@toshicloud/sdk 0.5.0 → 0.6.0

package/dist/interceptors.js

@@ -1,7 +1,7 @@
 import { ScalarType } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
-import { backoffDelay, isTransportLoss, newRequestKey, procedurePath, retryClassFor, sleep, } from "./retry.js";
-import { asProductError } from "./errors.js";
+import { isTransportLoss, newRequestKey, procedurePath, retryClassFor, retryDelayMs, serverWaitMs, sleep, } from "./retry.js";
+import { asTypedError } from "./errors.js";
 /**
  * Sends `Authorization: Bearer <token>` on every call and stream, on a copy of
  * the request: it is the innermost interceptor, so none outside it sees the
@@ -79,7 +79,11 @@ export function keyInterceptor() {
         return next(req);
     };
 }
-/** Retries a unary read or keyed write after a transport loss, with full jitter (retry.go:98-186). */
+/**
+ * Retries a unary read or keyed write after a transport loss, with full jitter
+ * (retry.go:98-186), or after a refusal that names how long to wait
+ * (serverWaitMs), waiting at least that long.
+ */
 export function retryInterceptor(retry) {
     if (retry === false) {
         return (next) => next;
@@ -96,10 +100,11 @@ export function retryInterceptor(retry) {
                 return await next(req);
             }
             catch (err) {
-                if (attempt + 1 >= policy.maxAttempts || !isTransportLoss(err)) {
+                const waitMs = serverWaitMs(err);
+                if (attempt + 1 >= policy.maxAttempts || (!isTransportLoss(err) && waitMs === undefined)) {
                     throw err;
                 }
-                await sleep(backoffDelay(policy, attempt), req.signal);
+                await sleep(retryDelayMs(policy, attempt, waitMs), req.signal);
             }
         }
     };
@@ -199,14 +204,14 @@ function isShared(msg, desc) {
  * on a stream's messages. It is the outermost interceptor, so the retry and
  * the helpers inside see the ConnectError they always did.
  */
-export function productInterceptor() {
+export function refusalInterceptor() {
     return (next) => async (req) => {
         let res;
         try {
             res = await next(req);
         }
         catch (err) {
-            throw asProductError(err);
+            throw asTypedError(err);
         }
         if (!res.stream) {
             return res;
@@ -219,6 +224,6 @@ async function* productStream(messages) {
         yield* messages;
     }
     catch (err) {
-        throw asProductError(err);
+        throw asTypedError(err);
     }
 }

package/dist/retry.d.ts

@@ -34,6 +34,24 @@ export declare function isTransportLoss(err: unknown): boolean;
 export declare function isStreamLoss(err: unknown): boolean;
 /** A uniform jittered delay in [0, min(maxBackoffMs, initialBackoffMs * 2**attempt)]. */
 export declare function backoffDelay(policy: RetryPolicy, attempt: number): number;
+/**
+ * How long the server asked the client to wait before a retry, in
+ * milliseconds, or undefined when it named no wait. A RESOURCE_EXHAUSTED
+ * refusal names the wait in a google.rpc.RetryInfo detail and in its
+ * Retry-After header, the detail winning when both are there; the API's rate
+ * limit sends both, with the same whole seconds. Such a refusal is retried
+ * only when it names a wait: one without, such as a plan's limit, does not
+ * pass on a retry. An HTTP 429 without a Connect error body reaches the
+ * client as Code.Unavailable with the message "HTTP 429" and the response's
+ * headers (connect 2.2.0 protocol-connect/validate-response.js:33), and names
+ * the wait in its Retry-After. Every other error names none.
+ */
+export declare function serverWaitMs(err: unknown): number | undefined;
+/**
+ * The delay before retry attempt + 1: the backoff's, or the server's wait when
+ * that is longer, never more than maxBackoffMs.
