@vercel/connect 0.0.6-alpha.1 → 0.1.2

package/LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -175,4 +176,27 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2026 Vercel, Inc.
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2017 Vercel, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,400 +1,59 @@
 # `@vercel/connect`
 
-SDK for obtaining scoped tokens for third-party services on behalf of apps or users. The runtime authenticates the calling Vercel project via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc) and exchanges the OIDC token for a Vercel Connect-issued credential through the Vercel API.
+SDK for obtaining scoped tokens for third-party services on behalf of apps or users. Authenticates the calling Vercel project via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc) and exchanges the OIDC token for a Vercel Connect-issued credential.
 
-The package ships four entrypoints:
+Four entrypoints, all ESM:
 
-- `@vercel/connect` — the core token / authorization SDK (no peer deps beyond `@vercel/oidc`).
-- `@vercel/connect/ash` — adapter helpers for the [Ash](https://github.com/vercel/ash) connection runtime. `experimental-ash` is an _optional_ peer dependency.
-- `@vercel/connect/betterauth` — a [Better Auth](https://www.better-auth.com/) `genericOAuth` provider. `better-auth` is an _optional_ peer dependency.
-- `@vercel/connect/authjs` — an [Auth.js](https://authjs.dev/) (NextAuth core) `OAuth2Config` provider. `@auth/core` is an _optional_ peer dependency.
-
-Consumers that don't use a given integration never load it.
+- `@vercel/connect` — core token / authorization SDK
+- `@vercel/connect/ash` — adapter helpers for [Ash](https://github.com/vercel/ash) connections (optional peer: `experimental-ash`)
+- `@vercel/connect/betterauth` — [Better Auth](https://www.better-auth.com/) `genericOAuth` provider (optional peer: `better-auth`)
+- `@vercel/connect/authjs` — [Auth.js](https://authjs.dev/) `OAuth2Config` provider (optional peer: `@auth/core`)
 
 ## Install
 
 ```sh
 pnpm add @vercel/connect
-# or
-npm install @vercel/connect
 ```
 
-The package is ESM-only (`"type": "module"`).
-
----
-
-## `@vercel/connect`
-
-### `getToken(connector, params, options?)`
-
-```ts
-function getToken(
-  connector: string,
-  params: ConnectTokenParams,
-  options?: ConnectOptions,
-): Promise<string>;
-```
+## Usage
 
-Returns a token string for the given Vercel Connect connector and subject. Wraps `getTokenResponse` and discards the metadata.
+### Core SDK
 
 ```ts
-import { getToken } from "@vercel/connect";
+import { getToken } from '@vercel/connect';
 
 const token = await getToken(process.env.CONNECTOR_LINEAR!, {
-  subject: { type: "user", id: "user_123" },
+  subject: { type: 'user', id: 'user_123' },
 });
 ```
 
