@vercel/connect 0.1.2 → 0.1.3

package/dist/ash/connection-authorization.d.ts

@@ -28,8 +28,8 @@
  * `@vercel/connect/ash` requires Ash to be installed in the consumer
  * project, but the rest of `@vercel/connect` works without it.
  */
-import { type InteractiveAuthorizationDefinition, type JsonValue, type NonInteractiveAuthorizationDefinition } from 'experimental-ash/connections';
-import type { ConnectOptions, ConnectTokenParams } from '../token.js';
+import { type ConnectionPrincipal, type InteractiveAuthorizationDefinition, type JsonValue, type NonInteractiveAuthorizationDefinition } from 'experimental-ash/connections';
+import type { ConnectOptions, ConnectTokenParams, ConnectTokenSubject } from '../token.js';
 /**
  * Authorization phase passed to {@link AshAuthorizationOptions.onError}
  * so consumers can branch their error translation per callback.
@@ -82,6 +82,13 @@ export interface AshAuthorizationOptions {
      * `authorizationDetails`. Passed through verbatim.
      */
     readonly tokenParams?: Omit<ConnectTokenParams, 'subject'>;
+    /**
+     * Override how Ash's framework-resolved principal is mapped to a
+     * Vercel Connect token subject. When omitted, app principals map to
+     * `{ type: "app" }` and user principals map to
+     * `{ type: "user", id, issuer }`.
+     */
+    readonly principalToSubject?: (principal: ConnectionPrincipal) => ConnectTokenSubject | Promise<ConnectTokenSubject>;
     /**
      * Low-level Vercel Connect SDK options (currently `vercelToken`
      * for overriding the OIDC bearer). Most callers leave this unset

package/dist/ash/connection-authorization.js

@@ -50,7 +50,7 @@ function buildInteractiveDefinition(options) {
         principalType: 'user',
         async getToken({ principal }) {
             try {
-                const response = await getTokenResponse(options.connector, buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -80,7 +80,7 @@ function buildInteractiveDefinition(options) {
                 // mints one URL, Vercel Connect redirects there" mental
                 // model. Revisit if tab-close timeouts become a real problem
                 // in production.
-                const response = await startAuthorization(options.connector, buildTokenParams(options, principal), {
+                const response = await startAuthorization(options.connector, await buildTokenParams(options, principal), {
                     ...options.connectOptions,
                     callbackUrl: callbackUrl ?? webhook,
                     deviceCode: true,
@@ -105,7 +105,7 @@ function buildInteractiveDefinition(options) {
         },
         async completeAuthorization({ principal, }) {
             try {
-                const response = await getTokenResponse(options.connector, buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -119,7 +119,7 @@ function buildNonInteractiveDefinition(options) {
         principalType: 'app',
         async getToken({ principal }) {
             try {
-                const response = await getTokenResponse(options.connector, buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -128,10 +128,11 @@ function buildNonInteractiveDefinition(options) {
         },
     };
 }
-function buildTokenParams(options, principal) {
+async function buildTokenParams(options, principal) {
+    const toSubject = options.principalToSubject ?? principalToSubject;
     return {
         ...options.tokenParams,
-        subject: principalToSubject(principal),
+        subject: await toSubject(principal),
     };
 }
 function principalToSubject(principal) {

package/dist/ash/slack-credentials.d.ts

@@ -1,4 +1,14 @@
 import type { SlackChannelCredentials } from 'experimental-ash/channels/slack';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectSlackCredentials}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Slack bot tokens are always app-scoped, so `subject`
+ * is pinned to `{ type: "app" }` by this helper and cannot be
+ * overridden.
+ */
+export type ConnectSlackCredentialsParams = Omit<ConnectTokenParams, 'subject'>;
 /**
  * Build {@link SlackChannelCredentials} backed by a Vercel Connect
  * connector that stores a Slack workspace's bot token.
@@ -13,6 +23,10 @@ import type { SlackChannelCredentials } from 'experimental-ash/channels/slack';
  * with `subject: { type: "app" }`. End-user identity (per-user OAuth
  * into Slack) is a separate concern handled elsewhere.
  *
+ * The optional `params` and `options` arguments mirror the signature
+ * of {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ *
  * ```ts
  * import { slackRoute } from "experimental-ash/channels/slack";
  * import { connectSlackCredentials } from "@vercel/connect/ash";
@@ -21,5 +35,12 @@ import type { SlackChannelCredentials } from 'experimental-ash/channels/slack';
  *   credentials: connectSlackCredentials("scl_..."),
  * });
  * ```
+ *
+ * Multi-workspace deployments can select a specific workspace install
+ * via `installationId`:
+ *
+ * ```ts
+ * connectSlackCredentials("scl_...", { installationId: workspaceId });
+ * ```
  */
-export declare function connectSlackCredentials(connector: string): SlackChannelCredentials;
+export declare function connectSlackCredentials(connector: string, params?: ConnectSlackCredentialsParams, options?: ConnectOptions): SlackChannelCredentials;