+ */
+export declare function retryDelayMs(policy: RetryPolicy, attempt: number, waitMs: number | undefined): number;
 /** Sleeps, rejecting at once when the signal aborts (retry.go:186-200). */
 export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
 /** The signal's reason as an error, or a Canceled ConnectError. */

package/dist/retry.js

@@ -1,14 +1,26 @@
 import { Code, ConnectError } from "@connectrpc/connect";
+import { BinaryReader, WireType } from "@bufbuild/protobuf/wire";
 /** Five attempts, a 200 ms initial backoff and a 10 s cap (options.go:79-85). */
 export const defaultRetryPolicy = {
     maxAttempts: 5,
     initialBackoffMs: 200,
     maxBackoffMs: 10_000,
 };
-// One entry per procedure of the Workspace API's services. A call that changes
-// what exists carries a request key and is retried; a call with no key is
-// retried only when it reads; a stream is never retried here.
+// One entry per procedure of the Workspace API's services. A stream is never
+// retried here; a call whose request takes a request_key is retried with that
+// key, so the server answers a retry with the first result; a read, a call
+// whose permission's level is read, is retried too; every other call is not.
+// test/retry.test.ts derives each class from the generated descriptors and
+// fails when a regeneration moves a procedure, so an entry follows the API and
+// not a list someone remembered to update. An entry whose class needs saying
+// more about has it above the entry.
 const procedureRetryClass = {
+    "/toshi.workspace.v1.AccountService/GetAccount": "read",
+    "/toshi.workspace.v1.AccountService/ListIdentities": "read",
+    // A repeat answers NOT_FOUND ("an identity the caller does not have fails
+    // with NOT_FOUND"), so a retry would report failure for a call that worked;
+    // its permission's level is read although it changes state.
+    "/toshi.workspace.v1.AccountService/UnlinkIdentity": "none",
     "/toshi.workspace.v1.WorkloadService/CreateJob": "keyed",
     "/toshi.workspace.v1.WorkloadService/GetJob": "read",
     "/toshi.workspace.v1.WorkloadService/ListJobs": "read",
@@ -21,7 +33,10 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.WorkloadService/WatchTelemetry": "none",
     "/toshi.workspace.v1.WorkloadService/WatchGuestLog": "none",
     "/toshi.workspace.v1.WorkloadService/Execute": "none",
+    "/toshi.workspace.v1.WorkloadService/ExecuteCommand": "none",
+    "/toshi.workspace.v1.WorkloadService/AnswerPrompt": "none",
     "/toshi.workspace.v1.WorkloadService/CancelExecution": "keyed",
+    "/toshi.workspace.v1.WorkloadService/ExportEvents": "none",
     "/toshi.workspace.v1.WorkloadService/GetOperation": "read",
     "/toshi.workspace.v1.WorkloadService/WaitOperation": "read",
     "/toshi.workspace.v1.WorkloadService/ListEvents": "read",
@@ -29,11 +44,16 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.WorkloadService/CreatePreviewShareLink": "none",
     "/toshi.workspace.v1.WorkloadService/ListPreviewShareLinks": "read",
     "/toshi.workspace.v1.WorkloadService/RevokePreviewShareLink": "none",
+    "/toshi.workspace.v1.WorkloadService/CreateServiceShareLink": "none",
+    "/toshi.workspace.v1.WorkloadService/ListServiceShareLinks": "read",
+    "/toshi.workspace.v1.WorkloadService/RevokeServiceShareLink": "none",
     "/toshi.workspace.v1.WorkloadService/CreateSandbox": "keyed",
     "/toshi.workspace.v1.WorkloadService/GetSandbox": "read",
     "/toshi.workspace.v1.WorkloadService/ListSandboxes": "read",
     "/toshi.workspace.v1.WorkloadService/UpdateSandbox": "keyed",
     "/toshi.workspace.v1.WorkloadService/DeleteSandbox": "keyed",
+    "/toshi.workspace.v1.WorkloadService/StopSandbox": "keyed",
+    "/toshi.workspace.v1.WorkloadService/StartSandbox": "keyed",
     "/toshi.workspace.v1.WorkloadService/WaitSandbox": "read",
     "/toshi.workspace.v1.WorkloadService/WatchSandboxes": "none",
     "/toshi.workspace.v1.WorkloadService/CreateService": "keyed",
@@ -43,14 +63,34 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.WorkloadService/DeleteService": "keyed",
     "/toshi.workspace.v1.WorkloadService/WaitService": "read",
     "/toshi.workspace.v1.WorkloadService/WatchServices": "none",
-    "/toshi.workspace.v1.WorkloadService/StartService": "none",
-    "/toshi.workspace.v1.WorkloadService/StopService": "none",
-    "/toshi.workspace.v1.WorkloadService/SetServiceMode": "none",
-    "/toshi.workspace.v1.WorkloadService/WakeService": "none",
-    "/toshi.workspace.v1.WorkloadService/HoldService": "none",
-    "/toshi.workspace.v1.WorkloadService/ReleaseService": "none",
+    "/toshi.workspace.v1.WorkloadService/StartService": "keyed",
+    "/toshi.workspace.v1.WorkloadService/StopService": "keyed",
+    "/toshi.workspace.v1.WorkloadService/SetServiceMode": "keyed",
+    "/toshi.workspace.v1.WorkloadService/WakeService": "keyed",
+    // Operator-only, and neither takes a request key: a lost answer is reported
+    // rather than repeated.