-### `getTokenResponse(connector, params, options?)`
-
-```ts
-function getTokenResponse(
-  connector: string,
-  params: ConnectTokenParams,
-  options?: ConnectOptions,
-): Promise<ConnectTokenResponse>;
-```
-
-Returns the full token response including `expiresAt`, connector identity (`connector`), `installationId`, `tenantId`, and `externalSubject`. Use this when you need the expiration or any of the metadata fields.
-
-Both functions share an in-process LRU cache (max 100 entries) keyed by `connector` plus the full `params` payload. Cached entries are reused until they fall inside the `validityBufferMs` window before expiration, after which they're refetched.
-
-`connector` accepts either the opaque service connector key (`scl_...`) or the human-readable UID (`oauth/mcp-linear-app`) — both resolve to the same connector on the Vercel Connect side.
-
-### `startAuthorization(connector, params, options?)`
-
-```ts
-function startAuthorization(
-  connector: string,
-  params: ConnectTokenParams,
-  options?: ConnectAuthorizationOptions,
-): Promise<ConnectAuthorizationResponse>;
-```
-
-Begins an interactive (user-facing) authorization flow. Returns a `{ request, verifier, url }` triple; redirect the end user to `url`, then call `getToken` / `getTokenResponse` once Vercel Connect signals completion (via the configured `webhook` or `callbackUrl`). The `verifier` is the PKCE verifier — store it alongside the in-flight request so you can correlate the callback.
-
-```ts
-import { startAuthorization } from "@vercel/connect";
-
-const { url, verifier } = await startAuthorization(
-  process.env.CONNECTOR_LINEAR!,
-  { subject: { type: "user", id: "user_123" } },
-  { callbackUrl: "https://app.example.com/connect/callback" },
-);
-```
-
-`callbackUrl` must be `https://` or `http://localhost` (for `vercel dev`). `webhook` must be `https://`. Both are validated client-side before the request is sent.
-
-### Types
+### Ash
 
 ```ts
-interface ConnectTokenParams {
-  subject: { type: "app" } | { type: "user"; id: string; issuer?: string };
-  installationId?: string;
-  audience?: string[];
-  scopes?: string[];
-  resources?: string[];
-  authorizationDetails?: Array<{ type: string } & Record<string, unknown>>;
-  /** Buffer (ms) before expiration to consider the token invalid. Default: 30_000. */
-  validityBufferMs?: number;
-}
-
-interface ConnectTokenResponse {
-  token: string;
-  /** Expiration timestamp in ms since epoch. */
-  expiresAt: number;
-  connector: {
-    /** Opaque Vercel Connect connector id. */
-    id: string;
-    /** Human-readable Vercel Connect connector UID. */
-    uid: string;
-    /** Vercel Connect connector type identifier. */
-    type: string;
-  };
-  name?: string;
-  installationId?: string;
-  tenantId?: string;
-  externalSubject?: string;
-  metadata?: Record<string, unknown>;
-}
-
-interface ConnectOptions {
-  /** Override the OIDC bearer used to authenticate to the Vercel API. */
-  vercelToken?: string;
-}
-
-interface ConnectAuthorizationOptions {
-  vercelToken?: string;
-  /** Browser-redirect target after consent. Must be https:// or http://localhost. */
-  callbackUrl?: string;
-  /** Server-POST callback. Must be https://. */
-  webhook?: string;
-}
-
-interface ConnectAuthorizationResponse {
-  request: string;
-  verifier: string;
-  url: string;
-}
-```
-
-### Errors
-
-All exchange / authorization calls reject with typed errors. Catch them by class to distinguish recoverable consent-required cases from terminal failures.
-
-| Class                                | Meaning                                                                                                           |
-| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
-| `NoValidTokenError`                  | Vercel Connect has no valid credential for this subject. For user subjects, recoverable via `startAuthorization`. |
-| `UserAuthorizationRequiredError`     | The user has not consented yet (or the previous grant was revoked). Recoverable via `startAuthorization`.         |
-| `ConnectorInstallationRequiredError` | The Vercel Connect connector is not installed for this team. Terminal — an operator must install the connector.   |
-
-Any other failure (network, 5xx, etc.) is thrown as a plain `Error` with the HTTP status and response body in the message.
-
-```ts
-import {
-  getToken,
-  NoValidTokenError,
-  UserAuthorizationRequiredError,
-  ConnectorInstallationRequiredError,
-} from "@vercel/connect";
-
-try {
-  await getToken(connector, { subject: { type: "user", id } });
-} catch (err) {
-  if (err instanceof UserAuthorizationRequiredError) {
-    // Redirect the user through startAuthorization().
-  } else if (err instanceof ConnectorInstallationRequiredError) {
-    // Surface "install this Vercel Connect connector" to an operator.
-  } else {
-    throw err;
-  }
-}
-```
-
----
-
-## `@vercel/connect/ash`
-
-Adapter helpers for the [Ash](https://github.com/vercel/ash) connection runtime. Importing this subpath requires `experimental-ash >= 0.8.2` to be installed in the consumer project.
-
-### `connect(input)`
-
-Builds an Ash `AuthorizationDefinition` backed by Vercel Connect, collapsing the `getToken` / `startAuthorization` / `completeAuthorization` boilerplate that each Vercel Connect-backed connection would otherwise repeat.
-
-```ts
-function connect(
-  connector: string,
-): AshConnectAuthorizationDefinition<
-  InteractiveAuthorizationDefinition<ConnectAuthorizationState>
->;
-function connect(
-  options: AshAuthorizationOptions & { principalType?: "user" },
-): AshConnectAuthorizationDefinition<
-  InteractiveAuthorizationDefinition<ConnectAuthorizationState>
->;
-function connect(
-  options: AshAuthorizationOptions & { principalType: "app" },
-): AshConnectAuthorizationDefinition<NonInteractiveAuthorizationDefinition>;
-```
-
-The shorthand form `connect("linear")` is equivalent to `connect({ connector: "linear" })` — `principalType` defaults to `"user"`, so the helper returns an interactive definition unless you opt into `"app"` explicitly.
-
-The return type narrows on `principalType`:
-
-- `"user"` (default) → interactive definition. Ash drives the consent flow through its framework-owned webhook; failures map to `ConnectionAuthorizationRequiredError` so the runtime can prompt the user.
-- `"app"` → non-interactive definition (`getToken` only). Failures map to `ConnectionAuthorizationFailedError` with `retryable: false` — there's nobody to consent for an app-scoped connector.
-
-```ts
-import { defineMcpClientConnection } from "experimental-ash/connections";
-import { connect } from "@vercel/connect/ash";
+import { defineMcpClientConnection } from 'experimental-ash/connections';
+import { connect } from '@vercel/connect/ash';
 
 export default defineMcpClientConnection({
-  url: "https://mcp.linear.app/sse",
-  description: "Linear workspace — issues, projects, cycles, and comments.",
-  auth: connect("oauth/mcp-linear-app"),
-});
-```
-
-#### `AshAuthorizationOptions`
-
-| Field            | Type                                                                       | Notes                                                                                                                                                                  |
-| ---------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `connector`      | `string`                                                                   | Vercel Connect connector identifier — accepts the opaque `scl_...` key or the human-readable UID (`oauth/mcp-linear-app`).                                             |
-| `principalType`  | `"app" \| "user"`                                                          | Defaults to `"user"` when omitted. Selects which definition shape is returned.                                                                                         |
-| `tokenParams`    | `Omit<ConnectTokenParams, "subject">`                                      | Forwarded verbatim to every token / authorization call. Use to pin `scopes`, `audience`, `resources`, etc. `subject` is derived from the framework-resolved principal. |
-| `connectOptions` | `ConnectOptions`                                                           | Low-level overrides (e.g. `vercelToken`). Most callers leave this unset.                                                                                               |
-| `instructions`   | `string`                                                                   | Custom call-to-action shown on `connection.authorization_required`. Defaults to a message derived from the connection's filename.                                      |
-| `onError`        | `(error: unknown, phase: ConnectAuthorizationPhase) => Error \| undefined` | Escape hatch for translating raw errors. Return a replacement `Error`, or `undefined` to fall back to the default mapping.                                             |
-
-#### Supporting types
-
-```ts
-type AshAuthorizationInput = string | AshAuthorizationOptions;
-
-interface VercelConnectMetadata {
-  readonly connector: string;
-}
-
-type AshConnectAuthorizationDefinition<
-  TAuthorization extends
-    | InteractiveAuthorizationDefinition<ConnectAuthorizationState>
-    | NonInteractiveAuthorizationDefinition,
-> = TAuthorization & {
-  readonly vercelConnect: VercelConnectMetadata;
-};
-
-type ConnectAuthorizationPhase =
-  | "getToken"
-  | "startAuthorization"
-  | "completeAuthorization";
-
-type ConnectAuthorizationState = {
-  readonly verifier: string;
-  readonly [key: string]: JsonValue;
-};
-```
-
-`ConnectAuthorizationState` is what Ash journals between `startAuthorization` and `completeAuthorization`. The index signature satisfies Ash's `State extends JsonValue` constraint; in practice only `verifier` is set.
-
-### `connectSlackCredentials(connector)`
-
-```ts
-function connectSlackCredentials(connector: string): SlackChannelCredentials;
-```
-
-Builds `SlackChannelCredentials` for the Ash Slack channel adapter, backed by a Vercel Connect connector that stores the workspace's bot token. The returned `botToken` is a function form, invoked once per inbound webhook so the adapter always picks up a fresh token (rotation, refresh, multi-workspace tenancy are all handled server-side).
-
-Slack bot tokens are app-scoped — one token per workspace install, shared across every end-user — so this helper calls Vercel Connect with `subject: { type: "app" }`. Per-user Slack OAuth is a separate concern.
-
-```ts
-import { slackRoute } from "experimental-ash/channels/slack";
-import { connectSlackCredentials } from "@vercel/connect/ash";
-
-export default slackRoute({
-  credentials: connectSlackCredentials("scl_..."),
+  url: 'https://mcp.linear.app/sse',
+  auth: connect('linear'),
 });
 ```
 
