@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/navigation/zone-entry-organization.js

@@ -0,0 +1,77 @@
+/**
+ * Which organization a navigation entry addresses, and whether the entry is what the browser URL names (#2276).
+ *
+ * Read by the per-entry organization hold (`useZoneEntryOrganizationHold`) and by `NavigationProvider` when it drops
+ * the entries a followed route left behind, so both judge an entry by the same organization.
+ */
+import { CoreResourceType, NavigationZoneName } from '@wildo-ai/saas-models';
+import { frontendResourceUtils } from '../../core/resources/frontend-resource.utils.js';
+import { NAVIGATION_STRUCTURAL_ZONES, NavigationContentType, } from './navigation.schemas.js';
+import { NavigationUtils } from './navigation.utils.js';
+/**
+ * The organization a navigation entry's content addresses, or `null` when it addresses none.
+ *
+ * Read from the content's own `contextResourceIdentifiers`, keyed by the ORGANIZATIONS resource type (the key
+ * `ScopeUtilsService` writes, whether the value came from the route's segment or from the session's scope). That is
+ * the organization every request the entry makes for itself is sent to, and it is known the moment the entry is
+ * pushed, before the router has committed the URL that names it.
+ *
+ * Content that carries no identifiers (an engine page, the settings hub, an error modal) addresses no organization.
+ * Total over `NavigationContentType`, so a new content type has to say which case it is.
+ */
+export function navigationContentOrganizationId(content) {
+    let identifiers;
+    switch (content.contentType) {
+        case NavigationContentType.RESOURCE_OPERATION:
+        case NavigationContentType.INLINE_CREATE:
+            identifiers = content.resourceContext.contextResourceIdentifiers;
+            break;
+        case NavigationContentType.COMPOSITE_VIEW:
+        case NavigationContentType.CHART_VIEW:
+        case NavigationContentType.FULL_CUSTOM_VIEW:
+        case NavigationContentType.FLOWS_ACTORS_VIEW:
+        case NavigationContentType.EXECUTION_VIEW:
+        case NavigationContentType.CUSTOM_COMPONENT:
+            identifiers = content.contextResourceIdentifiers;
+            break;
+        case NavigationContentType.ENGINE_PAGE:
+        case NavigationContentType.SETTINGS_HUB:
+        case NavigationContentType.ERROR_MODAL:
+            return null;
+        default: {
+            const unhandledContent = content;
+            return unhandledContent;
+        }
+    }
+    const value = identifiers?.[CoreResourceType.ORGANIZATIONS];
+    if (value === undefined || value === null) {
+        return null;
+    }
+    const organizationId = frontendResourceUtils.getResourceId(value);
+    return organizationId.length > 0 ? organizationId : null;
+}
+/**
+ * Whether an entry is what the browser URL names, or is about to name once the router commits the URL the
+ * controller wrote with it.
+ *
+ * A structural-zone entry with a `urlPath` is written to the URL by the controller (it sets `urlPath` exactly when it
+ * writes the URL) and found by URL sync. Two structural entries do not own it: a hosted pane, whose address rides on
+ * the host's URL as `?pane=`, and a COMPANION beside a hosted secondary, which the controller deliberately keeps from
+ * overwriting that composed URL (`NavigationUtils.resolveBrowserUrlForZoneEntry`). Overlay entries never own it.
+ *
+ * Only an entry that owns the URL makes the route move, so only such an entry can be waiting for the route's
+ * organization decision. An entry that does not own it is never held, or it would wait for a decision that never comes.
+ */
+export function zoneEntryOwnsBrowserUrl(entry, getZoneState) {
+    if (!entry.urlPath || entry.hostedPane) {
+        return false;
+    }
+    if (!NAVIGATION_STRUCTURAL_ZONES.includes(entry.zone)) {
+        return false;
+    }
+    if (entry.zone === NavigationZoneName.COMPANION) {
+        return !NavigationUtils.getTopEntry(getZoneState(NavigationZoneName.SECONDARY))?.hostedPane;
+    }
+    return true;
+}
+//# sourceMappingURL=zone-entry-organization.js.map

