@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.6

package/dist/esm/core/navigation/zone-emphasis.js

@@ -0,0 +1,72 @@
+import { NavigationZoneName } from '@wildo-ai/saas-models';
+/**
+ * The zone that actually takes the whole content area this render, given what the reader asked for
+ * and what the layout can currently show.
+ *
+ * Pure, so the rule is pinned without a provider stack. The reader's request
+ * (`NavigationContextType.emphasizedZone`) is a wish; this is the decision, and it yields the area
+ * back in every case where honouring the wish would hide the page:
+ *
+ * - on MOBILE there is one zone already, so emphasis means nothing;
+ * - a zone with NOTHING IN IT cannot be emphasized — an empty full-width pane over a hidden list is
+ *   the blank screen the request was never about;
+ * - PRIMARY is never emphasized: it has the whole area whenever nothing is beside it, and hiding the
+ *   adjacent zones to "emphasize" primary would be the same as closing them, which is a navigation
+ *   act with its own verbs.
+ *
+ * The request itself is left standing when it is not honoured. A reader who expanded a pane, lost it
+ * to a responsive collapse and got it back should find it expanded again; clearing the request on
+ * every non-honouring render would make emphasis flicker off under them.
+ */
+/*
+ * ─── AN EMPTY ZONE IS NEVER EMPHASIZED, and that closes two ways of hiding the whole page ────────
+ *
+ * Emphasis hides every other structural zone, PRIMARY included (`primaryHidden = emphasized !== null`).
+ * Until 2026-09-25 it was released only when the requested zone was not SHOWN — and a zone whose
+ * `onEmpty` resolves to `EMPTY_STATE` is shown WHILE EMPTY, by construction.
+ *
+ * 1. **The pane empties while emphasized.** Navigate primary, let the dependency cleanup clear the
+ *    pane, or pop its last entry: the zone keeps its width, keeps being shown, keeps being
+ *    emphasized — and the entire content area becomes the pane's empty-state placeholder with the
+ *    page behind it `display: none`. An `EMPTY_STATE` zone is deliberately NOT dismissable
+ *    (`zoneIsDismissable`), so the only ways out were Escape and the emphasis toggle.
+ * 2. **The reader navigates the app.** Nothing cleared emphasis on navigation, so a sidebar click
+ *    mounted the new destination in a hidden PRIMARY. This rule covers that case too rather than
+ *    needing its own: an app-level navigation is a clean break, the clean break clears the adjacent
+ *    zones, and a cleared zone now releases emphasis.
+ *
+ * "Shown" and "holds something" are different questions, and emphasis needs both. Asking only the
+ * first is what made an empty pane able to take the whole window.
+ */
+export function resolveEmphasizedZone(input) {
+    if (input.requested === null || input.isMobile)
+        return null;
+    if (input.requested === NavigationZoneName.SECONDARY) {
+        return input.secondaryShown && input.secondaryHasContent ? NavigationZoneName.SECONDARY : null;
+    }
+    if (input.requested === NavigationZoneName.COMPANION) {
+        return input.companionShown && input.companionHasContent ? NavigationZoneName.COMPANION : null;
+    }
+    return null;
+}
+/**
+ * Whether a keyboard Escape should restore the split.
+ *
+ * Escape is the universal "leave this mode" key and it is also what every text control, menu and
+ * dialog listens for. Emphasis yields to all of them: a key pressed inside an editable control is
+ * that control's, and a key pressed while an overlay is open belongs to the overlay (the overlay
+ * layer sits above the content areas and has its own dismissal). What is left — Escape on the page
+ * itself while a pane is emphasized — restores the split.
+ */
+export function escapeRestoresEmphasis(input) {
+    if (input.key !== 'Escape' || !input.emphasized || input.overlayOpen)
+        return false;
+    const element = input.target instanceof HTMLElement ? input.target : null;
+    if (element === null)
+        return true;
+    if (element.isContentEditable)
+        return false;
+    const tag = element.tagName;
+    return tag !== 'INPUT' && tag !== 'TEXTAREA' && tag !== 'SELECT';
+}
+//# sourceMappingURL=zone-emphasis.js.map

package/dist/esm/core/navigation/zone-emphasis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zone-emphasis.js","sourceRoot":"","sources":["../../../../../src/core/navigation/zone-emphasis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IACnF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5B,OAAO,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC;AACnE,CAAC","sourcesContent":["import { NavigationZoneName } from '@wildo-ai/saas-models';\n\n/**\n * The zone that actually takes the whole content area this render, given what the reader asked for\n * and what the layout can currently show.\n *\n * Pure, so the rule is pinned without a provider stack. The reader's request\n * (`NavigationContextType.emphasizedZone`) is a wish; this is the decision, and it yields the area\n * back in every case where honouring the wish would hide the page:\n *\n * - on MOBILE there is one zone already, so emphasis means nothing;\n * - a zone with NOTHING IN IT cannot be emphasized — an empty full-width pane over a hidden list is\n *   the blank screen the request was never about;\n * - PRIMARY is never emphasized: it has the whole area whenever nothing is beside it, and hiding the\n *   adjacent zones to \"emphasize\" primary would be the same as closing them, which is a navigation\n *   act with its own verbs.\n *\n * The request itself is left standing when it is not honoured. A reader who expanded a pane, lost it\n * to a responsive collapse and got it back should find it expanded again; clearing the request on\n * every non-honouring render would make emphasis flicker off under them.\n */\n/*\n * ─── AN EMPTY ZONE IS NEVER EMPHASIZED, and that closes two ways of hiding the whole page ────────\n *\n * Emphasis hides every other structural zone, PRIMARY included (`primaryHidden = emphasized !== null`).\n * Until 2026-09-25 it was released only when the requested zone was not SHOWN — and a zone whose\n * `onEmpty` resolves to `EMPTY_STATE` is shown WHILE EMPTY, by construction.\n *\n * 1. **The pane empties while emphasized.** Navigate primary, let the dependency cleanup clear the\n *    pane, or pop its last entry: the zone keeps its width, keeps being shown, keeps being\n *    emphasized — and the entire content area becomes the pane's empty-state placeholder with the\n *    page behind it `display: none`. An `EMPTY_STATE` zone is deliberately NOT dismissable\n *    (`zoneIsDismissable`), so the only ways out were Escape and the emphasis toggle.\n * 2. **The reader navigates the app.** Nothing cleared emphasis on navigation, so a sidebar click\n *    mounted the new destination in a hidden PRIMARY. This rule covers that case too rather than\n *    needing its own: an app-level navigation is a clean break, the clean break clears the adjacent\n *    zones, and a cleared zone now releases emphasis.\n *\n * \"Shown\" and \"holds something\" are different questions, and emphasis needs both. Asking only the\n * first is what made an empty pane able to take the whole window.\n */\nexport function resolveEmphasizedZone(input: {\n  requested: NavigationZoneName | null;\n  isMobile: boolean;\n  secondaryShown: boolean;\n  companionShown: boolean;\n  /** Does the zone actually HOLD something? See the emptiness rule below. */\n  secondaryHasContent: boolean;\n  companionHasContent: boolean;\n}): NavigationZoneName.SECONDARY | NavigationZoneName.COMPANION | null {\n  if (input.requested === null || input.isMobile) return null;\n  if (input.requested === NavigationZoneName.SECONDARY) {\n    return input.secondaryShown && input.secondaryHasContent ? NavigationZoneName.SECONDARY : null;\n  }\n  if (input.requested === NavigationZoneName.COMPANION) {\n    return input.companionShown && input.companionHasContent ? NavigationZoneName.COMPANION : null;\n  }\n  return null;\n}\n\n/**\n * Whether a keyboard Escape should restore the split.\n *\n * Escape is the universal \"leave this mode\" key and it is also what every text control, menu and\n * dialog listens for. Emphasis yields to all of them: a key pressed inside an editable control is\n * that control's, and a key pressed while an overlay is open belongs to the overlay (the overlay\n * layer sits above the content areas and has its own dismissal). What is left — Escape on the page\n * itself while a pane is emphasized — restores the split.\n */\nexport function escapeRestoresEmphasis(input: {\n  key: string;\n  emphasized: boolean;\n  overlayOpen: boolean;\n  target: EventTarget | null;\n}): boolean {\n  if (input.key !== 'Escape' || !input.emphasized || input.overlayOpen) return false;\n  const element = input.target instanceof HTMLElement ? input.target : null;\n  if (element === null) return true;\n  if (element.isContentEditable) return false;\n  const tag = element.tagName;\n  return tag !== 'INPUT' && tag !== 'TEXTAREA' && tag !== 'SELECT';\n}\n"]}

package/dist/esm/core/navigation/zone-empty-behavior.d.ts

@@ -61,6 +61,28 @@ export declare function resolveZoneEmptyBehavior({ zone, zones, destinationOverr
  * visibility expression is how one of them ends up reading the field and the other not.
  */
 export declare function zoneOccupiesSpaceWhenEmpty(behavior: ZoneEmptyBehavior): boolean;
+/**
+ * May this zone be DISMISSED — is a close control worth offering on it?
+ *
+ * Two conditions, and both are about whether the gesture would DO anything:
+ *
+ * - **It holds something.** Closing an empty pane is a no-op by definition.
+ * - **Closing gives the width back**, i.e. the resolved behavior is not `EMPTY_STATE`. A zone that
+ *   stays on screen when empty has declared that it stays; "closing" it would swap a record for a
+ *   placeholder and return no room, so the control would appear to do nothing. That is a worse
+ *   affordance than no control at all.
+ *
+ * Kept beside {@link zoneOccupiesSpaceWhenEmpty} — it is that predicate's inverse plus the content
+ * test — so the two cannot drift: the control can never appear on a pane that would stay put, nor be
+ * withheld from one that would go.
+ *
+ * Deliberately NOT conditioned on emphasis: closing an emphasized pane is the fastest way back to
+ * the list beneath it, and hiding the control there strands the reader on the expand toggle.
+ */
+export declare function zoneIsDismissable(params: {
+    hasContent: boolean;
+    behavior: ZoneEmptyBehavior;
+}): boolean;
 /**
  * Read `adjacentZoneOnEmpty` off whatever occupies PRIMARY.
  *

package/dist/esm/core/navigation/zone-empty-behavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zone-empty-behavior.d.ts","sourceRoot":"","sources":["../../../../src/core/navigation/zone-empty-behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE/G;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,mGAAmG;IACnG,IAAI,EAAE,kBAAkB,CAAC;IACzB,4FAA4F;IAC5F,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,mBAAmB,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,IAAI,EACJ,KAAK,EACL,mBAAmB,GACpB,EAAE,uBAAuB,GAAG,iBAAiB,CAO7C;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAE/E;AAED;;;;;;GAMG;AACH,wBAAgB,4CAA4C,CAAC,MAAM,EAAE;IACnE,cAAc,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACtD,cAAc,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;CACxE,GAAG,iBAAiB,GAAG,SAAS,CAEhC"}
+{"version":3,"file":"zone-empty-behavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/navigation/zone-empty-behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,KAAK,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE/G;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,mGAAmG;IACnG,IAAI,EAAE,kBAAkB,CAAC;IACzB,4FAA4F;IAC5F,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,mBAAmB,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,IAAI,EACJ,KAAK,EACL,mBAAmB,GACpB,EAAE,uBAAuB,GAAG,iBAAiB,CAO7C;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAE/E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAAG,OAAO,CAEvG;AAED;;;;;;GAMG;AACH,wBAAgB,4CAA4C,CAAC,MAAM,EAAE;IACnE,cAAc,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACtD,cAAc,EAAE,SAAS,+BAA+B,EAAE,GAAG,SAAS,CAAC;CACxE,GAAG,iBAAiB,GAAG,SAAS,CAEhC"}

package/dist/esm/core/navigation/zone-empty-behavior.js

@@ -50,6 +50,27 @@ export function resolveZoneEmptyBehavior({ zone, zones, destinationOverride, })
 export function zoneOccupiesSpaceWhenEmpty(behavior) {
     return behavior === ZoneEmptyBehavior.EMPTY_STATE;
 }
+/**
+ * May this zone be DISMISSED — is a close control worth offering on it?
+ *
+ * Two conditions, and both are about whether the gesture would DO anything:
+ *
+ * - **It holds something.** Closing an empty pane is a no-op by definition.
+ * - **Closing gives the width back**, i.e. the resolved behavior is not `EMPTY_STATE`. A zone that
+ *   stays on screen when empty has declared that it stays; "closing" it would swap a record for a
+ *   placeholder and return no room, so the control would appear to do nothing. That is a worse
+ *   affordance than no control at all.
+ *
+ * Kept beside {@link zoneOccupiesSpaceWhenEmpty} — it is that predicate's inverse plus the content
+ * test — so the two cannot drift: the control can never appear on a pane that would stay put, nor be
+ * withheld from one that would go.
+ *
+ * Deliberately NOT conditioned on emphasis: closing an emphasized pane is the fastest way back to
+ * the list beneath it, and hiding the control there strands the reader on the expand toggle.
+ */
+export function zoneIsDismissable(params) {
+    return params.hasContent && !zoneOccupiesSpaceWhenEmpty(params.behavior);
+}
 /**
  * Read `adjacentZoneOnEmpty` off whatever occupies PRIMARY.
  *

