@vercel/connect 0.0.4-alpha.6 → 0.0.4-alpha.8

package/README.md

@@ -313,7 +313,7 @@ export const auth = betterAuth({
 | -------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------- |
 | `id`                 | `string`                | Provider id used by Better Auth's generic OAuth plugin. Surfaces in the sign-in URL and account rows. |
 | `connector`          | `string`                | Vercel Connect connector identifier — accepts `scl_...` or the human-readable UID.                    |
-| `scopes`             | `readonly string[]`     | Scopes to request. `offline_access` is added automatically. Defaults to `["*"]`.                      |
+| `scopes`             | `readonly string[]`     | Scopes to request. `offline_access` is added automatically. Defaults to `["openid"]`.                 |
 | `getVercelOidcToken` | `() => Promise<string>` | Override the OIDC token fetcher. Defaults to `getVercelOidcToken` from `@vercel/oidc`.                |
 
 When the OIDC token is readable, the helper scopes the Vercel Connect consent UI to the deployment's Vercel team (`?teamId=...` on the authorization URL); outside Vercel it falls back to the unqualified URL.
@@ -354,7 +354,7 @@ export const authConfig: AuthConfig = {
 | `id`                 | `string`                | Provider id surfaced by Auth.js. Becomes the path segment in callback URLs and the `provider` field on accounts. |
 | `name`               | `string`                | Human-readable display name used by Auth.js sign-in UIs.                                                         |
 | `connector`          | `string`                | Vercel Connect connector identifier — accepts `scl_...` or the human-readable UID.                               |
-| `scopes`             | `readonly string[]`     | Scopes to request. `offline_access` is added automatically. Defaults to `["*"]`.                                 |
+| `scopes`             | `readonly string[]`     | Scopes to request. `offline_access` is added automatically. Defaults to `["openid"]`.                            |
 | `getVercelOidcToken` | `() => Promise<string>` | Override the OIDC token fetcher. Defaults to `getVercelOidcToken` from `@vercel/oidc`.                           |
 
 #### `ConnectProfile`

package/dist/ash/connection-authorization.d.ts

@@ -109,6 +109,36 @@ export interface AshAuthorizationOptions {
 }
 /** Input accepted by {@link connect}. */
 export type AshAuthorizationInput = string | AshAuthorizationOptions;
+/**
+ * Structurally-readable marker exposed on every {@link connect} return
+ * value so downstream tooling can detect Vercel Connect-backed
+ * connections at compile time and surface deep links to the matching
+ * connector settings page.
+ *
+ * The `connector` field carries the raw value the author passed to
+ * {@link connect} — either the human-readable UID
+ * (`"oauth/mcp-linear-app"`) or the opaque service-connector key
+ * (`"scl_..."`). Consumers that need the canonical `scl_...` form
+ * (eg. the Vercel dashboard, when building a `/connect/<clientId>`
+ * URL) can resolve UID → `scl_...` against the Vercel Connect API;
+ * both forms address the same connector.
+ *
+ * The marker is purely metadata — it does not influence the runtime
+ * token-fetching behaviour, which continues to be driven by the
+ * `getToken` / `startAuthorization` / `completeAuthorization`
+ * callbacks.
+ */
+export interface VercelConnectMetadata {
+    readonly connector: string;
+}
+/**
+ * Augments the standard Ash authorization shape with the
+ * {@link VercelConnectMetadata} marker, narrowed to whichever flavour
+ * `connect()` produces.
+ */
+export type AshConnectAuthorizationDefinition<TAuthorization extends InteractiveAuthorizationDefinition<ConnectAuthorizationState> | NonInteractiveAuthorizationDefinition> = TAuthorization & {
+    readonly vercelConnect: VercelConnectMetadata;
+};
 /**
  * Builds an Ash {@link AuthorizationDefinition} backed by Vercel
  * Connect. The return type narrows based on
@@ -120,12 +150,17 @@ export type AshAuthorizationInput = string | AshAuthorizationOptions;
  * - `principalType: "app"` returns a
  *   {@link NonInteractiveAuthorizationDefinition}; Ash never runs a
  *   consent flow for app-scoped connectors.
+ *
+ * Every returned definition also carries a {@link VercelConnectMetadata}
+ * marker on its `vercelConnect` field so downstream tooling (Ash
+ * compiler, dashboards) can detect Vercel Connect-backed connections
+ * without inspecting closure state.
  */
-export declare function connect(connector: string): InteractiveAuthorizationDefinition<ConnectAuthorizationState>;
+export declare function connect(connector: string): AshConnectAuthorizationDefinition<InteractiveAuthorizationDefinition<ConnectAuthorizationState>>;
 export declare function connect(options: AshAuthorizationOptions & {
     readonly principalType?: "user";
-}): InteractiveAuthorizationDefinition<ConnectAuthorizationState>;
+}): AshConnectAuthorizationDefinition<InteractiveAuthorizationDefinition<ConnectAuthorizationState>>;
 export declare function connect(options: AshAuthorizationOptions & {
     readonly principalType: "app";
-}): NonInteractiveAuthorizationDefinition;
-export declare function connect(options: AshAuthorizationInput): InteractiveAuthorizationDefinition<ConnectAuthorizationState> | NonInteractiveAuthorizationDefinition;
+}): AshConnectAuthorizationDefinition<NonInteractiveAuthorizationDefinition>;
+export declare function connect(options: AshAuthorizationInput): AshConnectAuthorizationDefinition<InteractiveAuthorizationDefinition<ConnectAuthorizationState> | NonInteractiveAuthorizationDefinition>;