package/dist/esm/core/navigation/zone-entry-organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zone-entry-organization.js","sourceRoot":"","sources":["../../../../../src/core/navigation/zone-entry-organization.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4DAA4D,CAAC;AACnG,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,GAItB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAA0B;IACxE,IAAI,WAAgD,CAAC;IACrD,QAAQ,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,KAAK,qBAAqB,CAAC,kBAAkB,CAAC;QAC9C,KAAK,qBAAqB,CAAC,aAAa;YACtC,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,0BAA0B,CAAC;YACjE,MAAM;QACR,KAAK,qBAAqB,CAAC,cAAc,CAAC;QAC1C,KAAK,qBAAqB,CAAC,UAAU,CAAC;QACtC,KAAK,qBAAqB,CAAC,gBAAgB,CAAC;QAC5C,KAAK,qBAAqB,CAAC,iBAAiB,CAAC;QAC7C,KAAK,qBAAqB,CAAC,cAAc,CAAC;QAC1C,KAAK,qBAAqB,CAAC,gBAAgB;YACzC,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC;YACjD,MAAM;QACR,KAAK,qBAAqB,CAAC,WAAW,CAAC;QACvC,KAAK,qBAAqB,CAAC,YAAY,CAAC;QACxC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,IAAI,CAAC;QACd,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,gBAAgB,GAAU,OAAO,CAAC;YACxC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,aAAa,CAAC,KAAkE,CAAC,CAAC;IAC/H,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAA2B,EAC3B,YAA+D;IAE/D,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,IAA0B,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["/**\n * Which organization a navigation entry addresses, and whether the entry is what the browser URL names (#2276).\n *\n * Read by the per-entry organization hold (`useZoneEntryOrganizationHold`) and by `NavigationProvider` when it drops\n * the entries a followed route left behind, so both judge an entry by the same organization.\n */\n\nimport { CoreResourceType, NavigationZoneName } from '@wildo-ai/saas-models';\nimport { frontendResourceUtils } from '~wildo-frontend-lib/core/resources/frontend-resource.utils';\nimport {\n  NAVIGATION_STRUCTURAL_ZONES,\n  NavigationContentType,\n  type NavigationContent,\n  type NavigationStackEntry,\n  type NavigationZoneState,\n} from './navigation.schemas';\nimport { NavigationUtils } from './navigation.utils';\n\n/**\n * The organization a navigation entry's content addresses, or `null` when it addresses none.\n *\n * Read from the content's own `contextResourceIdentifiers`, keyed by the ORGANIZATIONS resource type (the key\n * `ScopeUtilsService` writes, whether the value came from the route's segment or from the session's scope). That is\n * the organization every request the entry makes for itself is sent to, and it is known the moment the entry is\n * pushed, before the router has committed the URL that names it.\n *\n * Content that carries no identifiers (an engine page, the settings hub, an error modal) addresses no organization.\n * Total over `NavigationContentType`, so a new content type has to say which case it is.\n */\nexport function navigationContentOrganizationId(content: NavigationContent): string | null {\n  let identifiers: Record<string, unknown> | undefined;\n  switch (content.contentType) {\n    case NavigationContentType.RESOURCE_OPERATION:\n    case NavigationContentType.INLINE_CREATE:\n      identifiers = content.resourceContext.contextResourceIdentifiers;\n      break;\n    case NavigationContentType.COMPOSITE_VIEW:\n    case NavigationContentType.CHART_VIEW:\n    case NavigationContentType.FULL_CUSTOM_VIEW:\n    case NavigationContentType.FLOWS_ACTORS_VIEW:\n    case NavigationContentType.EXECUTION_VIEW:\n    case NavigationContentType.CUSTOM_COMPONENT:\n      identifiers = content.contextResourceIdentifiers;\n      break;\n    case NavigationContentType.ENGINE_PAGE:\n    case NavigationContentType.SETTINGS_HUB:\n    case NavigationContentType.ERROR_MODAL:\n      return null;\n    default: {\n      const unhandledContent: never = content;\n      return unhandledContent;\n    }\n  }\n  const value = identifiers?.[CoreResourceType.ORGANIZATIONS];\n  if (value === undefined || value === null) {\n    return null;\n  }\n  const organizationId = frontendResourceUtils.getResourceId(value as Parameters<typeof frontendResourceUtils.getResourceId>[0]);\n  return organizationId.length > 0 ? organizationId : null;\n}\n\n/**\n * Whether an entry is what the browser URL names, or is about to name once the router commits the URL the\n * controller wrote with it.\n *\n * A structural-zone entry with a `urlPath` is written to the URL by the controller (it sets `urlPath` exactly when it\n * writes the URL) and found by URL sync. Two structural entries do not own it: a hosted pane, whose address rides on\n * the host's URL as `?pane=`, and a COMPANION beside a hosted secondary, which the controller deliberately keeps from\n * overwriting that composed URL (`NavigationUtils.resolveBrowserUrlForZoneEntry`). Overlay entries never own it.\n *\n * Only an entry that owns the URL makes the route move, so only such an entry can be waiting for the route's\n * organization decision. An entry that does not own it is never held, or it would wait for a decision that never comes.\n */\nexport function zoneEntryOwnsBrowserUrl(\n  entry: NavigationStackEntry,\n  getZoneState: (zone: NavigationZoneName) => NavigationZoneState,\n): boolean {\n  if (!entry.urlPath || entry.hostedPane) {\n    return false;\n  }\n  if (!NAVIGATION_STRUCTURAL_ZONES.includes(entry.zone as NavigationZoneName)) {\n    return false;\n  }\n  if (entry.zone === NavigationZoneName.COMPANION) {\n    return !NavigationUtils.getTopEntry(getZoneState(NavigationZoneName.SECONDARY))?.hostedPane;\n  }\n  return true;\n}\n"]}

package/dist/esm/core/requests/auth-refresh-resilience.frontend.d.ts

@@ -1,3 +1,4 @@
+import { SessionEndReason } from '../../core/events/events.frontend.schemas';
 /**
  * Token-refresh resilience helpers (shared by `WildoHttpClient`'s 401-renewal
  * interceptor and `AuthSessionContext.tokenRenewalHandler`).
@@ -44,6 +45,20 @@
  * classified by its status.
  */
 export declare function isAuthoritativeRefreshRejection(error: unknown): boolean;
+/**
+ * Why the backend refused a session, read from the refusal itself (#2541).
+ *
+ * `authentication_user_not_active` means the ACCOUNT can no longer sign in (deactivated, suspended, pending, erased),
+ * so signing in again will not help and the person must be told so. Every other refusal is
+ * {@link SessionEndReason.SESSION_ENDED} — including `authentication_account_locked`, which is a TEMPORARY lockout after
+ * failed attempts that lifts by itself (the two shared that reference until the #2541 review split them). Read from
+ * the reference, never from message text: the reference is the stable vocabulary (`ErrorCustomMessageReference`), and
+ * the client-facing error keeps it while sanitizing removes the account status.
+ *
+ * Accepts the shapes a refusal reaches the frontend in: the enhanced axios error (`customMessageReference` set by
+ * the response interceptor), one carrying the built `wildoError`, or a raw response body.
+ */
+export declare function sessionEndReasonForRefusal(error: unknown): SessionEndReason;
 /**
  * Property the 401-renewal interceptor stamps on the ORIGINAL request error
  * when a token renewal could not complete for a NON-authoritative reason

package/dist/esm/core/requests/auth-refresh-resilience.frontend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-refresh-resilience.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWvE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,+BAA+B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAyBjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}
+{"version":3,"file":"auth-refresh-resilience.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAWvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAY3E;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,+BAA+B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAyBjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C"}

package/dist/esm/core/requests/auth-refresh-resilience.frontend.js

@@ -1,4 +1,6 @@
+import { ErrorCustomMessageReference } from '@wildo-ai/saas-models';
 import { envLoader } from '../../core/runtime/env-variable-loader.frontend.service.js';
+import { SessionEndReason } from '../../core/events/events.frontend.schemas.js';
 /**
  * Token-refresh resilience helpers (shared by `WildoHttpClient`'s 401-renewal
  * interceptor and `AuthSessionContext.tokenRenewalHandler`).
@@ -57,6 +59,28 @@ export function isAuthoritativeRefreshRejection(error) {
     // The backend authoritatively refused this refresh token.
     return status === 400 || status === 401 || status === 403;
 }
+/**
+ * Why the backend refused a session, read from the refusal itself (#2541).
+ *
+ * `authentication_user_not_active` means the ACCOUNT can no longer sign in (deactivated, suspended, pending, erased),
+ * so signing in again will not help and the person must be told so. Every other refusal is
+ * {@link SessionEndReason.SESSION_ENDED} — including `authentication_account_locked`, which is a TEMPORARY lockout after
+ * failed attempts that lifts by itself (the two shared that reference until the #2541 review split them). Read from
+ * the reference, never from message text: the reference is the stable vocabulary (`ErrorCustomMessageReference`), and
+ * the client-facing error keeps it while sanitizing removes the account status.
+ *
+ * Accepts the shapes a refusal reaches the frontend in: the enhanced axios error (`customMessageReference` set by
+ * the response interceptor), one carrying the built `wildoError`, or a raw response body.
+ */
+export function sessionEndReasonForRefusal(error) {
+    const e = error;
+    const reference = e?.customMessageReference
+        ?? e?.wildoError?.customMessageReference
+        ?? e?.response?.data?.error?.customMessageReference;
+    return reference === ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE
+        ? SessionEndReason.ACCOUNT_NOT_ACTIVE
+        : SessionEndReason.SESSION_ENDED;
+}
 /**
  * Property the 401-renewal interceptor stamps on the ORIGINAL request error
  * when a token renewal could not complete for a NON-authoritative reason

