent per-request retry policies — throttling (429/503,
+ * GET-only) and CSRF (401 token refresh) — built fresh per request rather
+ * than reused off a shared defaultRetryPolicy. This keeps concurrent requests
+ * from sharing mutable CSRF request-context state, and lets the throttling
+ * policy see this request's own HTTP method.
+ *
+ * The `retryService` handed in by the framework is used only as the runner for
+ * `applyRetry` — the real policy is always the per-request `composedPolicy`
+ * passed as the override, never the service's own `defaultRetryPolicy`. When no
+ * `retryService` is injected (e.g. the copilot/unauthorized descriptors, which
+ * intentionally opt out of retries), we fall through to a plain fetch.
+ */
+export declare function buildFetchRetryInterceptor(): RetryInterceptor;

package/dist/types/retry-policies/fetch-throttling-retry-policy.d.ts

@@ -10,7 +10,8 @@ type FetchThrottlingRetryPolicyConfig = {
 };
 export declare class FetchThrottlingRetryPolicy extends RetryPolicy<Response> {
     private config;
-    constructor(config?: FetchThrottlingRetryPolicyConfig);
+    private method?;
+    constructor(config?: FetchThrottlingRetryPolicyConfig, method?: string | undefined);
     shouldRetry(result: Response, context: RetryContext<Response>): Promise<boolean>;
     calculateDelay(result: Response, context: RetryContext<Response>): Promise<number>;
     parseRetryAfterHeader(result: Response): number | undefined;

package/dist/types/retry-policies/luvio-fetch-throttling-retry-policy.d.ts

@@ -10,7 +10,8 @@ type LuvioFetchThrottlingRetryPolicyConfig = {
 };
 export declare class LuvioFetchThrottlingRetryPolicy extends RetryPolicy<FetchResponse<any>> {
     private config;
-    constructor(config?: LuvioFetchThrottlingRetryPolicyConfig);
+    private method?;
+    constructor(config?: LuvioFetchThrottlingRetryPolicyConfig, method?: string | undefined);
     shouldRetry(result: FetchResponse<any>, context: RetryContext<FetchResponse<any>>): Promise<boolean>;
     calculateDelay(result: FetchResponse<any>, context: RetryContext<FetchResponse<any>>): Promise<number>;
     parseRetryAfterHeader(result: FetchResponse<any>): number | undefined;

