@vercel/connect 0.2.2 → 0.2.3

package/dist/eve/connection-authorization.d.ts

@@ -151,6 +151,33 @@ export interface VercelConnectMetadata {
  */
 export type EveConnectAuthorizationDefinition<TAuthorization extends InteractiveAuthorizationDefinition | NonInteractiveAuthorizationDefinition> = TAuthorization & {
     readonly vercelConnect: VercelConnectMetadata;
+    /**
+     * Drops the in-process Vercel Connect token cache entry for
+     * `principal` so the next `getToken` re-fetches instead of re-serving a
+     * rejected bearer. Eve's runtime calls this from its shared eviction
+     * path when a resolved token is rejected (a downstream `401` mapped to
+     * `requireAuth()`, or an MCP server rejecting the bearer), cascading
+     * invalidation from Eve's per-step cache down into this adapter's cache.
+     *
+     * By default this is a local-cache-only operation: it preserves the
+     * underlying Connect grant (and its refresh token), so the next
+     * `getToken` can refresh a merely-expired access token without forcing
+     * a new consent flow. That is the right default for the automatic
+     * `401` cascade, where the rejected bearer is usually just stale.
+     *
+     * Pass `revoke: true` only when the grant itself is known to be dead
+     * and you want it torn down at Vercel Connect (refresh token included)
+     * so the next `getToken` surfaces `user_authorization_required` and
+     * re-runs consent — e.g. a user-initiated "disconnect this
+     * integration" action. Revocation is destructive and best-effort: a
+     * failed or duplicate revoke is swallowed so it never masks the error
+     * that triggered eviction, and the local cache entry is dropped either
+     * way.
+     */
+    readonly evict: (opts: {
+        readonly principal: ConnectionPrincipal;
+        readonly revoke?: boolean;
+    }) => Promise<void>;
 };
 /**
  * Builds an Eve {@link AuthorizationDefinition} backed by Vercel

package/dist/eve/connection-authorization.js

@@ -30,14 +30,48 @@
  */
 import { ConnectionAuthorizationFailedError, ConnectionAuthorizationRequiredError, } from 'eve/connections';
 import { startAuthorization } from '../authorization.js';
-import { ConnectorInstallationRequiredError, getTokenResponse, NoValidTokenError, UserAuthorizationRequiredError, } from '../token.js';
+import { ConnectorInstallationRequiredError, deleteTokenCacheEntry, getTokenResponse, NoValidTokenError, revokeToken, UserAuthorizationRequiredError, } from '../token.js';
 export function connect(input) {
     const options = normalizeAuthorizationOptions(input);
     const vercelConnect = { connector: options.connector };
+    const evict = makeEvict(options);
     if (options.principalType === 'app') {
-        return { ...buildNonInteractiveDefinition(options), vercelConnect };
+        return { ...buildNonInteractiveDefinition(options), vercelConnect, evict };
     }
-    return { ...buildInteractiveDefinition(options), vercelConnect };
+    return { ...buildInteractiveDefinition(options), vercelConnect, evict };
+}
+/**
+ * Builds the {@link EveConnectAuthorizationDefinition.evict} callback for
+ * a connector. Resolves the same token params {@link getToken} uses for
+ * `principal`, then drops exactly that cache entry — leaving every other
+ * principal's cached token intact.
+ *
+ * When called with `revoke: true` it instead tears the grant down at
+ * Vercel Connect via {@link revokeToken} (best-effort, falling back to a
+ * local cache drop if the revoke request fails).
+ */
+function makeEvict(options) {
+    return async ({ principal, revoke }) => {
+        const params = await buildTokenParams(options, principal);
+        if (revoke) {
+            try {
+                // Destructive: tears down the grant at Vercel Connect (refresh
+                // token included) and clears the in-process cache. Best-effort —
+                // a failed or duplicate revoke must not mask the auth error that
+                // triggered eviction.
+                await revokeToken(options.connector, {
+                    subject: params.subject,
+                    installationId: params.installationId,
+                }, options.connectOptions);
+                return;
+            }
+            catch {
+                // Fall through to the local cache drop so the rejected bearer is
+                // gone even when the server-side revoke failed.
+            }
+        }
+        deleteTokenCacheEntry(options.connector, params);
+    };
 }
 function normalizeAuthorizationOptions(input) {
     if (typeof input === 'string') {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { getToken, getTokenResponse, revokeToken, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from './token.js';
+export { deleteTokenCacheEntry, getToken, getTokenResponse, revokeToken, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from './token.js';
 export { startAuthorization, type ConnectAuthorizationOptions, type ConnectAuthorizationResponse, } from './authorization.js';
 export type { ConnectAuthorizationDetail } from './authorization-details.js';