package/dist/ash/slack-credentials.js

@@ -1,4 +1,4 @@
-import { getToken } from '../index.js';
+import { getToken, } from '../index.js';
 import { vercelOidc } from 'experimental-ash/channels/auth';
 /**
  * Build {@link SlackChannelCredentials} backed by a Vercel Connect
@@ -14,6 +14,10 @@ import { vercelOidc } from 'experimental-ash/channels/auth';
  * with `subject: { type: "app" }`. End-user identity (per-user OAuth
  * into Slack) is a separate concern handled elsewhere.
  *
+ * The optional `params` and `options` arguments mirror the signature
+ * of {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ *
  * ```ts
  * import { slackRoute } from "experimental-ash/channels/slack";
  * import { connectSlackCredentials } from "@vercel/connect/ash";
@@ -22,10 +26,17 @@ import { vercelOidc } from 'experimental-ash/channels/auth';
  *   credentials: connectSlackCredentials("scl_..."),
  * });
  * ```
+ *
+ * Multi-workspace deployments can select a specific workspace install
+ * via `installationId`:
+ *
+ * ```ts
+ * connectSlackCredentials("scl_...", { installationId: workspaceId });
+ * ```
  */
-export function connectSlackCredentials(connector) {
+export function connectSlackCredentials(connector, params = {}, options) {
     return {
-        botToken: () => getToken(connector, { subject: { type: 'app' } }),
+        botToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
         webhookVerifier: vercelOidc(),
     };
 }

package/dist/authorization-details.d.ts

@@ -0,0 +1,11 @@
+export type ConnectAuthorizationDetail = ConnectGitHubAppInstallationAuthorizationDetail | ConnectCustomAuthorizationDetail;
+export interface ConnectCustomAuthorizationDetail {
+    type: string;
+    [key: string]: unknown;
+}
+export interface ConnectGitHubAppInstallationAuthorizationDetail {
+    type: 'github_app_installation';
+    org?: string;
+    permissions?: string | string[];
+    repositories?: string | string[];
+}

package/dist/authorization-details.js

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -1,2 +1,3 @@
-export { getToken, getTokenResponse, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectVendorErrorPayload, } from './token.js';
+export { getToken, getTokenResponse, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from './token.js';
 export { startAuthorization, type ConnectAuthorizationOptions, type ConnectAuthorizationResponse, } from './authorization.js';
+export type { ConnectAuthorizationDetail } from './authorization-details.js';

package/dist/token.d.ts

@@ -1,18 +1,30 @@
+import type { ConnectAuthorizationDetail } from './authorization-details.js';
+export type ConnectSubjectType = 'app' | 'user' | 'jwt-bearer';
+export type ConnectTokenSubject = ConnectAppTokenSubject | ConnectUserTokenSubject | ConnectJwtBearerTokenSubject;
+export interface ConnectAppTokenSubject {
+    type: 'app';
+}
+export interface ConnectUserTokenSubject {
+    type: 'user';
+    id: string;
+    issuer?: string;
+}
+export interface ConnectJwtBearerTokenSubject {
+    type: 'jwt-bearer';
+    sub: string;
+    /** Defaults to the connector's OAuth client id. */
+    iss?: string;
+    /** Defaults to the connector's OAuth token endpoint. */
+    aud?: string;
+    additionalClaims?: Record<string, unknown>;
+}
 export interface ConnectTokenParams {
-    subject: {
-        type: 'app';
-    } | {
-        type: 'user';
-        id: string;
-        issuer?: string;
-    };
+    subject: ConnectTokenSubject;
     installationId?: string;
     audience?: string[];
     scopes?: string[];
     resources?: string[];
-    authorizationDetails?: Array<{
-        type: string;
-    } & Record<string, unknown>>;
+    authorizationDetails?: ConnectAuthorizationDetail[];
     /**
      * Buffer time in milliseconds before token expiration to consider it invalid.
      * If the token expires within this buffer, it will be refreshed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {