@vercel/connect 0.1.2 → 0.2.0

package/README.md

@@ -2,10 +2,12 @@
 
 SDK for obtaining scoped tokens for third-party services on behalf of apps or users. Authenticates the calling Vercel project via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc) and exchanges the OIDC token for a Vercel Connect-issued credential.
 
-Four entrypoints, all ESM:
+Six entrypoints, all ESM:
 
 - `@vercel/connect` — core token / authorization SDK
-- `@vercel/connect/ash` — adapter helpers for [Ash](https://github.com/vercel/ash) connections (optional peer: `experimental-ash`)
+- `@vercel/connect/ai-sdk` — [Vercel AI SDK](https://ai-sdk.dev) glue: re-exports `connectAuthProvider` for MCP transports (optional peers: `ai`, `@ai-sdk/mcp`)
+- `@vercel/connect/mcp` — canonical MCP-spec `OAuthClientProvider` for any MCP client (optional peer: `@ai-sdk/mcp`)
+- `@vercel/connect/eve` — adapter helpers for [Eve](https://github.com/vercel/eve) connections (optional peer: `eve`)
 - `@vercel/connect/betterauth` — [Better Auth](https://www.better-auth.com/) `genericOAuth` provider (optional peer: `better-auth`)
 - `@vercel/connect/authjs` — [Auth.js](https://authjs.dev/) `OAuth2Config` provider (optional peer: `@auth/core`)
 
@@ -27,11 +29,50 @@ const token = await getToken(process.env.CONNECTOR_LINEAR!, {
 });
 ```
 
-### Ash
+### Vercel AI SDK + MCP
 
 ```ts
-import { defineMcpClientConnection } from 'experimental-ash/connections';
-import { connect } from '@vercel/connect/ash';
+import { createMCPClient } from '@ai-sdk/mcp';
+import { streamText } from 'ai';
+import {
+  connectAuthProvider,
+  ConsentRequiredError,
+} from '@vercel/connect/ai-sdk';
+
+const mcp = await createMCPClient({
+  transport: {
+    type: 'http',
+    url: 'https://mcp.linear.app',
+    authProvider: connectAuthProvider('oauth/linear', {
+      subject: { type: 'user', id: 'user_123' },
+    }),
+  },
+});
+
+try {
+  const result = await streamText({
+    model: 'openai/gpt-5.4',
+    tools: await mcp.tools(),
+    prompt,
+  });
+  return result.toUIMessageStreamResponse();
+} catch (err) {
+  if (err instanceof ConsentRequiredError) return Response.redirect(err.url);
+  throw err;
+}
+```
+
+Tool-call approval (Human-in-the-Loop) is independent of Connect — use the AI
+SDK's `toolApproval` option or `wrapMcpTools` from `@ai-sdk/policy-opa`.
+
+Non-AI-SDK MCP clients (the official MCP TypeScript SDK, Mastra, etc.)
+can import the same `connectAuthProvider` from `@vercel/connect/mcp`.
+
+### Eve
+
+```ts
+import { defineMcpClientConnection } from 'eve/connections';
+import { connect } from '@vercel/connect/eve';
 
 export default defineMcpClientConnection({
   url: 'https://mcp.linear.app/sse',

package/dist/ai-sdk/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Public surface of the `@vercel/connect/ai-sdk` subpath.
+ *
+ * Re-exports the MCP-spec `connectAuthProvider` (and its consent
+ * types) so AI SDK users have a single, ergonomic import. The
+ * provider plugs straight into `@ai-sdk/mcp`'s `createMCPClient`
+ * `authProvider` and works with AI SDK v6 and v7.
+ *
+ * Tool-call approval (Human-in-the-Loop) is intentionally not
+ * provided here — it is independent of Connect and already covered by
+ * the AI SDK's own `toolApproval` primitive (and `wrapMcpTools` in
+ * `@ai-sdk/policy-opa`). See `docs/ai-sdk-mcp-integration.md`.
+ *
+ * Both `ai` and `@ai-sdk/mcp` are optional peer dependencies:
+ * importing this entrypoint requires them to be installed in the
+ * consumer project, but the rest of `@vercel/connect` works without
+ * them.
+ *
+ * ```ts
+ * import { createMCPClient } from '@ai-sdk/mcp';
+ * import { streamText } from 'ai';
+ * import {
+ *   connectAuthProvider,
+ *   ConsentRequiredError,
+ * } from '@vercel/connect/ai-sdk';
+ *
+ * const mcpClient = await createMCPClient({
+ *   transport: {
+ *     type: 'http',
+ *     url: 'https://mcp.linear.app',
+ *     authProvider: connectAuthProvider('oauth/linear', {
+ *       subject: { type: 'user', id: userId },
+ *       scopes: ['read'],
+ *     }),
+ *   },
+ * });
+ *
+ * try {
+ *   const result = await streamText({
+ *     model: 'openai/gpt-5.4',
+ *     tools: await mcpClient.tools(),
+ *     prompt,
+ *   });
+ *   return result.toUIMessageStreamResponse();
+ * } catch (err) {
+ *   if (err instanceof ConsentRequiredError) return Response.redirect(err.url);
+ *   throw err;
+ * }
+ * ```
+ */
+export { connectAuthProvider, ConsentRequiredError, type ConnectAuthProviderOptions, type ConsentChallenge, } from '../mcp/connect-auth-provider.js';
+export { ConnectError, ConnectorInstallationRequiredError, NoValidTokenError, UserAuthorizationRequiredError, type ConnectErrorOptions, type ConnectTokenParams, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from '../token.js';