package/dist/index.js

@@ -1,2 +1,2 @@
-export { getToken, getTokenResponse, revokeToken, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, } from './token.js';
+export { deleteTokenCacheEntry, getToken, getTokenResponse, revokeToken, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, } from './token.js';
 export { startAuthorization, } from './authorization.js';

package/dist/token.d.ts

@@ -99,4 +99,22 @@ export declare function revokeToken(connector: string, params: {
     subject: ConnectTokenSubject;
     installationId?: string;
 }, options?: ConnectOptions): Promise<void>;
+/**
+ * Remove a single cached token entry for `(connector, params)` from the
+ * in-process cache.
+ *
+ * Targeted counterpart to {@link revokeToken}'s `cache.clear()`: it drops
+ * exactly the entry {@link getTokenResponse} would serve for these
+ * arguments, leaving every other connector/principal untouched. Use it
+ * when a credential is known to be bad (the resource server rejected the
+ * bearer with a `401`) so the next {@link getTokenResponse} re-fetches
+ * instead of re-serving the rejected token — without paying for a Connect
+ * round trip on every call the way {@link ConnectOptions.forceRefresh}
+ * does.
+ *
+ * The cache key is derived from `connector` plus every field of `params`,
+ * so pass the same `params` used for the original {@link getTokenResponse}
+ * call. No-op when no matching entry exists.
+ */
+export declare function deleteTokenCacheEntry(connector: string, params: ConnectTokenParams): void;
 export declare function createConnectErrorFromResponse(response: Response, fallbackMessage: string): Promise<ConnectError>;

package/dist/token.js

@@ -37,7 +37,7 @@ export async function getToken(connector, params, options) {
 }
 export async function getTokenResponse(connector, params, options) {
     const bufferMs = params.validityBufferMs ?? DEFAULT_VALIDITY_BUFFER_MS;
-    const cacheKey = JSON.stringify({ connector, ...params });
+    const cacheKey = tokenCacheKey(connector, params);
     if (options?.forceRefresh) {
         cache.delete(cacheKey);
     }
@@ -90,9 +90,37 @@ export async function revokeToken(connector, params, options) {
     }
     cache.clear();
 }
+/**
+ * Remove a single cached token entry for `(connector, params)` from the
+ * in-process cache.
+ *
+ * Targeted counterpart to {@link revokeToken}'s `cache.clear()`: it drops
+ * exactly the entry {@link getTokenResponse} would serve for these
+ * arguments, leaving every other connector/principal untouched. Use it
+ * when a credential is known to be bad (the resource server rejected the
+ * bearer with a `401`) so the next {@link getTokenResponse} re-fetches
+ * instead of re-serving the rejected token — without paying for a Connect
+ * round trip on every call the way {@link ConnectOptions.forceRefresh}
+ * does.
+ *
+ * The cache key is derived from `connector` plus every field of `params`,
+ * so pass the same `params` used for the original {@link getTokenResponse}
+ * call. No-op when no matching entry exists.
+ */
+export function deleteTokenCacheEntry(connector, params) {
+    cache.delete(tokenCacheKey(connector, params));
+}
 const DEFAULT_VALIDITY_BUFFER_MS = 30_000;
 const MAX_CACHE_SIZE = 100;
 const cache = new Map();
+/**
+ * Cache key for a `(connector, params)` pair. Stable across calls with
+ * equal arguments so {@link getTokenResponse} and
+ * {@link deleteTokenCacheEntry} address the same entry.
+ */
+function tokenCacheKey(connector, params) {
+    return JSON.stringify({ connector, ...params });
+}
 function evictLru() {
     let oldestKey;
     let oldestTime = Infinity;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {