@salesforce/lds-runtime-one-app 1.462.0 → 1.463.0

package/dist/oneAppLdsEngineCreator.js

@@ -16,6 +16,7 @@ import { HttpStatusCode as HttpStatusCode$2, InMemoryStore, Environment, Luvio,
 import usePredictiveLoading from '@salesforce/gate/lds.usePredictiveLoading';
 import useLocalStorage from '@salesforce/gate/lds.pdl.useLocalStorage';
 import useOneStoreGraphql from '@salesforce/gate/lds.oneStoreGraphqlEnabled.ltng';
+import usePersistedQueries from '@salesforce/gate/lds.graphqlusepersistedqueries';
 import canCombineRecordLayoutRequests from '@salesforce/gate/lds.pdl.canCombineRecordLayoutRequests';
 import { GetApexWireAdapterFactory, registerPrefetcher as registerPrefetcher$1 } from 'force/ldsAdaptersApex';
 import { instrument, getRecordAvatarsAdapterFactory, getRecordAdapterFactory, coerceFieldIdArray, coerceLayoutTypeArray, coerceLayoutModeArray, getRecordsAdapterFactory, getRecordActionsAdapterFactory, getObjectInfosAdapterFactory, coerceObjectIdArray, getObjectInfoAdapterFactory, coerceObjectId, getRelatedListsActionsAdapterFactory, getRelatedListInfoBatchAdapterFactory, getRelatedListInfoAdapterFactory, getRelatedListRecordsBatchAdapterFactory, getRelatedListRecordsAdapterFactory, getListInfoByNameAdapterFactory, getListInfosByObjectNameAdapterFactory, getListRecordsByNameAdapterFactory, getListObjectInfoAdapterFactory, getRelatedListsInfoAdapterFactory, getRelatedListActionsAdapterFactory, getRecordId18Array, buildRecordRepKeyFromId, configuration, InMemoryRecordRepresentationQueryEvaluator, UiApiNamespace, RecordRepresentationRepresentationType, registerPrefetcher, RecordRepresentationVersion } from 'force/ldsAdaptersUiapi';
@@ -28,7 +29,7 @@ import { dispatchGlobalEvent as dispatchGlobalEvent$1, executeGlobalControllerRa
 import auraNetworkAdapter, { dispatchAuraAction, defaultActionConfig, instrument as instrument$1, forceRecordTransactionsDisabled as forceRecordTransactionsDisabled$1, ldsNetworkAdapterInstrument, CrudEventState, CrudEventType, UIAPI_RECORDS_PATH, UIAPI_RELATED_LIST_RECORDS_BATCH_PATH, UIAPI_RELATED_LIST_RECORDS_PATH } from 'force/ldsNetwork';
 import { ThirdPartyTracker } from 'instrumentation:thirdPartyTracker';
 import { markStart, markEnd, counter, registerCacheStats, perfStart, perfEnd, registerPeriodicLogger, interaction, timer, mark } from 'instrumentation/service';
-import { instrument as instrument$2, isCsrfMethod, getFetchMethod, isRetryableMethod, isRetryableReadPost, compilePathMatchers, setupLexNetworkAdapter, UIAPI_PUBLIC_PATHS, UIAPI_PRIVATE_PATHS, isRetryableOperationType } from 'force/ldsNetworkFetch';
+import { instrument as instrument$2, isMutatingMethod, getFetchMethod, isIdempotentWrite, readUiApiErrorCode, isRetryableMethod, isRetryableReadPost, parseRetryAfterMs, compilePathMatchers, setupLexNetworkAdapter, UIAPI_PUBLIC_PATHS, UIAPI_PRIVATE_PATHS, isRetryableOperationType } from 'force/ldsNetworkFetch';
 import { REFRESH_ADAPTER_EVENT, ADAPTER_UNFULFILLED_ERROR, instrument as instrument$3 } from 'force/ldsBindings';
 import { stateManagerInstrumentation, OperationTypeValue, LRUCache, instrumentAdapter, instrumentLuvio, logMessage as logMessage$1, setupInstrumentation as setupInstrumentation$1, logObjectInfoChanged as logObjectInfoChanged$1, updatePercentileHistogramMetric, incrementCounterMetric, incrementGetRecordNotifyChangeAllowCount, incrementGetRecordNotifyChangeDropCount, incrementNotifyRecordUpdateAvailableAllowCount, incrementNotifyRecordUpdateAvailableDropCount, setLdsAdaptersUiapiInstrumentation, logError as logError$2, setLdsNetworkAdapterInstrumentation, executeAsyncActivity, METRIC_KEYS, onIdleDetected } from 'force/ldsInstrumentation';
 import { instrument as instrument$4 } from 'force/adsBridge';
@@ -388,6 +389,15 @@ function buildServiceDescriptor$q() {
   };
 }
 
+function applyOperationRequestOptions$1(init, operationType) {
+  if (operationType === void 0) {
+    return init;
+  }
+  return {
+    ...init,
+    onestore: { ...init?.onestore, retrySafe: operationType === "query" }
+  };
+}
 class AuraNetworkCommand extends NetworkCommand$1 {
   constructor(services) {
     super(services);
@@ -406,6 +416,18 @@ class AuraNetworkCommand extends NetworkCommand$1 {
       "Fetch parameters must be specified when using HTTP transport on an Aura adapter"
     );
   }
+  /**
+   * The command's operation type. Generated command subclasses override this
+   * getter with their concrete operation (see the generator's
+   * `generateOperationType`); the base returns `undefined` for commands that
+   * don't declare one. On the HTTP fallback path (`fetch`) it derives the
+   * request's `onestore.retrySafe` — reads (`query`) are retry-safe, writes
+   * (`mutation`) are not. Mirrors `FetchNetworkCommand.operationType`, which
+   * this class does not inherit (it extends `NetworkCommand` directly).
+   */
+  get operationType() {
+    return void 0;
+  }
   coerceAuraErrors(auraErrors) {
     return new UserVisibleError(getFetchResponseFromAuraError(auraErrors[0]));
   }
@@ -507,9 +529,11 @@ class AuraNetworkCommand extends NetworkCommand$1 {
         this.coerceAuraErrors
       );
     } else if (this.shouldUseFetch()) {
-      const params = this.fetchParams;
+      const [input, init] = this.fetchParams;
+      const initWithOptions = applyOperationRequestOptions$1(init, this.operationType);
       try {
-        return this.convertFetchResponseToData(this.services.fetch(...params));
+        const fetchCall = initWithOptions === void 0 ? this.services.fetch(input) : this.services.fetch(input, initWithOptions);
+        return this.convertFetchResponseToData(fetchCall);
       } catch (reason) {
         return resolvedPromiseLike$2(err$1(toError(reason)));
       }
@@ -1363,6 +1387,15 @@ class NetworkCommand extends BaseCommand {
   async afterRequestHooks(_options) {
   }
 }
+function applyOperationRequestOptions(init, operationType) {
+  if (operationType === void 0) {
+    return init;
+  }
+  return {
+    ...init,
+    onestore: { ...init?.onestore, retrySafe: operationType === "query" }
+  };
+}
 function isAbortableCommand(command) {
   return !!command && typeof command === "object" && "isAbortableCommand" in command && command.isAbortableCommand === true;
 }
@@ -1452,7 +1485,8 @@ const _FetchNetworkCommand = class _FetchNetworkCommand extends NetworkCommand {
    * `generateOperationType`); the base returns `undefined` for commands that
    * don't declare one (e.g. hand-written commands). Transport-layer
    * interceptors use it to tell a read (`query`) apart from a write — see
-   * `fetch`, which folds it into the context seed.
+   * `fetch`, which folds it into the context seed and derives
+   * `onestore.retrySafe` from it.
    */
   get operationType() {
     return void 0;
@@ -1461,8 +1495,9 @@ const _FetchNetworkCommand = class _FetchNetworkCommand extends NetworkCommand {
     try {
       const [input, init] = this.fetchParams;
       const operationType = this.operationType;
+      const initWithOptions = applyOperationRequestOptions(init, operationType);
       const seed = operationType === void 0 ? contextSeed : { operationType, ...contextSeed };
-      const initWithSeed = seed === void 0 ? init : { ...init, __contextSeed: seed };
+      const initWithSeed = seed === void 0 ? initWithOptions : { ...initWithOptions, __contextSeed: seed };
       const fetchCall = initWithSeed === void 0 ? this.services.fetch(input) : this.services.fetch(input, initWithSeed);
       return this.convertFetchResponseToData(fetchCall);
     } catch (reason) {
@@ -2601,7 +2636,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.462.0-50d9a13ba4
+// version: 1.463.0-ea9ecd17fc
 
 class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheControlCommand {
   constructor(config, documentRootType, services) {
@@ -2940,7 +2975,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.462.0-50d9a13ba4
+// version: 1.463.0-ea9ecd17fc
 
 class RetryService {
   constructor(defaultRetryPolicy) {
@@ -4460,10 +4495,14 @@ function getTextEncoder() {
   }
   return textEncoder;
 }
-function buildCompressionInterceptor(config) {
-  const threshold = config.threshold ?? 1024;
+function buildCompressionInterceptor(defaultConfig) {
   return async (args) => {
     const [resource, options = {}] = args;
+    const config = options.onestore?.compression ?? defaultConfig;
+    if (config === void 0) {
+      return resolvedPromiseLike$2(args);
+    }
+    const threshold = config.threshold ?? 1024;
     if (!options.body || typeof options.body !== "string") {
       return resolvedPromiseLike$2(args);
     }
@@ -5862,7 +5901,7 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.462.0-2919385b97
+// version: 1.463.0-8515018faf
 