package/dist/types/retry-policies/unconfigured-retry-policy.d.ts

@@ -0,0 +1,20 @@
+import type { RetryContext } from '@conduit-client/service-retry/v1';
+import { RetryPolicy } from '@conduit-client/service-retry/v1';
+/**
+ * The default policy for the runtime's shared retry service.
+ *
+ * Every fetch-service descriptor wired with the retry service also supplies its
+ * own `retry:` interceptor, which passes a per-request policy as the override to
+ * `applyRetry` — so this default is never consulted on any real path. It is
+ * reachable only if a descriptor is registered with the retry service but omits
+ * its `retry:` interceptor; in that case service-fetch-network falls back to
+ * `retryService.applyRetry(fetch)` with no override, and this policy runs.
+ *
+ * That is a wiring mistake, not a runtime condition. We surface it loudly in
+ * development rather than silently degrading to never-retry (the behavior of a
+ * plain empty policy), following the repo convention for should-never-run paths.
+ */
+export declare class UnconfiguredRetryPolicy extends RetryPolicy<Response> {
+    shouldRetry(_result: Response, _context: RetryContext<Response>): Promise<boolean>;
+    calculateDelay(_result: Response, _context: RetryContext<Response>): Promise<number>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-one-app",
-    "version": "1.453.0",
+    "version": "1.455.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for the one.app (LEX) runtime.",
     "main": "dist/oneAppLdsEngineCreator.js",
@@ -34,61 +34,61 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-one-app"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.26.1",
-        "@conduit-client/tools-core": "3.26.1",
-        "@salesforce/lds-adapters-apex": "^1.453.0",
-        "@salesforce/lds-adapters-uiapi": "^1.453.0",
-        "@salesforce/lds-ads-bridge": "^1.453.0",
-        "@salesforce/lds-aura-storage": "^1.453.0",
-        "@salesforce/lds-bindings": "^1.453.0",
-        "@salesforce/lds-instrumentation": "^1.453.0",
-        "@salesforce/lds-network-adapter": "^1.453.0",
-        "@salesforce/lds-network-aura": "^1.453.0",
-        "@salesforce/lds-network-fetch": "^1.453.0",
+        "@conduit-client/service-provisioner": "3.26.3",
+        "@conduit-client/tools-core": "3.26.3",
+        "@salesforce/lds-adapters-apex": "^1.455.0",
+        "@salesforce/lds-adapters-uiapi": "^1.455.0",
+        "@salesforce/lds-ads-bridge": "^1.455.0",
+        "@salesforce/lds-aura-storage": "^1.455.0",
+        "@salesforce/lds-bindings": "^1.455.0",
+        "@salesforce/lds-instrumentation": "^1.455.0",
+        "@salesforce/lds-network-adapter": "^1.455.0",
+        "@salesforce/lds-network-aura": "^1.455.0",
+        "@salesforce/lds-network-fetch": "^1.455.0",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.26.1",
-        "@conduit-client/command-aura-network": "3.26.1",
-        "@conduit-client/command-aura-normalized-cache-control": "3.26.1",
-        "@conduit-client/command-fetch-network": "3.26.1",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.26.1",
-        "@conduit-client/command-http-normalized-cache-control": "3.26.1",
-        "@conduit-client/command-ndjson": "3.26.1",
-        "@conduit-client/command-network": "3.26.1",
-        "@conduit-client/command-sse": "3.26.1",
-        "@conduit-client/command-streaming": "3.26.1",
-        "@conduit-client/jwt-manager": "3.26.1",
-        "@conduit-client/service-aura-network": "3.26.1",
-        "@conduit-client/service-bindings-imperative": "3.26.1",
-        "@conduit-client/service-bindings-lwc": "3.26.1",
-        "@conduit-client/service-cache": "3.26.1",
-        "@conduit-client/service-cache-control": "3.26.1",
-        "@conduit-client/service-cache-inclusion-policy": "3.26.1",
-        "@conduit-client/service-config": "3.26.1",
-        "@conduit-client/service-feature-flags": "3.26.1",
-        "@conduit-client/service-fetch-network": "3.26.1",
-        "@conduit-client/service-instrument-command": "3.26.1",
-        "@conduit-client/service-pubsub": "3.26.1",
-        "@conduit-client/service-renewable-resource-manager": "3.26.1",
-        "@conduit-client/service-store": "3.26.1",
-        "@conduit-client/utils": "3.26.1",
-        "@luvio/network-adapter-composable": "0.161.0",
-        "@luvio/network-adapter-fetch": "0.161.0",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.26.3",
+        "@conduit-client/command-aura-network": "3.26.3",
+        "@conduit-client/command-aura-normalized-cache-control": "3.26.3",
+        "@conduit-client/command-fetch-network": "3.26.3",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.26.3",
+        "@conduit-client/command-http-normalized-cache-control": "3.26.3",
+        "@conduit-client/command-ndjson": "3.26.3",
+        "@conduit-client/command-network": "3.26.3",
+        "@conduit-client/command-sse": "3.26.3",
+        "@conduit-client/command-streaming": "3.26.3",
+        "@conduit-client/jwt-manager": "3.26.3",
+        "@conduit-client/service-aura-network": "3.26.3",
+        "@conduit-client/service-bindings-imperative": "3.26.3",
+        "@conduit-client/service-bindings-lwc": "3.26.3",
+        "@conduit-client/service-cache": "3.26.3",
+        "@conduit-client/service-cache-control": "3.26.3",
+        "@conduit-client/service-cache-inclusion-policy": "3.26.3",
+        "@conduit-client/service-config": "3.26.3",
+        "@conduit-client/service-feature-flags": "3.26.3",
+        "@conduit-client/service-fetch-network": "3.26.3",
+        "@conduit-client/service-instrument-command": "3.26.3",
+        "@conduit-client/service-pubsub": "3.26.3",
+        "@conduit-client/service-renewable-resource-manager": "3.26.3",
+        "@conduit-client/service-store": "3.26.3",
+        "@conduit-client/utils": "3.26.3",
+        "@luvio/network-adapter-composable": "0.161.2",
+        "@luvio/network-adapter-fetch": "0.161.2",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.453.0",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.455.0",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.453.0",
-        "@salesforce/lds-luvio-service": "^1.453.0",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.453.0"
+        "@salesforce/lds-durable-storage": "^1.455.0",
+        "@salesforce/lds-luvio-service": "^1.455.0",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.455.0"
     },
     "luvioBundlesize": [
         {
             "path": "./dist/oneAppLdsEngineCreator.js",
             "maxSize": {
-                "none": "416 kB",
+                "none": "418 kB",
                 "min": "190 kB",
-                "compressed": "73 kB"
+                "compressed": "74 kB"
             }
         }
     ],

package/dist/types/retry-interceptors/csrf-retry.d.ts

@@ -1,2 +0,0 @@
-import type { RetryInterceptor } from '@conduit-client/service-fetch-network/v1';
-export declare function buildCsrfRetryInterceptor(): RetryInterceptor;