@absolutejs/auth 0.76.2 → 0.77.0

package/dist/linkedProviders/neonStores.d.ts

@@ -467,8 +467,14 @@ export declare const linkedProviderGrantsTable: import("drizzle-orm/pg-core").Pg
 }>;
 export type LinkedProviderGrantRow = typeof linkedProviderGrantsTable.$inferSelect;
 export type LinkedProviderBindingRow = typeof linkedProviderBindingsTable.$inferSelect;
-export declare const createNeonLinkedProviderBindingStore: <DB extends AnyPgDatabase>(db: DB) => LinkedProviderBindingStore;
-export declare const createNeonLinkedProviderGrantStore: <DB extends AnyPgDatabase>(db: DB) => LinkedProviderGrantStore;
+/**
+ * These two take a database rather than a connection string, so an application
+ * that already has one uses it instead of opening a second. Nothing in either
+ * is specific to Neon -- the Neon helpers below are the convenience that opens
+ * a connection for a caller who has none.
+ */
+export declare const createLinkedProviderBindingStore: <DB extends AnyPgDatabase>(db: DB) => LinkedProviderBindingStore;
+export declare const createLinkedProviderGrantStore: <DB extends AnyPgDatabase>(db: DB) => LinkedProviderGrantStore;
 export declare const createNeonLinkedProviderStores: (databaseUrl: string) => {
     bindingStore: LinkedProviderBindingStore;
     db: import("drizzle-orm/neon-http").NeonHttpDatabase<import("drizzle-orm").EmptyRelations> & {

package/dist/linkedProviders/resolver.d.ts

@@ -12,6 +12,21 @@ export type CreateLinkedProviderCredentialResolverOptions = {
         requiredScopes?: string[];
     }) => Promise<LinkedProviderRefreshResult | null> | LinkedProviderRefreshResult | null;
     now?: () => number;
+    /**
+     * What a reported failure does to the stored grant and binding.
+     *
+     * `latch`, the default, marks an unauthorized or revoked credential
+     * unusable, which is what a sign-in identity needs: nothing works again
+     * until the person authorizes again.
+     *
+     * `record` writes the same failure detail and leaves both statuses alone.
+     * A connector credential wants this. Its calls fail for reasons that live
+     * on the provider's side -- an app installation dropped from a repository,
+     * a project unshared -- and latching turns one refused call into a
+     * connection that stays shut until it is rebuilt, which does not fix
+     * anything because the credential was never the problem.
+     */
+    failurePolicy?: 'latch' | 'record';
     onReportFailure?: (input: {
         credential: ResolvedLinkedProviderCredential;
         report: LinkedProviderCredentialFailureReport;
@@ -19,4 +34,4 @@ export type CreateLinkedProviderCredentialResolverOptions = {
         binding?: LinkedProviderBinding;
     }) => Promise<void> | void;
 };
-export declare const createLinkedProviderCredentialResolver: ({ grantStore, bindingStore, loadAccessTokenLease, refreshAccessTokenLease, now, onReportFailure }: CreateLinkedProviderCredentialResolverOptions) => LinkedProviderCredentialResolver;
+export declare const createLinkedProviderCredentialResolver: ({ grantStore, bindingStore, failurePolicy, loadAccessTokenLease, refreshAccessTokenLease, now, onReportFailure }: CreateLinkedProviderCredentialResolverOptions) => LinkedProviderCredentialResolver;