package/dist/ai-sdk/index.js

@@ -0,0 +1,52 @@
+/**
+ * Public surface of the `@vercel/connect/ai-sdk` subpath.
+ *
+ * Re-exports the MCP-spec `connectAuthProvider` (and its consent
+ * types) so AI SDK users have a single, ergonomic import. The
+ * provider plugs straight into `@ai-sdk/mcp`'s `createMCPClient`
+ * `authProvider` and works with AI SDK v6 and v7.
+ *
+ * Tool-call approval (Human-in-the-Loop) is intentionally not
+ * provided here — it is independent of Connect and already covered by
+ * the AI SDK's own `toolApproval` primitive (and `wrapMcpTools` in
+ * `@ai-sdk/policy-opa`). See `docs/ai-sdk-mcp-integration.md`.
+ *
+ * Both `ai` and `@ai-sdk/mcp` are optional peer dependencies:
+ * importing this entrypoint requires them to be installed in the
+ * consumer project, but the rest of `@vercel/connect` works without
+ * them.
+ *
+ * ```ts
+ * import { createMCPClient } from '@ai-sdk/mcp';
+ * import { streamText } from 'ai';
+ * import {
+ *   connectAuthProvider,
+ *   ConsentRequiredError,
+ * } from '@vercel/connect/ai-sdk';
+ *
+ * const mcpClient = await createMCPClient({
+ *   transport: {
+ *     type: 'http',
+ *     url: 'https://mcp.linear.app',
+ *     authProvider: connectAuthProvider('oauth/linear', {
+ *       subject: { type: 'user', id: userId },
+ *       scopes: ['read'],
+ *     }),
+ *   },
+ * });
+ *
+ * try {
+ *   const result = await streamText({
+ *     model: 'openai/gpt-5.4',
+ *     tools: await mcpClient.tools(),
+ *     prompt,
+ *   });
+ *   return result.toUIMessageStreamResponse();
+ * } catch (err) {
+ *   if (err instanceof ConsentRequiredError) return Response.redirect(err.url);
+ *   throw err;
+ * }
+ * ```
+ */
+export { connectAuthProvider, ConsentRequiredError, } from '../mcp/connect-auth-provider.js';
+export { ConnectError, ConnectorInstallationRequiredError, NoValidTokenError, UserAuthorizationRequiredError, } from '../token.js';

package/dist/authorization-details.d.ts

@@ -0,0 +1,11 @@
+export type ConnectAuthorizationDetail = ConnectGitHubAppInstallationAuthorizationDetail | ConnectCustomAuthorizationDetail;
+export interface ConnectCustomAuthorizationDetail {
+    type: string;
+    [key: string]: unknown;
+}
+export interface ConnectGitHubAppInstallationAuthorizationDetail {
+    type: 'github_app_installation';
+    org?: string;
+    permissions?: string | string[];
+    repositories?: string | string[];
+}

package/dist/authorization-details.js

@@ -0,0 +1 @@
+export {};

package/dist/{ash → eve}/connect-oauth.d.ts

@@ -1,4 +1,4 @@
-import { type AuthFn, type VerifyOidcConfig } from 'experimental-ash/channels/auth';
+import { type AuthFn, type VerifyOidcConfig } from 'eve/channels/auth';
 export declare const CONNECT_OAUTH_ISSUER = "https://connect.vercel.com";
 export type ConnectOAuthEnvironment = 'production' | 'preview' | 'development';
 export type ConnectOAuthAudienceEnvironment = ConnectOAuthEnvironment | '*';
@@ -23,7 +23,7 @@ export interface ConnectOAuthOptions {
      */
     readonly environment?: ConnectOAuthAudienceEnvironment;
     /**
-     * Optional gateway session id (`sub`) matchers. Patterns use Ash's
+     * Optional gateway session id (`sub`) matchers. Patterns use Eve's
      * IAM-style `*` wildcard matching.
      */
     readonly subjects?: readonly string[];
@@ -49,11 +49,11 @@ export interface ConnectOAuthOptions {
      * `https://connect.vercel.com/.well-known/openid-configuration`.
      */
     readonly discoveryUrl?: string;
-    /** Clock skew in seconds. Defaults to Ash's OIDC verifier default. */
+    /** Clock skew in seconds. Defaults to Eve's OIDC verifier default. */
     readonly clockSkewSeconds?: number;
 }
 /**
- * Returns an Ash route auth callback for Vercel Connect OAuth gateway
+ * Returns an Eve route auth callback for Vercel Connect OAuth gateway
  * access tokens.
  *
  * The accepted token must be a bearer JWT issued by

package/dist/{ash → eve}/connect-oauth.js

@@ -1,7 +1,7 @@
-import { extractBearerToken, verifyOidc, } from 'experimental-ash/channels/auth';
+import { extractBearerToken, verifyOidc, } from 'eve/channels/auth';
 export const CONNECT_OAUTH_ISSUER = 'https://connect.vercel.com';
 /**
- * Returns an Ash route auth callback for Vercel Connect OAuth gateway
+ * Returns an Eve route auth callback for Vercel Connect OAuth gateway
  * access tokens.
  *
  * The accepted token must be a bearer JWT issued by