 /**
  * Helpers for reaching the Aura framework from the LDS Aura runtime.
@@ -6481,7 +6520,7 @@ function buildCsrfTokenInterceptor() {
             return resolvedPromiseLike$2(fetchArgs);
         }
         // Only add CSRF token for mutating operations
-        if (isCsrfMethod(getFetchMethod(fetchArgs))) {
+        if (isMutatingMethod(getFetchMethod(fetchArgs))) {
             const token = await getCsrfToken();
             if (token) {
                 // eslint-disable-next-line no-param-reassign
@@ -6509,7 +6548,7 @@ function buildLuvioCsrfTokenInterceptor() {
             resourceRequest.headers = {};
         }
         // Only add CSRF token for mutating operations
-        if (isCsrfMethod(resourceRequest.method)) {
+        if (isMutatingMethod(resourceRequest.method)) {
             // Don't overwrite existing CSRF token header if it already exists
             if (!resourceRequest.headers[CSRF_TOKEN_HEADER]) {
                 const token = await getCsrfToken();
@@ -6522,6 +6561,53 @@ function buildLuvioCsrfTokenInterceptor() {
     };
 }
 
+const IDEMPOTENCY_KEY_HEADER = 'Idempotency-Key';
+// Server-side idempotency error codes (UI SDK / UI-API `ApiExceptionCode`); the
+// mobile draft-queue handler is the reference consumer.
+const ERROR_CODE_IDEMPOTENCY_FEATURE_NOT_ENABLED = 'IDEMPOTENCY_FEATURE_NOT_ENABLED';
+const ERROR_CODE_IDEMPOTENCY_NOT_SUPPORTED = 'IDEMPOTENCY_NOT_SUPPORTED';
+const ERROR_CODE_IDEMPOTENCY_BACKEND_OPERATION_ERROR = 'IDEMPOTENCY_BACKEND_OPERATION_ERROR';
+const ERROR_CODE_IDEMPOTENCY_KEY_USED_DIFFERENT_USER = 'IDEMPOTENCY_KEY_USED_DIFFERENT_USER';
+const ERROR_CODE_IDEMPOTENCY_CONCURRENT_REQUEST = 'IDEMPOTENCY_CONCURRENT_REQUEST';
+const ERROR_CODE_IDEMPOTENCY_KEY_ALREADY_USED = 'IDEMPOTENCY_KEY_ALREADY_USED';
+/**
+ * Generates an RFC4122 v4 UUID for use as an idempotency key, preferring
+ * `crypto.randomUUID()` and falling back to a `Math.random()` builder if it is
+ * unavailable (matches the SFAP request-id approach in `network-sfap`).
+ */
+function mintIdempotencyKey() {
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+        return crypto.randomUUID();
+    }
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+        const r = (Math.random() * 16) | 0;
+        const v = c === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}
+/**
+ * Builds a Luvio request interceptor that mints and attaches an `Idempotency-Key`
+ * on mutations to onboarded endpoints, once per logical write, so the retry
+ * service re-sends the same key on every replay and the server can dedupe.
+ *
+ * Minting is gated here; retry *eligibility* is decided separately by
+ * `LuvioIdempotencyRetryPolicy` from the header's presence, so a stale
+ * registry flag can never cause an unsafe replay.
+ */
+function buildLuvioIdempotencyKeyInterceptor() {
+    return async (resourceRequest) => {
+        if (!resourceRequest.headers) {
+            resourceRequest.headers = {};
+        }
+        if (isMutatingMethod(resourceRequest.method) &&
+            isIdempotentWrite(resourceRequest.basePath) &&
+            !resourceRequest.headers[IDEMPOTENCY_KEY_HEADER]) {
+            resourceRequest.headers[IDEMPOTENCY_KEY_HEADER] = mintIdempotencyKey();
+        }
+        return resolvedPromiseLike$2(resourceRequest);
+    };
+}
+
 const ENTITY_ENCODING_HEADER = 'X-Chatter-Entity-Encoding';
 const ENTITY_ENCODING_DISABLED_VALUE = 'false';
 /**
@@ -6818,11 +6904,11 @@ function buildLuvioThirdPartyTrackerFinishInterceptor() {
     };
 }
 