package/dist/esm/core/requests/auth-refresh-resilience.frontend.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-refresh-resilience.frontend.js","sourceRoot":"","sources":["../../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAElG;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,MAAM,CAAC,GAAG,KAAqF,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,6DAA6D;IAC7D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,6CAA6C;IAC7C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,0DAA0D;IAC1D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,CAAC,GAAG,KAQU,CAAC;IAErB,IAAI,CAAC,EAAE,CAAC,iCAAiC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACzC,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,CAAC,EAAE,YAAY,KAAK,IAAI;WAC1B,CAAC,EAAE,OAAO,KAAK,SAAS;WACxB,CAAC,EAAE,MAAM,KAAK,SAAS;WACvB,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\n\n/**\n * Token-refresh resilience helpers (shared by `WildoHttpClient`'s 401-renewal\n * interceptor and `AuthSessionContext.tokenRenewalHandler`).\n *\n * Background — why this exists:\n *   The refresh token travels in the `__wildo_refresh` `HttpOnly` cookie.\n *   `AuthSessionContext.logout()` clears that cookie server-side, and the\n *   cookie is SHARED across every tab of the same origin. Historically ANY\n *   refresh failure triggered `logout()`, so a single non-authoritative blip\n *   (the backend restarting during a dev recompile, a 5xx, a timeout, or a\n *   racy revoke) did not merely fail one request — it DELETED the refresh\n *   token, turning a recoverable hiccup into a permanent, cross-tab forced\n *   logout. That is wrong in production (a backend blip must not log everyone\n *   out) and catastrophic in development (constant recompiles → constant\n *   \"you need to sign in again\").\n *\n * The fix splits refresh failures into two classes and only lets an\n * AUTHORITATIVE rejection destroy the session.\n */\n\n/**\n * Was the renewal AUTHORITATIVELY rejected — i.e. did the backend explicitly\n * refuse THIS refresh token, meaning the session is genuinely dead and the\n * user must re-authenticate?\n *\n * AUTHORITATIVE (returns `true`) — destroy the session:\n *   - `400` — the `__wildo_refresh` cookie was absent (no session to refresh).\n *   - `401` — the refresh token failed verification / was revoked / all\n *     sessions were invalidated.\n *   - `403` — the refresh was forbidden.\n *\n * TRANSIENT (returns `false`) — preserve the session, retry on a later request:\n *   - No HTTP response at all (`status` undefined) — network error,\n *     `ECONNREFUSED` while the backend is restarting, DNS, CORS preflight fail.\n *   - `>= 500` — a backend-side error (the backend is up but unhealthy /\n *     mid-boot), unrelated to the validity of the refresh token.\n *   - `408` — request timeout.\n *   - Any other unexpected status — treated conservatively as transient so an\n *     ambiguous code never silently destroys a valid session.\n *\n * The error shape is the enhanced axios error produced by\n * `WildoHttpClient.responseErrorInterceptor`, which sets `error.httpStatus`\n * only when the response carries a body; we therefore fall back to the raw\n * `error.response.status` so a body-less 4xx/5xx refresh response is still\n * classified by its status.\n */\nexport function isAuthoritativeRefreshRejection(error: unknown): boolean {\n  const e = error as { httpStatus?: unknown; response?: { status?: unknown } } | null | undefined;\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n\n  // No response → network / unreachable / timeout → transient.\n  if (status === undefined) return false;\n  // Backend-side error or timeout → transient.\n  if (status >= 500 || status === 408) return false;\n  // The backend authoritatively refused this refresh token.\n  return status === 400 || status === 401 || status === 403;\n}\n\n/**\n * Property the 401-renewal interceptor stamps on the ORIGINAL request error\n * when a token renewal could not complete for a NON-authoritative reason\n * (backend unreachable / 5xx / timeout). It lets a downstream recovery path\n * (notably session restore) recognise that a resulting 401 reflects \"renewal\n * couldn't happen\", not \"the session is dead\" — so it should be retried rather\n * than logged out. Set only when the renewal failure was transient; a genuinely\n * authoritative rejection is never tagged.\n */\nexport const RENEWAL_TRANSIENTLY_FAILED_MARKER = '__renewalTransientlyFailed';\n\n/**\n * Should a failure be treated as a TRANSIENT backend problem that warrants\n * preserving the session and retrying, rather than tearing it down?\n *\n * Returns `true` for:\n *   - an error tagged {@link RENEWAL_TRANSIENTLY_FAILED_MARKER} (a 401 whose\n *     in-flight renewal failed transiently — the session is not proven dead),\n *   - `>= 500` / `408` (backend-side error / timeout), and\n *   - a response-less error that is recognisably an HTTP/network-layer failure\n *     (axios network error: `isAxiosError` / `request` / `config` / a string\n *     `code`). A response-less error WITHOUT those markers is treated as\n *     NON-transient — it is almost certainly a thrown code bug, and retrying it\n *     forever would mask the bug and spin.\n *\n * Returns `false` for authoritative 4xx (400/401/403/etc.) and for non-HTTP\n * exceptions, both of which must terminate rather than retry.\n */\nexport function isTransientBackendFailure(error: unknown): boolean {\n  const e = error as {\n    [RENEWAL_TRANSIENTLY_FAILED_MARKER]?: unknown;\n    httpStatus?: unknown;\n    response?: { status?: unknown };\n    request?: unknown;\n    config?: unknown;\n    code?: unknown;\n    isAxiosError?: unknown;\n  } | null | undefined;\n\n  if (e?.[RENEWAL_TRANSIENTLY_FAILED_MARKER] === true) return true;\n\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n  if (status !== undefined) {\n    return status >= 500 || status === 408;\n  }\n\n  // No HTTP status: transient only if it's recognisably an HTTP/network-layer\n  // error, never for an arbitrary thrown exception (which would retry forever).\n  return e?.isAxiosError === true\n    || e?.request !== undefined\n    || e?.config !== undefined\n    || typeof e?.code === 'string';\n}\n\n/**\n * Is development-mode refresh leniency active?\n *\n * In `development` the backend is recompiled and restarted constantly by the\n * dev watchers, which routinely produces authoritative-LOOKING `400`/`401`\n * responses (e.g. the cookie momentarily cleared by a racing tab, or the\n * session store transiently unavailable) even though the session is fine once\n * the backend settles. To keep dev / AI-driven sessions alive we never\n * hard-logout on a refresh failure in development — the session is preserved\n * and the next request retries.\n *\n * Security note: this NEVER relaxes production. On any uncertainty (env not yet\n * loaded, loader throws) we fail closed to strict production behavior.\n */\nexport function isRefreshDevLenient(): boolean {\n  try {\n    return envLoader.isDevelopment();\n  } catch {\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"auth-refresh-resilience.frontend.js","sourceRoot":"","sources":["../../../../../src/core/requests/auth-refresh-resilience.