package/dist/{ash → eve}/connection-authorization.d.ts

@@ -1,8 +1,8 @@
 /**
- * Ash adapter helper for `@vercel/connect`.
+ * Eve adapter helper for `@vercel/connect`.
  *
  * {@link connect} turns a Vercel Connect OAuth connector id plus a
- * principal type into a ready-made Ash
+ * principal type into a ready-made Eve
  * {@link AuthorizationDefinition} that the connection runtime
  * consumes directly. The helper collapses the ~100 lines of
  * `getToken` / `startAuthorization` / `completeAuthorization`
@@ -10,8 +10,8 @@
  * to a single call:
  *
  * ```ts
- * import { defineMcpClientConnection } from "experimental-ash/connections";
- * import { connect } from "@vercel/connect/ash";
+ * import { defineMcpClientConnection } from "eve/connections";
+ * import { connect } from "@vercel/connect/eve";
  *
  * export default defineMcpClientConnection({
  *   url: "https://mcp.linear.app/sse",
@@ -22,34 +22,21 @@
  *
  * # Module layout
  *
- * This entrypoint is exposed at the `@vercel/connect/ash` subpath so
- * consumers that don't use Ash never load it. `experimental-ash` is
+ * This entrypoint is exposed at the `@vercel/connect/eve` subpath so
+ * consumers that don't use Eve never load it. `eve` is
  * declared as an optional peer dependency: importing
- * `@vercel/connect/ash` requires Ash to be installed in the consumer
+ * `@vercel/connect/eve` requires Eve to be installed in the consumer
  * project, but the rest of `@vercel/connect` works without it.
  */
-import { type InteractiveAuthorizationDefinition, type JsonValue, type NonInteractiveAuthorizationDefinition } from 'experimental-ash/connections';
-import type { ConnectOptions, ConnectTokenParams } from '../token.js';
+import { type ConnectionPrincipal, type InteractiveAuthorizationDefinition, type NonInteractiveAuthorizationDefinition } from 'eve/connections';
+import type { ConnectOptions, ConnectTokenParams, ConnectTokenSubject } from '../token.js';
 /**
- * Authorization phase passed to {@link AshAuthorizationOptions.onError}
+ * Authorization phase passed to {@link EveAuthorizationOptions.onError}
  * so consumers can branch their error translation per callback.
  */
 export type ConnectAuthorizationPhase = 'getToken' | 'startAuthorization' | 'completeAuthorization';
-/**
- * State journaled by Ash between
- * {@link InteractiveAuthorizationDefinition.startAuthorization} and
- * {@link InteractiveAuthorizationDefinition.completeAuthorization}.
- *
- * Currently just the PKCE verifier. The index signature exists to
- * satisfy Ash's `State extends JsonValue` constraint; in practice
- * the only key the helper produces or reads is `verifier`.
- */
-export type ConnectAuthorizationState = {
-    readonly verifier: string;
-    readonly [key: string]: JsonValue;
-};
 /** Options accepted by {@link connect}. */
-export interface AshAuthorizationOptions {
+export interface EveAuthorizationOptions {
     /**
      * Vercel Connect OAuth connector identifier. Accepts either the
      * opaque service connector key (`scl_...`) or the human-readable
@@ -64,9 +51,9 @@ export interface AshAuthorizationOptions {
      * on this choice:
      *
      * - `"user"` → full interactive OAuth definition with `getToken`,
-     *   `startAuthorization`, and `completeAuthorization`. Ash will
+     *   `startAuthorization`, and `completeAuthorization`. Eve will
      *   drive a consent flow through its framework-owned webhook.
-     * - `"app"` → non-interactive definition with `getToken` only. Ash
+     * - `"app"` → non-interactive definition with `getToken` only. Eve
      *   never runs a consent flow for app-scoped connectors; a failure
      *   to fetch the token surfaces as a terminal authorization
      *   failure so the channel can prompt an operator to install the
@@ -82,6 +69,13 @@ export interface AshAuthorizationOptions {
      * `authorizationDetails`. Passed through verbatim.
      */
     readonly tokenParams?: Omit<ConnectTokenParams, 'subject'>;
+    /**
+     * Override how Eve's framework-resolved principal is mapped to a
+     * Vercel Connect token subject. When omitted, app principals map to
+     * `{ type: "app" }` and user principals map to
+     * `{ type: "user", id, issuer }`.
+     */
+    readonly principalToSubject?: (principal: ConnectionPrincipal) => ConnectTokenSubject | Promise<ConnectTokenSubject>;
     /**
      * Low-level Vercel Connect SDK options (currently `vercelToken`
      * for overriding the OIDC bearer). Most callers leave this unset
@@ -90,14 +84,14 @@ export interface AshAuthorizationOptions {
     readonly connectOptions?: ConnectOptions;
     /**
      * Custom call-to-action rendered on the
-     * `connection.authorization_required` event. When omitted, Ash
+     * `connection.authorization_required` event. When omitted, Eve
      * fills in `Authorize <ConnectionName> in your browser to continue.`
      * from the connection's filename.
      */
     readonly instructions?: string;
     /**
      * Escape hatch for turning an unexpected Vercel Connect / network
-     * error into an Ash-recognizable error. Called once per failure
+     * error into an Eve-recognizable error. Called once per failure
      * with the raw error and the phase that produced it.
      *
      * Return a new `Error` to replace the helper's default translation,
@@ -108,7 +102,7 @@ export interface AshAuthorizationOptions {
     readonly onError?: (error: unknown, phase: ConnectAuthorizationPhase) => Error | undefined;
 }
 /** Input accepted by {@link connect}. */
-export type AshAuthorizationInput = string | AshAuthorizationOptions;
+export type EveAuthorizationInput = string | EveAuthorizationOptions;
 /**
  * Structurally-readable marker exposed on every {@link connect} return
  * value so downstream tooling can detect Vercel Connect-backed
@@ -132,35 +126,35 @@ export interface VercelConnectMetadata {
     readonly connector: string;
 }
 /**
- * Augments the standard Ash authorization shape with the
+ * Augments the standard Eve authorization shape with the
  * {@link VercelConnectMetadata} marker, narrowed to whichever flavour
  * `connect()` produces.
  */
-export type AshConnectAuthorizationDefinition<TAuthorization extends InteractiveAuthorizationDefinition<ConnectAuthorizationState> | NonInteractiveAuthorizationDefinition> = TAuthorization & {
+export type EveConnectAuthorizationDefinition<TAuthorization extends InteractiveAuthorizationDefinition | NonInteractiveAuthorizationDefinition> = TAuthorization & {
     readonly vercelConnect: VercelConnectMetadata;
 };
 /**
- * Builds an Ash {@link AuthorizationDefinition} backed by Vercel
+ * Builds an Eve {@link AuthorizationDefinition} backed by Vercel
  * Connect. The return type narrows based on
- * {@link AshAuthorizationOptions.principalType}:
+ * {@link EveAuthorizationOptions.principalType}:
  *
  * - omitted or `principalType: "user"` returns an
- *   {@link InteractiveAuthorizationDefinition}; Ash drives a consent
+ *   {@link InteractiveAuthorizationDefinition}; Eve drives a consent
  *   flow through its framework-owned webhook.
  * - `principalType: "app"` returns a
- *   {@link NonInteractiveAuthorizationDefinition}; Ash never runs a
+ *   {@link NonInteractiveAuthorizationDefinition}; Eve never runs a
  *   consent flow for app-scoped connectors.
  *
  * Every returned definition also carries a {@link VercelConnectMetadata}
- * marker on its `vercelConnect` field so downstream tooling (Ash
+ * marker on its `vercelConnect` field so downstream tooling (Eve
  * compiler, dashboards) can detect Vercel Connect-backed connections
  * without inspecting closure state.
  */
-export declare function connect(connector: string): AshConnectAuthorizationDefinition<InteractiveAuthorizationDefinition<ConnectAuthorizationState>>;
-export declare function connect(options: AshAuthorizationOptions & {
+export declare function connect(connector: string): EveConnectAuthorizationDefinition<InteractiveAuthorizationDefinition>;
+export declare function connect(options: EveAuthorizationOptions & {
     readonly principalType?: 'user';
-}): AshConnectAuthorizationDefinition<InteractiveAuthorizationDefinition<ConnectAuthorizationState>>;
-export declare function connect(options: AshAuthorizationOptions & {
+}): EveConnectAuthorizationDefinition<InteractiveAuthorizationDefinition>;