+    "/toshi.workspace.v1.WorkloadService/HoldWorkload": "none",
+    "/toshi.workspace.v1.WorkloadService/ReleaseWorkload": "none",
+    "/toshi.workspace.v1.WorkloadService/HoldService": "keyed",
+    "/toshi.workspace.v1.WorkloadService/ReleaseService": "keyed",
+    "/toshi.workspace.v1.WorkloadService/ListServiceRevisions": "read",
+    "/toshi.workspace.v1.WorkloadService/GetServiceRevision": "read",
+    "/toshi.workspace.v1.WorkloadService/RollbackService": "keyed",
+    "/toshi.workspace.v1.WorkloadService/ListServiceActivations": "read",
     "/toshi.workspace.v1.WorkloadService/ListServiceRuns": "read",
-    "/toshi.workspace.v1.SecretService/CreateSecretSet": "none",
+    "/toshi.workspace.v1.WorkloadService/EmitWorkloadEvent": "none",
+    "/toshi.workspace.v1.WorkloadService/SetServiceAlarm": "none",
+    "/toshi.workspace.v1.WorkloadService/GetServiceAlarm": "read",
+    "/toshi.workspace.v1.WorkloadService/ListServiceAlarms": "read",
+    "/toshi.workspace.v1.WorkloadService/DeleteServiceAlarm": "none",
+    "/toshi.workspace.v1.WorkloadService/PauseServiceAlarm": "none",
+    "/toshi.workspace.v1.WorkloadService/ResumeServiceAlarm": "none",
+    "/toshi.workspace.v1.WorkloadService/RunServiceAlarmNow": "keyed",
+    "/toshi.workspace.v1.WorkloadService/StartServiceSignIn": "none",
+    "/toshi.workspace.v1.WorkloadService/AnswerServiceSignIn": "none",
+    "/toshi.workspace.v1.WorkloadService/CancelServiceSignIn": "none",
+    "/toshi.workspace.v1.WorkloadService/GetServiceSignInStatus": "read",
+    "/toshi.workspace.v1.SecretService/CreateSecretSet": "keyed",
     "/toshi.workspace.v1.SecretService/ListSecretSets": "read",
     "/toshi.workspace.v1.SecretService/DeleteSecretSet": "none",
     "/toshi.workspace.v1.SecretService/PutSecret": "none",
@@ -60,18 +100,28 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.SecretService/GrantSecretSet": "none",
     "/toshi.workspace.v1.SecretService/RevokeSecretSet": "none",
     "/toshi.workspace.v1.SecretService/ListSecretSetGrants": "read",
+    "/toshi.workspace.v1.SecretService/UpdateSecretSet": "none",
     "/toshi.workspace.v1.ProjectService/ListProjects": "read",
+    "/toshi.workspace.v1.ProjectService/UpdateProject": "none",
     "/toshi.workspace.v1.ProjectService/ListRepositories": "read",
     "/toshi.workspace.v1.ProjectService/GetProject": "read",
     "/toshi.workspace.v1.ProjectService/ListBranchRules": "read",
-    "/toshi.workspace.v1.ProjectService/CreateProject": "none",
+    "/toshi.workspace.v1.ProjectService/CreateProject": "keyed",
     "/toshi.workspace.v1.ProjectService/ClaimRepository": "none",
-    "/toshi.workspace.v1.ProjectService/CreateEnvironment": "none",
+    "/toshi.workspace.v1.ProjectService/CreateEnvironment": "keyed",
     "/toshi.workspace.v1.ProjectService/DeleteEnvironment": "none",
     "/toshi.workspace.v1.ProjectService/SetBranchRules": "none",
     "/toshi.workspace.v1.ProjectService/CreateEmbedToken": "none",
     "/toshi.workspace.v1.ProjectService/ListEmbedTokens": "read",