-const DEFAULT_CONFIG$3 = {
+const DEFAULT_CONFIG$4 = {
     maxRetries: 1,
 };
 class LuvioCsrfTokenRetryPolicy extends RetryPolicy {
-    constructor(config = DEFAULT_CONFIG$3) {
+    constructor(config = DEFAULT_CONFIG$4) {
         super();
         this.config = config;
     }
@@ -6866,21 +6952,12 @@ class LuvioCsrfTokenRetryPolicy extends RetryPolicy {
         this.requestContext.request = { ...req, headers };
     }
 }
-/**
- * Returns true when a Luvio FetchResponse indicates a CSRF token error.
- * Body is already parsed JSON on FetchResponse, so no clone/json() needed.
- *
- * UIAPI error bodies come in both shapes: an object `{ errorCode, message }`
- * for single errors, or an array `[{ errorCode, message }]` for endpoints that
- * return collections of errors. Handle both.
- */
+/** True when a Luvio FetchResponse indicates a CSRF token error. */
 function isCsrfError$1(response) {
-    const body = response.body;
-    const errorCode = Array.isArray(body) ? body[0]?.errorCode : body?.errorCode;
-    return errorCode === 'INVALID_ACCESS_TOKEN';
+    return readUiApiErrorCode(response) === 'INVALID_ACCESS_TOKEN';
 }
 