+export declare function connect(options: EveAuthorizationOptions & {
     readonly principalType: 'app';
-}): AshConnectAuthorizationDefinition<NonInteractiveAuthorizationDefinition>;
-export declare function connect(options: AshAuthorizationInput): AshConnectAuthorizationDefinition<InteractiveAuthorizationDefinition<ConnectAuthorizationState> | NonInteractiveAuthorizationDefinition>;
+}): EveConnectAuthorizationDefinition<NonInteractiveAuthorizationDefinition>;
+export declare function connect(options: EveAuthorizationInput): EveConnectAuthorizationDefinition<InteractiveAuthorizationDefinition | NonInteractiveAuthorizationDefinition>;

package/dist/{ash → eve}/connection-authorization.js

@@ -1,8 +1,8 @@
 /**
- * Ash adapter helper for `@vercel/connect`.
+ * Eve adapter helper for `@vercel/connect`.
  *
  * {@link connect} turns a Vercel Connect OAuth connector id plus a
- * principal type into a ready-made Ash
+ * principal type into a ready-made Eve
  * {@link AuthorizationDefinition} that the connection runtime
  * consumes directly. The helper collapses the ~100 lines of
  * `getToken` / `startAuthorization` / `completeAuthorization`
@@ -10,8 +10,8 @@
  * to a single call:
  *
  * ```ts
- * import { defineMcpClientConnection } from "experimental-ash/connections";
- * import { connect } from "@vercel/connect/ash";
+ * import { defineMcpClientConnection } from "eve/connections";
+ * import { connect } from "@vercel/connect/eve";
  *
  * export default defineMcpClientConnection({
  *   url: "https://mcp.linear.app/sse",
@@ -22,13 +22,13 @@
  *
  * # Module layout
  *
- * This entrypoint is exposed at the `@vercel/connect/ash` subpath so
- * consumers that don't use Ash never load it. `experimental-ash` is
+ * This entrypoint is exposed at the `@vercel/connect/eve` subpath so
+ * consumers that don't use Eve never load it. `eve` is
  * declared as an optional peer dependency: importing
- * `@vercel/connect/ash` requires Ash to be installed in the consumer
+ * `@vercel/connect/eve` requires Eve to be installed in the consumer
  * project, but the rest of `@vercel/connect` works without it.
  */
-import { ConnectionAuthorizationFailedError, ConnectionAuthorizationRequiredError, } from 'experimental-ash/connections';
+import { ConnectionAuthorizationFailedError, ConnectionAuthorizationRequiredError, } from 'eve/connections';
 import { startAuthorization } from '../authorization.js';
 import { ConnectorInstallationRequiredError, getTokenResponse, NoValidTokenError, UserAuthorizationRequiredError, } from '../token.js';
 export function connect(input) {
@@ -50,7 +50,7 @@ function buildInteractiveDefinition(options) {
         principalType: 'user',
         async getToken({ principal }) {
             try {
-                const response = await getTokenResponse(options.connector, buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -59,7 +59,7 @@ function buildInteractiveDefinition(options) {
         },
         async startAuthorization({ principal, callbackUrl, webhook, }) {
             try {
-                // Ash's `webhook` parameter is semantically a browser-redirect
+                // Eve's `webhook` parameter is semantically a browser-redirect
                 // target — the orchestrator mints it via `createWebhook({
                 // respondWith: buildAuthorizationCompletePage() })` so the
                 // user lands on a friendly "you can close this tab" page after
@@ -74,13 +74,13 @@ function buildInteractiveDefinition(options) {
                 // `webhook:` (server-POST) field, even though it would
                 // survive the user closing the consent tab right after IdP
                 // callback. That mode shows the user Vercel Connect's
-                // generic "close this window" page instead of Ash's branded
+                // generic "close this window" page instead of Eve's branded
                 // landing page, and the helper would need to grow
-                // protocol-aware logic that diverges from the simple "Ash
+                // protocol-aware logic that diverges from the simple "Eve
                 // mints one URL, Vercel Connect redirects there" mental
                 // model. Revisit if tab-close timeouts become a real problem
                 // in production.
-                const response = await startAuthorization(options.connector, buildTokenParams(options, principal), {
+                const response = await startAuthorization(options.connector, await buildTokenParams(options, principal), {
                     ...options.connectOptions,
                     callbackUrl: callbackUrl ?? webhook,
                     deviceCode: true,
@@ -96,7 +96,6 @@ function buildInteractiveDefinition(options) {
                             ? { instructions: options.instructions }
                             : null),
                     },
-                    state: { verifier: response.verifier },
                 };
             }
             catch (error) {
@@ -105,7 +104,7 @@ function buildInteractiveDefinition(options) {
         },
         async completeAuthorization({ principal, }) {
             try {
-                const response = await getTokenResponse(options.connector, buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -119,7 +118,7 @@ function buildNonInteractiveDefinition(options) {
         principalType: 'app',
         async getToken({ principal }) {
             try {
-                const response = await getTokenResponse(options.connector, buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -128,10 +127,11 @@ function buildNonInteractiveDefinition(options) {
         },
     };
 }
-function buildTokenParams(options, principal) {
+async function buildTokenParams(options, principal) {
+    const toSubject = options.principalToSubject ?? principalToSubject;
     return {
         ...options.tokenParams,
-        subject: principalToSubject(principal),
+        subject: await toSubject(principal),
     };
 }
 function principalToSubject(principal) {
@@ -141,11 +141,11 @@ function principalToSubject(principal) {
     return { type: 'user', id: principal.id, issuer: principal.issuer };
 }
 /**
- * Translates raw Vercel Connect errors into Ash's public
+ * Translates raw Vercel Connect errors into Eve's public
  * {@link ConnectionAuthorizationRequiredError} /
- * {@link ConnectionAuthorizationFailedError} classes. Ash discriminates
+ * {@link ConnectionAuthorizationFailedError} classes. Eve discriminates
  * on `err.name` (not `instanceof`), so even if the consumer's bundle
- * loads a different copy of `experimental-ash` than this helper, the
+ * loads a different copy of `eve` than this helper, the
  * runtime still recognizes the throw.
  */
 function translate(error, phase, options) {
@@ -155,7 +155,7 @@ function translate(error, phase, options) {
     // `UserAuthorizationRequiredError` and `NoValidTokenError` both
     // mean "Vercel Connect has no valid credential for this principal
     // yet". For interactive (user) connectors that's recoverable via
-    // a consent flow; Ash will see the `Required` throw and drive
+    // a consent flow; Eve will see the `Required` throw and drive
     // `startAuthorization`. For app connectors it's terminal — there
     // is nobody to consent — so we surface `Failed` with
     // `retryable: false`.
@@ -169,7 +169,7 @@ function translate(error, phase, options) {
             });
         }
         if (phase === 'completeAuthorization') {
-            // The consent leg reported success (Ash would not call us
+            // The consent leg reported success (Eve would not call us
             // otherwise) but Vercel Connect still says the user is
             // unauthorized. Default to retryable so the model can
             // re-prompt; most cases (network blip, replay) resolve on
@@ -192,7 +192,7 @@ function translate(error, phase, options) {
             retryable: false,
         });
     }
-    // Every other error is re-thrown verbatim. Ash treats an unknown
+    // Every other error is re-thrown verbatim. Eve treats an unknown
     // throw from `completeAuthorization` as a retryable failure, so the
     // default behavior stays intuitive.
     return error instanceof Error ? error : new Error(String(error));

package/dist/eve/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Public surface of the `@vercel/connect/eve` subpath.
+ *
+ * Holds Eve-specific helpers that adapt the Vercel Connect SDK to
+ * Eve's connection runtime. Each helper lives in its own module;
+ * this barrel re-exports the public API so consumers import
+ * everything from `@vercel/connect/eve`.
+ */
+export { connect, type EveAuthorizationInput, type EveAuthorizationOptions, type EveConnectAuthorizationDefinition, type ConnectAuthorizationPhase, type VercelConnectMetadata, } from './connection-authorization.js';
+export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from './connect-oauth.js';
+export { connectSlackCredentials } from './slack-credentials.js';

package/dist/{ash → eve}/index.js

@@ -1,10 +1,10 @@
 /**
- * Public surface of the `@vercel/connect/ash` subpath.
+ * Public surface of the `@vercel/connect/eve` subpath.
  *
- * Holds Ash-specific helpers that adapt the Vercel Connect SDK to
- * Ash's connection runtime. Each helper lives in its own module;
+ * Holds Eve-specific helpers that adapt the Vercel Connect SDK to
+ * Eve's connection runtime. Each helper lives in its own module;
  * this barrel re-exports the public API so consumers import
- * everything from `@vercel/connect/ash`.
+ * everything from `@vercel/connect/eve`.
  */
 export { connect, } from './connection-authorization.js';
 export { CONNECT_OAUTH_ISSUER, connectOAuth, } from './connect-oauth.js';

package/dist/eve/slack-credentials.d.ts

@@ -0,0 +1,46 @@
+import type { SlackChannelCredentials } from 'eve/channels/slack';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectSlackCredentials}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Slack bot tokens are always app-scoped, so `subject`
+ * is pinned to `{ type: "app" }` by this helper and cannot be
+ * overridden.
+ */
+export type ConnectSlackCredentialsParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build {@link SlackChannelCredentials} backed by a Vercel Connect
+ * connector that stores a Slack workspace's bot token.
+ *
+ * The returned `botToken` is a function form, invoked once per
+ * inbound webhook so the chat adapter always picks up a fresh token
+ * from Vercel Connect (rotation, refresh, multi-workspace tenancy
+ * are all handled server-side).
+ *
+ * Slack bot tokens are app-scoped — one token per workspace install,
+ * shared across every end-user — so this helper calls Vercel Connect
+ * with `subject: { type: "app" }`. End-user identity (per-user OAuth
+ * into Slack) is a separate concern handled elsewhere.
+ *
+ * The optional `params` and `options` arguments mirror the signature
+ * of {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ *
+ * ```ts
+ * import { slackRoute } from "eve/channels/slack";
+ * import { connectSlackCredentials } from "@vercel/connect/eve";
+ *
+ * export default slackRoute({
+ *   credentials: connectSlackCredentials("scl_..."),
+ * });
+ * ```
+ *
+ * Multi-workspace deployments can select a specific workspace install
+ * via `installationId`:
+ *
+ * ```ts
+ * connectSlackCredentials("scl_...", { installationId: workspaceId });
+ * ```
+ */
+export declare function connectSlackCredentials(connector: string, params?: ConnectSlackCredentialsParams, options?: ConnectOptions): SlackChannelCredentials;

package/dist/{ash → eve}/slack-credentials.js

@@ -1,5 +1,5 @@
-import { getToken } from '../index.js';
-import { vercelOidc } from 'experimental-ash/channels/auth';
+import { getToken, } from '../index.js';
+import { vercelOidc } from 'eve/channels/auth';
 /**
  * Build {@link SlackChannelCredentials} backed by a Vercel Connect
  * connector that stores a Slack workspace's bot token.
@@ -14,18 +14,29 @@ import { vercelOidc } from 'experimental-ash/channels/auth';
  * with `subject: { type: "app" }`. End-user identity (per-user OAuth
  * into Slack) is a separate concern handled elsewhere.
  *
+ * The optional `params` and `options` arguments mirror the signature
+ * of {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ *
  * ```ts
- * import { slackRoute } from "experimental-ash/channels/slack";
- * import { connectSlackCredentials } from "@vercel/connect/ash";
+ * import { slackRoute } from "eve/channels/slack";
+ * import { connectSlackCredentials } from "@vercel/connect/eve";
  *
  * export default slackRoute({
  *   credentials: connectSlackCredentials("scl_..."),
  * });
  * ```
+ *
+ * Multi-workspace deployments can select a specific workspace install
+ * via `installationId`:
+ *
+ * ```ts
+ * connectSlackCredentials("scl_...", { installationId: workspaceId });
+ * ```
  */
-export function connectSlackCredentials(connector) {
+export function connectSlackCredentials(connector, params = {}, options) {
     return {
-        botToken: () => getToken(connector, { subject: { type: 'app' } }),
+        botToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
         webhookVerifier: vercelOidc(),
     };
 }

package/dist/index.d.ts

@@ -1,2 +1,3 @@
-export { getToken, getTokenResponse, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectVendorErrorPayload, } from './token.js';
+export { getToken, getTokenResponse, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from './token.js';
 export { startAuthorization, type ConnectAuthorizationOptions, type ConnectAuthorizationResponse, } from './authorization.js';
+export type { ConnectAuthorizationDetail } from './authorization-details.js';