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAE3F;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,MAAM,CAAC,GAAG,KAAqF,CAAC;IAChG,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,6DAA6D;IAC7D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,6CAA6C;IAC7C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAClD,0DAA0D;IAC1D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,CAAC,GAAG,KAIU,CAAC;IACrB,MAAM,SAAS,GAAG,CAAC,EAAE,sBAAsB;WACtC,CAAC,EAAE,UAAU,EAAE,sBAAsB;WACrC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC;IACtD,OAAO,SAAS,KAAK,2BAA2B,CAAC,8BAA8B;QAC7E,CAAC,CAAC,gBAAgB,CAAC,kBAAkB;QACrC,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,CAAC,GAAG,KAQU,CAAC;IAErB,IAAI,CAAC,EAAE,CAAC,iCAAiC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,SAAS,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACzC,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,CAAC,EAAE,YAAY,KAAK,IAAI;WAC1B,CAAC,EAAE,OAAO,KAAK,SAAS;WACxB,CAAC,EAAE,MAAM,KAAK,SAAS;WACvB,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { SessionEndReason } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\n\n/**\n * Token-refresh resilience helpers (shared by `WildoHttpClient`'s 401-renewal\n * interceptor and `AuthSessionContext.tokenRenewalHandler`).\n *\n * Background — why this exists:\n *   The refresh token travels in the `__wildo_refresh` `HttpOnly` cookie.\n *   `AuthSessionContext.logout()` clears that cookie server-side, and the\n *   cookie is SHARED across every tab of the same origin. Historically ANY\n *   refresh failure triggered `logout()`, so a single non-authoritative blip\n *   (the backend restarting during a dev recompile, a 5xx, a timeout, or a\n *   racy revoke) did not merely fail one request — it DELETED the refresh\n *   token, turning a recoverable hiccup into a permanent, cross-tab forced\n *   logout. That is wrong in production (a backend blip must not log everyone\n *   out) and catastrophic in development (constant recompiles → constant\n *   \"you need to sign in again\").\n *\n * The fix splits refresh failures into two classes and only lets an\n * AUTHORITATIVE rejection destroy the session.\n */\n\n/**\n * Was the renewal AUTHORITATIVELY rejected — i.e. did the backend explicitly\n * refuse THIS refresh token, meaning the session is genuinely dead and the\n * user must re-authenticate?\n *\n * AUTHORITATIVE (returns `true`) — destroy the session:\n *   - `400` — the `__wildo_refresh` cookie was absent (no session to refresh).\n *   - `401` — the refresh token failed verification / was revoked / all\n *     sessions were invalidated.\n *   - `403` — the refresh was forbidden.\n *\n * TRANSIENT (returns `false`) — preserve the session, retry on a later request:\n *   - No HTTP response at all (`status` undefined) — network error,\n *     `ECONNREFUSED` while the backend is restarting, DNS, CORS preflight fail.\n *   - `>= 500` — a backend-side error (the backend is up but unhealthy /\n *     mid-boot), unrelated to the validity of the refresh token.\n *   - `408` — request timeout.\n *   - Any other unexpected status — treated conservatively as transient so an\n *     ambiguous code never silently destroys a valid session.\n *\n * The error shape is the enhanced axios error produced by\n * `WildoHttpClient.responseErrorInterceptor`, which sets `error.httpStatus`\n * only when the response carries a body; we therefore fall back to the raw\n * `error.response.status` so a body-less 4xx/5xx refresh response is still\n * classified by its status.\n */\nexport function isAuthoritativeRefreshRejection(error: unknown): boolean {\n  const e = error as { httpStatus?: unknown; response?: { status?: unknown } } | null | undefined;\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n\n  // No response → network / unreachable / timeout → transient.\n  if (status === undefined) return false;\n  // Backend-side error or timeout → transient.\n  if (status >= 500 || status === 408) return false;\n  // The backend authoritatively refused this refresh token.\n  return status === 400 || status === 401 || status === 403;\n}\n\n/**\n * Why the backend refused a session, read from the refusal itself (#2541).\n *\n * `authentication_user_not_active` means the ACCOUNT can no longer sign in (deactivated, suspended, pending, erased),\n * so signing in again will not help and the person must be told so. Every other refusal is\n * {@link SessionEndReason.SESSION_ENDED} — including `authentication_account_locked`, which is a TEMPORARY lockout after\n * failed attempts that lifts by itself (the two shared that reference until the #2541 review split them). Read from\n * the reference, never from message text: the reference is the stable vocabulary (`ErrorCustomMessageReference`), and\n * the client-facing error keeps it while sanitizing removes the account status.\n *\n * Accepts the shapes a refusal reaches the frontend in: the enhanced axios error (`customMessageReference` set by\n * the response interceptor), one carrying the built `wildoError`, or a raw response body.\n */\nexport function sessionEndReasonForRefusal(error: unknown): SessionEndReason {\n  const e = error as {\n    customMessageReference?: unknown;\n    wildoError?: { customMessageReference?: unknown };\n    response?: { data?: { error?: { customMessageReference?: unknown } } };\n  } | null | undefined;\n  const reference = e?.customMessageReference\n    ?? e?.wildoError?.customMessageReference\n    ?? e?.response?.data?.error?.customMessageReference;\n  return reference === ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_ACTIVE\n    ? SessionEndReason.ACCOUNT_NOT_ACTIVE\n    : SessionEndReason.SESSION_ENDED;\n}\n\n/**\n * Property the 401-renewal interceptor stamps on the ORIGINAL request error\n * when a token renewal could not complete for a NON-authoritative reason\n * (backend unreachable / 5xx / timeout). It lets a downstream recovery path\n * (notably session restore) recognise that a resulting 401 reflects \"renewal\n * couldn't happen\", not \"the session is dead\" — so it should be retried rather\n * than logged out. Set only when the renewal failure was transient; a genuinely\n * authoritative rejection is never tagged.\n */\nexport const RENEWAL_TRANSIENTLY_FAILED_MARKER = '__renewalTransientlyFailed';\n\n/**\n * Should a failure be treated as a TRANSIENT backend problem that warrants\n * preserving the session and retrying, rather than tearing it down?\n *\n * Returns `true` for:\n *   - an error tagged {@link RENEWAL_TRANSIENTLY_FAILED_MARKER} (a 401 whose\n *     in-flight renewal failed transiently — the session is not proven dead),\n *   - `>= 500` / `408` (backend-side error / timeout), and\n *   - a response-less error that is recognisably an HTTP/network-layer failure\n *     (axios network error: `isAxiosError` / `request` / `config` / a string\n *     `code`). A response-less error WITHOUT those markers is treated as\n *     NON-transient — it is almost certainly a thrown code bug, and retrying it\n *     forever would mask the bug and spin.\n *\n * Returns `false` for authoritative 4xx (400/401/403/etc.) and for non-HTTP\n * exceptions, both of which must terminate rather than retry.\n */\nexport function isTransientBackendFailure(error: unknown): boolean {\n  const e = error as {\n    [RENEWAL_TRANSIENTLY_FAILED_MARKER]?: unknown;\n    httpStatus?: unknown;\n    response?: { status?: unknown };\n    request?: unknown;\n    config?: unknown;\n    code?: unknown;\n    isAxiosError?: unknown;\n  } | null | undefined;\n\n  if (e?.[RENEWAL_TRANSIENTLY_FAILED_MARKER] === true) return true;\n\n  const rawStatus = e?.httpStatus ?? e?.response?.status;\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n  if (status !== undefined) {\n    return status >= 500 || status === 408;\n  }\n\n  // No HTTP status: transient only if it's recognisably an HTTP/network-layer\n  // error, never for an arbitrary thrown exception (which would retry forever).\n  return e?.isAxiosError === true\n    || e?.request !== undefined\n    || e?.config !== undefined\n    || typeof e?.code === 'string';\n}\n\n/**\n * Is development-mode refresh leniency active?\n *\n * In `development` the backend is recompiled and restarted constantly by the\n * dev watchers, which routinely produces authoritative-LOOKING `400`/`401`\n * responses (e.g. the cookie momentarily cleared by a racing tab, or the\n * session store transiently unavailable) even though the session is fine once\n * the backend settles. To keep dev / AI-driven sessions alive we never\n * hard-logout on a refresh failure in development — the session is preserved\n * and the next request retries.\n *\n * Security note: this NEVER relaxes production. On any uncertainty (env not yet\n * loaded, loader throws) we fail closed to strict production behavior.\n */\nexport function isRefreshDevLenient(): boolean {\n  try {\n    return envLoader.isDevelopment();\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/esm/core/requests/automatic-resend-safety.frontend.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Whether a failed request may be SENT AGAIN without a person deciding (#3004) — the one predicate every automatic retry
+ * in this client consults: the HTTP client's own retry ladder (`WildoBackendHttpClient.shouldRetry`) and the resource
+ * mutation manager's (`ResourceMutationManager`, through `HttpTransportAdapter`).
+ *
+ * ## The rule
+ *
+ * spec-cite: RFC 9110 §9.2.2 (https://www.rfc-editor.org/rfc/rfc9110#section-9.2.2), fetched 2026-10-20 — "A client SHOULD
+ * NOT automatically retry a request with a non-idempotent method unless it has some means to know that the request
+ * semantics are actually idempotent, regardless of the method, or some means to detect that the original request was
+ * never applied."
+ *
+ * So a request may be resent when ANY of these holds, and otherwise not:
+ *
+ * 1. **Its method is safe** (GET, HEAD, OPTIONS — §9.2.1): it asked for nothing to change.
+ * 2. **The server said so** in the error envelope: `error.requestOutcome` is `not_applied` (refused before anything
+ *    happened: a rate limiter, the provider-operation door's checks before it calls the vendor) or `repeatable` (it may
+ *    have happened, and repeating it has the same effect). This is the server KNOWING, never the client guessing.
+ * 3. **The very same request is resent under its `Idempotency-Key`**: a RESOURCE OPERATION whose variant declares the key
+ *    (the resources client mints one per call only then, #535) is answered, on a repeat of the SAME key, with the first
+ *    outcome. So the HTTP client's own ladder, which resends the identical request config, may resend it; a ladder that
+ *    re-dispatches the operation (the RMM) mints a NEW key and must not count it (`sameRequestResent: false`). Only a
+ *    resource operation: a hand-mounted route (the provider-operation door, the auth routes) does not enforce the key.
+ *
+ * ## What is deliberately NOT a reason, with the evidence
+ *
+ * - **`If-Match` is NOT a reason** (#3004 review F1). The resource controller ADMITS it on every single-row UPDATE-like
+ *   operation, custom ones included, but only a repository write that filters on the version ENFORCES it: a custom
+ *   operation that emails or calls a vendor before (or without) a versioned row write (`organizationMembers.RESEND`,
+ *   `billingAccount.OPEN_CHECKOUT`), and every resource persisted through an HTTP API binding, would run twice. The
+ *   client cannot tell those from a plain field update, so the header proves nothing to it.
+ *
+ * - **PUT and DELETE are NOT treated as idempotent here**, although §9.2.2 calls them idempotent. In this framework a
+ *   custom operation is mounted as PUT or DELETE by its `resourceOperationLike` (UPDATE → PUT), whatever it does: a
+ *   transfer of ownership that emails the tenant, a deletion request that notifies, a provider call. The method says
+ *   nothing reliable about the request's semantics, so only the three reasons above count.
+ * - **A status code is not a reason.** A 502 from the provider-operation door can mean a vendor write that may already
+ *   have happened (`kind: UNKNOWN_OUTCOME`); a 503 or 429 from a proxy in front of the server says nothing about what a
+ *   request it forwarded did. Where the server knows, it says so (reason 2).
+ * - **A network error is not a reason.** In a browser, a refused connection and a connection reset after the body left
+ *   look the same (`ERR_NETWORK`), and only the first is "never applied". Requests the client itself never sent (offline,
+ *   or held by the readiness gate) are rejected before this predicate is asked and are handled where they are raised.
+ */
+export interface AutomaticResendCandidate {
+    /** The request's method as axios carries it (lower case); absent means axios's default, GET. */
+    readonly method?: string;
+    /** The request's own headers; any casing, any axios header container that enumerates as an object. */
+    readonly headers?: unknown;
+    /** `error.requestOutcome` from the server's error envelope, when it answered one. */
+    readonly requestOutcome?: unknown;
+    /** The request is a resource operation (the resources client stamps `resourceType`), whose controller enforces the key. */
+    readonly resourceOperation?: boolean;
+    /**
+     * The resend is the IDENTICAL request (same config, same `Idempotency-Key`), as the HTTP client's own ladder sends it.
+     * `false` for a ladder that re-dispatches the operation (the RMM), which mints a new key: there the key protects nothing.
+     */
+    readonly sameRequestResent?: boolean;
+}
+/** Who would resend a failed request, which decides whether its `Idempotency-Key` still protects the resend. */
+export declare enum AutomaticResendLadder {
+    /** The HTTP client's own retry: the identical request config, the same key. */
+    SAME_REQUEST = "same_request",
+    /** The resource mutation manager's retry: the operation dispatched again, under a newly minted key. */
+    REDISPATCH = "redispatch"
+}
+/** See the module JSDoc: whether this failed request may be sent again without a person deciding. */
+export declare function requestMayBeResentAutomatically(candidate: AutomaticResendCandidate): boolean;
+/**
+ * The same question asked of an axios failure: its request config and, when the server answered, the envelope's
+ * `error.requestOutcome`. A value that is not an axios failure (no `config`) is answered `false`: nothing says what
+ * request it was. `ladder` names who would resend: the HTTP client resends the identical config, the RMM re-dispatches.
+ */
+export declare function failedRequestMayBeResentAutomatically(error: unknown, ladder: AutomaticResendLadder): boolean;
+//# sourceMappingURL=automatic-resend-safety.frontend.d.ts.map