-const DEFAULT_CONFIG$2 = {
+const DEFAULT_CONFIG$3 = {
     maxRetries: 3,
     maxTimeToRetry: 10000,
     baseDelay: 250,
@@ -6894,7 +6971,7 @@ class LuvioFetchThrottlingRetryPolicy extends RetryPolicy {
     // is why we take the plain `ResourceRequest` rather than the mutable-container
     // pattern the CSRF policy uses — that policy rewrites the request (new token)
     // between attempts; this one never mutates it.
-    constructor(config = DEFAULT_CONFIG$2, request) {
+    constructor(config = DEFAULT_CONFIG$3, request) {
         super();
         this.config = config;
         this.request = request;
@@ -6922,57 +6999,157 @@ class LuvioFetchThrottlingRetryPolicy extends RetryPolicy {
         return Math.max(0, delay + jitter);
     }
     parseRetryAfterHeader(result) {
-        const headers = result.headers;
-        if (!headers) {
-            return undefined;
-        }
-        // FetchResponse headers is a plain { [key: string]: string } object
-        // (no Headers.get available), so do a case-insensitive lookup manually.
-        let value;
-        for (const key in headers) {
-            if (key.toLowerCase() === 'retry-after') {
-                value = headers[key];
-                break;
+        return parseRetryAfterMs(result.headers);
+    }
+}
+
+const DEFAULT_CONFIG$2 = {
+    maxRetries: 3,
+};
+// The idempotency handler never emits 429 (that's throttling's domain). Its 503
+// is a keyed-write lock-acquire failure (scenario 7), not throttling's keyless
+// GET/read-POST 503 — the two never contend (see classifyResponse).
+const HTTP_STATUS_BAD_REQUEST = 400;
+const HTTP_STATUS_REQUEST_TIMEOUT = 408;
+const HTTP_STATUS_CONFLICT = 409;
+const HTTP_STATUS_UNPROCESSABLE_ENTITY = 422;
+const HTTP_STATUS_SERVER_ERROR = 500;
+const HTTP_STATUS_SERVICE_UNAVAILABLE = 503;
+// Terminal cases (IDEMPOTENCY_AUTHENTICATION_FAILED on 401, INVALID_IDEMPOTENCY_KEY
+// on 400) are deliberately absent so they fall through to 'none'.
+const STRIP_ERROR_CODES = [
+    ERROR_CODE_IDEMPOTENCY_FEATURE_NOT_ENABLED,
+    ERROR_CODE_IDEMPOTENCY_NOT_SUPPORTED,
+    ERROR_CODE_IDEMPOTENCY_BACKEND_OPERATION_ERROR,
+];
+const ROTATE_ERROR_CODES = [
+    ERROR_CODE_IDEMPOTENCY_KEY_USED_DIFFERENT_USER,
+    ERROR_CODE_IDEMPOTENCY_KEY_ALREADY_USED,
+];
+/**
+ * Maps an idempotent-write response to its disposition. Status alone is
+ * ambiguous (e.g. 409 is same-key for a concurrent request but rotate for a
+ * different user), so pair it with the body's errorCode.
+ */
+function classifyResponse(response) {
+    const errorCode = readUiApiErrorCode(response);
+    // FetchResponse.status is typed as HttpStatusCode, which omits 408/409/422
+    // even though the idempotency handler emits them; widen to match.
+    const status = response.status;
+    switch (status) {
+        case HTTP_STATUS_SERVER_ERROR:
+            return errorCode === ERROR_CODE_IDEMPOTENCY_BACKEND_OPERATION_ERROR ? 'strip' : 'none';
+        case HTTP_STATUS_BAD_REQUEST:
+            // FEATURE_NOT_ENABLED / NOT_SUPPORTED → strip. Any other 400 (incl.
+            // INVALID_IDEMPOTENCY_KEY and CSRF's INVALID_ACCESS_TOKEN) is terminal.
+            return errorCode !== undefined && STRIP_ERROR_CODES.includes(errorCode)
+                ? 'strip'
+                : 'none';
+        case HTTP_STATUS_REQUEST_TIMEOUT:
+            // Backend connection timeout — the write may have already committed;
+            // replay same-key so the server can dedupe.
+            return 'same-key';
+        case HTTP_STATUS_SERVICE_UNAVAILABLE:
+            // Lock-acquire failure (scenario 7): the write never committed. Only a
+            // keyed write reaches here (shouldRetry gates on key presence) — a
+            // keyless 503 is the throttling policy's GET/read-POST case.
+            return 'same-key';
+        case HTTP_STATUS_CONFLICT:
+            // KEY_USED_DIFFERENT_USER → rotate; CONCURRENT_REQUEST → same key.
+            if (errorCode !== undefined && ROTATE_ERROR_CODES.includes(errorCode)) {
+                return 'rotate';
             }
+            return errorCode === ERROR_CODE_IDEMPOTENCY_CONCURRENT_REQUEST ? 'same-key' : 'none';
+        case HTTP_STATUS_UNPROCESSABLE_ENTITY:
+            // Same key reused for a different request body → needs a new key.
+            return errorCode === ERROR_CODE_IDEMPOTENCY_KEY_ALREADY_USED ? 'rotate' : 'none';
+        default:
+            return 'none';
+    }
+}
+/**
+ * Retry policy for writes carrying an `Idempotency-Key`. A peer of the CSRF and
+ * throttling policies in the composed retry chain, not a modification of
+ * either: its 503 (keyed-write lock-acquire) and throttling's 503 (keyless
+ * GET/read-POST) never contend because they key off different requests, and it
+ * only claims a 400/409 when the body carries an idempotency-specific
+ * errorCode, so it never steals CSRF's INVALID_ACCESS_TOKEN.
+ *
+ * Eligibility follows from the header's *presence* on the request, not from
+ * the mint interceptor's registry flag — so a stale flag can never cause an
+ * unsafe replay.
+ */
+class LuvioIdempotencyRetryPolicy extends RetryPolicy {
+    constructor(config = DEFAULT_CONFIG$2) {
+        super();
+        this.config = config;
+    }
+    setRequestContext(context) {
+        this.requestContext = context;
+    }
+    async shouldRetry(result, context) {
+        if (context.attempt >= this.config.maxRetries) {
+            return false;
         }
-        if (!value) {
-            return undefined;
+        const headers = this.requestContext?.request.headers;
+        if (!headers || !headers[IDEMPOTENCY_KEY_HEADER]) {
+            return false;
         }
-        const trimmed = value.trim();
-        if (/^\d+$/.test(trimmed)) {
-            const seconds = Number(trimmed);
-            if (Number.isFinite(seconds) && seconds >= 0) {
-                return seconds * 1000;
-            }
-            return undefined;
+        return classifyResponse(result) !== 'none';
+    }
+    async calculateDelay(result, _context) {
+        // Only same-key replays (408/409/503) carry a Retry-After to honor;
+        // strip/rotate retry immediately.
+        if (classifyResponse(result) !== 'same-key') {
+            return 0;
         }
-        const IMF_FIXDATE = /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), \d{2} (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{4} \d{2}:\d{2}:\d{2} GMT$/;
-        if (!IMF_FIXDATE.test(trimmed)) {
-            return undefined;
+        // Honor the server's Retry-After in full, like the mobile handler — it's
+        // a lock-hold hint, not a client-owned backoff (unlike the throttling
+        // sibling's capped delay). maxRetries bounds replays instead.
+        return parseRetryAfterMs(result.headers) ?? 0;
+    }
+    async prepareRetry(result, _context) {
+        if (!this.requestContext) {
+            return;
         }
-        const millis = Date.parse(trimmed);
-        if (Number.isFinite(millis)) {
-            return Math.max(0, millis - Date.now());
+        const disposition = classifyResponse(result);
+        if (disposition === 'same-key' || disposition === 'none') {
+            return;
         }
-        return undefined;
+        const req = this.requestContext.request;
+        // Drop the existing key via immutable spread (matches the CSRF policy).
+        const { [IDEMPOTENCY_KEY_HEADER]: _stale, ...remainingHeaders } = req.headers ?? {};
+        const headers = disposition === 'rotate'
+            ? { ...remainingHeaders, [IDEMPOTENCY_KEY_HEADER]: mintIdempotencyKey() }
+            : // 'strip': retry plain — the feature is unavailable for this request.
+                remainingHeaders;
+        this.requestContext.request = { ...req, headers };
     }
 }
 