-The `webhookVerifier` is set to `vercelOidc()`, which authenticates inbound webhooks using the Vercel OIDC token issued for the calling project.
-
-### `connectOAuth(options?)`
-
-```ts
-function connectOAuth(options?: ConnectOAuthOptions): AuthFn<Request>;
-```
-
-Returns an Ash route auth callback for Vercel Connect OAuth gateway access tokens. It verifies bearer JWTs issued by `https://connect.vercel.com`, requires the gateway access-token claim `typ: "at"`, and by default accepts Connect OAuth audiences shaped `teamId:VERCEL_PROJECT_ID:VERCEL_ENV`; the team id segment is ignored because project ids are globally unique.
+### Better Auth
 
 ```ts
-import { httpRoute } from "experimental-ash/channels/http";
-import { connectOAuth } from "@vercel/connect/ash";
+import { genericOAuth } from 'better-auth/plugins';
+import { connect } from '@vercel/connect/betterauth';
 
-export default httpRoute({
-  auth: connectOAuth({
-    connectors: ["slack/mybot"],
-  }),
-});
+genericOAuth({ config: [connect({ connector: 'linear' })] });
 ```
 
-Pass `audiences` to accept explicit `aud` values, or pass `projectId` and `environment` to build the Connect OAuth audience manually. `connectors` accepts both `scl_...` connector ids and connector UIDs by checking each value against the `clientId` and `clientUid` claims; `tenantIds`, `installationIds`, `subjects`, and `claims` can further narrow accepted gateway tokens.
-
----
-
-## `@vercel/connect/betterauth`
-
-Better Auth provider for Vercel Connect's OAuth2 endpoints. Importing this subpath requires `better-auth >= 1.5.0` to be installed in the consumer project.
-
-### `connect(options)`
+### Auth.js
 
 ```ts
-function connect(options: BetterAuthConnectOptions): GenericOAuthConfig;
-```
+import { connect } from '@vercel/connect/authjs';
 
-Returns a `GenericOAuthConfig` entry that drops into `genericOAuth({ config: [...] })` from `better-auth/plugins/generic-oauth`. Vercel Connect's OAuth client authentication is non-standard — the "client secret" is a Vercel OIDC token that has to be fetched per-request — so the helper overrides `getToken` to inject the token endpoint `Authorization` header.
-
-```ts
-import { betterAuth } from "better-auth";
-import { genericOAuth } from "better-auth/plugins/generic-oauth";
-import { connect } from "@vercel/connect/betterauth";
-
-export const auth = betterAuth({
-  plugins: [
-    genericOAuth({
-      config: [
-        connect({
-          providerId: "slack",
-          connector: process.env.CONNECTOR_SLACK!,
-        }),
-      ],
-    }),
-  ],
-});
-```
-
-#### `BetterAuthConnectOptions`
-
-| Field                | Type                    | Notes                                                                                                 |
-| -------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------- |
-| `id`                 | `string`                | Provider id used by Better Auth's generic OAuth plugin. Surfaces in the sign-in URL and account rows. |
-| `connector`          | `string`                | Vercel Connect connector identifier — accepts `scl_...` or the human-readable UID.                    |
-| `scopes`             | `readonly string[]`     | Scopes to request. `offline_access` is added automatically. Defaults to `["openid"]`.                 |
-| `getVercelOidcToken` | `() => Promise<string>` | Override the OIDC token fetcher. Defaults to `getVercelOidcToken` from `@vercel/oidc`.                |
-
-When the OIDC token is readable, the helper scopes the Vercel Connect consent UI to the deployment's Vercel team (`?teamId=...` on the authorization URL); outside Vercel it falls back to the unqualified URL.
-
----
-
-## `@vercel/connect/authjs`
-
-Auth.js (NextAuth core) provider for Vercel Connect's OAuth2 endpoints. Importing this subpath requires `@auth/core >= 0.37.0` to be installed in the consumer project.
-
-### `connect(options)`
-
-```ts
-function connect(options: AuthJsConnectOptions): OAuth2Config<ConnectProfile>;
+const providers = [connect({ connector: 'linear' })];
 ```
 
