@vercel/connect 0.2.0 → 0.2.2

package/README.md

@@ -97,4 +97,4 @@ import { connect } from '@vercel/connect/authjs';
 const providers = [connect({ connector: 'linear' })];
 ```
 
-See the source under `src/` for the full API (additional helpers like `getTokenResponse`, `startAuthorization`, typed error classes, and per-adapter options).
+See the source under `src/` for the full API (additional helpers like `revokeToken`, `getTokenResponse`, `startAuthorization`, typed error classes, and per-adapter options).

package/dist/eve/connection-authorization.d.ts

@@ -82,6 +82,25 @@ export interface EveAuthorizationOptions {
      * and rely on `@vercel/oidc` auto-discovery.
      */
     readonly connectOptions?: ConnectOptions;
+    /**
+     * Re-validate the grant against Vercel Connect on every `getToken`
+     * instead of trusting the in-process token cache.
+     *
+     * By default `getToken` returns a cached token as long as it has not
+     * expired, so a grant the user revoked server-side keeps reaching the
+     * tool until the bearer's natural expiry. With `validate: true` each
+     * `getToken` bypasses the local cache and re-checks Connect; a revoked
+     * grant comes back as `no_token` / `user_authorization_required`, which
+     * the adapter maps to {@link ConnectionAuthorizationRequiredError} so
+     * Eve re-runs the consent flow rather than calling the tool with a dead
+     * token.
+     *
+     * This trades a Connect round trip per call for freshness — leave it
+     * off for high-frequency tools where a short revocation window is
+     * acceptable, and turn it on for sensitive actions (payments, deletes,
+     * privileged writes) that must never run on a revoked grant.
+     */
+    readonly validate?: boolean;
     /**
      * Custom call-to-action rendered on the
      * `connection.authorization_required` event. When omitted, Eve

package/dist/eve/connection-authorization.js

@@ -50,7 +50,7 @@ function buildInteractiveDefinition(options) {
         principalType: 'user',
         async getToken({ principal }) {
             try {
-                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -118,7 +118,7 @@ function buildNonInteractiveDefinition(options) {
         principalType: 'app',
         async getToken({ principal }) {
             try {
-                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -127,6 +127,18 @@ function buildNonInteractiveDefinition(options) {
         },
     };
 }
+/**
+ * Connect SDK options for `getToken` calls. When {@link
+ * EveAuthorizationOptions.validate} is set, forces a cache-bypassing
+ * re-fetch so a revoked-but-unexpired grant is caught instead of served
+ * from the in-process token cache.
+ */
+function getTokenConnectOptions(options) {
+    if (!options.validate) {
+        return options.connectOptions;
+    }
+    return { ...options.connectOptions, forceRefresh: true };
+}
 async function buildTokenParams(options, principal) {
     const toSubject = options.principalToSubject ?? principalToSubject;
     return {

package/dist/eve/github-credentials.d.ts

@@ -0,0 +1,24 @@
+import type { GitHubChannelCredentials } from 'eve/channels/github';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectGitHubCredentials}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — GitHub installation tokens are app-scoped, so `subject`
+ * is pinned to `{ type: "app" }` by this helper and cannot be
+ * overridden.
+ */
+export type ConnectGitHubCredentialsParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build {@link GitHubChannelCredentials} backed by a Vercel Connect
+ * connector that stores a GitHub installation access token.
+ *
+ * Eve uses `installationToken` directly for authenticated GitHub API
+ * calls and skips its native GitHub App JWT exchange. The token is a
+ * function form so rotation, refresh, and multi-installation tenancy
+ * stay delegated to Vercel Connect.
+ *
+ * The webhook verifier accepts Connect-forwarded webhooks authenticated
+ * with Vercel OIDC instead of GitHub's webhook secret.
+ */
+export declare function connectGitHubCredentials(connector: string, params?: ConnectGitHubCredentialsParams, options?: ConnectOptions): GitHubChannelCredentials;

package/dist/eve/github-credentials.js

@@ -0,0 +1,20 @@
+import { vercelOidc } from 'eve/channels/auth';
+import { getToken, } from '../index.js';
+/**
+ * Build {@link GitHubChannelCredentials} backed by a Vercel Connect
+ * connector that stores a GitHub installation access token.
+ *
+ * Eve uses `installationToken` directly for authenticated GitHub API
+ * calls and skips its native GitHub App JWT exchange. The token is a
+ * function form so rotation, refresh, and multi-installation tenancy
+ * stay delegated to Vercel Connect.