 /**
- * Builds the LuvioRetryInterceptor used by the UIAPI fetch adapter.
+ * Builds the LuvioRetryInterceptor used by the UIAPI fetch adapter. A fresh
+ * RetryService and policies are created per request to keep the
+ * mutableRequest context isolated across concurrent requests.
  *
- * A fresh RetryService and policy instances are created per request to keep the
- * CSRF policy's mutableRequest context isolated from concurrent requests.
+ * Policy order matters: ComposedRetryPolicy uses the first matching policy's
+ * shouldRetry/delay. A keyed-write 503 fails throttling's method gate, so it
+ * falls to the idempotency policy to replay same-key.
  */
 function buildLuvioFetchRetryInterceptor() {
     return (request, doFetch) => {
+        const idempotencyPolicy = new LuvioIdempotencyRetryPolicy();
         const csrfPolicy = new LuvioCsrfTokenRetryPolicy();
         const composedPolicy = new ComposedRetryPolicy([
+            idempotencyPolicy,
             new LuvioFetchThrottlingRetryPolicy(undefined, request),
             csrfPolicy,
         ]);
         const retryService = new RetryService(composedPolicy);
         const mutableRequest = { request };
+        // Both policies rewrite headers on the shared request between attempts
+        // (idempotency strips/rotates the key; CSRF refreshes the token).
+        idempotencyPolicy.setRequestContext(mutableRequest);
         csrfPolicy.setRequestContext(mutableRequest);
         return retryService.applyRetry(() => doFetch(mutableRequest.request));
     };
@@ -7184,6 +7361,7 @@ const composedFetchNetworkAdapter = {
             buildLuvioTransportMarksSendInterceptor(),
             buildLuvioPageScopedCacheRequestInterceptor(),
             buildLuvioCsrfTokenInterceptor(),
+            buildLuvioIdempotencyKeyInterceptor(),
             buildLuvioFirstPartyHeaderInterceptor(),
             buildLuvioEntityEncodingInterceptor(),
         ],
@@ -11319,6 +11497,8 @@ function initializeOneStore(luvio) {
     // across LEX and sites. Paired with the HTTP UIAPI fetch path being
     // disabled on sites (see network-fetch.ts).
     featureFlagsService.set('graphQLUseAura', true);
+    // Persisted (named) GraphQL queries; no consumers yet (W-23971639).
+    featureFlagsService.set('graphQLUsePersistedQueries', usePersistedQueries.isOpen({ fallback: false }));
     const services = [
         instrumentationServiceDescriptor,
         buildLexRuntimeDefaultFetchServiceDescriptor(loggerService, retryService),
@@ -11379,4 +11559,4 @@ function ldsEngineCreator() {
 }
 
 export { LexRequestStrategy, PDL_ENGINE_REGISTRATION_ID, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.462.0-50d9a13ba4
+// version: 1.463.0-ea9ecd17fc

package/dist/types/request-interceptors/idempotency-key.d.ts

@@ -0,0 +1,24 @@
+import type { ResourceRequest } from '@luvio/engine';
+export declare const IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
+export declare const ERROR_CODE_IDEMPOTENCY_FEATURE_NOT_ENABLED = "IDEMPOTENCY_FEATURE_NOT_ENABLED";
+export declare const ERROR_CODE_IDEMPOTENCY_NOT_SUPPORTED = "IDEMPOTENCY_NOT_SUPPORTED";
+export declare const ERROR_CODE_IDEMPOTENCY_BACKEND_OPERATION_ERROR = "IDEMPOTENCY_BACKEND_OPERATION_ERROR";
+export declare const ERROR_CODE_IDEMPOTENCY_KEY_USED_DIFFERENT_USER = "IDEMPOTENCY_KEY_USED_DIFFERENT_USER";
+export declare const ERROR_CODE_IDEMPOTENCY_CONCURRENT_REQUEST = "IDEMPOTENCY_CONCURRENT_REQUEST";
+export declare const ERROR_CODE_IDEMPOTENCY_KEY_ALREADY_USED = "IDEMPOTENCY_KEY_ALREADY_USED";
+/**
+ * Generates an RFC4122 v4 UUID for use as an idempotency key, preferring
+ * `crypto.randomUUID()` and falling back to a `Math.random()` builder if it is
+ * unavailable (matches the SFAP request-id approach in `network-sfap`).
+ */
+export declare function mintIdempotencyKey(): string;
+/**
+ * Builds a Luvio request interceptor that mints and attaches an `Idempotency-Key`
+ * on mutations to onboarded endpoints, once per logical write, so the retry
+ * service re-sends the same key on every replay and the server can dedupe.
+ *
+ * Minting is gated here; retry *eligibility* is decided separately by
+ * `LuvioIdempotencyRetryPolicy` from the header's presence, so a stale
+ * registry flag can never cause an unsafe replay.
+ */
+export declare function buildLuvioIdempotencyKeyInterceptor(): (resourceRequest: ResourceRequest) => Promise<ResourceRequest>;

package/dist/types/retry-interceptors/luvio-fetch-retry.d.ts

@@ -1,8 +1,11 @@
 import type { LuvioRetryInterceptor } from '@salesforce/lds-network-fetch';
 /**
- * Builds the LuvioRetryInterceptor used by the UIAPI fetch adapter.
+ * Builds the LuvioRetryInterceptor used by the UIAPI fetch adapter. A fresh
+ * RetryService and policies are created per request to keep the
+ * mutableRequest context isolated across concurrent requests.
  *
- * A fresh RetryService and policy instances are created per request to keep the
- * CSRF policy's mutableRequest context isolated from concurrent requests.
+ * Policy order matters: ComposedRetryPolicy uses the first matching policy's
+ * shouldRetry/delay. A keyed-write 503 fails throttling's method gate, so it
+ * falls to the idempotency policy to replay same-key.
  */
 export declare function buildLuvioFetchRetryInterceptor(): LuvioRetryInterceptor;

package/dist/types/retry-policies/luvio-csrf-token-retry-policy.d.ts

@@ -19,13 +19,6 @@ export declare class LuvioCsrfTokenRetryPolicy extends RetryPolicy<FetchResponse
     calculateDelay(_result: FetchResponse<any>, _context: RetryContext<FetchResponse<any>>): Promise<number>;
     prepareRetry(_result: FetchResponse<any>, _context: RetryContext<FetchResponse<any>>): Promise<void>;
 }
-/**
- * Returns true when a Luvio FetchResponse indicates a CSRF token error.
- * Body is already parsed JSON on FetchResponse, so no clone/json() needed.
- *
- * UIAPI error bodies come in both shapes: an object `{ errorCode, message }`
- * for single errors, or an array `[{ errorCode, message }]` for endpoints that
- * return collections of errors. Handle both.
- */
+/** True when a Luvio FetchResponse indicates a CSRF token error. */
 export declare function isCsrfError(response: FetchResponse<any>): boolean;
 export {};

