Builds the policy from its guard, reauth hook and status vocabulary.
Shared retry-budget limiter.
Hook that refreshes the session; resolves true on success.
Auth-failure statuses that trigger the retry; defaults to [401].
Whether a rejection is an auth failure this policy owns: an
HttpError whose status is in the injected vocabulary. The one
read of that vocabulary outside the retry itself — SessionAPI's
sign-in normalization consults it so the statuses are spelled once
per protocol.
The rejection to inspect.
true for an owned auth failure, narrowing it.
Runs the attempt, replaying it once after a successful reauth.
The request attempt to decorate.
The attempt's resolved value.
HttpError The original error, when the guard refuses the window or the reauth hook fails (anything not an owned auth failure propagates unchanged).
Reactive authentication retry. On an auth-failure status:
trueif the session was successfully refreshed (token exchange or fullresumeSession) andfalseif it failed.Ownership: only the injected auth-failure statuses (
401by default; a wire that reports an expired token as400passes both). Other HTTP errors, network errors, and anything not fromHttpErrorpropagate unchanged so inner / outer policies can handle them in isolation.