package/dist/esm/core/requests/automatic-resend-safety.frontend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automatic-resend-safety.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/automatic-resend-safety.frontend.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,WAAW,wBAAwB;IACvC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sGAAsG;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,2HAA2H;IAC3H,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,gHAAgH;AAChH,oBAAY,qBAAqB;IAC/B,+EAA+E;IAC/E,YAAY,iBAAiB;IAC7B,uGAAuG;IACvG,UAAU,eAAe;CAC1B;AAsBD,qGAAqG;AACrG,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO,CAI5F;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAa5G"}

package/dist/esm/core/requests/automatic-resend-safety.frontend.js

@@ -0,0 +1,52 @@
+import { ErrorRequestOutcome, WildoHeaderKeys, errorRequestOutcomeAdmitsAutomaticResend } from '@wildo-ai/saas-models';
+/** Who would resend a failed request, which decides whether its `Idempotency-Key` still protects the resend. */
+export var AutomaticResendLadder;
+(function (AutomaticResendLadder) {
+    /** The HTTP client's own retry: the identical request config, the same key. */
+    AutomaticResendLadder["SAME_REQUEST"] = "same_request";
+    /** The resource mutation manager's retry: the operation dispatched again, under a newly minted key. */
+    AutomaticResendLadder["REDISPATCH"] = "redispatch";
+})(AutomaticResendLadder || (AutomaticResendLadder = {}));
+/** RFC 9110 §9.2.1's safe methods. TRACE is not sent by this client. */
+const SAFE_METHODS = new Set(['get', 'head', 'options']);
+/** The header that makes a repeat of the SAME request answer the first outcome (reason 3). */
+const RESEND_PROTECTING_HEADERS = new Set([WildoHeaderKeys.IDEMPOTENCY_KEY]);
+function readsAsOutcome(value) {
+    return Object.values(ErrorRequestOutcome).includes(value) ? value : undefined;
+}
+function carriesResendProtection(headers) {
+    if (headers === null || typeof headers !== 'object')
+        return false;
+    // An `AxiosHeaders` instance enumerates its own entries through `toJSON`; a plain object enumerates directly.
+    const plain = typeof headers.toJSON === 'function'
+        ? headers.toJSON()
+        : headers;
+    return Object.entries(plain).some(([name, value]) => RESEND_PROTECTING_HEADERS.has(name.toLowerCase())
+        && value !== undefined && value !== null && String(value).trim() !== '');
+}
+/** See the module JSDoc: whether this failed request may be sent again without a person deciding. */
+export function requestMayBeResentAutomatically(candidate) {
+    if (SAFE_METHODS.has((candidate.method ?? 'get').toLowerCase()))
+        return true;
+    if (errorRequestOutcomeAdmitsAutomaticResend(readsAsOutcome(candidate.requestOutcome)))
+        return true;
+    return candidate.resourceOperation === true && candidate.sameRequestResent === true && carriesResendProtection(candidate.headers);
+}
+/**
+ * The same question asked of an axios failure: its request config and, when the server answered, the envelope's
+ * `error.requestOutcome`. A value that is not an axios failure (no `config`) is answered `false`: nothing says what
+ * request it was. `ladder` names who would resend: the HTTP client resends the identical config, the RMM re-dispatches.
+ */
+export function failedRequestMayBeResentAutomatically(error, ladder) {
+    const failure = error;
+    if (!failure || typeof failure !== 'object' || !failure.config)
+        return false;
+    return requestMayBeResentAutomatically({
+        method: failure.config.method,
+        headers: failure.config.headers,
+        requestOutcome: failure.response?.data?.error?.requestOutcome,
+        resourceOperation: typeof failure.config.resourceType === 'string' && failure.config.resourceType !== '',
+        sameRequestResent: ladder === AutomaticResendLadder.SAME_REQUEST,
+    });
+}
+//# sourceMappingURL=automatic-resend-safety.frontend.js.map