package/dist/mcp/connect-auth-provider.d.ts

@@ -0,0 +1,99 @@
+import type { OAuthClientProvider } from '@ai-sdk/mcp';
+import { type ConnectTokenParams } from '../token.js';
+/** Options accepted by {@link connectAuthProvider}. */
+export interface ConnectAuthProviderOptions {
+    /**
+     * Override the Vercel OIDC token used to authenticate against the
+     * Connect API. Defaults to the `@vercel/oidc` resolver used by the
+     * rest of `@vercel/connect`. Useful for tests and non-Vercel
+     * runtimes.
+     *
+     * Accepts a callback because the adapter is long-lived: `tokens()`
+     * is invoked across many turns and refreshes, so a captured string
+     * would go stale. When a function is provided it is resolved at
+     * call time.
+     */
+    readonly vercelToken?: string | (() => string | Promise<string>);
+    /**
+     * Where to send the user after they finish granting access on
+     * Connect's hosted consent page. Forwarded to Connect's
+     * `startAuthorization` (as its `callbackUrl`) and also surfaced
+     * through the MCP-spec `OAuthClientProvider.redirectUrl` getter.
+     *
+     * Defaults to an empty string — Connect then falls back to the
+     * connector's server-side registered redirect.
+     */
+    readonly redirectUrl?: string;
+    /**
+     * Request the device-authorization flow when minting a consent
+     * challenge. When `true`, Connect returns a `deviceCode` (and
+     * `expiresAt`) on the {@link ConsentChallenge} for out-of-band /
+     * headless approval. Defaults to `false`.
+     */
+    readonly deviceCode?: boolean;
+    /**
+     * Called when Vercel Connect reports that the user has not yet
+     * authorized the connector. The caller decides how to surface the
+     * consent URL — `redirect()`, throw a typed error, emit a custom
+     * UI chunk, etc. If omitted, `connectAuthProvider` throws
+     * {@link ConsentRequiredError}.
+     */
+    readonly onConsentRequired?: (challenge: ConsentChallenge) => void | Promise<void>;
+}
+/**
+ * Returned to {@link ConnectAuthProviderOptions.onConsentRequired} (or
+ * raised inside {@link ConsentRequiredError}) when Connect has no
+ * cached grant for the configured subject and the caller must surface
+ * the consent URL.
+ */
+export interface ConsentChallenge {
+    readonly connector: string;
+    readonly subject: ConnectTokenParams['subject'];
+    /** Consent URL to redirect the user to. */
+    readonly url: string;
+    readonly request: string;
+    readonly verifier: string;
+    /**
+     * Device code to display to the user when Connect issues a
+     * device-flow authorization. Present only when the connector uses
+     * device flow.
+     */
+    readonly deviceCode?: string;
+    /** Epoch-ms expiry of the consent challenge, when Connect reports one. */
+    readonly expiresAt?: number;
+}
+/**
+ * Thrown by the {@link connectAuthProvider} default
+ * `onConsentRequired` handler when the user has no Connect grant for
+ * the configured subject. Catch at the boundary
+ * (`route handler` / `streamText` call site) and redirect to
+ * `error.url`.
+ */
+export declare class ConsentRequiredError extends Error {
+    readonly name = "ConsentRequiredError";
+    readonly connector: string;
+    readonly subject: ConnectTokenParams['subject'];
+    readonly url: string;
+    readonly request: string;
+    readonly verifier: string;
+    readonly deviceCode?: string;
+    readonly expiresAt?: number;
+    constructor(challenge: ConsentChallenge);
+}
+/**
+ * Builds an MCP-spec {@link OAuthClientProvider} backed by Vercel
+ * Connect. The returned object delegates `tokens()` to
+ * {@link getTokenResponse} and `redirectToAuthorization` to
+ * {@link startAuthorization}. Connect owns client registration, PKCE,
+ * state, and the callback handshake server-side, so most of the
+ * `OAuthClientProvider` surface is intentionally a no-op.
+ *
+ * @param connector Vercel Connect connector UID (e.g. `oauth/linear`)
+ *   or opaque connector id.
+ * @param params Token request parameters — always specify a
+ *   `subject`; the three subject types
+ *   (`'app'` / `'user'` / `'jwt-bearer'`) have distinct security
+ *   semantics.
+ * @param options Optional adapter behavior overrides.
+ */
+export declare function connectAuthProvider(connector: string, params: ConnectTokenParams, options?: ConnectAuthProviderOptions): OAuthClientProvider;