-Returns an `OAuth2Config` provider entry for `AuthConfig.providers`. Vercel Connect's token endpoint expects the Vercel OIDC token in place of a static client secret, so the helper declares `token_endpoint_auth_method: "none"` and injects the token endpoint `Authorization` header via Auth.js's `customFetch` symbol.
-
-```ts
-import type { AuthConfig } from "@auth/core";
-import { connect } from "@vercel/connect/authjs";
-
-export const authConfig: AuthConfig = {
-  providers: [
-    connect({
-      id: "slack",
-      name: "Slack",
-      connector: process.env.CONNECTOR_SLACK!,
-    }),
-  ],
-};
-```
-
-#### `AuthJsConnectOptions`
-
-| Field                | Type                    | Notes                                                                                                            |
-| -------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| `id`                 | `string`                | Provider id surfaced by Auth.js. Becomes the path segment in callback URLs and the `provider` field on accounts. |
-| `name`               | `string`                | Human-readable display name used by Auth.js sign-in UIs.                                                         |
-| `connector`          | `string`                | Vercel Connect connector identifier — accepts `scl_...` or the human-readable UID.                               |
-| `scopes`             | `readonly string[]`     | Scopes to request. `offline_access` is added automatically. Defaults to `["openid"]`.                            |
-| `getVercelOidcToken` | `() => Promise<string>` | Override the OIDC token fetcher. Defaults to `getVercelOidcToken` from `@vercel/oidc`.                           |
-
-#### `ConnectProfile`
-
-```ts
-interface ConnectProfile {
-  sub: string;
-  email?: string;
-  email_verified?: boolean;
-  name?: string;
-  picture?: string;
-}
-```
-
-Userinfo payload returned by Vercel Connect's OIDC userinfo endpoint. The helper maps it to an Auth.js user via `profile()`; override that callback in the provider config if you need to surface additional fields.
-
-## License
-
-Apache-2.0. See [LICENSE](LICENSE) for details.
+See the source under `src/` for the full API (additional helpers like `getTokenResponse`, `startAuthorization`, typed error classes, and per-adapter options).

package/dist/ash/connect-oauth.d.ts

@@ -1,7 +1,7 @@
-import { type AuthFn, type VerifyOidcConfig } from "experimental-ash/channels/auth";
+import { type AuthFn, type VerifyOidcConfig } from 'experimental-ash/channels/auth';
 export declare const CONNECT_OAUTH_ISSUER = "https://connect.vercel.com";
-export type ConnectOAuthEnvironment = "production" | "preview" | "development";
-export type ConnectOAuthAudienceEnvironment = ConnectOAuthEnvironment | "*";
+export type ConnectOAuthEnvironment = 'production' | 'preview' | 'development';
+export type ConnectOAuthAudienceEnvironment = ConnectOAuthEnvironment | '*';
 export interface ConnectOAuthOptions {
     /**
      * Exact `aud` claim values to accept. When omitted, the helper
@@ -43,7 +43,7 @@ export interface ConnectOAuthOptions {
      * Additional exact-match string claims to require. `typ` is always
      * constrained to `"at"` for Connect OAuth gateway access tokens.
      */
-    readonly claims?: VerifyOidcConfig["claims"];
+    readonly claims?: VerifyOidcConfig['claims'];
     /**
      * Override the OIDC discovery URL. Defaults to
      * `https://connect.vercel.com/.well-known/openid-configuration`.