+ *
+ * The webhook verifier accepts Connect-forwarded webhooks authenticated
+ * with Vercel OIDC instead of GitHub's webhook secret.
+ */
+export function connectGitHubCredentials(connector, params = {}, options) {
+    return {
+        installationToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: vercelOidc(),
+    };
+}

package/dist/eve/index.d.ts

@@ -8,4 +8,6 @@
  */
 export { connect, type EveAuthorizationInput, type EveAuthorizationOptions, type EveConnectAuthorizationDefinition, type ConnectAuthorizationPhase, type VercelConnectMetadata, } from './connection-authorization.js';
 export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from './connect-oauth.js';
-export { connectSlackCredentials } from './slack-credentials.js';
+export { connectGitHubCredentials, type ConnectGitHubCredentialsParams, } from './github-credentials.js';
+export { connectLinearCredentials, type ConnectLinearCredentialsParams, } from './linear-credentials.js';
+export { connectSlackCredentials, type ConnectSlackCredentialsParams, } from './slack-credentials.js';

package/dist/eve/index.js

@@ -8,4 +8,6 @@
  */
 export { connect, } from './connection-authorization.js';
 export { CONNECT_OAUTH_ISSUER, connectOAuth, } from './connect-oauth.js';
-export { connectSlackCredentials } from './slack-credentials.js';
+export { connectGitHubCredentials, } from './github-credentials.js';
+export { connectLinearCredentials, } from './linear-credentials.js';
+export { connectSlackCredentials, } from './slack-credentials.js';

package/dist/eve/linear-credentials.d.ts

@@ -0,0 +1,22 @@
+import type { LinearChannelCredentials } from 'eve/channels/linear';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectLinearCredentials}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Linear Agent tokens are app-scoped, so `subject` is
+ * pinned to `{ type: "app" }` by this helper and cannot be overridden.
+ */
+export type ConnectLinearCredentialsParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build {@link LinearChannelCredentials} backed by a Vercel Connect
+ * connector that stores a Linear app access token.
+ *
+ * Eve uses `accessToken` for Linear GraphQL calls. The token is a
+ * function form so rotation, refresh, and multi-workspace tenancy stay
+ * delegated to Vercel Connect.
+ *
+ * The webhook verifier accepts Connect-forwarded webhooks authenticated
+ * with Vercel OIDC instead of Linear's webhook secret.
+ */
+export declare function connectLinearCredentials(connector: string, params?: ConnectLinearCredentialsParams, options?: ConnectOptions): LinearChannelCredentials;

package/dist/eve/linear-credentials.js

@@ -0,0 +1,19 @@
+import { vercelOidc } from 'eve/channels/auth';
+import { getToken, } from '../index.js';
+/**
+ * Build {@link LinearChannelCredentials} backed by a Vercel Connect
+ * connector that stores a Linear app access token.
+ *
+ * Eve uses `accessToken` for Linear GraphQL calls. The token is a
+ * function form so rotation, refresh, and multi-workspace tenancy stay
+ * delegated to Vercel Connect.
+ *
+ * The webhook verifier accepts Connect-forwarded webhooks authenticated
+ * with Vercel OIDC instead of Linear's webhook secret.
+ */
+export function connectLinearCredentials(connector, params = {}, options) {
+    return {
+        accessToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: vercelOidc(),
+    };
+}

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { getToken, getTokenResponse, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from './token.js';
+export { getToken, getTokenResponse, revokeToken, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, type ConnectErrorOptions, type ConnectOptions, type ConnectTokenParams, type ConnectTokenResponse, type ConnectTokenSubject, type ConnectVendorErrorPayload, } from './token.js';
 export { startAuthorization, type ConnectAuthorizationOptions, type ConnectAuthorizationResponse, } from './authorization.js';
 export type { ConnectAuthorizationDetail } from './authorization-details.js';

package/dist/index.js

@@ -1,2 +1,2 @@
-export { getToken, getTokenResponse, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, } from './token.js';
+export { getToken, getTokenResponse, revokeToken, ConnectError, NoValidTokenError, UserAuthorizationRequiredError, ConnectorInstallationRequiredError, } from './token.js';
 export { startAuthorization, } from './authorization.js';

package/dist/token.d.ts

@@ -22,6 +22,10 @@ export interface ConnectTokenParams {
     subject: ConnectTokenSubject;
     installationId?: string;
     audience?: string[];
+    /**
+     * Access scopes to request. Use `['*']` to request the default scopes for
+     * the specified subject type.
+     */
     scopes?: string[];
     resources?: string[];
     authorizationDetails?: ConnectAuthorizationDetail[];
@@ -76,7 +80,23 @@ export declare class ConnectorInstallationRequiredError extends ConnectError {
 }
 export interface ConnectOptions {
     vercelToken?: string;
+    /**
+     * Bypass the in-process token cache and re-fetch from Vercel Connect.
+     *
+     * The cache normally serves any token that is not within
+     * {@link ConnectTokenParams.validityBufferMs} of expiry. That means a
+     * grant the user revoked server-side keeps being handed back from the
+     * local cache until it expires. Set `forceRefresh` when the caller
+     * needs Connect to re-validate the grant on this call — a revoked grant
+     * then surfaces as `no_token` / `user_authorization_required` instead of
+     * a stale bearer.
+     */
+    forceRefresh?: boolean;
 }
 export declare function getToken(connector: string, params: ConnectTokenParams, options?: ConnectOptions): Promise<string>;
 export declare function getTokenResponse(connector: string, params: ConnectTokenParams, options?: ConnectOptions): Promise<ConnectTokenResponse>;
+export declare function revokeToken(connector: string, params: {
+    subject: ConnectTokenSubject;
+    installationId?: string;
+}, options?: ConnectOptions): Promise<void>;
 export declare function createConnectErrorFromResponse(response: Response, fallbackMessage: string): Promise<ConnectError>;

package/dist/token.js

@@ -38,15 +38,20 @@ export async function getToken(connector, params, options) {
 export async function getTokenResponse(connector, params, options) {
     const bufferMs = params.validityBufferMs ?? DEFAULT_VALIDITY_BUFFER_MS;
     const cacheKey = JSON.stringify({ connector, ...params });
-    const cached = cache.get(cacheKey);
-    if (cached) {
-        const now = Date.now();
-        if (cached.response.expiresAt - now > bufferMs) {
-            cached.lastUsed = now;
-            return cached.response;
-        }
+    if (options?.forceRefresh) {
         cache.delete(cacheKey);
     }
+    else {
+        const cached = cache.get(cacheKey);
+        if (cached) {
+            const now = Date.now();
+            if (cached.response.expiresAt - now > bufferMs) {
+                cached.lastUsed = now;
+                return cached.response;
+            }
+            cache.delete(cacheKey);
+        }
+    }
     const vercelToken = options?.vercelToken ?? (await getVercelOidcToken());
     const endpoint = `https://api.vercel.com/v1/connect/token/${encodeURIComponent(connector)}`;
     const response = await fetch(endpoint, {
@@ -68,6 +73,23 @@ export async function getTokenResponse(connector, params, options) {
     cache.set(cacheKey, { response: data, lastUsed: Date.now() });
     return data;
 }
+export async function revokeToken(connector, params, options) {
+    const vercelToken = options?.vercelToken ?? (await getVercelOidcToken());
+    const endpoint = `https://api.vercel.com/v1/connect/connectors/${encodeURIComponent(connector)}/tokens`;
+    const response = await fetch(endpoint, {
+        method: 'DELETE',
+        headers: {
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${vercelToken}`,
+        },
+        body: JSON.stringify(params),
+    });
+    if (!response.ok) {
+        throw await createConnectErrorFromResponse(response, 'Failed to revoke token');
+    }
+    cache.clear();
+}
 const DEFAULT_VALIDITY_BUFFER_MS = 30_000;
 const MAX_CACHE_SIZE = 100;
 const cache = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -45,7 +45,7 @@
     "@auth/core": ">=0.37.0",
     "ai": "^6 || ^7",
     "better-auth": ">=1.5.0",
-    "eve": ">=0.8.2"
+    "eve": ">=0.6.0-beta.1"
   },
   "peerDependenciesMeta": {
     "@ai-sdk/mcp": {
@@ -69,7 +69,7 @@
     "@auth/core": "0.37.4",
     "ai": "7.0.0-beta.116",
     "better-auth": "1.5.5",
-    "eve": "file:./fixtures/eve",
+    "eve": "0.6.0-beta.1",
     "typescript": "^5"
   },
   "private": false,