package/dist/mcp/connect-auth-provider.js

@@ -0,0 +1,148 @@
+import { startAuthorization } from '../authorization.js';
+import { ConnectorInstallationRequiredError, UserAuthorizationRequiredError, getTokenResponse, } from '../token.js';
+/**
+ * Thrown by the {@link connectAuthProvider} default
+ * `onConsentRequired` handler when the user has no Connect grant for
+ * the configured subject. Catch at the boundary
+ * (`route handler` / `streamText` call site) and redirect to
+ * `error.url`.
+ */
+export class ConsentRequiredError extends Error {
+    name = 'ConsentRequiredError';
+    connector;
+    subject;
+    url;
+    request;
+    verifier;
+    deviceCode;
+    expiresAt;
+    constructor(challenge) {
+        super(`Vercel Connect: user authorization required for connector "${challenge.connector}". Redirect the user to challenge.url to grant access.`);
+        this.connector = challenge.connector;
+        this.subject = challenge.subject;
+        this.url = challenge.url;
+        this.request = challenge.request;
+        this.verifier = challenge.verifier;
+        this.deviceCode = challenge.deviceCode;
+        this.expiresAt = challenge.expiresAt;
+    }
+}
+const EMPTY_CLIENT_METADATA = {
+    redirect_uris: [],
+};
+/**
+ * Builds an MCP-spec {@link OAuthClientProvider} backed by Vercel
+ * Connect. The returned object delegates `tokens()` to
+ * {@link getTokenResponse} and `redirectToAuthorization` to
+ * {@link startAuthorization}. Connect owns client registration, PKCE,
+ * state, and the callback handshake server-side, so most of the
+ * `OAuthClientProvider` surface is intentionally a no-op.
+ *
+ * @param connector Vercel Connect connector UID (e.g. `oauth/linear`)
+ *   or opaque connector id.
+ * @param params Token request parameters — always specify a
+ *   `subject`; the three subject types
+ *   (`'app'` / `'user'` / `'jwt-bearer'`) have distinct security
+ *   semantics.
+ * @param options Optional adapter behavior overrides.
+ */
+export function connectAuthProvider(connector, params, options) {
+    const redirectUrl = options?.redirectUrl ?? '';
+    async function resolveVercelToken() {
+        const { vercelToken } = options ?? {};
+        if (typeof vercelToken === 'function') {
+            return vercelToken();
+        }
+        return vercelToken;
+    }
+    return {
+        async tokens() {
+            try {
+                const vercelToken = await resolveVercelToken();
+                const response = await getTokenResponse(connector, params, vercelToken !== undefined ? { vercelToken } : undefined);
+                const expiresInSeconds = Math.max(1, Math.floor((response.expiresAt - Date.now()) / 1000));
+                return {
+                    access_token: response.token,
+                    token_type: 'Bearer',
+                    expires_in: expiresInSeconds,
+                };
+            }
+            catch (err) {
+                if (err instanceof UserAuthorizationRequiredError) {
+                    // Returning undefined lets the MCP transport's auth()
+                    // orchestrator trigger redirectToAuthorization below,
+                    // where we surface the Connect consent URL.
+                    return undefined;
+                }
+                if (err instanceof ConnectorInstallationRequiredError) {
+                    // Configuration problem, not a per-user issue. Surface
+                    // immediately rather than masking as a consent challenge.
+                    throw err;
+                }
+                throw err;
+            }
+        },
+        async redirectToAuthorization(_authorizationUrl) {
+            // The URL argument is the MCP server's discovered authorization
+            // endpoint. We ignore it — Connect has its own consent URL
+            // backed by the connector's registered OAuth client.
+            const vercelToken = await resolveVercelToken();
+            const response = await startAuthorization(connector, params, {
+                ...(vercelToken !== undefined && { vercelToken }),
+                // Forward the post-consent return URL so the user lands back
+                // in the app. Falsy (the default empty string) => Connect uses
+                // the connector's registered redirect.
+                ...(redirectUrl && { callbackUrl: redirectUrl }),
+                ...(options?.deviceCode && { deviceCode: true }),
+            });
+            const challenge = {
+                connector,
+                subject: params.subject,
+                url: response.url,
+                request: response.request,
+                verifier: response.verifier,
+                deviceCode: response.deviceCode,
+                expiresAt: response.expiresAt,
+            };
+            if (options?.onConsentRequired) {
+                await options.onConsentRequired(challenge);
+                return;
+            }
+            throw new ConsentRequiredError(challenge);
+        },
+        saveTokens(_tokens) {
+            // No-op: Connect owns token persistence server-side. The
+            // in-memory LRU cache in @vercel/connect's token module
+            // handles per-request reuse.
+        },
+        saveCodeVerifier(_codeVerifier) {
+            // No-op: Connect owns PKCE.
+        },
+        codeVerifier() {
+            // The MCP transport never reaches this when tokens() /
+            // redirectToAuthorization are wired correctly. If a future
+            // transport change starts calling it, throw loudly rather
+            // than fabricate a bogus verifier.
+            throw new Error('@vercel/connect: OAuthClientProvider.codeVerifier() is unsupported. Vercel Connect owns the PKCE flow server-side; this method should never be invoked by a correctly-configured MCP transport.');
+        },
+        get redirectUrl() {
+            // Same value forwarded to Connect as the post-consent return
+            // URL. Surfaced here to satisfy the OAuthClientProvider
+            // contract; the standard flow that reads it is never triggered.
+            return redirectUrl;
+        },
+        get clientMetadata() {
+            // Returned only during dynamic client registration, which we
+            // never trigger. A minimal but valid value satisfies the
+            // contract.
+            return EMPTY_CLIENT_METADATA;
+        },
+        clientInformation() {
+            // The connector UID stands in as the logical client id. The
+            // MCP transport uses this for cache keys and debug output;
+            // tying it to the Connect identifier is more useful than
+            // returning a synthetic value.
+            return { client_id: connector };
+        },
+    };
+}

package/dist/mcp/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Public surface of the `@vercel/connect/mcp` subpath.
+ *
+ * Holds the MCP-spec `OAuthClientProvider` adapter for Vercel
+ * Connect. Plug the returned object into any MCP client that
+ * consumes the spec — `@ai-sdk/mcp`, the official
+ * `@modelcontextprotocol/typescript-sdk`, Mastra's MCP client,
+ * etc. AI SDK consumers should import the same function from
+ * `@vercel/connect/ai-sdk` instead; that subpath re-exports from
+ * here.
+ *
+ * `@ai-sdk/mcp` is an optional peer dependency: importing this
+ * entrypoint requires it to be installed in the consumer project,
+ * but the rest of `@vercel/connect` works without it.
+ *
+ * ```ts
+ * import { createMCPClient } from '@ai-sdk/mcp';
+ * import { connectAuthProvider } from '@vercel/connect/mcp';
+ *
+ * const mcpClient = await createMCPClient({
+ *   transport: {
+ *     type: 'http',
+ *     url: 'https://mcp.linear.app',
+ *     authProvider: connectAuthProvider('oauth/linear', {
+ *       subject: { type: 'user', id: userId },
+ *       scopes: ['read'],
+ *     }),
+ *   },
+ * });
+ * ```
+ */
+export { connectAuthProvider, ConsentRequiredError, type ConnectAuthProviderOptions, type ConsentChallenge, } from './connect-auth-provider.js';
+export { ConnectError, ConnectorInstallationRequiredError, NoValidTokenError, UserAuthorizationRequiredError, type ConnectErrorOptions, type ConnectTokenParams, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from '../token.js';