package/dist/ash/connect-oauth.js

@@ -1,5 +1,5 @@
-import { extractBearerToken, verifyOidc, } from "experimental-ash/channels/auth";
-export const CONNECT_OAUTH_ISSUER = "https://connect.vercel.com";
+import { extractBearerToken, verifyOidc, } from 'experimental-ash/channels/auth';
+export const CONNECT_OAUTH_ISSUER = 'https://connect.vercel.com';
 /**
  * Returns an Ash route auth callback for Vercel Connect OAuth gateway
  * access tokens.
@@ -17,7 +17,7 @@ export function connectOAuth(opts = {}) {
     const connectorPolicy = resolveConnectorPolicy(opts);
     const claims = buildClaimMatchers(opts);
     return async (request) => {
-        const token = extractBearerToken(request.headers.get("authorization"));
+        const token = extractBearerToken(request.headers.get('authorization'));
         if (token === null) {
             return null;
         }
@@ -26,8 +26,7 @@ export function connectOAuth(opts = {}) {
             return null;
         }
         const audiences = resolveRequestAudiences(payload, audiencePolicy);
-        if (audiences === null ||
-            !isConnectorAccepted(payload, connectorPolicy)) {
+        if (audiences === null || !isConnectorAccepted(payload, connectorPolicy)) {
             return null;
         }
         const result = await verifyOidc(token, {
@@ -44,29 +43,29 @@ export function connectOAuth(opts = {}) {
 function resolveAudiencePolicy(opts) {
     if (opts.audiences !== undefined) {
         if (opts.audiences.length === 0) {
-            throw new Error("connectOAuth: audiences must not be empty.");
+            throw new Error('connectOAuth: audiences must not be empty.');
         }
-        return { kind: "exact", audiences: opts.audiences };
+        return { kind: 'exact', audiences: opts.audiences };
     }
-    const projectId = opts.projectId ?? readNonEmptyEnv("VERCEL_PROJECT_ID");
+    const projectId = opts.projectId ?? readNonEmptyEnv('VERCEL_PROJECT_ID');
     const environment = opts.environment ?? inferVercelEnvironment();
     if (projectId === undefined) {
-        throw new Error("connectOAuth: could not infer projectId from VERCEL_PROJECT_ID; pass audiences or projectId explicitly.");
+        throw new Error('connectOAuth: could not infer projectId from VERCEL_PROJECT_ID; pass audiences or projectId explicitly.');
     }
     if (environment === undefined) {
-        throw new Error("connectOAuth: could not infer environment from VERCEL_TARGET_ENV or VERCEL_ENV; pass audiences or environment explicitly.");
+        throw new Error('connectOAuth: could not infer environment from VERCEL_TARGET_ENV or VERCEL_ENV; pass audiences or environment explicitly.');
     }
-    const environments = environment === "*"
-        ? ["production", "preview", "development"]
+    const environments = environment === '*'
+        ? ['production', 'preview', 'development']
         : [environment];
-    return { kind: "project", environments, projectId };
+    return { kind: 'project', environments, projectId };
 }
 function resolveRequestAudiences(payload, policy) {
-    if (policy.kind === "exact") {
+    if (policy.kind === 'exact') {
         return policy.audiences;
     }
     const audiences = extractAudiences(payload);
-    const accepted = audiences.filter((audience) => {
+    const accepted = audiences.filter(audience => {
         const parsed = parseConnectOAuthAudience(audience);
         return (parsed !== null &&
             parsed.projectId === policy.projectId &&
@@ -76,26 +75,26 @@ function resolveRequestAudiences(payload, policy) {
 }
 function resolveConnectorPolicy(opts) {
     if (opts.connectors === undefined) {
-        return { kind: "any" };
+        return { kind: 'any' };
     }
     if (opts.connectors.length === 0) {
-        throw new Error("connectOAuth: connectors must not be empty.");