     "/toshi.workspace.v1.ProjectService/RevokeEmbedToken": "none",
+    "/toshi.workspace.v1.ProjectService/GetProjectNetwork": "read",
+    "/toshi.workspace.v1.ProjectService/SetProjectNetwork": "none",
+    "/toshi.workspace.v1.ProjectService/GetEnvironmentNetwork": "read",
+    "/toshi.workspace.v1.ProjectService/SetEnvironmentNetwork": "none",
+    "/toshi.workspace.v1.ProjectService/GetEnvironmentRetention": "read",
+    "/toshi.workspace.v1.ProjectService/SetEnvironmentRetention": "none",
+    "/toshi.workspace.v1.ProjectService/SetEnvironmentVolumes": "none",
+    "/toshi.workspace.v1.ProjectService/UpdateEnvironment": "none",
     "/toshi.workspace.v1.WebhookService/CreateWebhookEndpoint": "keyed",
     "/toshi.workspace.v1.WebhookService/GetWebhookEndpoint": "read",
     "/toshi.workspace.v1.WebhookService/ListWebhookEndpoints": "read",
@@ -80,6 +130,9 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.WebhookService/RotateWebhookEndpointSecret": "keyed",
     "/toshi.workspace.v1.WebhookService/ListWebhookDeliveries": "read",
     "/toshi.workspace.v1.WebhookService/ReplayWebhookEvents": "keyed",
+    // A retry returns the session the first call opened, with replayed set and
+    // no token, and opens nothing, so it cannot give the caller a session it can
+    // use.
     "/toshi.workspace.v1.DisplayService/OpenDisplaySession": "none",
     "/toshi.workspace.v1.DisplayService/GetDisplaySession": "read",
     "/toshi.workspace.v1.DisplayService/ListDisplaySessions": "read",
@@ -88,7 +141,7 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.DisplayService/SendDisplayPointer": "none",
     "/toshi.workspace.v1.DisplayService/SetDisplayClipboard": "none",
     "/toshi.workspace.v1.DisplayService/TakeDisplayScreenshot": "none",
-    "/toshi.workspace.v1.ChannelService/CreateChannel": "none",
+    "/toshi.workspace.v1.ChannelService/CreateChannel": "keyed",
     "/toshi.workspace.v1.ChannelService/ListChannels": "read",
     "/toshi.workspace.v1.ChannelService/GetChannel": "read",
     "/toshi.workspace.v1.ChannelService/GetChannelPolicy": "read",
@@ -101,28 +154,34 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.ChannelService/DeleteChannel": "none",
     "/toshi.workspace.v1.ChannelService/ListForwards": "read",
     "/toshi.workspace.v1.ChannelService/GetLink": "read",
+    "/toshi.workspace.v1.ChannelService/ReplayChannelMessage": "none",
+    "/toshi.workspace.v1.ChannelService/SendChannelMessage": "keyed",
+    "/toshi.workspace.v1.ChannelService/TailChannelMessages": "none",
     "/toshi.workspace.v1.RecordingService/ListRecordings": "read",
     "/toshi.workspace.v1.RecordingService/GetRecording": "read",
     "/toshi.workspace.v1.RecordingService/CreateRecordingShareLink": "none",
     "/toshi.workspace.v1.RecordingService/ListRecordingShareLinks": "read",
     "/toshi.workspace.v1.RecordingService/RevokeRecordingShareLink": "none",
     "/toshi.workspace.v1.VolumeService/ListVolumes": "read",