package/dist/esm/core/navigation/zone-empty-behavior.js.map

@@ -1 +1 @@
-{"version":3,"file":"zone-empty-behavior.js","sourceRoot":"","sources":["../../../../src/core/navigation/zone-empty-behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG9E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8BAA8B,CAAC;AAuB1F;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,IAAI,EACJ,KAAK,EACL,mBAAmB,GACK;IACxB,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,OAAO,mBAAmB;WACrB,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO;WACtB,iBAAiB,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,QAAQ,KAAK,iBAAiB,CAAC,WAAW,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4CAA4C,CAAC,MAG5D;IACC,OAAO,0CAA0C,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;AACjF,CAAC","sourcesContent":["/**\n * Zone empty-behavior resolution — what an ADJACENT zone does once its last content is dismissed.\n *\n * ## Why this is a resolver rather than a field read\n *\n * `ZoneConfig.onEmpty` is declared per ZONE, so one value covers every destination that splits into\n * that zone — and destinations legitimately disagree. A LIST wants the detail pane to stay put so the\n * layout does not reflow while a reviewer steps through rows; a CANVAS wants its width back the moment\n * nothing is selected. They share one secondary zone, so a single zone-level value is wrong for one of\n * them whichever way it is set.\n *\n * The override therefore lives on the DESTINATION — the thing occupying primary — because the question\n * \"what should happen to my detail pane when it empties\" is a property of the surface being returned\n * TO, not of the content that just left.\n *\n * ## Precedence, and why COLLAPSE is the floor\n *\n *   destination override → zone config → `ZoneEmptyBehavior.COLLAPSE`\n *\n * COLLAPSE is the schema default and, until this resolver existed, the UNCONDITIONAL behavior: nothing\n * read `onEmpty` at all, so every zone collapsed regardless of what its layout declared (issue #191).\n * Keeping COLLAPSE as the floor is what makes this change invisible to every layout that authored\n * nothing — and to every layout that authored COLLAPSE and was silently getting it by accident.\n */\n\nimport { NavigationZoneName, ZoneEmptyBehavior } from '@wildo-ai/saas-models';\nimport type { NavigationLayout } from '@wildo-ai/saas-models';\n\nimport { resolvePrimaryDestinationLayoutDeclaration } from './primary-destination-layout';\nimport type { PrimaryDestinationCompositeView, PrimaryDestinationContent } from './primary-destination-layout';\n\n/**\n * The destination-level override, already resolved from whatever is in primary.\n *\n * Passed in rather than looked up here so this stays a pure function of its arguments: resolving a\n * composite view's or a resource operation's frontend config needs the registry and the app config,\n * and threading those through would make the precedence rule — the part worth testing — untestable\n * without mounting half the runtime.\n */\nexport interface ZoneEmptyBehaviorInputs {\n  /** The zone whose empty behavior is being resolved. PRIMARY never empties; see the guard below. */\n  zone: NavigationZoneName;\n  /** The resolved layout's zone declarations, or `undefined` when no layout is configured. */\n  zones: NavigationLayout['zones'] | undefined;\n  /**\n   * `adjacentZoneOnEmpty` declared by whatever currently occupies PRIMARY, or `undefined` when the\n   * destination declares nothing (the common case).\n   */\n  destinationOverride: ZoneEmptyBehavior | undefined;\n}\n\n/**\n * Resolve what `zone` does when its stack empties.\n *\n * PRIMARY always answers COLLAPSE, which is not a behavior so much as a refusal: primary never empties\n * (it falls back to the router's own children), so no caller should be asking. Answering the floor\n * rather than throwing keeps a mis-call from taking the shell down over a layout question.\n */\nexport function resolveZoneEmptyBehavior({\n  zone,\n  zones,\n  destinationOverride,\n}: ZoneEmptyBehaviorInputs): ZoneEmptyBehavior {\n  if (zone === NavigationZoneName.PRIMARY) {\n    return ZoneEmptyBehavior.COLLAPSE;\n  }\n  return destinationOverride\n    ?? zones?.[zone]?.onEmpty\n    ?? ZoneEmptyBehavior.COLLAPSE;\n}\n\n/**\n * Should `zone` occupy space right now?\n *\n * Two reasons a zone is shown, and they are different questions: it HAS content, or it has none and\n * its resolved behavior is `EMPTY_STATE` (a reserved pane carrying a placeholder). Kept beside the\n * resolver so the two can never drift — a caller that resolved the behavior and then wrote its own\n * visibility expression is how one of them ends up reading the field and the other not.\n */\nexport function zoneOccupiesSpaceWhenEmpty(behavior: ZoneEmptyBehavior): boolean {\n  return behavior === ZoneEmptyBehavior.EMPTY_STATE;\n}\n\n/**\n * Read `adjacentZoneOnEmpty` off whatever occupies PRIMARY.\n *\n * A thin projection over {@link resolvePrimaryDestinationLayoutDeclaration}, which owns the\n * content-kind switch shared with `zoneContentFill`. Kept as a named function rather than inlined at\n * the call site so the pins below exercise the same path the runtime takes.\n */\nexport function resolvePrimaryDestinationAdjacentZoneOnEmpty(params: {\n  primaryContent: PrimaryDestinationContent | undefined;\n  compositeViews: readonly PrimaryDestinationCompositeView[] | undefined;\n}): ZoneEmptyBehavior | undefined {\n  return resolvePrimaryDestinationLayoutDeclaration(params)?.adjacentZoneOnEmpty;\n}\n"]}
+{"version":3,"file":"zone-empty-behavior.js","sourceRoot":"","sources":["../../../../../src/core/navigation/zone-empty-behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG9E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8BAA8B,CAAC;AAuB1F;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,IAAI,EACJ,KAAK,EACL,mBAAmB,GACK;IACxB,IAAI,IAAI,KAAK,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,OAAO,mBAAmB;WACrB,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO;WACtB,iBAAiB,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,QAAQ,KAAK,iBAAiB,CAAC,WAAW,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA4D;IAC5F,OAAO,MAAM,CAAC,UAAU,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4CAA4C,CAAC,MAG5D;IACC,OAAO,0CAA0C,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;AACjF,CAAC","sourcesContent":["/**\n * Zone empty-behavior resolution — what an ADJACENT zone does once its last content is dismissed.\n *\n * ## Why this is a resolver rather than a field read\n *\n * `ZoneConfig.onEmpty` is declared per ZONE, so one value covers every destination that splits into\n * that zone — and destinations legitimately disagree. A LIST wants the detail pane to stay put so the\n * layout does not reflow while a reviewer steps through rows; a CANVAS wants its width back the moment\n * nothing is selected. They share one secondary zone, so a single zone-level value is wrong for one of\n * them whichever way it is set.\n *\n * The override therefore lives on the DESTINATION — the thing occupying primary — because the question\n * \"what should happen to my detail pane when it empties\" is a property of the surface being returned\n * TO, not of the content that just left.\n *\n * ## Precedence, and why COLLAPSE is the floor\n *\n *   destination override → zone config → `ZoneEmptyBehavior.COLLAPSE`\n *\n * COLLAPSE is the schema default and, until this resolver existed, the UNCONDITIONAL behavior: nothing\n * read `onEmpty` at all, so every zone collapsed regardless of what its layout declared (issue #191).\n * Keeping COLLAPSE as the floor is what makes this change invisible to every layout that authored\n * nothing — and to every layout that authored COLLAPSE and was silently getting it by accident.\n */\n\nimport { NavigationZoneName, ZoneEmptyBehavior } from '@wildo-ai/saas-models';\nimport type { NavigationLayout } from '@wildo-ai/saas-models';\n\nimport { resolvePrimaryDestinationLayoutDeclaration } from './primary-destination-layout';\nimport type { PrimaryDestinationCompositeView, PrimaryDestinationContent } from './primary-destination-layout';\n\n/**\n * The destination-level override, already resolved from whatever is in primary.\n *\n * Passed in rather than looked up here so this stays a pure function of its arguments: resolving a\n * composite view's or a resource operation's frontend config needs the registry and the app config,\n * and threading those through would make the precedence rule — the part worth testing — untestable\n * without mounting half the runtime.\n */\nexport interface ZoneEmptyBehaviorInputs {\n  /** The zone whose empty behavior is being resolved. PRIMARY never empties; see the guard below. */\n  zone: NavigationZoneName;\n  /** The resolved layout's zone declarations, or `undefined` when no layout is configured. */\n  zones: NavigationLayout['zones'] | undefined;\n  /**\n   * `adjacentZoneOnEmpty` declared by whatever currently occupies PRIMARY, or `undefined` when the\n   * destination declares nothing (the common case).\n   */\n  destinationOverride: ZoneEmptyBehavior | undefined;\n}\n\n/**\n * Resolve what `zone` does when its stack empties.\n *\n * PRIMARY always answers COLLAPSE, which is not a behavior so much as a refusal: primary never empties\n * (it falls back to the router's own children), so no caller should be asking. Answering the floor\n * rather than throwing keeps a mis-call from taking the shell down over a layout question.\n */\nexport function resolveZoneEmptyBehavior({\n  zone,\n  zones,\n  destinationOverride,\n}: ZoneEmptyBehaviorInputs): ZoneEmptyBehavior {\n  if (zone === NavigationZoneName.PRIMARY) {\n    return ZoneEmptyBehavior.COLLAPSE;\n  }\n  return destinationOverride\n    ?? zones?.[zone]?.onEmpty\n    ?? ZoneEmptyBehavior.COLLAPSE;\n}\n\n/**\n * Should `zone` occupy space right now?\n *\n * Two reasons a zone is shown, and they are different questions: it HAS content, or it has none and\n * its resolved behavior is `EMPTY_STATE` (a reserved pane carrying a placeholder). Kept beside the\n * resolver so the two can never drift — a caller that resolved the behavior and then wrote its own\n * visibility expression is how one of them ends up reading the field and the other not.\n */\nexport function zoneOccupiesSpaceWhenEmpty(behavior: ZoneEmptyBehavior): boolean {\n  return behavior === ZoneEmptyBehavior.EMPTY_STATE;\n}\n\n/**\n * May this zone be DISMISSED — is a close control worth offering on it?\n *\n * Two conditions, and both are about whether the gesture would DO anything:\n *\n * - **It holds something.** Closing an empty pane is a no-op by definition.\n * - **Closing gives the width back**, i.e. the resolved behavior is not `EMPTY_STATE`. A zone that\n *   stays on screen when empty has declared that it stays; \"closing\" it would swap a record for a\n *   placeholder and return no room, so the control would appear to do nothing. That is a worse\n *   affordance than no control at all.\n *\n * Kept beside {@link zoneOccupiesSpaceWhenEmpty} — it is that predicate's inverse plus the content\n * test — so the two cannot drift: the control can never appear on a pane that would stay put, nor be\n * withheld from one that would go.\n *\n * Deliberately NOT conditioned on emphasis: closing an emphasized pane is the fastest way back to\n * the list beneath it, and hiding the control there strands the reader on the expand toggle.\n */\nexport function zoneIsDismissable(params: { hasContent: boolean; behavior: ZoneEmptyBehavior }): boolean {\n  return params.hasContent && !zoneOccupiesSpaceWhenEmpty(params.behavior);\n}\n\n/**\n * Read `adjacentZoneOnEmpty` off whatever occupies PRIMARY.\n *\n * A thin projection over {@link resolvePrimaryDestinationLayoutDeclaration}, which owns the\n * content-kind switch shared with `zoneContentFill`. Kept as a named function rather than inlined at\n * the call site so the pins below exercise the same path the runtime takes.\n */\nexport function resolvePrimaryDestinationAdjacentZoneOnEmpty(params: {\n  primaryContent: PrimaryDestinationContent | undefined;\n  compositeViews: readonly PrimaryDestinationCompositeView[] | undefined;\n}): ZoneEmptyBehavior | undefined {\n  return resolvePrimaryDestinationLayoutDeclaration(params)?.adjacentZoneOnEmpty;\n}\n"]}

package/dist/esm/core/navigation/zone-visible-entry.d.ts

@@ -23,4 +23,26 @@ import type { NavigationStackEntry } from './navigation.schemas';
  * @returns The index to render, or `-1` for an empty stack.
  */
 export declare function resolveVisibleEntryIndex(stack: NavigationStackEntry[], contentModel: NavigationZoneContentModel | undefined, activeTabId: string | undefined): number;
+/**
+ * Which entry a zone MUTATION acts on — the reducer's counterpart to {@link resolveVisibleEntryIndex}.
+ *
+ * ## Why it does not take the content model
+ *
+ * `resolveVisibleEntryIndex` is the renderer's answer and reads `contentModel` off the LAYOUT. The
+ * reducer has no layout, so it reads the one thing that is only ever written for a TABBED zone:
+ * `NavigationZoneState.activeTabId`. Absent, the acted-on entry is the top of the stack, which is
+ * the SINGLE contract exactly.
+ *
+ * ## Why it is a function and not two inline copies
+ *
+ * It was two, briefly, on 2026-09-25 — one in `replaceEntry` and one in `popEntry` — added in the
+ * change that deleted `useIsStackEntryActive` for being a third answer to the same question. Two
+ * copies with a rule of their own is the thing that change existed to remove, so they became this.
+ *
+ * A stale `activeTabId` matching no entry falls back to the top rather than dropping the write: a
+ * tab closed from under an id must not make the zone unwritable.
+ */
+export declare function zoneMutationTargetIndex(stack: readonly {
+    id: string;
+}[], activeTabId: string | undefined): number;
 //# sourceMappingURL=zone-visible-entry.d.ts.map

package/dist/esm/core/navigation/zone-visible-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zone-visible-entry.d.ts","sourceRoot":"","sources":["../../../../src/core/navigation/zone-visible-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,EAAE,EAC7B,YAAY,EAAE,0BAA0B,GAAG,SAAS,EACpD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,CAuDR"}
+{"version":3,"file":"zone-visible-entry.d.ts","sourceRoot":"","sources":["../../../../../src/core/navigation/zone-visible-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,EAAE,EAC7B,YAAY,EAAE,0BAA0B,GAAG,SAAS,EACpD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,CAuDR;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,EAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,CAIR"}

package/dist/esm/core/navigation/zone-visible-entry.js

@@ -73,4 +73,29 @@ export function resolveVisibleEntryIndex(stack, contentModel, activeTabId) {
     const activeIndex = stack.findIndex(entry => entry.id === activeTabId);
     return activeIndex >= 0 ? activeIndex : topIndex;
 }
+/**
+ * Which entry a zone MUTATION acts on — the reducer's counterpart to {@link resolveVisibleEntryIndex}.
+ *
+ * ## Why it does not take the content model
+ *
+ * `resolveVisibleEntryIndex` is the renderer's answer and reads `contentModel` off the LAYOUT. The
+ * reducer has no layout, so it reads the one thing that is only ever written for a TABBED zone:
+ * `NavigationZoneState.activeTabId`. Absent, the acted-on entry is the top of the stack, which is
+ * the SINGLE contract exactly.
+ *
+ * ## Why it is a function and not two inline copies
+ *
+ * It was two, briefly, on 2026-09-25 — one in `replaceEntry` and one in `popEntry` — added in the
+ * change that deleted `useIsStackEntryActive` for being a third answer to the same question. Two
+ * copies with a rule of their own is the thing that change existed to remove, so they became this.
+ *
+ * A stale `activeTabId` matching no entry falls back to the top rather than dropping the write: a
+ * tab closed from under an id must not make the zone unwritable.
+ */
+export function zoneMutationTargetIndex(stack, activeTabId) {
+    if (stack.length === 0)
+        return -1;
+    const activeIndex = activeTabId !== undefined ? stack.findIndex(entry => entry.id === activeTabId) : -1;
+    return activeIndex >= 0 ? activeIndex : stack.length - 1;
+}
 //# sourceMappingURL=zone-visible-entry.js.map

package/dist/esm/core/navigation/zone-visible-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"zone-visible-entry.js","sourceRoot":"","sources":["../../../../src/core/navigation/zone-visible-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAInE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA6B,EAC7B,YAAoD,EACpD,WAA+B;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhD,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,0BAA0B,CAAC,MAAM;YACpC,OAAO,QAAQ,CAAC;QAClB,KAAK,0BAA0B,CAAC,MAAM;YACpC,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,sBAAsB,GAAU,YAAY,CAAC;YACnD;;;;;eAKG;YACH,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,sBAAsB,CAAC,yBAAyB;kBACzF,8EAA8E,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IACvE,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC","sourcesContent":["/**\n * Which entry of a zone's stack is the VISIBLE one — the single behavioural difference between the\n * two `NavigationZoneContentModel` members (#411).\n *\n * Both models keep every entry mounted. `SINGLE` shows the TOP of the stack and BACK pops it;\n * `TABBED` shows the ACTIVE tab and the rest are one click away. Everything else about the two\n * renderings is identical, so this function is the whole distinction and is the only place it is\n * decided.\n *\n * It exists as a named pure function rather than an expression inside `ZoneContentRenderer` because\n * that expression is what `TABBED` was missing for its entire life: the member was declared,\n * documented as \"parallel tabs, tab bar visible\", validated by the layout schema and selected by one\n * of the framework's own shipped presets, while the renderer showed the top of the stack — with no\n * error. A behaviour that is one inline ternary is a behaviour nothing can pin.\n */\n\nimport { NavigationZoneContentModel } from '@wildo-ai/saas-models';\n\nimport type { NavigationStackEntry } from './navigation.schemas';\n\n/**\n * @param stack        The zone's entries, oldest first.\n * @param contentModel The zone's DECLARED content model. `undefined` reads as `SINGLE` — the schema\n *                     default, and the behaviour every zone had before a model was declarable.\n * @param activeTabId  `NavigationZoneState.activeTabId`. Ignored outside `TABBED`.\n * @returns The index to render, or `-1` for an empty stack.\n */\nexport function resolveVisibleEntryIndex(\n  stack: NavigationStackEntry[],\n  contentModel: NavigationZoneContentModel | undefined,\n  activeTabId: string | undefined,\n): number {\n  if (stack.length === 0) return -1;\n\n  const topIndex = stack.length - 1;\n\n  /*\n   * ─── EXHAUSTIVE ON PURPOSE: a new content model must not be able to ship silently ───────────────\n   *\n   * This switch is the fourth item of #411, and it is the one that outlives the other three. All\n   * three behaviours that issue fixed failed the SAME way — declared in a vocabulary, validated by a\n   * schema, selected by a config, and read by no renderer, with no error — and `TABBED` is the\n   * clearest case because the framework's own preset chose it and got a single stack.\n   *\n   * A `switch` with a `never` assignment turns the next such member into a COMPILE error at the\n   * exact place a renderer has to exist. That is strictly stronger than a runtime warning, which\n   * fires only if someone happens to configure the member and happens to be reading the console;\n   * `preset-navigation.ts` selected TABBED for months with nobody reading anything.\n   *\n   * `undefined` (the schema default, and every zone that predates the field) is handled BEFORE the\n   * switch so that adding a member cannot be satisfied by widening a `default:` arm — there is no\n   * `default:` arm to widen.\n   */\n  if (contentModel === undefined) return topIndex;\n\n  switch (contentModel) {\n    case NavigationZoneContentModel.SINGLE:\n      return topIndex;\n    case NavigationZoneContentModel.TABBED:\n      break;\n    default: {\n      const unrenderedContentModel: never = contentModel;\n      /*\n       * Unreachable while the switch is exhaustive. Kept as a THROW rather than a silent fallback\n       * because the alternative — quietly returning the top entry — is precisely the degradation\n       * this whole guard exists to make impossible, and a build that somehow reaches here (a value\n       * from an older bundle, a cast) should say so rather than pretend.\n       */\n      throw new Error(\n        `[navigation] Zone content model '${String(unrenderedContentModel)}' reaches no renderer. `\n        + 'Add a case to resolveVisibleEntryIndex, and the rendering that case implies.',\n      );\n    }\n  }\n\n  /*\n   * The TOP entry is the fallback in two situations, and both are ordinary rather than exceptional:\n   * nothing has been activated yet (the frame after the first tab opens), and `activeTabId` names an\n   * entry the stack no longer holds (a tab closed while it was active). Rendering nothing in either\n   * case would blank the zone under a full tab bar.\n   *\n   * Falling back to the TOP rather than the FIRST is deliberate: the newest tab is the one the user\n   * just caused to exist, so it is the one they are looking for.\n   */\n  const activeIndex = stack.findIndex(entry => entry.id === activeTabId);\n  return activeIndex >= 0 ? activeIndex : topIndex;\n}\n"]}
+{"version":3,"file":"zone-visible-entry.js","sourceRoot":"","sources":["../../../../../src/core/navigation/zone-visible-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAInE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA6B,EAC7B,YAAoD,EACpD,WAA+B;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhD,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,0BAA0B,CAAC,MAAM;YACpC,OAAO,QAAQ,CAAC;QAClB,KAAK,0BAA0B,CAAC,MAAM;YACpC,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,sBAAsB,GAAU,YAAY,CAAC;YACnD;;;;;eAKG;YACH,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,sBAAsB,CAAC,yBAAyB;kBACzF,8EAA8E,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IACvE,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAgC,EAChC,WAA+B;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC","sourcesContent":["/**\n * Which entry of a zone's stack is the VISIBLE one — the single behavioural difference between the\n * two `NavigationZoneContentModel` members (#411).\n *\n * Both models keep every entry mounted. `SINGLE` shows the TOP of the stack and BACK pops it;\n * `TABBED` shows the ACTIVE tab and the rest are one click away. Everything else about the two\n * renderings is identical, so this function is the whole distinction and is the only place it is\n * decided.\n *\n * It exists as a named pure function rather than an expression inside `ZoneContentRenderer` because\n * that expression is what `TABBED` was missing for its entire life: the member was declared,\n * documented as \"parallel tabs, tab bar visible\", validated by the layout schema and selected by one\n * of the framework's own shipped presets, while the renderer showed the top of the stack — with no\n * error. A behaviour that is one inline ternary is a behaviour nothing can pin.\n */\n\nimport { NavigationZoneContentModel } from '@wildo-ai/saas-models';\n\nimport type { NavigationStackEntry } from './navigation.schemas';\n\n/**\n * @param stack        The zone's entries, oldest first.\n * @param contentModel The zone's DECLARED content model. `undefined` reads as `SINGLE` — the schema\n *                     default, and the behaviour every zone had before a model was declarable.\n * @param activeTabId  `NavigationZoneState.activeTabId`. Ignored outside `TABBED`.\n * @returns The index to render, or `-1` for an empty stack.\n */\nexport function resolveVisibleEntryIndex(\n  stack: NavigationStackEntry[],\n  contentModel: NavigationZoneContentModel | undefined,\n  activeTabId: string | undefined,\n): number {\n  if (stack.length === 0) return -1;\n\n  const topIndex = stack.length - 1;\n\n  /*\n   * ─── EXHAUSTIVE ON PURPOSE: a new content model must not be able to ship silently ───────────────\n   *\n   * This switch is the fourth item of #411, and it is the one that outlives the other three. All\n   * three behaviours that issue fixed failed the SAME way — declared in a vocabulary, validated by a\n   * schema, selected by a config, and read by no renderer, with no error — and `TABBED` is the\n   * clearest case because the framework's own preset chose it and got a single stack.\n   *\n   * A `switch` with a `never` assignment turns the next such member into a COMPILE error at the\n   * exact place a renderer has to exist. That is strictly stronger than a runtime warning, which\n   * fires only if someone happens to configure the member and happens to be reading the console;\n   * `preset-navigation.ts` selected TABBED for months with nobody reading anything.\n   *\n   * `undefined` (the schema default, and every zone that predates the field) is handled BEFORE the\n   * switch so that adding a member cannot be satisfied by widening a `default:` arm — there is no\n   * `default:` arm to widen.\n   */\n  if (contentModel === undefined) return topIndex;\n\n  switch (contentModel) {\n    case NavigationZoneContentModel.SINGLE:\n      return topIndex;\n    case NavigationZoneContentModel.TABBED:\n      break;\n    default: {\n      const unrenderedContentModel: never = contentModel;\n      /*\n       * Unreachable while the switch is exhaustive. Kept as a THROW rather than a silent fallback\n       * because the alternative — quietly returning the top entry — is precisely the degradation\n       * this whole guard exists to make impossible, and a build that somehow reaches here (a value\n       * from an older bundle, a cast) should say so rather than pretend.\n       */\n      throw new Error(\n        `[navigation] Zone content model '${String(unrenderedContentModel)}' reaches no renderer. `\n        + 'Add a case to resolveVisibleEntryIndex, and the rendering that case implies.',\n      );\n    }\n  }\n\n  /*\n   * The TOP entry is the fallback in two situations, and both are ordinary rather than exceptional:\n   * nothing has been activated yet (the frame after the first tab opens), and `activeTabId` names an\n   * entry the stack no longer holds (a tab closed while it was active). Rendering nothing in either\n   * case would blank the zone under a full tab bar.\n   *\n   * Falling back to the TOP rather than the FIRST is deliberate: the newest tab is the one the user\n   * just caused to exist, so it is the one they are looking for.\n   */\n  const activeIndex = stack.findIndex(entry => entry.id === activeTabId);\n  return activeIndex >= 0 ? activeIndex : topIndex;\n}\n\n/**\n * Which entry a zone MUTATION acts on — the reducer's counterpart to {@link resolveVisibleEntryIndex}.\n *\n * ## Why it does not take the content model\n *\n * `resolveVisibleEntryIndex` is the renderer's answer and reads `contentModel` off the LAYOUT. The\n * reducer has no layout, so it reads the one thing that is only ever written for a TABBED zone:\n * `NavigationZoneState.activeTabId`. Absent, the acted-on entry is the top of the stack, which is\n * the SINGLE contract exactly.\n *\n * ## Why it is a function and not two inline copies\n *\n * It was two, briefly, on 2026-09-25 — one in `replaceEntry` and one in `popEntry` — added in the\n * change that deleted `useIsStackEntryActive` for being a third answer to the same question. Two\n * copies with a rule of their own is the thing that change existed to remove, so they became this.\n *\n * A stale `activeTabId` matching no entry falls back to the top rather than dropping the write: a\n * tab closed from under an id must not make the zone unwritable.\n */\nexport function zoneMutationTargetIndex(\n  stack: readonly { id: string }[],\n  activeTabId: string | undefined,\n): number {\n  if (stack.length === 0) return -1;\n  const activeIndex = activeTabId !== undefined ? stack.findIndex(entry => entry.id === activeTabId) : -1;\n  return activeIndex >= 0 ? activeIndex : stack.length - 1;\n}\n"]}

package/dist/esm/core/requests/api-readiness-checker.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-readiness-checker.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/requests/api-readiness-checker.frontend.service.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAK/C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,QAAQ,CAA2C;IAC3D,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,gBAAgB,CAA8B;IAItD,OAAO,CAAC,UAAU,CAAkB;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,sBAA2B;IAYhE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;OAGG;YACW,SAAS;IAsBvB;;;;;;;;;;;;;;;;;;OAkBG;IACU,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwC5D;;OAEG;YACW,qBAAqB;IAgEnC;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;OAEG;IACI,UAAU,IAAI,OAAO;IAI5B;;;;;;;;;OASG;IACI,KAAK,IAAI,IAAI;IAOpB;;OAEG;IACI,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAK5C;AAQD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,sBAAsB,GAC9B,mBAAmB,CAUrB"}
+{"version":3,"file":"api-readiness-checker.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/api-readiness-checker.frontend.service.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAK/C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,QAAQ,CAA2C;IAC3D,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,gBAAgB,CAA8B;IAItD,OAAO,CAAC,UAAU,CAAkB;gBAExB,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,sBAA2B;IAYhE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAItB;;;OAGG;YACW,SAAS;IAsBvB;;;;;;;;;;;;;;;;;;OAkBG;IACU,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwC5D;;OAEG;YACW,qBAAqB;IAgEnC;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;OAEG;IACI,UAAU,IAAI,OAAO;IAI5B;;;;;;;;;OASG;IACI,KAAK,IAAI,IAAI;IAOpB;;OAEG;IACI,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAK5C;AAQD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,sBAAsB,GAC9B,mBAAmB,CAUrB"}