+        throw new Error('connectOAuth: connectors must not be empty.');
     }
-    return { kind: "connectors", connectors: opts.connectors };
+    return { kind: 'connectors', connectors: opts.connectors };
 }
 function isConnectorAccepted(payload, policy) {
-    if (policy.kind === "any") {
+    if (policy.kind === 'any') {
         return true;
     }
-    const clientId = stringClaim(payload, "clientId");
+    const clientId = stringClaim(payload, 'clientId');
     if (clientId !== undefined && policy.connectors.includes(clientId)) {
         return true;
     }
-    const clientUid = stringClaim(payload, "clientUid");
+    const clientUid = stringClaim(payload, 'clientUid');
     return clientUid !== undefined && policy.connectors.includes(clientUid);
 }
 function inferVercelEnvironment() {
-    const value = readNonEmptyEnv("VERCEL_TARGET_ENV") ?? readNonEmptyEnv("VERCEL_ENV");
+    const value = readNonEmptyEnv('VERCEL_TARGET_ENV') ?? readNonEmptyEnv('VERCEL_ENV');
     if (value === undefined)
         return undefined;
     assertEnvironment(value);
@@ -108,58 +107,58 @@ function buildClaimMatchers(opts) {
         ...(opts.installationIds === undefined
             ? {}
             : { installationId: opts.installationIds }),
-        typ: ["at"],
+        typ: ['at'],
     };
 }
 function readNonEmptyEnv(name) {
-    const value = typeof process === "undefined" ? undefined : process.env?.[name]?.trim();
+    const value = typeof process === 'undefined' ? undefined : process.env?.[name]?.trim();
     return value === undefined || value.length === 0 ? undefined : value;
 }
 function extractAudiences(payload) {
     const aud = payload.aud;
-    if (typeof aud === "string") {
+    if (typeof aud === 'string') {
         return [aud];
     }
     if (Array.isArray(aud)) {
-        return aud.filter((value) => typeof value === "string");
+        return aud.filter((value) => typeof value === 'string');
     }
     return [];
 }
 function stringClaim(payload, claim) {
     const value = payload[claim];
-    return typeof value === "string" && value.length > 0 ? value : undefined;
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
 function decodeJwtPayload(token) {
     try {
-        const payload = token.split(".")[1];
+        const payload = token.split('.')[1];
         if (payload === undefined)
             return null;
-        const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-        const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+        const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
         const decoded = JSON.parse(atob(padded));
-        return typeof decoded === "object" && decoded !== null ? decoded : null;
+        return typeof decoded === 'object' && decoded !== null ? decoded : null;
     }
     catch {
         return null;
     }
 }
 function parseConnectOAuthAudience(audience) {
-    const [teamId, projectId, environment, extra] = audience.split(":");
+    const [teamId, projectId, environment, extra] = audience.split(':');
     if (!teamId || !projectId || !environment || extra !== undefined) {
         return null;
     }
-    if (environment !== "production" &&
-        environment !== "preview" &&
-        environment !== "development") {
+    if (environment !== 'production' &&
+        environment !== 'preview' &&
+        environment !== 'development') {
         return null;
     }
     return { projectId, environment };
 }
 function assertEnvironment(value) {
-    if (value !== "production" &&
-        value !== "preview" &&
-        value !== "development" &&
-        value !== "*") {
+    if (value !== 'production' &&
+        value !== 'preview' &&
+        value !== 'development' &&
+        value !== '*') {
         throw new Error(`connectOAuth: invalid environment ${JSON.stringify(value)}; expected "production", "preview", "development", or "*".`);
     }
 }