+    "/toshi.workspace.v1.VolumeService/GetVolume": "read",
     "/toshi.workspace.v1.VolumeService/AttachVolume": "none",
     "/toshi.workspace.v1.VolumeService/DetachVolume": "none",
+    "/toshi.workspace.v1.VolumeService/ListVolumeVersions": "read",
+    "/toshi.workspace.v1.VolumeService/RestoreVolume": "none",
+    "/toshi.workspace.v1.VolumeService/CreateVolume": "keyed",
+    "/toshi.workspace.v1.VolumeService/UpdateVolume": "none",
+    "/toshi.workspace.v1.VolumeService/DeleteVolume": "none",
     "/toshi.workspace.v1.ArtifactService/ListArtifacts": "read",
     "/toshi.workspace.v1.ArtifactService/GetArtifact": "read",
     "/toshi.workspace.v1.ArtifactService/GetArtifactDownloadURL": "read",
     "/toshi.workspace.v1.ArtifactUploadService/ReserveUpload": "none",
     "/toshi.workspace.v1.ArtifactUploadService/CompleteUpload": "none",
     "/toshi.workspace.v1.WorkspaceService/GetWorkspace": "read",
+    "/toshi.workspace.v1.WorkspaceService/UpdateWorkspace": "none",
     "/toshi.workspace.v1.WorkspaceService/ListWorkspaces": "read",
     "/toshi.workspace.v1.WorkspaceService/GetWorkspaceBilling": "read",
     "/toshi.workspace.v1.WorkspaceService/GetWorkspaceStatement": "read",
-    "/toshi.workspace.v1.WorkspaceService/SetWorkspaceOwnHostsOnly": "none",
-    "/toshi.workspace.v1.WorkspaceService/SetWorkspaceAllowOverflow": "none",
-    "/toshi.workspace.v1.WorkspaceService/SetWorkspaceAllowCacheWarm": "none",
-    "/toshi.workspace.v1.WorkspaceService/SetWorkspaceCancelRunOnVmDeath": "none",
-    "/toshi.workspace.v1.WorkspaceService/SetWorkspaceSpendLimits": "none",
+    "/toshi.workspace.v1.WorkspaceService/GetWorkspaceUpcomingInvoice": "read",
     "/toshi.workspace.v1.WorkspaceService/ListEgressIPs": "read",
     "/toshi.workspace.v1.WorkspaceService/GetUsage": "read",
     "/toshi.workspace.v1.WorkspaceService/GetQueueTimes": "read",
@@ -131,38 +190,99 @@ const procedureRetryClass = {
     "/toshi.workspace.v1.WorkspaceService/CreateCheckoutSession": "none",
     "/toshi.workspace.v1.WorkspaceService/CreateBillingPortalSession": "none",
     "/toshi.workspace.v1.WorkspaceService/GetVersion": "read",
+    "/toshi.workspace.v1.WorkspaceService/ListSeats": "read",
+    "/toshi.workspace.v1.WorkspaceService/AssignSeat": "none",
+    "/toshi.workspace.v1.WorkspaceService/RemoveSeat": "none",
+    "/toshi.workspace.v1.WorkspaceService/DeleteWorkspace": "none",
+    "/toshi.workspace.v1.WorkspaceService/CancelWorkspaceDeletion": "none",
     "/toshi.workspace.v1.HostJobService/ListHostJobs": "read",
     "/toshi.workspace.v1.HostJobService/GetHostJob": "read",
     "/toshi.workspace.v1.HostJobService/CancelHostJob": "none",
     "/toshi.workspace.v1.HostJobService/GetHostJobFailure": "read",
     "/toshi.workspace.v1.HostJobService/GetHostJobTelemetry": "read",
-    "/toshi.workspace.v1.HostJobService/GetHostJobDebugAccess": "read",
+    // Not a read: it hands out a debug key and a suspended workspace is refused
+    // it; the request carries no request_key, so it is never retried.
+    "/toshi.workspace.v1.HostJobService/GetHostJobDebugAccess": "none",
     "/toshi.workspace.v1.HostJobService/StopHostJobDebug": "none",
     "/toshi.workspace.v1.HostService/ListHosts": "read",
     "/toshi.workspace.v1.HostService/ListHostStorage": "read",
     "/toshi.workspace.v1.HostService/ListHostAlerts": "read",
     "/toshi.workspace.v1.HostService/SetHostState": "none",
     "/toshi.workspace.v1.HostService/RetireHost": "none",
-    "/toshi.workspace.v1.HostService/CreateCloudHost": "none",
+    "/toshi.workspace.v1.HostService/CreateCloudHost": "keyed",
     "/toshi.workspace.v1.HostService/CheckCloudHost": "none",
     "/toshi.workspace.v1.HostService/CreateEnrollmentToken": "none",
     "/toshi.workspace.v1.TokenService/ListTokens": "read",
     "/toshi.workspace.v1.TokenService/CreateWorkspaceToken": "none",
+    "/toshi.workspace.v1.TokenService/RollWorkspaceToken": "none",
+    "/toshi.workspace.v1.TokenService/UpdateToken": "none",
     "/toshi.workspace.v1.TokenService/RevokeToken": "none",
     "/toshi.workspace.v1.AuditEventService/ListAuditEvents": "read",
+    "/toshi.workspace.v1.AuditEventService/ExportAuditEvents": "none",
     "/toshi.workspace.v1.FillerService/ListFillers": "read",
     "/toshi.workspace.v1.FillerService/PutFiller": "none",
     "/toshi.workspace.v1.FillerService/DeleteFiller": "none",
     "/toshi.workspace.v1.FillerService/SetFillerEnabled": "none",
     "/toshi.workspace.v1.FillerService/ListFillerRuns": "read",
+    "/toshi.workspace.v1.GrantService/CreateGrant": "keyed",
+    "/toshi.workspace.v1.GrantService/GetGrant": "read",
+    "/toshi.workspace.v1.GrantService/ListGrants": "read",
+    "/toshi.workspace.v1.GrantService/AcceptGrant": "none",
+    "/toshi.workspace.v1.GrantService/DeclineGrant": "none",
+    "/toshi.workspace.v1.GrantService/UpdateGrant": "none",
+    "/toshi.workspace.v1.GrantService/RevokeGrant": "none",
+    "/toshi.workspace.v1.GrantService/LeaveGrant": "none",
     "/toshi.workspace.v1.StorageProviderService/ListStorageProviders": "read",
-    "/toshi.workspace.v1.StorageProviderService/CreateStorageProvider": "none",
+    "/toshi.workspace.v1.StorageProviderService/CreateStorageProvider": "keyed",
     "/toshi.workspace.v1.StorageProviderService/CheckStorageProvider": "none",
     "/toshi.workspace.v1.StorageProviderService/DeleteStorageProvider": "none",
     "/toshi.workspace.v1.ProductService/ListProducts": "read",
     "/toshi.workspace.v1.ProductService/UpdateProduct": "none",
-    "/toshi.workspace.v1.ProductService/RemoveProduct": "none",
     "/toshi.workspace.v1.DiscoveryService/Discover": "read",
+    "/toshi.workspace.v1.ConnectionService/ListConnections": "read",
+    "/toshi.workspace.v1.ConnectionService/GetConnection": "read",
+    "/toshi.workspace.v1.ConnectionService/CreateConnection": "keyed",
+    "/toshi.workspace.v1.ConnectionService/DeleteConnection": "keyed",
+    "/toshi.workspace.v1.ConnectionService/RotateConnectionSecret": "keyed",
+    "/toshi.workspace.v1.ConnectionService/UpdateConnection": "none",
+    "/toshi.workspace.v1.ConnectionService/ListConnectionDeliveries": "read",
+    "/toshi.workspace.v1.ConnectionService/GetConnectionDelivery": "read",
+    "/toshi.workspace.v1.ConnectionService/ReplayConnectionDelivery": "keyed",
+    "/toshi.workspace.v1.ImageService/BuildImage": "none",
+    "/toshi.workspace.v1.ImageService/CreateImage": "keyed",
+    "/toshi.workspace.v1.ImageService/DeleteImage": "none",
+    "/toshi.workspace.v1.ImageService/GetImage": "read",
+    "/toshi.workspace.v1.ImageService/ListImages": "read",
+    "/toshi.workspace.v1.ImageService/UpdateImage": "none",
+    "/toshi.workspace.v1.RoleService/ListRoles": "read",
+    "/toshi.workspace.v1.RoleService/CreateRole": "keyed",
+    "/toshi.workspace.v1.RoleService/UpdateRole": "none",
+    "/toshi.workspace.v1.RoleService/DeleteRole": "none",
+    "/toshi.workspace.v1.RoleService/ListRoleGrants": "read",
+    "/toshi.workspace.v1.RoleService/GrantRole": "none",
+    "/toshi.workspace.v1.RoleService/RevokeRole": "none",
+    "/toshi.workspace.v1.RoleService/ListMembers": "read",
+    "/toshi.workspace.v1.RoleService/RemoveMember": "none",
+    "/toshi.workspace.v1.RoleService/CreateInvitation": "none",
+    "/toshi.workspace.v1.RoleService/ListInvitations": "read",
+    "/toshi.workspace.v1.RoleService/RevokeInvitation": "none",
+    // A repeat answers ALREADY_EXISTS ("a caller who is already a member fails
+    // with ALREADY_EXISTS"), so a retry would report failure for a call that
+    // worked; its permission's level is read although it changes state.