package/dist/esm/core/requests/api-readiness-checker.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-readiness-checker.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/requests/api-readiness-checker.frontend.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAwBzF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IAC5C,0DAA0D;IACjD,IAAI,GAAG,eAAe,CAAC;IACvB,OAAO,CAAS;IAChB,SAAS,CAAS;IAE3B,YAAY,OAAe,EAAE,SAAiB;QAC5C,KAAK,CAAC,kBAAkB,OAAO,IAAI,iBAAiB,gCAAgC,SAAS,IAAI,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAmB;IACtB,OAAO,CAAS;IAChB,MAAM,CAAmC;IACzC,MAAM,CAAwB;IAC9B,QAAQ,CAA2C;IACnD,OAAO,GAAY,KAAK,CAAC;IACzB,gBAAgB,GAAyB,IAAI,CAAC;IACtD,gFAAgF;IAChF,gFAAgF;IAChF,kEAAkE;IAC1D,UAAU,GAAY,KAAK,CAAC;IAEpC,YAAY,OAAe,EAAE,SAAiC,EAAE;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,qBAAqB;YACxD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,oBAAoB;YACrD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,0BAA0B;SACxE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;OAUG;IACK,cAAc,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAC9B,GAAG,IAAI,CAAC,OAAO,eAAe,EAC9B;gBACE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACrC,yDAAyD;gBACzD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;aAC3B,CACF,CAAC;YAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+BAA+B;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACI,KAAK,CAAC,YAAY,CAAC,SAAkB;QAC1C,iDAAiD;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,sDAAsD;QACtD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,SAAS;gBACT,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC7F,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAErC,IAAI,KAAK,EAAE,CAAC;oBACV,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,0EAA0E;oBAC1E,kEAAkE;oBAClE,0EAA0E;oBAC1E,+BAA+B;oBAC/B,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;wBAClC,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;4BACzE,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,QAAQ,EAAE,MAAM;yBACjB,CAAC,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACzB,sEAAsE;wBACtE,wEAAwE;wBACxE,oEAAoE;wBACpE,4DAA4D;wBAC5D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;4BAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;4BAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,KAAK,IAAI,EAAE;gCACpF,OAAO,EAAE,IAAI,CAAC,OAAO;gCACrB,OAAO,EAAE,OAAO,GAAG,CAAC;6BACrB,CAAC,CAAC;4BACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BACxB,OAAO,EAAE,CAAC;4BACV,SAAS;wBACX,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBACpB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;wBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,QAAQ,EAAE,OAAO,GAAG,CAAC;qBACtB,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,oCAAoC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE;oBACxD,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,OAAO,GAAG,CAAC;oBACpB,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;QACD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACI,UAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK;QACV,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,OAAe;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,mCAAmC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEtE;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAA+B;IAE/B,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAE7E,IAAI,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACzD,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import axios from 'axios';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { fullJitterBackoffMs, recoveryOffsetMs } from './network-backoff.frontend.utils';\n\n/**\n * Readiness check response from /health/ready endpoint\n */\ninterface ReadinessResponse {\n  status: 'healthy' | 'unhealthy' | 'degraded';\n  timestamp: string;\n  uptime: number;\n  version: string;\n}\n\n/**\n * Configuration for the readiness checker\n */\nexport interface ReadinessCheckerConfig {\n  /** Base delay in ms for exponential backoff (default: 100) */\n  baseDelayMs?: number;\n  /** Maximum delay cap in ms (default: 10000 = 10s) */\n  maxDelayMs?: number;\n  /** Timeout for each health check request in ms (default: 5000) */\n  requestTimeoutMs?: number;\n}\n\nconst DEFAULT_BASE_DELAY_MS = 100;\nconst DEFAULT_MAX_DELAY_MS = 10000;\nconst DEFAULT_REQUEST_TIMEOUT_MS = 5000;\n\n/**\n * Typed rejection produced when a BOUNDED {@link ApiReadinessChecker.waitForReady}\n * gives up before the backend reports ready.\n *\n * This is the first-class \"network unavailable\" lane for foreground requests:\n * before it existed, every request issued after a connection loss parked forever\n * on the never-settling readiness promise (audit finding B2 — an FK dropdown\n * spinner that never resolves). Callers and retry ladders classify it by `name`\n * / `code` (or via {@link isApiNotReadyError}); it is a TRANSIENT condition —\n * the backend may come back — never a validation or server failure.\n *\n * The background poll loop is NOT stopped by this rejection: it keeps polling\n * `/health/ready` (that part is by design, see {@link ApiReadinessChecker}),\n * so a later request finds the gate open again once the backend recovers.\n */\nexport class ApiNotReadyError extends Error {\n  override readonly name = 'ApiNotReadyError';\n  /** Stable machine-readable classifier for retry logic. */\n  readonly code = 'API_NOT_READY';\n  readonly baseUrl: string;\n  readonly timeoutMs: number;\n\n  constructor(baseUrl: string, timeoutMs: number) {\n    super(`Backend API at ${baseUrl || '<unset baseUrl>'} did not become ready within ${timeoutMs}ms`);\n    this.baseUrl = baseUrl;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Recognise an {@link ApiNotReadyError} across module instances (dual-package /\n * multiple bundles), matching by the stable `name` rather than `instanceof`.\n */\nexport function isApiNotReadyError(error: unknown): error is ApiNotReadyError {\n  return error instanceof Error && error.name === 'ApiNotReadyError';\n}\n\n/**\n * API Readiness Checker\n *\n * Checks if the target API is ready by polling /health/ready endpoint.\n * Uses exponential backoff: 2^attempts * baseDelay, capped at maxDelay.\n * The background poll loop never stops — it keeps retrying until the API is\n * ready. Individual waiters may bound their wait (`waitForReady(timeoutMs)`)\n * and receive a typed {@link ApiNotReadyError} rejection without affecting\n * the shared loop.\n *\n * @example\n * ```typescript\n * const checker = new ApiReadinessChecker('https://api.example.com');\n * await checker.waitForReady();        // Blocks until API is ready (unbounded)\n * await checker.waitForReady(10_000);  // Rejects with ApiNotReadyError after 10s\n * ```\n */\nexport class ApiReadinessChecker {\n  private baseUrl: string;\n  private config: Required<ReadinessCheckerConfig>;\n  private logger: LoggerFrontendService;\n  private logDebug: (message: string, context?: any) => void;\n  private isReady: boolean = false;\n  private readinessPromise: Promise<void> | null = null;\n  // True while a `performReadinessCheck` loop is actively polling. Guards against\n  // `reset()` nulling `readinessPromise` mid-poll and letting a second concurrent\n  // loop spawn on the same instance (redundant /health/ready load).\n  private isChecking: boolean = false;\n\n  constructor(baseUrl: string, config: ReadinessCheckerConfig = {}) {\n    this.baseUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;\n    this.config = {\n      baseDelayMs: config.baseDelayMs ?? DEFAULT_BASE_DELAY_MS,\n      maxDelayMs: config.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,\n      requestTimeoutMs: config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,\n    };\n    this.logger = LoggerFrontendService.getLogger();\n    this.logDebug = this.logger.debugByType('ApiReadinessChecker');\n    this.logger.setDebugTypeLogging('ApiReadinessChecker', false);\n  }\n\n  /**\n   * Calculate the poll delay for a given attempt using JITTERED exponential\n   * backoff: a random value in [0, min(maxDelay, 2^attempt · baseDelay)].\n   *\n   * The jitter is the cross-client de-herd lever for the readiness gate. Every\n   * client that was up when the backend went down starts polling /health/ready at\n   * the same moment and, with a deterministic curve, would hit the endpoint in\n   * lockstep — and then all flip \"ready\" and flood the backend on the same tick.\n   * Randomising the poll cadence spreads both the health-probe load and the\n   * subsequent recovery burst.\n   */\n  private calculateDelay(attempt: number): number {\n    return fullJitterBackoffMs(attempt, this.config.baseDelayMs, this.config.maxDelayMs);\n  }\n\n  /**\n   * Check readiness once\n   * @returns true if API is ready, false otherwise\n   */\n  private async checkOnce(): Promise<boolean> {\n    try {\n      const response = await axios.get<ReadinessResponse>(\n        `${this.baseUrl}/health/ready`,\n        {\n          timeout: this.config.requestTimeoutMs,\n          // Don't throw on non-2xx status - we handle it ourselves\n          validateStatus: () => true,\n        }\n      );\n\n      if (response.status === 200 && response.data?.status === 'healthy') {\n        return true;\n      }\n\n      return false;\n    } catch (error) {\n      // Network error, timeout, etc.\n      return false;\n    }\n  }\n\n  /**\n   * Wait until the API is ready.\n   *\n   * Without `timeoutMs`, blocks until the backend reports ready — the shared\n   * poll loop (`performReadinessCheck`) uses exponential backoff and never\n   * gives up. That unbounded form is appropriate for background consumers\n   * (e.g. connectivity banners) that WANT to ride the outage to its end.\n   *\n   * With `timeoutMs`, the wait is BOUNDED: if the backend is still not ready\n   * when the timeout elapses, the returned promise rejects with a typed\n   * {@link ApiNotReadyError} so the caller's error path runs (toast, inline\n   * error, retry ladder classification). Foreground request paths MUST use\n   * this form — an unbounded wait parks every user-visible request forever\n   * after a connection loss (audit B2). The timeout is per-caller: it never\n   * settles, cancels, or otherwise affects the SHARED `readinessPromise`,\n   * whose loop keeps polling in the background so a later call can succeed.\n   *\n   * @param timeoutMs - Optional bound in ms. Omit for the unbounded wait.\n   */\n  public async waitForReady(timeoutMs?: number): Promise<void> {\n    // If no baseUrl configured, skip readiness check\n    if (!this.baseUrl) {\n      this.logger.warn('API readiness check skipped: no baseUrl configured');\n      return;\n    }\n\n    // If already ready, return immediately\n    if (this.isReady) {\n      return;\n    }\n\n    // Join (or start) the shared readiness poll. The shared promise only ever\n    // RESOLVES (the loop retries forever), so racing it below can never leave\n    // an unhandled rejection behind on the shared object.\n    if (!this.readinessPromise) {\n      this.readinessPromise = this.performReadinessCheck();\n    }\n    const readiness = this.readinessPromise;\n\n    if (timeoutMs === undefined) {\n      await readiness;\n      return;\n    }\n\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await Promise.race([\n        readiness,\n        new Promise<never>((_, reject) => {\n          timer = setTimeout(() => reject(new ApiNotReadyError(this.baseUrl, timeoutMs)), timeoutMs);\n        }),\n      ]);\n    } finally {\n      // Always clear the per-caller timer so a resolved wait doesn't leave a\n      // stray timeout (and a pending ApiNotReadyError construction) behind.\n      if (timer !== undefined) clearTimeout(timer);\n    }\n  }\n\n  /**\n   * Perform the actual readiness check with retries\n   */\n  private async performReadinessCheck(): Promise<void> {\n    let attempt = 0;\n\n    this.isChecking = true;\n    this.logDebug('Starting API readiness check', { baseUrl: this.baseUrl });\n\n    try {\n    while (!this.isReady) {\n      const ready = await this.checkOnce();\n\n      if (ready) {\n        // Recovery de-sync: if the backend was actually unavailable for a while\n        // (attempt > 0 = we had to retry), delay the \"ready\" flip by a per-client\n        // random offset so every client that was blocked on the SAME outage\n        // doesn't release its queued requests — and re-fire its WS reconnect — in\n        // the same instant. The first-ever cold check (attempt 0 succeeds\n        // immediately against a healthy backend) is NOT delayed, so page load and\n        // normal navigation stay fast.\n        if (attempt > 0) {\n          const offset = recoveryOffsetMs();\n          this.logDebug('API ready after outage — applying recovery de-sync offset', {\n            baseUrl: this.baseUrl,\n            offsetMs: offset,\n          });\n          await this.sleep(offset);\n          // The backend may have died again DURING the (up to 2s) offset sleep.\n          // Re-confirm before committing the sticky `isReady` flag — otherwise we\n          // could flip the gate open against a down backend and fire the next\n          // request blindly. If it's no longer healthy, keep polling.\n          if (!(await this.checkOnce())) {\n            const delay = this.calculateDelay(attempt);\n            this.logger.warn(`API went unhealthy during recovery offset, retrying in ${delay}ms`, {\n              baseUrl: this.baseUrl,\n              attempt: attempt + 1,\n            });\n            await this.sleep(delay);\n            attempt++;\n            continue;\n          }\n        }\n        this.isReady = true;\n        this.logDebug('API is ready', {\n          baseUrl: this.baseUrl,\n          attempts: attempt + 1,\n        });\n        return;\n      }\n\n      // Not ready - log warning and retry\n      const delay = this.calculateDelay(attempt);\n      this.logger.warn(`API not ready, retrying in ${delay}ms`, {\n        baseUrl: this.baseUrl,\n        attempt: attempt + 1,\n        nextDelayMs: delay,\n      });\n\n      await this.sleep(delay);\n      attempt++;\n    }\n    } finally {\n      this.isChecking = false;\n    }\n  }\n\n  /**\n   * Sleep for given duration\n   */\n  private sleep(ms: number): Promise<void> {\n    return new Promise(resolve => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Check if API is currently marked as ready\n   */\n  public getIsReady(): boolean {\n    return this.isReady;\n  }\n\n  /**\n   * Reset the ready state (useful for reconnection scenarios).\n   *\n   * Only clears `readinessPromise` when no poll loop is currently running. If a\n   * `performReadinessCheck` is mid-flight, nulling the promise here would let the\n   * next `waitForReady()` spawn a SECOND concurrent poll loop on the same instance\n   * (both would hammer /health/ready). Instead the running loop is left in place —\n   * setting `isReady = false` keeps it polling until the backend recovers, which\n   * is exactly the re-arm behaviour `reset()` wants.\n   */\n  public reset(): void {\n    this.isReady = false;\n    if (!this.isChecking) {\n      this.readinessPromise = null;\n    }\n  }\n\n  /**\n   * Update the base URL (useful when environment changes)\n   */\n  public updateBaseUrl(baseUrl: string): void {\n    this.baseUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;\n    // Reset readiness when URL changes\n    this.reset();\n  }\n}\n\n/**\n * Singleton factory for API readiness checkers\n * Maintains one checker per base URL\n */\nconst readinessCheckers: Map<string, ApiReadinessChecker> = new Map();\n\n/**\n * Get or create an API readiness checker for the given base URL\n */\nexport function getReadinessChecker(\n  baseUrl: string,\n  config?: ReadinessCheckerConfig\n): ApiReadinessChecker {\n  const normalizedUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;\n  \n  let checker = readinessCheckers.get(normalizedUrl);\n  if (!checker) {\n    checker = new ApiReadinessChecker(normalizedUrl, config);\n    readinessCheckers.set(normalizedUrl, checker);\n  }\n  \n  return checker;\n}\n"]}
+{"version":3,"file":"api-readiness-checker.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/requests/api-readiness-checker.frontend.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAwBzF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IAC5C,0DAA0D;IACjD,IAAI,GAAG,eAAe,CAAC;IACvB,OAAO,CAAS;IAChB,SAAS,CAAS;IAE3B,YAAY,OAAe,EAAE,SAAiB;QAC5C,KAAK,CAAC,kBAAkB,OAAO,IAAI,iBAAiB,gCAAgC,SAAS,IAAI,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAmB;IACtB,OAAO,CAAS;IAChB,MAAM,CAAmC;IACzC,MAAM,CAAwB;IAC9B,QAAQ,CAA2C;IACnD,OAAO,GAAY,KAAK,CAAC;IACzB,gBAAgB,GAAyB,IAAI,CAAC;IACtD,gFAAgF;IAChF,gFAAgF;IAChF,kEAAkE;IAC1D,UAAU,GAAY,KAAK,CAAC;IAEpC,YAAY,OAAe,EAAE,SAAiC,EAAE;QAC9D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,qBAAqB;YACxD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,oBAAoB;YACrD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,0BAA0B;SACxE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;OAUG;IACK,cAAc,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAC9B,GAAG,IAAI,CAAC,OAAO,eAAe,EAC9B;gBACE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACrC,yDAAyD;gBACzD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;aAC3B,CACF,CAAC;YAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+BAA+B;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACI,KAAK,CAAC,YAAY,CAAC,SAAkB;QAC1C,iDAAiD;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,sDAAsD;QACtD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,SAAS;gBACT,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC7F,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAErC,IAAI,KAAK,EAAE,CAAC;oBACV,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,0EAA0E;oBAC1E,kEAAkE;oBAClE,0EAA0E;oBAC1E,+BAA+B;oBAC/B,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;wBAClC,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;4BACzE,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,QAAQ,EAAE,MAAM;yBACjB,CAAC,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACzB,sEAAsE;wBACtE,wEAAwE;wBACxE,oEAAoE;wBACpE,4DAA4D;wBAC5D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;4BAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;4BAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,KAAK,IAAI,EAAE;gCACpF,OAAO,EAAE,IAAI,CAAC,OAAO;gCACrB,OAAO,EAAE,OAAO,GAAG,CAAC;6BACrB,CAAC,CAAC;4BACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BACxB,OAAO,EAAE,CAAC;4BACV,SAAS;wBACX,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBACpB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;wBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,QAAQ,EAAE,OAAO,GAAG,CAAC;qBACtB,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,oCAAoC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE;oBACxD,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,OAAO,GAAG,CAAC;oBACpB,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;QACD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACI,UAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK;QACV,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,OAAe;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,mCAAmC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEtE;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAA+B;IAE/B,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAE7E,IAAI,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACzD,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import axios from 'axios';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { fullJitterBackoffMs, recoveryOffsetMs } from './network-backoff.frontend.utils';\n\n/**\n * Readiness check response from /health/ready endpoint\n */\ninterface ReadinessResponse {\n  status: 'healthy' | 'unhealthy' | 'degraded';\n  timestamp: string;\n  uptime: number;\n  version: string;\n}\n\n/**\n * Configuration for the readiness checker\n */\nexport interface ReadinessCheckerConfig {\n  /** Base delay in ms for exponential backoff (default: 100) */\n  baseDelayMs?: number;\n  /** Maximum delay cap in ms (default: 10000 = 10s) */\n  maxDelayMs?: number;\n  /** Timeout for each health check request in ms (default: 5000) */\n  requestTimeoutMs?: number;\n}\n\nconst DEFAULT_BASE_DELAY_MS = 100;\nconst DEFAULT_MAX_DELAY_MS = 10000;\nconst DEFAULT_REQUEST_TIMEOUT_MS = 5000;\n\n/**\n * Typed rejection produced when a BOUNDED {@link ApiReadinessChecker.waitForReady}\n * gives up before the backend reports ready.\n *\n * This is the first-class \"network unavailable\" lane for foreground requests:\n * before it existed, every request issued after a connection loss parked forever\n * on the never-settling readiness promise (audit finding B2 — an FK dropdown\n * spinner that never resolves). Callers and retry ladders classify it by `name`\n * / `code` (or via {@link isApiNotReadyError}); it is a TRANSIENT condition —\n * the backend may come back — never a validation or server failure.\n *\n * The background poll loop is NOT stopped by this rejection: it keeps polling\n * `/health/ready` (that part is by design, see {@link ApiReadinessChecker}),\n * so a later request finds the gate open again once the backend recovers.\n */\nexport class ApiNotReadyError extends Error {\n  override readonly name = 'ApiNotReadyError';\n  /** Stable machine-readable classifier for retry logic. */\n  readonly code = 'API_NOT_READY';\n  readonly baseUrl: string;\n  readonly timeoutMs: number;\n\n  constructor(baseUrl: string, timeoutMs: number) {\n    super(`Backend API at ${baseUrl || '<unset baseUrl>'} did not become ready within ${timeoutMs}ms`);\n    this.baseUrl = baseUrl;\n    this.timeoutMs = timeoutMs;\n  }\n}\n\n/**\n * Recognise an {@link ApiNotReadyError} across module instances (dual-package /\n * multiple bundles), matching by the stable `name` rather than `instanceof`.\n */\nexport function isApiNotReadyError(error: unknown): error is ApiNotReadyError {\n  return error instanceof Error && error.name === 'ApiNotReadyError';\n}\n\n/**\n * API Readiness Checker\n *\n * Checks if the target API is ready by polling /health/ready endpoint.\n * Uses exponential backoff: 2^attempts * baseDelay, capped at maxDelay.\n * The background poll loop never stops — it keeps retrying until the API is\n * ready. Individual waiters may bound their wait (`waitForReady(timeoutMs)`)\n * and receive a typed {@link ApiNotReadyError} rejection without affecting\n * the shared loop.\n *\n * @example\n * ```typescript\n * const checker = new ApiReadinessChecker('https://api.example.com');\n * await checker.waitForReady();        // Blocks until API is ready (unbounded)\n * await checker.waitForReady(10_000);  // Rejects with ApiNotReadyError after 10s\n * ```\n */\nexport class ApiReadinessChecker {\n  private baseUrl: string;\n  private config: Required<ReadinessCheckerConfig>;\n  private logger: LoggerFrontendService;\n  private logDebug: (message: string, context?: any) => void;\n  private isReady: boolean = false;\n  private readinessPromise: Promise<void> | null = null;\n  // True while a `performReadinessCheck` loop is actively polling. Guards against\n  // `reset()` nulling `readinessPromise` mid-poll and letting a second concurrent\n  // loop spawn on the same instance (redundant /health/ready load).\n  private isChecking: boolean = false;\n\n  constructor(baseUrl: string, config: ReadinessCheckerConfig = {}) {\n    this.baseUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;\n    this.config = {\n      baseDelayMs: config.baseDelayMs ?? DEFAULT_BASE_DELAY_MS,\n      maxDelayMs: config.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,\n      requestTimeoutMs: config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,\n    };\n    this.logger = LoggerFrontendService.getLogger();\n    this.logDebug = this.logger.debugByType('ApiReadinessChecker');\n    this.logger.setDebugTypeLogging('ApiReadinessChecker', false);\n  }\n\n  /**\n   * Calculate the poll delay for a given attempt using JITTERED exponential\n   * backoff: a random value in [0, min(maxDelay, 2^attempt · baseDelay)].\n   *\n   * The jitter is the cross-client de-herd lever for the readiness gate. Every\n   * client that was up when the backend went down starts polling /health/ready at\n   * the same moment and, with a deterministic curve, would hit the endpoint in\n   * lockstep — and then all flip \"ready\" and flood the backend on the same tick.\n   * Randomising the poll cadence spreads both the health-probe load and the\n   * subsequent recovery burst.\n   */\n  private calculateDelay(attempt: number): number {\n    return fullJitterBackoffMs(attempt, this.config.baseDelayMs, this.config.maxDelayMs);\n  }\n\n  /**\n   * Check readiness once\n   * @returns true if API is ready, false otherwise\n   */\n  private async checkOnce(): Promise<boolean> {\n    try {\n      const response = await axios.get<ReadinessResponse>(\n        `${this.baseUrl}/health/ready`,\n        {\n          timeout: this.config.requestTimeoutMs,\n          // Don't throw on non-2xx status - we handle it ourselves\n          validateStatus: () => true,\n        }\n      );\n\n      if (response.status === 200 && response.data?.status === 'healthy') {\n        return true;\n      }\n\n      return false;\n    } catch (error) {\n      // Network error, timeout, etc.\n      return false;\n    }\n  }\n\n  /**\n   * Wait until the API is ready.\n   *\n   * Without `timeoutMs`, blocks until the backend reports ready — the shared\n   * poll loop (`performReadinessCheck`) uses exponential backoff and never\n   * gives up. That unbounded form is appropriate for background consumers\n   * (e.g. connectivity banners) that WANT to ride the outage to its end.\n   *\n   * With `timeoutMs`, the wait is BOUNDED: if the backend is still not ready\n   * when the timeout elapses, the returned promise rejects with a typed\n   * {@link ApiNotReadyError} so the caller's error path runs (toast, inline\n   * error, retry ladder classification). Foreground request paths MUST use\n   * this form — an unbounded wait parks every user-visible request forever\n   * after a connection loss (audit B2). The timeout is per-caller: it never\n   * settles, cancels, or otherwise affects the SHARED `readinessPromise`,\n   * whose loop keeps polling in the background so a later call can succeed.\n   *\n   * @param timeoutMs - Optional bound in ms. Omit for the unbounded wait.\n   */\n  public async waitForReady(timeoutMs?: number): Promise<void> {\n    // If no baseUrl configured, skip readiness check\n    if (!this.baseUrl) {\n      this.logger.warn('API readiness check skipped: no baseUrl configured');\n      return;\n    }\n\n    // If already ready, return immediately\n    if (this.isReady) {\n      return;\n    }\n\n    // Join (or start) the shared readiness poll. The shared promise only ever\n    // RESOLVES (the loop retries forever), so racing it below can never leave\n    // an unhandled rejection behind on the shared object.\n    if (!this.readinessPromise) {\n      this.readinessPromise = this.performReadinessCheck();\n    }\n    const readiness = this.readinessPromise;\n\n    if (timeoutMs === undefined) {\n      await readiness;\n      return;\n    }\n\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n      await Promise.race([\n        readiness,\n        new Promise<never>((_, reject) => {\n          timer = setTimeout(() => reject(new ApiNotReadyError(this.baseUrl, timeoutMs)), timeoutMs);\n        }),\n      ]);\n    } finally {\n      // Always clear the per-caller timer so a resolved wait doesn't leave a\n      // stray timeout (and a pending ApiNotReadyError construction) behind.\n      if (timer !== undefined) clearTimeout(timer);\n    }\n  }\n\n  /**\n   * Perform the actual readiness check with retries\n   */\n  private async performReadinessCheck(): Promise<void> {\n    let attempt = 0;\n\n    this.isChecking = true;\n    this.logDebug('Starting API readiness check', { baseUrl: this.baseUrl });\n\n    try {\n    while (!this.isReady) {\n      const ready = await this.checkOnce();\n\n      if (ready) {\n        // Recovery de-sync: if the backend was actually unavailable for a while\n        // (attempt > 0 = we had to retry), delay the \"ready\" flip by a per-client\n        // random offset so every client that was blocked on the SAME outage\n        // doesn't release its queued requests — and re-fire its WS reconnect — in\n        // the same instant. The first-ever cold check (attempt 0 succeeds\n        // immediately against a healthy backend) is NOT delayed, so page load and\n        // normal navigation stay fast.\n        if (attempt > 0) {\n          const offset = recoveryOffsetMs();\n          this.logDebug('API ready after outage — applying recovery de-sync offset', {\n            baseUrl: this.baseUrl,\n            offsetMs: offset,\n          });\n          await this.sleep(offset);\n          // The backend may have died again DURING the (up to 2s) offset sleep.\n          // Re-confirm before committing the sticky `isReady` flag — otherwise we\n          // could flip the gate open against a down backend and fire the next\n          // request blindly. If it's no longer healthy, keep polling.\n          if (!(await this.checkOnce())) {\n            const delay = this.calculateDelay(attempt);\n            this.logger.warn(`API went unhealthy during recovery offset, retrying in ${delay}ms`, {\n              baseUrl: this.baseUrl,\n              attempt: attempt + 1,\n            });\n            await this.sleep(delay);\n            attempt++;\n            continue;\n          }\n        }\n        this.isReady = true;\n        this.logDebug('API is ready', {\n          baseUrl: this.baseUrl,\n          attempts: attempt + 1,\n        });\n        return;\n      }\n\n      // Not ready - log warning and retry\n      const delay = this.calculateDelay(attempt);\n      this.logger.warn(`API not ready, retrying in ${delay}ms`, {\n        baseUrl: this.baseUrl,\n        attempt: attempt + 1,\n        nextDelayMs: delay,\n      });\n\n      await this.sleep(delay);\n      attempt++;\n    }\n    } finally {\n      this.isChecking = false;\n    }\n  }\n\n  /**\n   * Sleep for given duration\n   */\n  private sleep(ms: number): Promise<void> {\n    return new Promise(resolve => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Check if API is currently marked as ready\n   */\n  public getIsReady(): boolean {\n    return this.isReady;\n  }\n\n  /**\n   * Reset the ready state (useful for reconnection scenarios).\n   *\n   * Only clears `readinessPromise` when no poll loop is currently running. If a\n   * `performReadinessCheck` is mid-flight, nulling the promise here would let the\n   * next `waitForReady()` spawn a SECOND concurrent poll loop on the same instance\n   * (both would hammer /health/ready). Instead the running loop is left in place —\n   * setting `isReady = false` keeps it polling until the backend recovers, which\n   * is exactly the re-arm behaviour `reset()` wants.\n   */\n  public reset(): void {\n    this.isReady = false;\n    if (!this.isChecking) {\n      this.readinessPromise = null;\n    }\n  }\n\n  /**\n   * Update the base URL (useful when environment changes)\n   */\n  public updateBaseUrl(baseUrl: string): void {\n    this.baseUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;\n    // Reset readiness when URL changes\n    this.reset();\n  }\n}\n\n/**\n * Singleton factory for API readiness checkers\n * Maintains one checker per base URL\n */\nconst readinessCheckers: Map<string, ApiReadinessChecker> = new Map();\n\n/**\n * Get or create an API readiness checker for the given base URL\n */\nexport function getReadinessChecker(\n  baseUrl: string,\n  config?: ReadinessCheckerConfig\n): ApiReadinessChecker {\n  const normalizedUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;\n  \n  let checker = readinessCheckers.get(normalizedUrl);\n  if (!checker) {\n    checker = new ApiReadinessChecker(normalizedUrl, config);\n    readinessCheckers.set(normalizedUrl, checker);\n  }\n  \n  return checker;\n}\n"]}