package/dist/mcp/index.js

@@ -0,0 +1,33 @@
+/**
+ * Public surface of the `@vercel/connect/mcp` subpath.
+ *
+ * Holds the MCP-spec `OAuthClientProvider` adapter for Vercel
+ * Connect. Plug the returned object into any MCP client that
+ * consumes the spec — `@ai-sdk/mcp`, the official
+ * `@modelcontextprotocol/typescript-sdk`, Mastra's MCP client,
+ * etc. AI SDK consumers should import the same function from
+ * `@vercel/connect/ai-sdk` instead; that subpath re-exports from
+ * here.
+ *
+ * `@ai-sdk/mcp` is an optional peer dependency: importing this
+ * entrypoint requires it to be installed in the consumer project,
+ * but the rest of `@vercel/connect` works without it.
+ *
+ * ```ts
+ * import { createMCPClient } from '@ai-sdk/mcp';
+ * import { connectAuthProvider } from '@vercel/connect/mcp';
+ *
+ * const mcpClient = await createMCPClient({
+ *   transport: {
+ *     type: 'http',
+ *     url: 'https://mcp.linear.app',
+ *     authProvider: connectAuthProvider('oauth/linear', {
+ *       subject: { type: 'user', id: userId },
+ *       scopes: ['read'],
+ *     }),
+ *   },
+ * });
+ * ```
+ */
+export { connectAuthProvider, ConsentRequiredError, } from './connect-auth-provider.js';
+export { ConnectError, ConnectorInstallationRequiredError, NoValidTokenError, UserAuthorizationRequiredError, } from '../token.js';

package/dist/token.d.ts

@@ -1,18 +1,30 @@
+import type { ConnectAuthorizationDetail } from './authorization-details.js';
+export type ConnectSubjectType = 'app' | 'user' | 'jwt-bearer';
+export type ConnectTokenSubject = ConnectAppTokenSubject | ConnectUserTokenSubject | ConnectJwtBearerTokenSubject;
+export interface ConnectAppTokenSubject {
+    type: 'app';
+}
+export interface ConnectUserTokenSubject {
+    type: 'user';
+    id: string;
+    issuer?: string;
+}
+export interface ConnectJwtBearerTokenSubject {
+    type: 'jwt-bearer';
+    sub: string;
+    /** Defaults to the connector's OAuth client id. */
+    iss?: string;
+    /** Defaults to the connector's OAuth token endpoint. */
+    aud?: string;
+    additionalClaims?: Record<string, unknown>;
+}
 export interface ConnectTokenParams {
-    subject: {
-        type: 'app';
-    } | {
-        type: 'user';
-        id: string;
-        issuer?: string;
-    };
+    subject: ConnectTokenSubject;
     installationId?: string;
     audience?: string[];
     scopes?: string[];
     resources?: string[];
-    authorizationDetails?: Array<{
-        type: string;
-    } & Record<string, unknown>>;
+    authorizationDetails?: ConnectAuthorizationDetail[];
     /**
      * Buffer time in milliseconds before token expiration to consider it invalid.
      * If the token expires within this buffer, it will be refreshed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -13,9 +13,9 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
-    "./ash": {
-      "types": "./dist/ash/index.d.ts",
-      "default": "./dist/ash/index.js"
+    "./eve": {
+      "types": "./dist/eve/index.d.ts",
+      "default": "./dist/eve/index.js"
     },
     "./betterauth": {
       "types": "./dist/betterauth/index.d.ts",
@@ -24,34 +24,52 @@
     "./authjs": {
       "types": "./dist/authjs/index.d.ts",
       "default": "./dist/authjs/index.js"
+    },
+    "./mcp": {
+      "types": "./dist/mcp/index.d.ts",
+      "default": "./dist/mcp/index.js"
+    },
+    "./ai-sdk": {
+      "types": "./dist/ai-sdk/index.d.ts",
+      "default": "./dist/ai-sdk/index.js"
     }
   },
   "files": [
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "3.6.0"
+    "@vercel/oidc": "3.6.1"
   },
   "peerDependencies": {
+    "@ai-sdk/mcp": "^1 || ^2",
     "@auth/core": ">=0.37.0",
+    "ai": "^6 || ^7",
     "better-auth": ">=1.5.0",
-    "experimental-ash": ">=0.8.2"
+    "eve": ">=0.8.2"
   },
   "peerDependenciesMeta": {
+    "@ai-sdk/mcp": {
+      "optional": true
+    },
     "@auth/core": {
       "optional": true
     },
+    "ai": {
+      "optional": true
+    },
     "better-auth": {
       "optional": true
     },
-    "experimental-ash": {
+    "eve": {
       "optional": true
     }
   },
   "devDependencies": {
+    "@ai-sdk/mcp": "2.0.0-beta.37",
     "@auth/core": "0.37.4",
+    "ai": "7.0.0-beta.116",
     "better-auth": "1.5.5",
-    "experimental-ash": "0.31.0",
+    "eve": "file:./fixtures/eve",
     "typescript": "^5"
   },
   "private": false,
@@ -60,6 +78,9 @@
   },
   "scripts": {
     "build": "tsc",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run --config ../../vitest.config.mts",
+    "vitest-unit": "vitest run --config ../../vitest.config.mts"
   }
 }

package/dist/ash/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * Public surface of the `@vercel/connect/ash` subpath.
- *
- * Holds Ash-specific helpers that adapt the Vercel Connect SDK to
- * Ash's connection runtime. Each helper lives in its own module;
- * this barrel re-exports the public API so consumers import
- * everything from `@vercel/connect/ash`.
- */
-export { connect, type AshAuthorizationInput, type AshAuthorizationOptions, type AshConnectAuthorizationDefinition, type ConnectAuthorizationPhase, type ConnectAuthorizationState, type VercelConnectMetadata, } from './connection-authorization.js';
-export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from './connect-oauth.js';
-export { connectSlackCredentials } from './slack-credentials.js';

package/dist/ash/slack-credentials.d.ts

@@ -1,25 +0,0 @@
-import type { SlackChannelCredentials } from 'experimental-ash/channels/slack';
-/**
- * Build {@link SlackChannelCredentials} backed by a Vercel Connect
- * connector that stores a Slack workspace's bot token.
- *
- * The returned `botToken` is a function form, invoked once per
- * inbound webhook so the chat adapter always picks up a fresh token
- * from Vercel Connect (rotation, refresh, multi-workspace tenancy
- * are all handled server-side).
- *
- * Slack bot tokens are app-scoped — one token per workspace install,
- * shared across every end-user — so this helper calls Vercel Connect
- * with `subject: { type: "app" }`. End-user identity (per-user OAuth
- * into Slack) is a separate concern handled elsewhere.
- *
- * ```ts
- * import { slackRoute } from "experimental-ash/channels/slack";
- * import { connectSlackCredentials } from "@vercel/connect/ash";
- *
- * export default slackRoute({
- *   credentials: connectSlackCredentials("scl_..."),
- * });
- * ```
- */
-export declare function connectSlackCredentials(connector: string): SlackChannelCredentials;