+    "/toshi.workspace.v1.RoleService/AcceptInvitation": "none",
+    "/toshi.workspace.v1.RoleService/ApproveMember": "none",
+    "/toshi.workspace.v1.RoleService/DeclineMember": "none",
+    "/toshi.workspace.v1.TriggerService/CreateTrigger": "keyed",
+    "/toshi.workspace.v1.TriggerService/GetTrigger": "read",
+    "/toshi.workspace.v1.TriggerService/ListTriggers": "read",
+    "/toshi.workspace.v1.TriggerService/UpdateTrigger": "keyed",
+    "/toshi.workspace.v1.TriggerService/DeleteTrigger": "keyed",
+    "/toshi.workspace.v1.DomainService/CreateDomain": "keyed",
+    "/toshi.workspace.v1.DomainService/GetDomain": "read",
+    "/toshi.workspace.v1.DomainService/ListDomains": "read",
+    "/toshi.workspace.v1.DomainService/VerifyDomain": "keyed",
+    "/toshi.workspace.v1.DomainService/IssueDomain": "keyed",
+    "/toshi.workspace.v1.DomainService/DeleteDomain": "none",
 };
 /** The retry class of a generated procedure path; an unknown path is "none". */
 export function retryClassFor(procedure) {
@@ -263,9 +383,96 @@ export function backoffDelay(policy, attempt) {
     if (limit <= 0) {
         return 0;
     }
-    const random = globalThis.crypto.getRandomValues(new Uint32Array(1))[0] / 2 ** 32;
+    // The jitter is not a secret, so a non-cryptographic source is enough.
+    const random = Math.random();
     return Math.floor(random * (limit + 1));
 }
+/**
+ * How long the server asked the client to wait before a retry, in
+ * milliseconds, or undefined when it named no wait. A RESOURCE_EXHAUSTED
+ * refusal names the wait in a google.rpc.RetryInfo detail and in its
+ * Retry-After header, the detail winning when both are there; the API's rate
+ * limit sends both, with the same whole seconds. Such a refusal is retried
+ * only when it names a wait: one without, such as a plan's limit, does not
+ * pass on a retry. An HTTP 429 without a Connect error body reaches the
+ * client as Code.Unavailable with the message "HTTP 429" and the response's
+ * headers (connect 2.2.0 protocol-connect/validate-response.js:33), and names
+ * the wait in its Retry-After. Every other error names none.
+ */
+export function serverWaitMs(err) {
+    if (!(err instanceof ConnectError)) {
+        return undefined;
+    }
+    if (err.code === Code.ResourceExhausted) {
+        for (const detail of err.details) {
+            if (!("type" in detail) || detail.type !== "google.rpc.RetryInfo") {
+                continue;
+            }
+            const ms = decodeRetryInfoMs(detail.value);
+            if (ms !== undefined) {
+                return ms;
+            }
+        }
+        return parseRetryAfterMs(err.metadata.get("Retry-After"));
+    }
+    if (err.code === Code.Unavailable && err.rawMessage === "HTTP 429") {
+        return parseRetryAfterMs(err.metadata.get("Retry-After"));
+    }
+    return undefined;
+}
+/**
+ * The delay before retry attempt + 1: the backoff's, or the server's wait when
+ * that is longer, never more than maxBackoffMs.