package/dist/esm/core/requests/auth-refresh-resilience.frontend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-refresh-resilience.frontend.d.ts","sourceRoot":"","sources":["../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWvE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,+BAA+B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAyBjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}
+{"version":3,"file":"auth-refresh-resilience.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWvE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,+BAA+B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAyBjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}

package/dist/esm/core/requests/auth-refresh-resilience.frontend.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-refresh-resilience.frontend.js","sourceRoot":"","sources":["../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAElG;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,MAAM,CAAC,GAAG,KAAqF,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,6DAA6D;IAC7D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,6CAA6C;IAC7C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,0DAA0D;IAC1D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,CAAC,GAAG,KAQU,CAAC;IAErB,IAAI,CAAC,EAAE,CAAC,iCAAiC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACzC,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,CAAC,EAAE,YAAY,KAAK,IAAI;WAC1B,CAAC,EAAE,OAAO,KAAK,SAAS;WACxB,CAAC,EAAE,MAAM,KAAK,SAAS;WACvB,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\n\n/**\n * Token-refresh resilience helpers (shared by `WildoHttpClient`'s 401-renewal\n * interceptor and `AuthSessionContext.tokenRenewalHandler`).\n *\n * Background — why this exists:\n *   The refresh token travels in the `__wildo_refresh` `HttpOnly` cookie.\n *   `AuthSessionContext.logout()` clears that cookie server-side, and the\n *   cookie is SHARED across every tab of the same origin. Historically ANY\n *   refresh failure triggered `logout()`, so a single non-authoritative blip\n *   (the backend restarting during a dev recompile, a 5xx, a timeout, or a\n *   racy revoke) did not merely fail one request — it DELETED the refresh\n *   token, turning a recoverable hiccup into a permanent, cross-tab forced\n *   logout. That is wrong in production (a backend blip must not log everyone\n *   out) and catastrophic in development (constant recompiles → constant\n *   \"you need to sign in again\").\n *\n * The fix splits refresh failures into two classes and only lets an\n * AUTHORITATIVE rejection destroy the session.\n */\n\n/**\n * Was the renewal AUTHORITATIVELY rejected — i.e. did the backend explicitly\n * refuse THIS refresh token, meaning the session is genuinely dead and the\n * user must re-authenticate?\n *\n * AUTHORITATIVE (returns `true`) — destroy the session:\n *   - `400` — the `__wildo_refresh` cookie was absent (no session to refresh).\n *   - `401` — the refresh token failed verification / was revoked / all\n *     sessions were invalidated.\n *   - `403` — the refresh was forbidden.\n *\n * TRANSIENT (returns `false`) — preserve the session, retry on a later request:\n *   - No HTTP response at all (`status` undefined) — network error,\n *     `ECONNREFUSED` while the backend is restarting, DNS, CORS preflight fail.\n *   - `>= 500` — a backend-side error (the backend is up but unhealthy /\n *     mid-boot), unrelated to the validity of the refresh token.\n *   - `408` — request timeout.\n *   - Any other unexpected status — treated conservatively as transient so an\n *     ambiguous code never silently destroys a valid session.\n *\n * The error shape is the enhanced axios error produced by\n * `WildoHttpClient.responseErrorInterceptor`, which sets `error.httpStatus`\n * only when the response carries a body; we therefore fall back to the raw\n * `error.response.status` so a body-less 4xx/5xx refresh response is still\n * classified by its status.\n */\nexport function isAuthoritativeRefreshRejection(error: unknown): boolean {\n  const e = error as { httpStatus?: unknown; response?: { status?: unknown } } | null | undefined;\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n\n  // No response → network / unreachable / timeout → transient.\n  if (status === undefined) return false;\n  // Backend-side error or timeout → transient.\n  if (status >= 500 || status === 408) return false;\n  // The backend authoritatively refused this refresh token.\n  return status === 400 || status === 401 || status === 403;\n}\n\n/**\n * Property the 401-renewal interceptor stamps on the ORIGINAL request error\n * when a token renewal could not complete for a NON-authoritative reason\n * (backend unreachable / 5xx / timeout). It lets a downstream recovery path\n * (notably session restore) recognise that a resulting 401 reflects \"renewal\n * couldn't happen\", not \"the session is dead\" — so it should be retried rather\n * than logged out. Set only when the renewal failure was transient; a genuinely\n * authoritative rejection is never tagged.\n */\nexport const RENEWAL_TRANSIENTLY_FAILED_MARKER = '__renewalTransientlyFailed';\n\n/**\n * Should a failure be treated as a TRANSIENT backend problem that warrants\n * preserving the session and retrying, rather than tearing it down?\n *\n * Returns `true` for:\n *   - an error tagged {@link RENEWAL_TRANSIENTLY_FAILED_MARKER} (a 401 whose\n *     in-flight renewal failed transiently — the session is not proven dead),\n *   - `>= 500` / `408` (backend-side error / timeout), and\n *   - a response-less error that is recognisably an HTTP/network-layer failure\n *     (axios network error: `isAxiosError` / `request` / `config` / a string\n *     `code`). A response-less error WITHOUT those markers is treated as\n *     NON-transient — it is almost certainly a thrown code bug, and retrying it\n *     forever would mask the bug and spin.\n *\n * Returns `false` for authoritative 4xx (400/401/403/etc.) and for non-HTTP\n * exceptions, both of which must terminate rather than retry.\n */\nexport function isTransientBackendFailure(error: unknown): boolean {\n  const e = error as {\n    [RENEWAL_TRANSIENTLY_FAILED_MARKER]?: unknown;\n    httpStatus?: unknown;\n    response?: { status?: unknown };\n    request?: unknown;\n    config?: unknown;\n    code?: unknown;\n    isAxiosError?: unknown;\n  } | null | undefined;\n\n  if (e?.[RENEWAL_TRANSIENTLY_FAILED_MARKER] === true) return true;\n\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n  if (status !== undefined) {\n    return status >= 500 || status === 408;\n  }\n\n  // No HTTP status: transient only if it's recognisably an HTTP/network-layer\n  // error, never for an arbitrary thrown exception (which would retry forever).\n  return e?.isAxiosError === true\n    || e?.request !== undefined\n    || e?.config !== undefined\n    || typeof e?.code === 'string';\n}\n\n/**\n * Is development-mode refresh leniency active?\n *\n * In `development` the backend is recompiled and restarted constantly by the\n * dev watchers, which routinely produces authoritative-LOOKING `400`/`401`\n * responses (e.g. the cookie momentarily cleared by a racing tab, or the\n * session store transiently unavailable) even though the session is fine once\n * the backend settles. To keep dev / AI-driven sessions alive we never\n * hard-logout on a refresh failure in development — the session is preserved\n * and the next request retries.\n *\n * Security note: this NEVER relaxes production. On any uncertainty (env not yet\n * loaded, loader throws) we fail closed to strict production behavior.\n */\nexport function isRefreshDevLenient(): boolean {\n  try {\n    return envLoader.isDevelopment();\n  } catch {\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"auth-refresh-resilience.frontend.js","sourceRoot":"","sources":["../../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAElG;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,MAAM,CAAC,GAAG,KAAqF,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,6DAA6D;IAC7D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,6CAA6C;IAC7C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,0DAA0D;IAC1D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,CAAC,GAAG,KAQU,CAAC;IAErB,IAAI,CAAC,EAAE,CAAC,iCAAiC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACzC,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,CAAC,EAAE,YAAY,KAAK,IAAI;WAC1B,CAAC,EAAE,OAAO,KAAK,SAAS;WACxB,CAAC,EAAE,MAAM,KAAK,SAAS;WACvB,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\n\n/**\n * Token-refresh resilience helpers (shared by `WildoHttpClient`'s 401-renewal\n * interceptor and `AuthSessionContext.tokenRenewalHandler`).\n *\n * Background — why this exists:\n *   The refresh token travels in the `__wildo_refresh` `HttpOnly` cookie.\n *   `AuthSessionContext.logout()` clears that cookie server-side, and the\n *   cookie is SHARED across every tab of the same origin. Historically ANY\n *   refresh failure triggered `logout()`, so a single non-authoritative blip\n *   (the backend restarting during a dev recompile, a 5xx, a timeout, or a\n *   racy revoke) did not merely fail one request — it DELETED the refresh\n *   token, turning a recoverable hiccup into a permanent, cross-tab forced\n *   logout. That is wrong in production (a backend blip must not log everyone\n *   out) and catastrophic in development (constant recompiles → constant\n *   \"you need to sign in again\").\n *\n * The fix splits refresh failures into two classes and only lets an\n * AUTHORITATIVE rejection destroy the session.\n */\n\n/**\n * Was the renewal AUTHORITATIVELY rejected — i.e. did the backend explicitly\n * refuse THIS refresh token, meaning the session is genuinely dead and the\n * user must re-authenticate?\n *\n * AUTHORITATIVE (returns `true`) — destroy the session:\n *   - `400` — the `__wildo_refresh` cookie was absent (no session to refresh).\n *   - `401` — the refresh token failed verification / was revoked / all\n *     sessions were invalidated.\n *   - `403` — the refresh was forbidden.\n *\n * TRANSIENT (returns `false`) — preserve the session, retry on a later request:\n *   - No HTTP response at all (`status` undefined) — network error,\n *     `ECONNREFUSED` while the backend is restarting, DNS, CORS preflight fail.\n *   - `>= 500` — a backend-side error (the backend is up but unhealthy /\n *     mid-boot), unrelated to the validity of the refresh token.\n *   - `408` — request timeout.\n *   - Any other unexpected status — treated conservatively as transient so an\n *     ambiguous code never silently destroys a valid session.\n *\n * The error shape is the enhanced axios error produced by\n * `WildoHttpClient.responseErrorInterceptor`, which sets `error.httpStatus`\n * only when the response carries a body; we therefore fall back to the raw\n * `error.response.status` so a body-less 4xx/5xx refresh response is still\n * classified by its status.\n */\nexport function isAuthoritativeRefreshRejection(error: unknown): boolean {\n  const e = error as { httpStatus?: unknown; response?: { status?: unknown } } | null | undefined;\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n\n  // No response → network / unreachable / timeout → transient.\n  if (status === undefined) return false;\n  // Backend-side error or timeout → transient.\n  if (status >= 500 || status === 408) return false;\n  // The backend authoritatively refused this refresh token.\n  return status === 400 || status === 401 || status === 403;\n}\n\n/**\n * Property the 401-renewal interceptor stamps on the ORIGINAL request error\n * when a token renewal could not complete for a NON-authoritative reason\n * (backend unreachable / 5xx / timeout). It lets a downstream recovery path\n * (notably session restore) recognise that a resulting 401 reflects \"renewal\n * couldn't happen\", not \"the session is dead\" — so it should be retried rather\n * than logged out. Set only when the renewal failure was transient; a genuinely\n * authoritative rejection is never tagged.\n */\nexport const RENEWAL_TRANSIENTLY_FAILED_MARKER = '__renewalTransientlyFailed';\n\n/**\n * Should a failure be treated as a TRANSIENT backend problem that warrants\n * preserving the session and retrying, rather than tearing it down?\n *\n * Returns `true` for:\n *   - an error tagged {@link RENEWAL_TRANSIENTLY_FAILED_MARKER} (a 401 whose\n *     in-flight renewal failed transiently — the session is not proven dead),\n *   - `>= 500` / `408` (backend-side error / timeout), and\n *   - a response-less error that is recognisably an HTTP/network-layer failure\n *     (axios network error: `isAxiosError` / `request` / `config` / a string\n *     `code`). A response-less error WITHOUT those markers is treated as\n *     NON-transient — it is almost certainly a thrown code bug, and retrying it\n *     forever would mask the bug and spin.\n *\n * Returns `false` for authoritative 4xx (400/401/403/etc.) and for non-HTTP\n * exceptions, both of which must terminate rather than retry.\n */\nexport function isTransientBackendFailure(error: unknown): boolean {\n  const e = error as {\n    [RENEWAL_TRANSIENTLY_FAILED_MARKER]?: unknown;\n    httpStatus?: unknown;\n    response?: { status?: unknown };\n    request?: unknown;\n    config?: unknown;\n    code?: unknown;\n    isAxiosError?: unknown;\n  } | null | undefined;\n\n  if (e?.[RENEWAL_TRANSIENTLY_FAILED_MARKER] === true) return true;\n\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n  if (status !== undefined) {\n    return status >= 500 || status === 408;\n  }\n\n  // No HTTP status: transient only if it's recognisably an HTTP/network-layer\n  // error, never for an arbitrary thrown exception (which would retry forever).\n  return e?.isAxiosError === true\n    || e?.request !== undefined\n    || e?.config !== undefined\n    || typeof e?.code === 'string';\n}\n\n/**\n * Is development-mode refresh leniency active?\n *\n * In `development` the backend is recompiled and restarted constantly by the\n * dev watchers, which routinely produces authoritative-LOOKING `400`/`401`\n * responses (e.g. the cookie momentarily cleared by a racing tab, or the\n * session store transiently unavailable) even though the session is fine once\n * the backend settles. To keep dev / AI-driven sessions alive we never\n * hard-logout on a refresh failure in development — the session is preserved\n * and the next request retries.\n *\n * Security note: this NEVER relaxes production. On any uncertainty (env not yet\n * loaded, loader throws) we fail closed to strict production behavior.\n */\nexport function isRefreshDevLenient(): boolean {\n  try {\n    return envLoader.isDevelopment();\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/esm/core/requests/client-instance-id.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-instance-id.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/requests/client-instance-id.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAwE9D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAqClF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAKxD;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,qBAAqB,CAEhE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD"}
+{"version":3,"file":"client-instance-id.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/client-instance-id.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAwE9D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAqClF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAKxD;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,qBAAqB,CAEhE;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAIlD"}

