@faable/auth-sdk 2.6.10 → 2.6.12

package/.github/workflows/release.yml

@@ -14,7 +14,16 @@ jobs:
   release:
     name: release
     runs-on: ubuntu-latest
-    timeout-minutes: 3
+    # 10, no 3: el presupuesto del guard `verify:published` es de CINCO minutos
+    # (30 intentos × 10 s esperando a que el packument propague), y a 3 el job lo
+    # mataba a media espera. Los pasos previos tardan ~35 s y `npm run release`
+    # ya ha publicado y tageado para entonces, así que lo único que se perdía era
+    # la comprobación — pero el run queda en rojo y, peor, GitHub lo reporta como
+    # "cancelled", que se lee como si alguien lo hubiera parado a mano. Pasó en 5
+    # de los 8 releases anteriores al 2026-09-16; el último murió en el intento
+    # 16 de 30, con 140 s de presupuesto que nunca llegó a usar. Mismo fallo y
+    # misma lectura engañosa que el `build-image.yml` de auth (10 → 25).
+    timeout-minutes: 10
 
     steps:
       - uses: actions/checkout@v6

package/dist/api/types.d.ts

@@ -695,7 +695,7 @@ export interface paths {
         put?: never;
         /**
          * Set a credential's password
-         * @description Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The password is never returned.
+         * @description Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The confirmation email is only sent when an EXISTING password is rotated: setting the first password on a credential that had none is a creation, not a change. The password is never returned.
          */
         post: operations["credentials/setPassword"];
         delete?: never;

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.6.10";
+export const version = "2.6.12";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "5809563";
+export const commit = "9aefac0";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.6.10",
+  "version": "2.6.12",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.13.1",
+    "version": "2.13.2",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -16208,7 +16208,7 @@
         "tags": [
           "credentials"
         ],
-        "description": "Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The password is never returned.",
+        "description": "Sets or rotates the password for a database credential. The previous password is invalidated immediately. Records a `credential.password_changed` audit entry (initiated_by=admin) for traceability. The confirmation email is only sent when an EXISTING password is rotated: setting the first password on a credential that had none is a creation, not a change. The password is never returned.",
         "requestBody": {
           "required": true,
           "content": {