+ */
+export function retryDelayMs(policy, attempt, waitMs) {
+    return Math.min(Math.max(backoffDelay(policy, attempt), waitMs ?? 0), policy.maxBackoffMs);
+}
+/** A Retry-After of whole seconds, the form the API sends; a date or anything else names no wait. */
+function parseRetryAfterMs(value) {
+    if (value === null || !/^\s*\d+\s*$/.test(value)) {
+        return undefined;
+    }
+    const ms = Number(value.trim()) * 1000;
+    return Number.isSafeInteger(ms) ? ms : undefined;
+}
+/**
+ * Reads google.rpc.RetryInfo's retry_delay (1), a google.protobuf.Duration of
+ * seconds (1) and nanos (2), as milliseconds, reading the wire format itself
+ * as errors.ts does for ErrorInfo.
+ */
+function decodeRetryInfoMs(bytes) {
+    try {
+        const reader = new BinaryReader(bytes);
+        while (reader.pos < reader.len) {
+            const [field, wireType] = reader.tag();
+            if (field !== 1 || wireType !== WireType.LengthDelimited) {
+                reader.skip(wireType);
+                continue;
+            }
+            const duration = new BinaryReader(reader.bytes());
+            let seconds = 0;
+            let nanos = 0;
+            while (duration.pos < duration.len) {
+                const [part, partType] = duration.tag();
+                if (part === 1 && partType === WireType.Varint) {
+                    seconds = Number(duration.int64());
+                }
+                else if (part === 2 && partType === WireType.Varint) {
+                    nanos = duration.int32();
+                }
+                else {
+                    duration.skip(partType);
+                }
+            }
+            const ms = seconds * 1000 + Math.ceil(nanos / 1e6);
+            return seconds >= 0 && nanos >= 0 && Number.isSafeInteger(ms) ? ms : undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
 /** Sleeps, rejecting at once when the signal aborts (retry.go:186-200). */
 export function sleep(ms, signal) {
     return new Promise((resolve, reject) => {

package/dist/test/alarms.d.ts

@@ -0,0 +1,29 @@
+import type { DeleteServiceAlarmRequest, DeleteServiceAlarmResponse, GetServiceAlarmRequest, GetServiceAlarmResponse, ListServiceAlarmsRequest, ListServiceAlarmsResponse, PauseServiceAlarmRequest, PauseServiceAlarmResponse, ResumeServiceAlarmRequest, ResumeServiceAlarmResponse, RunServiceAlarmNowRequest, RunServiceAlarmNowResponse, SetServiceAlarmRequest, SetServiceAlarmResponse } from "../gen/toshi/workspace/v1/workloads_pb.js";
+/**
+ * The alarms the fake keeps for any service ID: the fake holds no services. It
+ * has no clock, so an alarm publishes nothing on its own and a cron alarm has
+ * no next instant.
+ */
+export declare class AlarmStore {
+    private readonly alarms;
+    private readonly runs;
+    /** Creates the alarm at generation 1, or replaces it at the next generation, resumed. */
+    set(request: SetServiceAlarmRequest): SetServiceAlarmResponse;
+    /** Returns the alarm and its most recent occurrences, newest first. */
+    get(request: GetServiceAlarmRequest): GetServiceAlarmResponse;
+    /** Returns every alarm of the service, by name. */
+    list(request: ListServiceAlarmsRequest): ListServiceAlarmsResponse;
+    /** Removes an alarm and its occurrences. */
+    delete(request: DeleteServiceAlarmRequest): DeleteServiceAlarmResponse;
+    /** Pauses an alarm; pausing a paused alarm changes nothing. */
+    pause(request: PauseServiceAlarmRequest): PauseServiceAlarmResponse;
+    /** Resumes an alarm; resuming a running alarm changes nothing. */
+    resume(request: ResumeServiceAlarmRequest): ResumeServiceAlarmResponse;
+    /**
+     * Records a manual occurrence at the alarm's generation. A request key the
+     * fake has already answered returns the same occurrence.
+     */
+    runNow(request: RunServiceAlarmNowRequest): RunServiceAlarmNowResponse;
+    /** Returns the alarm of a service with this name. */
+    private alarm;
+}