package/dist/esm/core/requests/client-instance-id.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-instance-id.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/requests/client-instance-id.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AAE9G;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,kBAAkB,CAAC;AAEtF;;GAEG;AACH,IAAI,WAAW,GAA0B,qBAAqB,CAAC,QAAQ,CAAC;AAExE,8FAA8F;AAC9F,IAAI,sBAA0C,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,KAA4B;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GACR,KAAK,KAAK,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc;YACnE,CAAC,CAAC,KAAK,KAAK,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY;gBACtE,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,4BAA4B;IACnC,KAAK,MAAM,KAAK,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,eAAe,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,8BAA8B,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IACD,kGAAkG;IAClG,2FAA2F;IAC3F,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAA4B;IAC1E,WAAW,GAAG,KAAK,CAAC;IACpB,sBAAsB,GAAG,SAAS,CAAC;IAEnC,IAAI,KAAK,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QAC7C,4BAA4B,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,8FAA8F;QAC9F,gGAAgG;QAChG,8BAA8B;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,kGAAkG;IAClG,+DAA+D;IAC/D,4BAA4B,EAAE,CAAC;IAE/B,MAAM,EAAE,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,qFAAqF;QACrF,OAAO;IACT,CAAC;IACD,sBAAsB,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,WAAW,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC;IAC7C,sBAAsB,GAAG,SAAS,CAAC;IACnC,4BAA4B,EAAE,CAAC;AACjC,CAAC","sourcesContent":["/**\n * Client-install identification (`clientInstanceId`) — the browser half of the OPT-IN,\n * DEFAULT-OFF capability decided in Fork D / SD9.\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\" — the axis that\n * lets an investigator group one actor's activity across sessions and logins, which the per-request\n * `correlationId` and the static `frontendServiceName` cannot. Because it is stored on the user's\n * terminal equipment it engages ePrivacy Art 5(3), so the framework never enables it on its own:\n * each application authors `compliance.clientInstanceIdScope` and this module obeys it.\n *\n * **Why a module-level singleton rather than React state.** The HTTP clients are constructed during\n * bootstrap, BEFORE the backend app-config (which carries the policy) has been fetched, and they live\n * outside the React tree — so they cannot read `ApplicationContext`. This mirrors the established\n * `envLoader` singleton + the \"push state into the HTTP client\" pattern already used for anonymous\n * sessions and consumable tokens.\n *\n * **Fail-closed by construction.** The scope starts `DISABLED`, so between process start and the\n * moment bootstrap calls {@link configureClientInstanceIdPolicy} nothing is minted, stored, or sent.\n * An application that never opts in therefore never creates the identifier at all — and even if a\n * client did send the header, the backend independently refuses to ingest it under the same policy.\n */\nimport { ClientInstanceIdScope } from '@wildo-ai/saas-models';\nimport { RUNTIME_SCOPED_STORAGE_KEYS } from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\n/**\n * Storage key for the minted id — named in `RUNTIME_SCOPED_STORAGE_KEYS` (the registry for keys whose\n * storage AREA is chosen at runtime), not in `LOCAL_STORAGE_KEYS`, because this value may live in\n * either area depending on the authored scope.\n */\nconst CLIENT_INSTANCE_ID_STORAGE_KEY = RUNTIME_SCOPED_STORAGE_KEYS.CLIENT_INSTANCE_ID;\n\n/**\n * The policy currently in force. `DISABLED` until bootstrap says otherwise — see \"fail-closed\" above.\n */\nlet activeScope: ClientInstanceIdScope = ClientInstanceIdScope.DISABLED;\n\n/** In-memory cache so the per-request read in the axios interceptor never touches storage. */\nlet cachedClientInstanceId: string | undefined;\n\n/**\n * The Web Storage area a scope stores its id in. `SESSION` uses `sessionStorage` so the id dies with\n * the tab; `PERSISTENT` uses `localStorage` so it survives restarts and logouts. `DISABLED` has none.\n *\n * **Probes availability instead of sniffing for `window`.** `engine/CLAUDE.md` requires frontend libs to\n * stay pure-frontend with no `typeof window` checks, and the check would be the wrong question anyway:\n * what this module needs to know is whether a STORAGE AREA exists, which is also false in a browser with\n * storage blocked (private mode, disabled cookies, a sandboxed cross-origin frame). Reading through\n * `globalThis` inside try/catch answers exactly that in one expression — `undefined` in a non-browser\n * realm, a throw when the browser refuses access, a `Storage` otherwise.\n */\nfunction storageForScope(scope: ClientInstanceIdScope): Storage | undefined {\n  try {\n    const area: Storage | undefined =\n      scope === ClientInstanceIdScope.SESSION ? globalThis.sessionStorage\n      : scope === ClientInstanceIdScope.PERSISTENT ? globalThis.localStorage\n      : undefined;\n    return area ?? undefined;\n  } catch {\n    // The browser refused access to the area. Treated as unavailable — see the mint rule below.\n    return undefined;\n  }\n}\n\n/**\n * Erase any previously stored id from BOTH storage areas.\n *\n * Called on every policy application, which is what makes the control reversible: turning the policy\n * OFF (or NARROWING `PERSISTENT` → `SESSION`) must not leave the old identifier sitting on the user's\n * device. Without this, a persistent id would silently outlive the consent or the decision that\n * created it — the practical form of the Art-17 erasure obligation on this field.\n *\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — withdrawing or narrowing the client-install\n * policy erases the identifier from the user's device rather than merely ceasing to send it.\n */\nfunction purgeStoredClientInstanceIds(): void {\n  for (const scope of [ClientInstanceIdScope.SESSION, ClientInstanceIdScope.PERSISTENT]) {\n    try {\n      storageForScope(scope)?.removeItem(CLIENT_INSTANCE_ID_STORAGE_KEY);\n    } catch {\n      // Unavailable storage — nothing to purge there.\n    }\n  }\n}\n\nfunction mintClientInstanceId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  // Fallback for environments without the WebCrypto UUID helper. This value is a correlation token,\n  // never a secret or an authorization input, so a non-cryptographic fallback is acceptable.\n  return `ci-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;\n}\n\n/**\n * Apply the application's authored policy. Called ONCE from bootstrap, after the backend app-config\n * (which carries `compliance.clientInstanceIdScope`) has been fetched.\n *\n * - `DISABLED` → purges any stored id and sends nothing thereafter.\n * - `SESSION` / `PERSISTENT` → reuses the id already held in that scope's storage, or mints one.\n *\n * Idempotent, and safe to call again with a DIFFERENT scope: the previous storage area is purged\n * first, so narrowing the policy genuinely removes the wider-lifetime identifier.\n *\n * **No storage ⇒ no identifier.** If the scope's storage area is unavailable (a non-browser realm such\n * as the companion's Node bridge or an SSR pass, or a browser refusing access in private mode), this\n * mints NOTHING and the capability stays off. That is deliberate on two grounds. Correctness: this\n * module's state is module-level, so an id minted in a shared Node process would be one identifier\n * handed to every user that process serves — a cross-user identifier, the exact opposite of what a\n * per-install id means. Value: the id exists to correlate activity ACROSS sessions, which an\n * in-memory-only value cannot do, so the fallback bought nothing while carrying that risk.\n */\nexport function configureClientInstanceIdPolicy(scope: ClientInstanceIdScope): void {\n  activeScope = scope;\n  cachedClientInstanceId = undefined;\n\n  if (scope === ClientInstanceIdScope.DISABLED) {\n    purgeStoredClientInstanceIds();\n    return;\n  }\n\n  const storage = storageForScope(scope);\n  if (!storage) {\n    // See \"No storage ⇒ no identifier\" above. `activeScope` is left as authored so a transparency\n    // surface still reports the app's posture truthfully; `getClientInstanceId()` returns undefined\n    // because nothing was minted.\n    return;\n  }\n\n  let existing: string | null = null;\n  try {\n    existing = storage.getItem(CLIENT_INSTANCE_ID_STORAGE_KEY);\n  } catch {\n    existing = null;\n  }\n\n  // Purge AFTER reading so the id is carried across a same-scope re-configure, but the OTHER area's\n  // stale copy (from a previously wider scope) is still removed.\n  purgeStoredClientInstanceIds();\n\n  const id = existing || mintClientInstanceId();\n  try {\n    storage.setItem(CLIENT_INSTANCE_ID_STORAGE_KEY, id);\n  } catch {\n    // The area existed a moment ago but refused the write (quota, eviction). Do not cache an id we\n    // could not persist — it would be per-page-load only, i.e. the case ruled out above.\n    return;\n  }\n  cachedClientInstanceId = id;\n}\n\n/**\n * The id to stamp on outbound requests, or `undefined` when the application has not opted in.\n * Read per request (never cached at client construction) so the policy takes effect the moment\n * bootstrap applies it, on a client that was built before the config arrived.\n */\nexport function getClientInstanceId(): string | undefined {\n  if (activeScope === ClientInstanceIdScope.DISABLED) {\n    return undefined;\n  }\n  return cachedClientInstanceId;\n}\n\n/** The policy currently in force — for diagnostics and transparency surfaces. */\nexport function getClientInstanceIdScope(): ClientInstanceIdScope {\n  return activeScope;\n}\n\n/**\n * Reset to the fail-closed default and erase stored ids. Used by tests, and available to an\n * application that must honour a consent withdrawal without a reload.\n */\nexport function resetClientInstanceIdPolicy(): void {\n  activeScope = ClientInstanceIdScope.DISABLED;\n  cachedClientInstanceId = undefined;\n  purgeStoredClientInstanceIds();\n}\n"]}
+{"version":3,"file":"client-instance-id.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/requests/client-instance-id.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,iEAAiE,CAAC;AAE9G;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,kBAAkB,CAAC;AAEtF;;GAEG;AACH,IAAI,WAAW,GAA0B,qBAAqB,CAAC,QAAQ,CAAC;AAExE,8FAA8F;AAC9F,IAAI,sBAA0C,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,KAA4B;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GACR,KAAK,KAAK,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc;YACnE,CAAC,CAAC,KAAK,KAAK,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY;gBACtE,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,4BAA4B;IACnC,KAAK,MAAM,KAAK,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,eAAe,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,8BAA8B,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IACD,kGAAkG;IAClG,2FAA2F;IAC3F,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAA4B;IAC1E,WAAW,GAAG,KAAK,CAAC;IACpB,sBAAsB,GAAG,SAAS,CAAC;IAEnC,IAAI,KAAK,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QAC7C,4BAA4B,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,8FAA8F;QAC9F,gGAAgG;QAChG,8BAA8B;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,kGAAkG;IAClG,+DAA+D;IAC/D,4BAA4B,EAAE,CAAC;IAE/B,MAAM,EAAE,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,qFAAqF;QACrF,OAAO;IACT,CAAC;IACD,sBAAsB,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,WAAW,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC;IAC7C,sBAAsB,GAAG,SAAS,CAAC;IACnC,4BAA4B,EAAE,CAAC;AACjC,CAAC","sourcesContent":["/**\n * Client-install identification (`clientInstanceId`) — the browser half of the OPT-IN,\n * DEFAULT-OFF capability decided in Fork D / SD9.\n *\n * A `clientInstanceId` answers \"which browser/device install issued this request?\" — the axis that\n * lets an investigator group one actor's activity across sessions and logins, which the per-request\n * `correlationId` and the static `frontendServiceName` cannot. Because it is stored on the user's\n * terminal equipment it engages ePrivacy Art 5(3), so the framework never enables it on its own:\n * each application authors `compliance.clientInstanceIdScope` and this module obeys it.\n *\n * **Why a module-level singleton rather than React state.** The HTTP clients are constructed during\n * bootstrap, BEFORE the backend app-config (which carries the policy) has been fetched, and they live\n * outside the React tree — so they cannot read `ApplicationContext`. This mirrors the established\n * `envLoader` singleton + the \"push state into the HTTP client\" pattern already used for anonymous\n * sessions and consumable tokens.\n *\n * **Fail-closed by construction.** The scope starts `DISABLED`, so between process start and the\n * moment bootstrap calls {@link configureClientInstanceIdPolicy} nothing is minted, stored, or sent.\n * An application that never opts in therefore never creates the identifier at all — and even if a\n * client did send the header, the backend independently refuses to ingest it under the same policy.\n */\nimport { ClientInstanceIdScope } from '@wildo-ai/saas-models';\nimport { RUNTIME_SCOPED_STORAGE_KEYS } from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\n/**\n * Storage key for the minted id — named in `RUNTIME_SCOPED_STORAGE_KEYS` (the registry for keys whose\n * storage AREA is chosen at runtime), not in `LOCAL_STORAGE_KEYS`, because this value may live in\n * either area depending on the authored scope.\n */\nconst CLIENT_INSTANCE_ID_STORAGE_KEY = RUNTIME_SCOPED_STORAGE_KEYS.CLIENT_INSTANCE_ID;\n\n/**\n * The policy currently in force. `DISABLED` until bootstrap says otherwise — see \"fail-closed\" above.\n */\nlet activeScope: ClientInstanceIdScope = ClientInstanceIdScope.DISABLED;\n\n/** In-memory cache so the per-request read in the axios interceptor never touches storage. */\nlet cachedClientInstanceId: string | undefined;\n\n/**\n * The Web Storage area a scope stores its id in. `SESSION` uses `sessionStorage` so the id dies with\n * the tab; `PERSISTENT` uses `localStorage` so it survives restarts and logouts. `DISABLED` has none.\n *\n * **Probes availability instead of sniffing for `window`.** `engine/CLAUDE.md` requires frontend libs to\n * stay pure-frontend with no `typeof window` checks, and the check would be the wrong question anyway:\n * what this module needs to know is whether a STORAGE AREA exists, which is also false in a browser with\n * storage blocked (private mode, disabled cookies, a sandboxed cross-origin frame). Reading through\n * `globalThis` inside try/catch answers exactly that in one expression — `undefined` in a non-browser\n * realm, a throw when the browser refuses access, a `Storage` otherwise.\n */\nfunction storageForScope(scope: ClientInstanceIdScope): Storage | undefined {\n  try {\n    const area: Storage | undefined =\n      scope === ClientInstanceIdScope.SESSION ? globalThis.sessionStorage\n      : scope === ClientInstanceIdScope.PERSISTENT ? globalThis.localStorage\n      : undefined;\n    return area ?? undefined;\n  } catch {\n    // The browser refused access to the area. Treated as unavailable — see the mint rule below.\n    return undefined;\n  }\n}\n\n/**\n * Erase any previously stored id from BOTH storage areas.\n *\n * Called on every policy application, which is what makes the control reversible: turning the policy\n * OFF (or NARROWING `PERSISTENT` → `SESSION`) must not leave the old identifier sitting on the user's\n * device. Without this, a persistent id would silently outlive the consent or the decision that\n * created it — the practical form of the Art-17 erasure obligation on this field.\n *\n * assurance-control: WILDO.PRIVACY.DATA_MINIMIZATION — withdrawing or narrowing the client-install\n * policy erases the identifier from the user's device rather than merely ceasing to send it.\n */\nfunction purgeStoredClientInstanceIds(): void {\n  for (const scope of [ClientInstanceIdScope.SESSION, ClientInstanceIdScope.PERSISTENT]) {\n    try {\n      storageForScope(scope)?.removeItem(CLIENT_INSTANCE_ID_STORAGE_KEY);\n    } catch {\n      // Unavailable storage — nothing to purge there.\n    }\n  }\n}\n\nfunction mintClientInstanceId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  // Fallback for environments without the WebCrypto UUID helper. This value is a correlation token,\n  // never a secret or an authorization input, so a non-cryptographic fallback is acceptable.\n  return `ci-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;\n}\n\n/**\n * Apply the application's authored policy. Called ONCE from bootstrap, after the backend app-config\n * (which carries `compliance.clientInstanceIdScope`) has been fetched.\n *\n * - `DISABLED` → purges any stored id and sends nothing thereafter.\n * - `SESSION` / `PERSISTENT` → reuses the id already held in that scope's storage, or mints one.\n *\n * Idempotent, and safe to call again with a DIFFERENT scope: the previous storage area is purged\n * first, so narrowing the policy genuinely removes the wider-lifetime identifier.\n *\n * **No storage ⇒ no identifier.** If the scope's storage area is unavailable (a non-browser realm such\n * as the companion's Node bridge or an SSR pass, or a browser refusing access in private mode), this\n * mints NOTHING and the capability stays off. That is deliberate on two grounds. Correctness: this\n * module's state is module-level, so an id minted in a shared Node process would be one identifier\n * handed to every user that process serves — a cross-user identifier, the exact opposite of what a\n * per-install id means. Value: the id exists to correlate activity ACROSS sessions, which an\n * in-memory-only value cannot do, so the fallback bought nothing while carrying that risk.\n */\nexport function configureClientInstanceIdPolicy(scope: ClientInstanceIdScope): void {\n  activeScope = scope;\n  cachedClientInstanceId = undefined;\n\n  if (scope === ClientInstanceIdScope.DISABLED) {\n    purgeStoredClientInstanceIds();\n    return;\n  }\n\n  const storage = storageForScope(scope);\n  if (!storage) {\n    // See \"No storage ⇒ no identifier\" above. `activeScope` is left as authored so a transparency\n    // surface still reports the app's posture truthfully; `getClientInstanceId()` returns undefined\n    // because nothing was minted.\n    return;\n  }\n\n  let existing: string | null = null;\n  try {\n    existing = storage.getItem(CLIENT_INSTANCE_ID_STORAGE_KEY);\n  } catch {\n    existing = null;\n  }\n\n  // Purge AFTER reading so the id is carried across a same-scope re-configure, but the OTHER area's\n  // stale copy (from a previously wider scope) is still removed.\n  purgeStoredClientInstanceIds();\n\n  const id = existing || mintClientInstanceId();\n  try {\n    storage.setItem(CLIENT_INSTANCE_ID_STORAGE_KEY, id);\n  } catch {\n    // The area existed a moment ago but refused the write (quota, eviction). Do not cache an id we\n    // could not persist — it would be per-page-load only, i.e. the case ruled out above.\n    return;\n  }\n  cachedClientInstanceId = id;\n}\n\n/**\n * The id to stamp on outbound requests, or `undefined` when the application has not opted in.\n * Read per request (never cached at client construction) so the policy takes effect the moment\n * bootstrap applies it, on a client that was built before the config arrived.\n */\nexport function getClientInstanceId(): string | undefined {\n  if (activeScope === ClientInstanceIdScope.DISABLED) {\n    return undefined;\n  }\n  return cachedClientInstanceId;\n}\n\n/** The policy currently in force — for diagnostics and transparency surfaces. */\nexport function getClientInstanceIdScope(): ClientInstanceIdScope {\n  return activeScope;\n}\n\n/**\n * Reset to the fail-closed default and erase stored ids. Used by tests, and available to an\n * application that must honour a consent withdrawal without a reload.\n */\nexport function resetClientInstanceIdPolicy(): void {\n  activeScope = ClientInstanceIdScope.DISABLED;\n  cachedClientInstanceId = undefined;\n  purgeStoredClientInstanceIds();\n}\n"]}