package/dist/types/retry-policies/luvio-idempotency-retry-policy.d.ts

@@ -0,0 +1,29 @@
+import type { RetryContext } from '@conduit-client/service-retry/v1';
+import { RetryPolicy } from '@conduit-client/service-retry/v1';
+import type { FetchResponse } from '@luvio/engine';
+import type { MutableLuvioRequest } from './luvio-csrf-token-retry-policy';
+type LuvioIdempotencyRetryPolicyConfig = {
+    maxRetries: number;
+};
+/**
+ * Retry policy for writes carrying an `Idempotency-Key`. A peer of the CSRF and
+ * throttling policies in the composed retry chain, not a modification of
+ * either: its 503 (keyed-write lock-acquire) and throttling's 503 (keyless
+ * GET/read-POST) never contend because they key off different requests, and it
+ * only claims a 400/409 when the body carries an idempotency-specific
+ * errorCode, so it never steals CSRF's INVALID_ACCESS_TOKEN.
+ *
+ * Eligibility follows from the header's *presence* on the request, not from
+ * the mint interceptor's registry flag — so a stale flag can never cause an
+ * unsafe replay.
+ */
+export declare class LuvioIdempotencyRetryPolicy extends RetryPolicy<FetchResponse<any>> {
+    private config;
+    private requestContext?;
+    constructor(config?: LuvioIdempotencyRetryPolicyConfig);
+    setRequestContext(context: MutableLuvioRequest): void;
+    shouldRetry(result: FetchResponse<any>, context: RetryContext<FetchResponse<any>>): Promise<boolean>;
+    calculateDelay(result: FetchResponse<any>, _context: RetryContext<FetchResponse<any>>): Promise<number>;
+    prepareRetry(result: FetchResponse<any>, _context: RetryContext<FetchResponse<any>>): Promise<void>;
+}
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-one-app",
-    "version": "1.462.0",
+    "version": "1.463.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for the one.app (LEX) runtime.",
     "main": "dist/oneAppLdsEngineCreator.js",
@@ -34,53 +34,53 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-one-app"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.29.0",
-        "@conduit-client/tools-core": "3.29.0",
-        "@salesforce/lds-adapters-apex": "^1.462.0",
-        "@salesforce/lds-adapters-uiapi": "^1.462.0",
-        "@salesforce/lds-ads-bridge": "^1.462.0",
-        "@salesforce/lds-aura-storage": "^1.462.0",
-        "@salesforce/lds-bindings": "^1.462.0",
-        "@salesforce/lds-instrumentation": "^1.462.0",
-        "@salesforce/lds-network-adapter": "^1.462.0",
-        "@salesforce/lds-network-aura": "^1.462.0",
-        "@salesforce/lds-network-fetch": "^1.462.0",
+        "@conduit-client/service-provisioner": "3.30.0",
+        "@conduit-client/tools-core": "3.30.0",
+        "@salesforce/lds-adapters-apex": "^1.463.0",
+        "@salesforce/lds-adapters-uiapi": "^1.463.0",
+        "@salesforce/lds-ads-bridge": "^1.463.0",
+        "@salesforce/lds-aura-storage": "^1.463.0",
+        "@salesforce/lds-bindings": "^1.463.0",
+        "@salesforce/lds-instrumentation": "^1.463.0",
+        "@salesforce/lds-network-adapter": "^1.463.0",
+        "@salesforce/lds-network-aura": "^1.463.0",
+        "@salesforce/lds-network-fetch": "^1.463.0",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.29.0",
-        "@conduit-client/command-aura-network": "3.29.0",
-        "@conduit-client/command-aura-normalized-cache-control": "3.29.0",
-        "@conduit-client/command-fetch-network": "3.29.0",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.29.0",
-        "@conduit-client/command-http-normalized-cache-control": "3.29.0",
-        "@conduit-client/command-ndjson": "3.29.0",
-        "@conduit-client/command-network": "3.29.0",
-        "@conduit-client/command-sse": "3.29.0",
-        "@conduit-client/command-streaming": "3.29.0",
-        "@conduit-client/jwt-manager": "3.29.0",
-        "@conduit-client/service-aura-network": "3.29.0",
-        "@conduit-client/service-bindings-imperative": "3.29.0",
-        "@conduit-client/service-bindings-lwc": "3.29.0",
-        "@conduit-client/service-cache": "3.29.0",
-        "@conduit-client/service-cache-control": "3.29.0",
-        "@conduit-client/service-cache-inclusion-policy": "3.29.0",
-        "@conduit-client/service-config": "3.29.0",
-        "@conduit-client/service-feature-flags": "3.29.0",
-        "@conduit-client/service-fetch-network": "3.29.0",
-        "@conduit-client/service-instrument-command": "3.29.0",
-        "@conduit-client/service-pubsub": "3.29.0",
-        "@conduit-client/service-renewable-resource-manager": "3.29.0",
-        "@conduit-client/service-store": "3.29.0",
-        "@conduit-client/utils": "3.29.0",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.30.0",
+        "@conduit-client/command-aura-network": "3.30.0",
+        "@conduit-client/command-aura-normalized-cache-control": "3.30.0",
+        "@conduit-client/command-fetch-network": "3.30.0",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.30.0",
+        "@conduit-client/command-http-normalized-cache-control": "3.30.0",
+        "@conduit-client/command-ndjson": "3.30.0",
+        "@conduit-client/command-network": "3.30.0",
+        "@conduit-client/command-sse": "3.30.0",
+        "@conduit-client/command-streaming": "3.30.0",
+        "@conduit-client/jwt-manager": "3.30.0",
+        "@conduit-client/service-aura-network": "3.30.0",
+        "@conduit-client/service-bindings-imperative": "3.30.0",
+        "@conduit-client/service-bindings-lwc": "3.30.0",
+        "@conduit-client/service-cache": "3.30.0",
+        "@conduit-client/service-cache-control": "3.30.0",
+        "@conduit-client/service-cache-inclusion-policy": "3.30.0",
+        "@conduit-client/service-config": "3.30.0",
+        "@conduit-client/service-feature-flags": "3.30.0",
+        "@conduit-client/service-fetch-network": "3.30.0",
+        "@conduit-client/service-instrument-command": "3.30.0",
+        "@conduit-client/service-pubsub": "3.30.0",
+        "@conduit-client/service-renewable-resource-manager": "3.30.0",
+        "@conduit-client/service-store": "3.30.0",
+        "@conduit-client/utils": "3.30.0",
         "@luvio/network-adapter-composable": "0.161.2",
         "@luvio/network-adapter-fetch": "0.161.2",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.462.0",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.463.0",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.462.0",
-        "@salesforce/lds-luvio-service": "^1.462.0",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.462.0"
+        "@salesforce/lds-durable-storage": "^1.463.0",
+        "@salesforce/lds-luvio-service": "^1.463.0",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.463.0"
     },
     "luvioBundlesize": [
         {