nexu-io/open-design · warning · TeamResourceAuthorityUnavailableError

WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE

WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE

Error message

team resource authority is temporarily unavailable

What it means

Thrown by unshareIfCurrentlyShared when an authoritative Team Hub read (sharedResources with authoritative:true) fails for any reason. The error is a 503 retryable signal: the hub that owns the list of team-shared resources cannot be reached, so the caller cannot safely decide whether a resource is shared. The function deliberately re-throws an existing TeamResourceAuthorityUnavailableError as-is, and wraps any other failure (network timeout, Vela CLI crash, JSON parse error) into a new one so all hub-down conditions surface uniformly.

Source

Thrown at apps/daemon/src/collab/team-resource-share.ts:306

 * `requestTeamVisibility`/`collabSync.requestTeamUnshare` instead of this
 * helper because projects don't go through `TeamResourceShareService`).
 *
 * Returns whether an unshare actually ran, so a caller — and its tests — can
 * assert on the real state transition instead of a "was unshare called" mock.
 * Deliberately does NOT swallow a thrown `TeamResourceShareForbiddenError`:
 * the caller's delete must abort rather than proceed past a failed unshare.
 */
export async function unshareIfCurrentlyShared(
  service: Pick<TeamResourceShareService, 'sharedResources' | 'unshare'>,
  resourceId: string,
  scope: TeamResourceRequestScope,
): Promise<boolean> {
  let resources: TeamResourceShareRecord[];
  try {
    resources = await service.sharedResources(scope, { authoritative: true });
  } catch (error) {
    if (error instanceof TeamResourceAuthorityUnavailableError) throw error;
    throw new TeamResourceAuthorityUnavailableError(error);
  }
  if (!resources.some((resource) => resource.id === resourceId)) return false;
  return service.unshare(resourceId, scope);
}

interface SharedResourceListPayload {
  resources?: Array<{
    id?: unknown;
    kind?: unknown;
    deletedAt?: unknown;
    metadata?: unknown;
    ownerMemberId?: unknown;
    publishedVersion?: unknown;
  }>;
}

export function parseSharedResourceIds(
  stdout: string,

View on GitHub (pinned to 5be4028344)

Solutions

1. Retry the delete operation after confirming Vela login is active (od login status or re-authenticate via the Team Hub login flow).
2. Check network connectivity to the Resource Hub endpoint and verify the hub service is operational.
3. If using a cached/expired session, trigger a token refresh through the Vela CLI resolver before retrying the unshare.
4. If the hub is genuinely down, surface the 503 to the user and queue the operation for retry rather than proceeding with a local-only delete that would leave a dangling hub entry.

Example fix

// before — swallowing the authority error and proceeding with delete
try {
  await unshareIfCurrentlyShared(service, resourceId, scope);
} catch {
  // ignore and delete locally — WRONG: leaves dangling hub entry
}
await deleteResource(resourceId);

// after — propagate the 503 so the caller can retry or surface to user
try {
  await unshareIfCurrentlyShared(service, resourceId, scope);
} catch (error) {
  if (error instanceof TeamResourceAuthorityUnavailableError) {
    return res.status(503).json({
      code: 'WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE',
      message: 'Team hub is temporarily unavailable. Please retry.',
      retryable: true,
    });
  }
  throw error;
}
await deleteResource(resourceId);

// Before calling unshareIfCurrentlyShared, verify Vela login is active.
// This is a best-effort pre-check; the hub may still fail at read time.
async function isAuthorityLikelyReachable(vela: VelaCliResolver): Promise<boolean> {
  try {
    const status = await vela.loginStatus();
    return status === 'logged_in';
  } catch {
    return false;
  }
}

if (!(await isAuthorityLikelyReachable(vela))) {
  return res.status(503).json({
    code: 'WORKSPACE_RESOURCE_AUTHORITY_UNAVAILABLE',
    message: 'Team hub login is inactive. Please re-authenticate.',
    retryable: true,
  });
}

export function isTeamResourceAuthorityUnavailableError(
  error: unknown,
): error is TeamResourceAuthorityUnavailableError {
  return error instanceof TeamResourceAuthorityUnavailableError;
}

// Usage:
if (isTeamResourceAuthorityUnavailableError(error)) {
  // error.status === 503, error.retryable === true
  // safe to retry after backoff
}

try {
  const unshared = await unshareIfCurrentlyShared(service, resourceId, scope);
  await deleteResource(resourceId);
} catch (error) {
  if (error instanceof TeamResourceAuthorityUnavailableError) {
    // 503 retryable — surface to client with Retry-After header
    res.set('Retry-After', '5');
    return res.status(503).json({
      code: error.code,
      message: error.message,
      retryable: error.retryable,
    });
  }
  // Non-authority errors (e.g., TeamResourceShareForbiddenError) propagate
  throw error;
}

When it happens

Trigger: Calling unshareIfCurrentlyShared(service, resourceId, scope) when the underlying Vela CLI Resource Hub is unreachable. This happens when service.sharedResources(scope, { authoritative: true }) rejects — Vela login session expired, Resource Hub API returned 5xx, network partition, or the Vela binary returned malformed stdout. The catch block at line 304 converts every non-authority error into TeamResourceAuthorityUnavailableError.

Common situations: A user deletes a design system that was previously team-shared, but their Vela login token has expired. The daemon tries to unshare from the hub first, the hub read fails, and the delete route aborts with this 503 rather than silently deleting locally and leaving a dangling hub entry. Also seen during network blips, VPN drops, or when the Resource Hub backend is under maintenance.

Related errors

• AUTHORIZED_TEAM_PROJECT_PULL_RECEIPT_EXPIRED
• authoritative Team resource listing is unavailable
• authorized pull receipt has invalid ${key}
• authorized pull response is not valid JSON
• authorized pull response must be an object

AI-assisted analysis of nexu-io/open-design@5be4028344 (2026-08-12). Data as JSON: /api/errors/3bb586b0a328818d. Report an issue: GitHub.