package/dist/esm/core/requests/network-backoff.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-backoff.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/requests/network-backoff.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAuC,GAAG,MAAM,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,KAAK,GAAE,MAA+B,EACtC,KAAK,GAAE,MAA+B,GACrC,MAAM,CAER;AAED,iEAAiE;AACjE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}
+{"version":3,"file":"network-backoff.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/network-backoff.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAuC,GAAG,MAAM,CAEvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,KAAK,GAAE,MAA+B,EACtC,KAAK,GAAE,MAA+B,GACrC,MAAM,CAER;AAED,iEAAiE;AACjE,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/esm/core/requests/network-backoff.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-backoff.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/requests/network-backoff.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,8DAA8D;AAC9D,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAC5C,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,WAAmB,EAAE,KAAa;IACrF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,8BAA8B;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAgB,sBAAsB,EACtC,QAAgB,sBAAsB;IAEtC,OAAO,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC","sourcesContent":["/**\n * Shared jittered-backoff + staggered-release helpers for the frontend network\n * layer.\n *\n * These centralise the anti-thundering-herd (\"auto-DDOS\") math so every recovery\n * path de-synchronises the same way: the HTTP retry backoff, the offline-queue\n * drain, the API-readiness gate, and the WebSocket readiness poll all import from\n * here. The problem they solve: when a backend outage ends, EVERY stuck client\n * would otherwise fire its backlog — plus its WS reconnect — in the same instant,\n * re-overloading the server the moment it comes back.\n *\n * What jitter fixes is SYNCHRONISATION, not per-client volume. Full jitter has a\n * mean of ~window/2 vs. a deterministic window, so an individual client actually\n * polls/retries somewhat MORE often on average — but the retries of N clients are\n * de-correlated, so the server sees a smooth spread instead of a synchronised\n * spike every backoff step. The spike is what melts a recovering backend, so this\n * is the right trade (the probed endpoints — /health/ready — are cheap). If\n * per-client probe rate ever becomes the concern, switch to \"equal jitter\"\n * (half-fixed + half-random) to lift the mean back toward ~3·window/4.\n *\n * Design rationale (why not a token bucket): the HTTP client already caps\n * in-flight requests via `maxConcurrentRequests`, so bounding the RATE is already\n * handled. All that's missing is de-correlating WHEN each request/client fires,\n * which random jitter achieves with zero additional state. See\n * `.claude/plans/network-resilience-organization.md` (decision D3).\n */\n\n/** Default ceiling on the per-client recovery offset (ms). */\nconst DEFAULT_RECOVERY_OFFSET_MAX_MS = 2000;\n/** Default lower bound for the inter-release stagger gap (ms). */\nconst DEFAULT_STAGGER_MIN_MS = 25;\n/** Default upper bound for the inter-release stagger gap (ms). */\nconst DEFAULT_STAGGER_MAX_MS = 250;\n\n/**\n * AWS \"full jitter\" exponential backoff: a uniformly random delay in\n * `[0, min(capMs, baseDelayMs · 2^attempt)]`.\n *\n * Full jitter (as opposed to raw exponential, or \"equal jitter\") gives the best\n * cross-client de-synchronisation — two clients that failed on the same round\n * pick independent delays, so their retries spread out instead of colliding again\n * on every subsequent round. The randomness is the whole point; do not replace it\n * with a deterministic curve.\n *\n * @param attempt      Zero-based attempt index (0 = first retry).\n * @param baseDelayMs  Base unit of backoff before doubling.\n * @param capMs        Hard ceiling on the pre-jitter window.\n * @returns            A jittered delay in milliseconds.\n */\nexport function fullJitterBackoffMs(attempt: number, baseDelayMs: number, capMs: number): number {\n  const safeAttempt = Math.max(0, attempt);\n  const window = Math.min(capMs, baseDelayMs * Math.pow(2, safeAttempt));\n  return Math.floor(Math.random() * Math.max(0, window));\n}\n\n/**\n * A fresh per-recovery offset in `[0, maxMs]`, rolled on each call.\n *\n * Applied ONCE per recovery event (the first offline→online drain, or the moment\n * the readiness gate flips healthy after an outage). Because each client rolls an\n * independent value, N clients that were all blocked on the same outage release\n * at N different instants instead of stampeding together. Rolled fresh per\n * recovery (not cached for the tab's lifetime) so a client that draws a large\n * offset on one outage isn't perpetually last on every future one.\n *\n * @param maxMs  Upper bound on the offset (defaults to 2000ms).\n */\nexport function recoveryOffsetMs(maxMs: number = DEFAULT_RECOVERY_OFFSET_MAX_MS): number {\n  return Math.floor(Math.random() * Math.max(0, maxMs));\n}\n\n/**\n * A small randomised gap between successive releases when draining a backlog\n * (offline queue, readiness-gate waiters). Spreads a burst over time WITHIN a\n * single client. Combined with {@link recoveryOffsetMs} (which de-syncs clients\n * from each other), this de-syncs a single client's own queued requests.\n *\n * @param minMs  Lower bound of the gap (defaults to 25ms).\n * @param maxMs  Upper bound of the gap (defaults to 250ms).\n */\nexport function staggerGapMs(\n  minMs: number = DEFAULT_STAGGER_MIN_MS,\n  maxMs: number = DEFAULT_STAGGER_MAX_MS,\n): number {\n  return minMs + Math.floor(Math.random() * Math.max(0, maxMs - minMs));\n}\n\n/** Promise-based sleep used by the staggered-release helpers. */\nexport function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n"]}
+{"version":3,"file":"network-backoff.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/requests/network-backoff.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,8DAA8D;AAC9D,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAC5C,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,WAAmB,EAAE,KAAa;IACrF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,8BAA8B;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAgB,sBAAsB,EACtC,QAAgB,sBAAsB;IAEtC,OAAO,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC","sourcesContent":["/**\n * Shared jittered-backoff + staggered-release helpers for the frontend network\n * layer.\n *\n * These centralise the anti-thundering-herd (\"auto-DDOS\") math so every recovery\n * path de-synchronises the same way: the HTTP retry backoff, the offline-queue\n * drain, the API-readiness gate, and the WebSocket readiness poll all import from\n * here. The problem they solve: when a backend outage ends, EVERY stuck client\n * would otherwise fire its backlog — plus its WS reconnect — in the same instant,\n * re-overloading the server the moment it comes back.\n *\n * What jitter fixes is SYNCHRONISATION, not per-client volume. Full jitter has a\n * mean of ~window/2 vs. a deterministic window, so an individual client actually\n * polls/retries somewhat MORE often on average — but the retries of N clients are\n * de-correlated, so the server sees a smooth spread instead of a synchronised\n * spike every backoff step. The spike is what melts a recovering backend, so this\n * is the right trade (the probed endpoints — /health/ready — are cheap). If\n * per-client probe rate ever becomes the concern, switch to \"equal jitter\"\n * (half-fixed + half-random) to lift the mean back toward ~3·window/4.\n *\n * Design rationale (why not a token bucket): the HTTP client already caps\n * in-flight requests via `maxConcurrentRequests`, so bounding the RATE is already\n * handled. All that's missing is de-correlating WHEN each request/client fires,\n * which random jitter achieves with zero additional state. See\n * `.claude/plans/network-resilience-organization.md` (decision D3).\n */\n\n/** Default ceiling on the per-client recovery offset (ms). */\nconst DEFAULT_RECOVERY_OFFSET_MAX_MS = 2000;\n/** Default lower bound for the inter-release stagger gap (ms). */\nconst DEFAULT_STAGGER_MIN_MS = 25;\n/** Default upper bound for the inter-release stagger gap (ms). */\nconst DEFAULT_STAGGER_MAX_MS = 250;\n\n/**\n * AWS \"full jitter\" exponential backoff: a uniformly random delay in\n * `[0, min(capMs, baseDelayMs · 2^attempt)]`.\n *\n * Full jitter (as opposed to raw exponential, or \"equal jitter\") gives the best\n * cross-client de-synchronisation — two clients that failed on the same round\n * pick independent delays, so their retries spread out instead of colliding again\n * on every subsequent round. The randomness is the whole point; do not replace it\n * with a deterministic curve.\n *\n * @param attempt      Zero-based attempt index (0 = first retry).\n * @param baseDelayMs  Base unit of backoff before doubling.\n * @param capMs        Hard ceiling on the pre-jitter window.\n * @returns            A jittered delay in milliseconds.\n */\nexport function fullJitterBackoffMs(attempt: number, baseDelayMs: number, capMs: number): number {\n  const safeAttempt = Math.max(0, attempt);\n  const window = Math.min(capMs, baseDelayMs * Math.pow(2, safeAttempt));\n  return Math.floor(Math.random() * Math.max(0, window));\n}\n\n/**\n * A fresh per-recovery offset in `[0, maxMs]`, rolled on each call.\n *\n * Applied ONCE per recovery event (the first offline→online drain, or the moment\n * the readiness gate flips healthy after an outage). Because each client rolls an\n * independent value, N clients that were all blocked on the same outage release\n * at N different instants instead of stampeding together. Rolled fresh per\n * recovery (not cached for the tab's lifetime) so a client that draws a large\n * offset on one outage isn't perpetually last on every future one.\n *\n * @param maxMs  Upper bound on the offset (defaults to 2000ms).\n */\nexport function recoveryOffsetMs(maxMs: number = DEFAULT_RECOVERY_OFFSET_MAX_MS): number {\n  return Math.floor(Math.random() * Math.max(0, maxMs));\n}\n\n/**\n * A small randomised gap between successive releases when draining a backlog\n * (offline queue, readiness-gate waiters). Spreads a burst over time WITHIN a\n * single client. Combined with {@link recoveryOffsetMs} (which de-syncs clients\n * from each other), this de-syncs a single client's own queued requests.\n *\n * @param minMs  Lower bound of the gap (defaults to 25ms).\n * @param maxMs  Upper bound of the gap (defaults to 250ms).\n */\nexport function staggerGapMs(\n  minMs: number = DEFAULT_STAGGER_MIN_MS,\n  maxMs: number = DEFAULT_STAGGER_MAX_MS,\n): number {\n  return minMs + Math.floor(Math.random() * Math.max(0, maxMs - minMs));\n}\n\n/** Promise-based sleep used by the staggered-release helpers. */\nexport function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n"]}