package/dist/esm/core/requests/automatic-resend-safety.frontend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automatic-resend-safety.frontend.js","sourceRoot":"","sources":["../../../../../src/core/requests/automatic-resend-safety.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AA6DvH,gHAAgH;AAChH,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC/B,+EAA+E;IAC/E,sDAA6B,CAAA;IAC7B,uGAAuG;IACvG,kDAAyB,CAAA;AAC3B,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,wEAAwE;AACxE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAE9E,8FAA8F;AAC9F,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC;AAElG,SAAS,cAAc,CAAC,KAAc;IACpC,OAAQ,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;AACtH,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,8GAA8G;IAC9G,MAAM,KAAK,GAAG,OAAQ,OAAgC,CAAC,MAAM,KAAK,UAAU;QAC1E,CAAC,CAAE,OAAqD,CAAC,MAAM,EAAE;QACjE,CAAC,CAAC,OAAkC,CAAC;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;WACjG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,+BAA+B,CAAC,SAAmC;IACjF,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,wCAAwC,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,OAAO,SAAS,CAAC,iBAAiB,KAAK,IAAI,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI,IAAI,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACpI,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAAc,EAAE,MAA6B;IACjG,MAAM,OAAO,GAAG,KAGR,CAAC;IACT,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,+BAA+B,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;QAC7B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;QAC/B,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc;QAC7D,iBAAiB,EAAE,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,EAAE;QACxG,iBAAiB,EAAE,MAAM,KAAK,qBAAqB,CAAC,YAAY;KACjE,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { ErrorRequestOutcome, WildoHeaderKeys, errorRequestOutcomeAdmitsAutomaticResend } from '@wildo-ai/saas-models';\n\n/**\n * Whether a failed request may be SENT AGAIN without a person deciding (#3004) — the one predicate every automatic retry\n * in this client consults: the HTTP client's own retry ladder (`WildoBackendHttpClient.shouldRetry`) and the resource\n * mutation manager's (`ResourceMutationManager`, through `HttpTransportAdapter`).\n *\n * ## The rule\n *\n * spec-cite: RFC 9110 §9.2.2 (https://www.rfc-editor.org/rfc/rfc9110#section-9.2.2), fetched 2026-10-20 — \"A client SHOULD\n * NOT automatically retry a request with a non-idempotent method unless it has some means to know that the request\n * semantics are actually idempotent, regardless of the method, or some means to detect that the original request was\n * never applied.\"\n *\n * So a request may be resent when ANY of these holds, and otherwise not:\n *\n * 1. **Its method is safe** (GET, HEAD, OPTIONS — §9.2.1): it asked for nothing to change.\n * 2. **The server said so** in the error envelope: `error.requestOutcome` is `not_applied` (refused before anything\n *    happened: a rate limiter, the provider-operation door's checks before it calls the vendor) or `repeatable` (it may\n *    have happened, and repeating it has the same effect). This is the server KNOWING, never the client guessing.\n * 3. **The very same request is resent under its `Idempotency-Key`**: a RESOURCE OPERATION whose variant declares the key\n *    (the resources client mints one per call only then, #535) is answered, on a repeat of the SAME key, with the first\n *    outcome. So the HTTP client's own ladder, which resends the identical request config, may resend it; a ladder that\n *    re-dispatches the operation (the RMM) mints a NEW key and must not count it (`sameRequestResent: false`). Only a\n *    resource operation: a hand-mounted route (the provider-operation door, the auth routes) does not enforce the key.\n *\n * ## What is deliberately NOT a reason, with the evidence\n *\n * - **`If-Match` is NOT a reason** (#3004 review F1). The resource controller ADMITS it on every single-row UPDATE-like\n *   operation, custom ones included, but only a repository write that filters on the version ENFORCES it: a custom\n *   operation that emails or calls a vendor before (or without) a versioned row write (`organizationMembers.RESEND`,\n *   `billingAccount.OPEN_CHECKOUT`), and every resource persisted through an HTTP API binding, would run twice. The\n *   client cannot tell those from a plain field update, so the header proves nothing to it.\n *\n * - **PUT and DELETE are NOT treated as idempotent here**, although §9.2.2 calls them idempotent. In this framework a\n *   custom operation is mounted as PUT or DELETE by its `resourceOperationLike` (UPDATE → PUT), whatever it does: a\n *   transfer of ownership that emails the tenant, a deletion request that notifies, a provider call. The method says\n *   nothing reliable about the request's semantics, so only the three reasons above count.\n * - **A status code is not a reason.** A 502 from the provider-operation door can mean a vendor write that may already\n *   have happened (`kind: UNKNOWN_OUTCOME`); a 503 or 429 from a proxy in front of the server says nothing about what a\n *   request it forwarded did. Where the server knows, it says so (reason 2).\n * - **A network error is not a reason.** In a browser, a refused connection and a connection reset after the body left\n *   look the same (`ERR_NETWORK`), and only the first is \"never applied\". Requests the client itself never sent (offline,\n *   or held by the readiness gate) are rejected before this predicate is asked and are handled where they are raised.\n */\nexport interface AutomaticResendCandidate {\n  /** The request's method as axios carries it (lower case); absent means axios's default, GET. */\n  readonly method?: string;\n  /** The request's own headers; any casing, any axios header container that enumerates as an object. */\n  readonly headers?: unknown;\n  /** `error.requestOutcome` from the server's error envelope, when it answered one. */\n  readonly requestOutcome?: unknown;\n  /** The request is a resource operation (the resources client stamps `resourceType`), whose controller enforces the key. */\n  readonly resourceOperation?: boolean;\n  /**\n   * The resend is the IDENTICAL request (same config, same `Idempotency-Key`), as the HTTP client's own ladder sends it.\n   * `false` for a ladder that re-dispatches the operation (the RMM), which mints a new key: there the key protects nothing.\n   */\n  readonly sameRequestResent?: boolean;\n}\n\n/** Who would resend a failed request, which decides whether its `Idempotency-Key` still protects the resend. */\nexport enum AutomaticResendLadder {\n  /** The HTTP client's own retry: the identical request config, the same key. */\n  SAME_REQUEST = 'same_request',\n  /** The resource mutation manager's retry: the operation dispatched again, under a newly minted key. */\n  REDISPATCH = 'redispatch',\n}\n\n/** RFC 9110 §9.2.1's safe methods. TRACE is not sent by this client. */\nconst SAFE_METHODS: ReadonlySet<string> = new Set(['get', 'head', 'options']);\n\n/** The header that makes a repeat of the SAME request answer the first outcome (reason 3). */\nconst RESEND_PROTECTING_HEADERS: ReadonlySet<string> = new Set([WildoHeaderKeys.IDEMPOTENCY_KEY]);\n\nfunction readsAsOutcome(value: unknown): ErrorRequestOutcome | undefined {\n  return (Object.values(ErrorRequestOutcome) as unknown[]).includes(value) ? value as ErrorRequestOutcome : undefined;\n}\n\nfunction carriesResendProtection(headers: unknown): boolean {\n  if (headers === null || typeof headers !== 'object') return false;\n  // An `AxiosHeaders` instance enumerates its own entries through `toJSON`; a plain object enumerates directly.\n  const plain = typeof (headers as { toJSON?: unknown }).toJSON === 'function'\n    ? (headers as { toJSON: () => Record<string, unknown> }).toJSON()\n    : headers as Record<string, unknown>;\n  return Object.entries(plain).some(([name, value]) => RESEND_PROTECTING_HEADERS.has(name.toLowerCase())\n    && value !== undefined && value !== null && String(value).trim() !== '');\n}\n\n/** See the module JSDoc: whether this failed request may be sent again without a person deciding. */\nexport function requestMayBeResentAutomatically(candidate: AutomaticResendCandidate): boolean {\n  if (SAFE_METHODS.has((candidate.method ?? 'get').toLowerCase())) return true;\n  if (errorRequestOutcomeAdmitsAutomaticResend(readsAsOutcome(candidate.requestOutcome))) return true;\n  return candidate.resourceOperation === true && candidate.sameRequestResent === true && carriesResendProtection(candidate.headers);\n}\n\n/**\n * The same question asked of an axios failure: its request config and, when the server answered, the envelope's\n * `error.requestOutcome`. A value that is not an axios failure (no `config`) is answered `false`: nothing says what\n * request it was. `ladder` names who would resend: the HTTP client resends the identical config, the RMM re-dispatches.\n */\nexport function failedRequestMayBeResentAutomatically(error: unknown, ladder: AutomaticResendLadder): boolean {\n  const failure = error as {\n    config?: { method?: string; headers?: unknown; resourceType?: unknown };\n    response?: { data?: { error?: { requestOutcome?: unknown } } };\n  } | null;\n  if (!failure || typeof failure !== 'object' || !failure.config) return false;\n  return requestMayBeResentAutomatically({\n    method: failure.config.method,\n    headers: failure.config.headers,\n    requestOutcome: failure.response?.data?.error?.requestOutcome,\n    resourceOperation: typeof failure.config.resourceType === 'string' && failure.config.resourceType !== '',\n    sameRequestResent: ladder === AutomaticResendLadder.SAME_REQUEST,\n  });\n}\n"]}

package/dist/esm/core/requests/websockets/WebSocketContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebSocketContext.d.ts","sourceRoot":"","sources":["../../../../../../src/core/requests/websockets/WebSocketContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAM3G,OAAO,EAaL,sBAAsB,EASvB,MAAM,uBAAuB,CAAC;AA6E/B;;;;GAIG;AAEH,oBAAY,eAAe;IACzB,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,YAAY,iBAAiB;CAC9B;AAED,KAAK,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAsDlH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,qBAAqB,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpD;AAoCD,MAAM,WAAW,oBAAoB;IAEnC,MAAM,EAAE,eAAe,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,cAAc,EAAE,CAAC;IAGlC,OAAO,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,kBAAkB,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAGtF,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,IAAI,CAAC;IAGvD,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,iBAAiB,EAAE,CAAC,MAAM,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,uBAAuB,EAAE,CAAC,MAAM,EAAE;QAChC,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGpB,YAAY,EAAE,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,MAAM,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC;IAGX,eAAe,EAAE,CAAC,MAAM,EAAE;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,0BAA0B,EAAE,+BAA+B,CAAC;QAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,KAAK,IAAI,CAAC;IAGX,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAGlF,iBAAiB,EAAE,MAAM;QACvB,MAAM,EAAE,eAAe,CAAC;QACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAA8D,CAAC;AAa5I,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CA46C/D,CAAC"}
+{"version":3,"file":"WebSocketContext.d.ts","sourceRoot":"","sources":["../../../../../../src/core/requests/websockets/WebSocketContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAM3G,OAAO,EAaL,sBAAsB,EASvB,MAAM,uBAAuB,CAAC;AAoF/B;;;;GAIG;AAEH,oBAAY,eAAe;IACzB,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,KAAK,UAAU;IACf,YAAY,iBAAiB;CAC9B;AAED,KAAK,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAsDlH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;OAkBG;IACH,qBAAqB,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpD;AAoCD,MAAM,WAAW,oBAAoB;IAEnC,MAAM,EAAE,eAAe,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,cAAc,EAAE,CAAC;IAGlC,OAAO,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,kBAAkB,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAGtF,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC9E,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK,IAAI,CAAC;IACpE,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,IAAI,CAAC;IAGvD,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,iBAAiB,EAAE,CAAC,MAAM,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,uBAAuB,EAAE,CAAC,MAAM,EAAE;QAChC,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAC5B,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGpB,YAAY,EAAE,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,0BAA0B,EAAE,+BAA+B,CAAC;KAC7D,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,MAAM,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,KAAK,IAAI,CAAC;IAGX,eAAe,EAAE,CAAC,MAAM,EAAE;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,0BAA0B,EAAE,+BAA+B,CAAC;QAC5D,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,KAAK,IAAI,CAAC;IAGX,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAGlF,iBAAiB,EAAE,MAAM;QACvB,MAAM,EAAE,eAAe,CAAC;QACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;KAC1B,CAAC;CACH;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAA8D,CAAC;AAa5I,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAu8C/D,CAAC"}

package/dist/esm/core/requests/websockets/WebSocketContext.js

@@ -75,6 +75,12 @@ function pickFresherAccessToken(storedToken, incomingToken) {
  * so ordinary clock-skew / one-off races self-heal well within it.
  */
 const MAX_CONSECUTIVE_WS_AUTH_RENEWALS = 5;
+/**
+ * The shortest gap between two immediate reconnects the server asked for by ending a connection for re-authentication
+ * (#1795). The second within the gap is left to the connectivity supervisor's watchdog, whose backoff de-correlates
+ * clients, so a server that keeps ending a socket cannot drive a reconnect loop.
+ */
+const SERVER_REQUESTED_RECONNECT_MIN_GAP_MS = 5000;
 /**
  * WebSocket Context
  * Manages Socket.IO connections and real-time communication
@@ -219,6 +225,12 @@ export const WebSocketProvider = ({ children }) => {
     // The organization a refused ORGANIZATION_SWITCH already triggered a re-handshake for (#1597). One resync per
     // intended organization, reset by the next switch, so a switch the server keeps refusing cannot loop.
     const switchResyncForOrganizationRef = useRef(null);
+    // #1795: the server said it is ending this connection so its authority is derived again
+    // (`AUTHORITY_REEVALUATION_REQUIRED`), so the `io server disconnect` that follows is reconnected at once instead of
+    // waiting for the supervisor's watchdog. The instant of the last such reconnect bounds it to one per
+    // `SERVER_REQUESTED_RECONNECT_MIN_GAP_MS`; a server that keeps ending the socket faster is left to the watchdog's backoff.
+    const serverRequestedReauthenticationRef = useRef(false);
+    const lastServerRequestedReconnectAtRef = useRef(0);
     const reconnectTimeoutRef = useRef(null);
     const reconnectAttemptsRef = useRef(0);
     // Backoff counter for the connectivity SUPERVISOR's watchdog probes (see the
@@ -542,6 +554,20 @@ export const WebSocketProvider = ({ children }) => {
             connectInFlightRef.current = false;
             setStatus(WebSocketStatus.DISCONNECTED);
             console.log('Socket.IO disconnected:', reason);
+            // #1795: a server disconnect is never retried by Socket.IO itself. When the server announced it as a
+            // re-authentication, reconnect now: the handshake presents the latest token and re-derives every room, and an
+            // expired token is refused there and renewed through `connect_error` (`requestAuthRenewal`).
+            const reauthenticationRequested = serverRequestedReauthenticationRef.current;
+            serverRequestedReauthenticationRef.current = false;
+            if (reason === 'io server disconnect' && reauthenticationRequested) {
+                const now = Date.now();
+                if (now - lastServerRequestedReconnectAtRef.current >= SERVER_REQUESTED_RECONNECT_MIN_GAP_MS) {
+                    lastServerRequestedReconnectAtRef.current = now;
+                    console.log('WebSocket: Reconnecting so the server can re-derive this connection\'s authority');
+                    socket.connect();
+                }
+                return;
+            }
             // A disconnect is transient churn, NOT a user-facing error: Socket.IO will
             // auto-reconnect (for transport drops), and the status bar
             // (useWebSocket().status) already shows the DISCONNECTED/RECONNECTING state.
@@ -583,6 +609,11 @@ export const WebSocketProvider = ({ children }) => {
                 requestAuthRenewal('live refresh rejected');
                 return;
             }
+            if (payload?.code === WebSocketSystemErrorCode.AUTHORITY_REEVALUATION_REQUIRED) {
+                // The disconnect that follows is reconnected by the `disconnect` handler (#1795).
+                serverRequestedReauthenticationRef.current = true;
+                return;
+            }
             if (payload?.code === WebSocketSystemErrorCode.ORGANIZATION_SWITCH_FORBIDDEN) {
                 // The server kept this connection in its PREVIOUS organization — its rooms, its subscription checks — while the
                 // UI has moved on (#1597). Left alone that lasts until some later reconnect. Re-handshake ONCE per intended