package/dist/ash/connection-authorization.js

@@ -33,10 +33,11 @@ import { startAuthorization } from "../authorization.js";
 import { ConnectorInstallationRequiredError, getTokenResponse, NoValidTokenError, UserAuthorizationRequiredError, } from "../token.js";
 export function connect(input) {
     const options = normalizeAuthorizationOptions(input);
+    const vercelConnect = { connector: options.connector };
     if (options.principalType === "app") {
-        return buildNonInteractiveDefinition(options);
+        return { ...buildNonInteractiveDefinition(options), vercelConnect };
     }
-    return buildInteractiveDefinition(options);
+    return { ...buildInteractiveDefinition(options), vercelConnect };
 }
 function normalizeAuthorizationOptions(input) {
     if (typeof input === "string") {

package/dist/ash/index.d.ts

@@ -6,6 +6,6 @@
  * this barrel re-exports the public API so consumers import
  * everything from `@vercel/connect/ash`.
  */
-export { connect, type AshAuthorizationInput, type AshAuthorizationOptions, type ConnectAuthorizationPhase, type ConnectAuthorizationState, } from "./connection-authorization.js";
+export { connect, type AshAuthorizationInput, type AshAuthorizationOptions, type AshConnectAuthorizationDefinition, type ConnectAuthorizationPhase, type ConnectAuthorizationState, type VercelConnectMetadata, } from "./connection-authorization.js";
 export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from "./connect-oauth.js";
 export { connectSlackCredentials } from "./slack-credentials.js";

package/dist/authjs/connect-provider.d.ts

@@ -26,7 +26,7 @@ export interface AuthJsConnectOptions {
     /**
      * Scopes to request. `offline_access` is added automatically so
      * the Vercel Connect side can mint refresh tokens. Defaults to
-     * `["*"]`.
+     * `["openid"]`.
      */
     readonly scopes?: readonly string[];
     /**

package/dist/authjs/connect-provider.js

@@ -35,7 +35,7 @@ const CONNECT_USERINFO_URL = "https://connect.vercel.com/oauth/userinfo";
  */
 export function connect(options) {
     const fetchVercelToken = options.getVercelOidcToken ?? getVercelOidcToken;
-    const scope = Array.from(new Set([...(options.scopes ?? ["*"]), "offline_access"])).join(" ");
+    const scope = Array.from(new Set([...(options.scopes ?? ["openid"]), "offline_access"])).join(" ");
     return {
         id: options.id,
         name: options.name,

package/dist/betterauth/connect-provider.d.ts

@@ -15,7 +15,7 @@ export interface BetterAuthConnectOptions {
     readonly connector: string;
     /**
      * Scopes to request. `offline_access` is added automatically so the
-     * Vercel Connect side can mint refresh tokens. Defaults to `["*"]`.
+     * Vercel Connect side can mint refresh tokens. Defaults to `["openid"]`.
      */
     readonly scopes?: readonly string[];
     /**

package/dist/betterauth/connect-provider.js

@@ -39,7 +39,7 @@ const CONNECT_USERINFO_URL = "https://connect.vercel.com/oauth/userinfo";
  */
 export function connect(options) {
     const fetchVercelToken = options.getVercelOidcToken ?? getVercelOidcToken;
-    const scopes = Array.from(new Set([...(options.scopes ?? ["*"]), "offline_access"]));
+    const scopes = Array.from(new Set([...(options.scopes ?? ["openid"]), "offline_access"]));
     return {
         providerId: options.providerId,
         clientId: options.connector,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.0.4-alpha.6",
+  "version": "0.0.4-alpha.8",
   "type": "module",
   "exports": {
     ".": {
@@ -29,7 +29,7 @@
   "peerDependencies": {
     "@auth/core": ">=0.37.0",
     "better-auth": ">=1.5.0",
-    "experimental-ash": ">=0.3.0-alpha.29"
+    "experimental-ash": ">=0.8.2"
   },
   "peerDependenciesMeta": {
     "@auth/core": {