package/dist/esm/core/requests/offline-replay-policy.frontend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"offline-replay-policy.frontend.d.ts","sourceRoot":"","sources":["../../../../src/core/requests/offline-replay-policy.frontend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,gHAAgH;IAChH,MAAM,WAAW;IACjB,uFAAuF;IACvF,mBAAmB,wBAAwB;CAC5C;AASD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAKnG;AAED,6FAA6F;AAC7F,oBAAY,oBAAoB;IAC9B,2EAA2E;IAC3E,iBAAiB,sBAAsB;IACvC,yEAAyE;IACzE,mBAAmB,wBAAwB;CAC5C;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,8GAA8G;IAC9G,SAAgB,qBAAqB,QAAQ;IAC7C,SAAgB,MAAM,EAAE,oBAAoB,CAAC;IAC7C,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACI,MAAM,CAAC,EAAE,OAAO,CAAC;gBAEZ,MAAM,EAAE,oBAAoB,EAAE,GAAG,CAAC,EAAE,MAAM;CAYvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAMtF"}
+{"version":3,"file":"offline-replay-policy.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/offline-replay-policy.frontend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,mBAAmB;IAC7B,gHAAgH;IAChH,MAAM,WAAW;IACjB,uFAAuF;IACvF,mBAAmB,wBAAwB;CAC5C;AASD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAKnG;AAED,6FAA6F;AAC7F,oBAAY,oBAAoB;IAC9B,2EAA2E;IAC3E,iBAAiB,sBAAsB;IACvC,yEAAyE;IACzE,mBAAmB,wBAAwB;CAC5C;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,8GAA8G;IAC9G,SAAgB,qBAAqB,QAAQ;IAC7C,SAAgB,MAAM,EAAE,oBAAoB,CAAC;IAC7C,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACI,MAAM,CAAC,EAAE,OAAO,CAAC;gBAEZ,MAAM,EAAE,oBAAoB,EAAE,GAAG,CAAC,EAAE,MAAM;CAYvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAMtF"}

package/dist/esm/core/requests/offline-replay-policy.frontend.js.map

@@ -1 +1 @@
-{"version":3,"file":"offline-replay-policy.frontend.js","sourceRoot":"","sources":["../../../../src/core/requests/offline-replay-policy.frontend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,gHAAgH;IAChH,wCAAiB,CAAA;IACjB,uFAAuF;IACvF,kEAA2C,CAAA;AAC7C,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CAAC,MAA0B;IAC5E,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,CAAC,CAAC,mBAAmB,CAAC,MAAM;QAC5B,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,2EAA2E;IAC3E,+DAAuC,CAAA;IACvC,yEAAyE;IACzE,mEAA2C,CAAA;AAC7C,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,8GAA8G;IAC9F,qBAAqB,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAuB;IAC7B,GAAG,CAAU;IAC7B;;;;;OAKG;IACI,MAAM,CAAW;IAExB,YAAY,MAA4B,EAAE,GAAY;QACpD,KAAK,CACH,MAAM,KAAK,oBAAoB,CAAC,iBAAiB;YAC/C,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,yDAAyD,CAC9D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,uFAAuF;QACvF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA6C,CAAC,qBAAqB,KAAK,IAAI,CAC9E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Offline replay policy — decides what the HTTP client does with a request that\n * is issued while the browser reports no connectivity.\n *\n * The offline queue is a genuine convenience for READS: a GET that fires during a\n * mobile tunnel blip can safely be held and replayed a moment later — the caller\n * gets fresh data and nothing was mutated twice. MUTATIONS are the opposite: the\n * queue has no de-duplication and entries never expire, so a POST/PUT/PATCH/DELETE\n * enqueued at 9am could silently replay hours later against stale state, or double-\n * submit if the user retried in the meantime. For a mutation the honest behaviour\n * is to fail fast with a clear \"you're offline\" signal and let the user (or the\n * caller) decide to retry.\n *\n * v1 (locked 2026-07-07): reads REPLAY (with a TTL enforced by the client),\n * mutations REJECT. No idempotency-key replay path yet — see\n * `.claude/plans/network-resilience-organization.md` (decision D4).\n */\nexport enum OfflineReplayPolicy {\n  /** Hold the request in the offline queue and replay it when connectivity returns (subject to the queue TTL). */\n  REPLAY = 'REPLAY',\n  /** Reject the request immediately with a {@link NetworkOfflineError}; do not queue. */\n  REJECT_WHEN_OFFLINE = 'REJECT_WHEN_OFFLINE',\n}\n\n/**\n * HTTP methods that are safe to replay after an offline blip. Anything not in\n * this set is treated as a mutation and rejected when offline (unless the caller\n * overrides via `RequestOptions.offlineReplayPolicy`).\n */\nconst REPLAY_SAFE_METHODS: ReadonlySet<string> = new Set(['GET', 'HEAD', 'OPTIONS']);\n\n/**\n * Default policy for a request when the caller did not specify one explicitly:\n * safe/idempotent reads replay, everything else rejects.\n *\n * @param method  HTTP verb (case-insensitive); undefined is treated as GET,\n *                matching axios's own default method.\n */\nexport function defaultOfflineReplayPolicyForMethod(method: string | undefined): OfflineReplayPolicy {\n  const normalized = (method ?? 'GET').toUpperCase();\n  return REPLAY_SAFE_METHODS.has(normalized)\n    ? OfflineReplayPolicy.REPLAY\n    : OfflineReplayPolicy.REJECT_WHEN_OFFLINE;\n}\n\n/** Distinguishes the two offline-failure shapes so callers/telemetry can tell them apart. */\nexport enum NetworkOfflineReason {\n  /** A mutation was rejected because the client was offline (never sent). */\n  MUTATION_REJECTED = 'MUTATION_REJECTED',\n  /** A queued read outlived the queue TTL before connectivity returned. */\n  QUEUE_ENTRY_EXPIRED = 'QUEUE_ENTRY_EXPIRED',\n}\n\n/**\n * Error raised when a request cannot proceed due to lack of connectivity. It is\n * deliberately NOT a transport error and NOT a cancellation: the HTTP client's\n * response-error interceptor recognises it via {@link isNetworkOfflineRejection}\n * and short-circuits — it is never retried, never re-classified as a generic\n * NETWORK fault, and never routed through the global error toast. UX for the\n * offline state is owned by the connectivity layer (a single banner), not by\n * per-request toasts.\n */\nexport class NetworkOfflineError extends Error {\n  /** Marker property used by {@link isNetworkOfflineRejection} (survives structured-clone / prototype loss). */\n  public readonly __wildoNetworkOffline = true;\n  public readonly reason: NetworkOfflineReason;\n  public readonly url?: string;\n  /**\n   * The originating axios request config, attached at the throw site so the HTTP\n   * client's response-error interceptor can emit the balancing LOADING_*_END\n   * event (LOADING_*_START was already emitted before the request was rejected /\n   * queued). Typed `unknown` to keep this policy module free of an axios import.\n   */\n  public config?: unknown;\n\n  constructor(reason: NetworkOfflineReason, url?: string) {\n    super(\n      reason === NetworkOfflineReason.MUTATION_REJECTED\n        ? 'Request could not be sent because the device is offline'\n        : 'Queued request expired before connectivity was restored',\n    );\n    this.name = 'NetworkOfflineError';\n    this.reason = reason;\n    this.url = url;\n    // Restore the prototype chain for `instanceof` after transpilation to ES5-ish targets.\n    Object.setPrototypeOf(this, NetworkOfflineError.prototype);\n  }\n}\n\n/**\n * Predicate mirroring `isAbortOrCancelError`: recognises a {@link NetworkOfflineError}\n * by its marker property so the check survives even if the prototype is lost (e.g.\n * across an event-bus round-trip). Used at the single response-interceptor boundary\n * that suppresses offline rejections from retry/classification.\n */\nexport function isNetworkOfflineRejection(error: unknown): error is NetworkOfflineError {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    (error as { __wildoNetworkOffline?: unknown }).__wildoNetworkOffline === true\n  );\n}\n"]}
+{"version":3,"file":"offline-replay-policy.frontend.js","sourceRoot":"","sources":["../../../../../src/core/requests/offline-replay-policy.frontend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,gHAAgH;IAChH,wCAAiB,CAAA;IACjB,uFAAuF;IACvF,kEAA2C,CAAA;AAC7C,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CAAC,MAA0B;IAC5E,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,CAAC,CAAC,mBAAmB,CAAC,MAAM;QAC5B,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,2EAA2E;IAC3E,+DAAuC,CAAA;IACvC,yEAAyE;IACzE,mEAA2C,CAAA;AAC7C,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,8GAA8G;IAC9F,qBAAqB,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAuB;IAC7B,GAAG,CAAU;IAC7B;;;;;OAKG;IACI,MAAM,CAAW;IAExB,YAAY,MAA4B,EAAE,GAAY;QACpD,KAAK,CACH,MAAM,KAAK,oBAAoB,CAAC,iBAAiB;YAC/C,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,yDAAyD,CAC9D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,uFAAuF;QACvF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA6C,CAAC,qBAAqB,KAAK,IAAI,CAC9E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Offline replay policy — decides what the HTTP client does with a request that\n * is issued while the browser reports no connectivity.\n *\n * The offline queue is a genuine convenience for READS: a GET that fires during a\n * mobile tunnel blip can safely be held and replayed a moment later — the caller\n * gets fresh data and nothing was mutated twice. MUTATIONS are the opposite: the\n * queue has no de-duplication and entries never expire, so a POST/PUT/PATCH/DELETE\n * enqueued at 9am could silently replay hours later against stale state, or double-\n * submit if the user retried in the meantime. For a mutation the honest behaviour\n * is to fail fast with a clear \"you're offline\" signal and let the user (or the\n * caller) decide to retry.\n *\n * v1 (locked 2026-07-07): reads REPLAY (with a TTL enforced by the client),\n * mutations REJECT. No idempotency-key replay path yet — see\n * `.claude/plans/network-resilience-organization.md` (decision D4).\n */\nexport enum OfflineReplayPolicy {\n  /** Hold the request in the offline queue and replay it when connectivity returns (subject to the queue TTL). */\n  REPLAY = 'REPLAY',\n  /** Reject the request immediately with a {@link NetworkOfflineError}; do not queue. */\n  REJECT_WHEN_OFFLINE = 'REJECT_WHEN_OFFLINE',\n}\n\n/**\n * HTTP methods that are safe to replay after an offline blip. Anything not in\n * this set is treated as a mutation and rejected when offline (unless the caller\n * overrides via `RequestOptions.offlineReplayPolicy`).\n */\nconst REPLAY_SAFE_METHODS: ReadonlySet<string> = new Set(['GET', 'HEAD', 'OPTIONS']);\n\n/**\n * Default policy for a request when the caller did not specify one explicitly:\n * safe/idempotent reads replay, everything else rejects.\n *\n * @param method  HTTP verb (case-insensitive); undefined is treated as GET,\n *                matching axios's own default method.\n */\nexport function defaultOfflineReplayPolicyForMethod(method: string | undefined): OfflineReplayPolicy {\n  const normalized = (method ?? 'GET').toUpperCase();\n  return REPLAY_SAFE_METHODS.has(normalized)\n    ? OfflineReplayPolicy.REPLAY\n    : OfflineReplayPolicy.REJECT_WHEN_OFFLINE;\n}\n\n/** Distinguishes the two offline-failure shapes so callers/telemetry can tell them apart. */\nexport enum NetworkOfflineReason {\n  /** A mutation was rejected because the client was offline (never sent). */\n  MUTATION_REJECTED = 'MUTATION_REJECTED',\n  /** A queued read outlived the queue TTL before connectivity returned. */\n  QUEUE_ENTRY_EXPIRED = 'QUEUE_ENTRY_EXPIRED',\n}\n\n/**\n * Error raised when a request cannot proceed due to lack of connectivity. It is\n * deliberately NOT a transport error and NOT a cancellation: the HTTP client's\n * response-error interceptor recognises it via {@link isNetworkOfflineRejection}\n * and short-circuits — it is never retried, never re-classified as a generic\n * NETWORK fault, and never routed through the global error toast. UX for the\n * offline state is owned by the connectivity layer (a single banner), not by\n * per-request toasts.\n */\nexport class NetworkOfflineError extends Error {\n  /** Marker property used by {@link isNetworkOfflineRejection} (survives structured-clone / prototype loss). */\n  public readonly __wildoNetworkOffline = true;\n  public readonly reason: NetworkOfflineReason;\n  public readonly url?: string;\n  /**\n   * The originating axios request config, attached at the throw site so the HTTP\n   * client's response-error interceptor can emit the balancing LOADING_*_END\n   * event (LOADING_*_START was already emitted before the request was rejected /\n   * queued). Typed `unknown` to keep this policy module free of an axios import.\n   */\n  public config?: unknown;\n\n  constructor(reason: NetworkOfflineReason, url?: string) {\n    super(\n      reason === NetworkOfflineReason.MUTATION_REJECTED\n        ? 'Request could not be sent because the device is offline'\n        : 'Queued request expired before connectivity was restored',\n    );\n    this.name = 'NetworkOfflineError';\n    this.reason = reason;\n    this.url = url;\n    // Restore the prototype chain for `instanceof` after transpilation to ES5-ish targets.\n    Object.setPrototypeOf(this, NetworkOfflineError.prototype);\n  }\n}\n\n/**\n * Predicate mirroring `isAbortOrCancelError`: recognises a {@link NetworkOfflineError}\n * by its marker property so the check survives even if the prototype is lost (e.g.\n * across an event-bus round-trip). Used at the single response-interceptor boundary\n * that suppresses offline rejections from retry/classification.\n */\nexport function isNetworkOfflineRejection(error: unknown): error is NetworkOfflineError {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    (error as { __wildoNetworkOffline?: unknown }).__wildoNetworkOffline === true\n  );\n}\n"]}

package/dist/esm/core/requests/request-cancellation.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-cancellation.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/requests/request-cancellation.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAY5D"}
+{"version":3,"file":"request-cancellation.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/request-cancellation.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAY5D"}