@vercel/connect 0.2.10 → 0.3.1

package/README.md

@@ -2,9 +2,10 @@
 
 SDK for obtaining scoped tokens for third-party services on behalf of apps or users. Authenticates the calling Vercel project via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc) and exchanges the OIDC token for a Vercel Connect-issued credential.
 
-Six entrypoints, all ESM:
+Seven entrypoints, all ESM:
 
 - `@vercel/connect` — core token / authorization SDK
+- `@vercel/connect/chat` — adapter helpers for the [Chat SDK](https://chat-sdk.dev) (`chat`): `connectSlackAdapter`, `connectGitHubAdapter`, `connectLinearAdapter` (no Chat SDK dependency — returns structural config)
 - `@vercel/connect/ai-sdk` — [Vercel AI SDK](https://ai-sdk.dev) glue: re-exports `connectAuthProvider` for MCP transports (optional peers: `ai`, `@ai-sdk/mcp`)
 - `@vercel/connect/mcp` — canonical MCP-spec `OAuthClientProvider` for any MCP client (optional peer: `@ai-sdk/mcp`)
 - `@vercel/connect/eve` — adapter helpers for [Eve](https://github.com/vercel/eve) connections (optional peer: `eve`)
@@ -29,6 +30,27 @@ const token = await getToken(process.env.CONNECTOR_LINEAR!, {
 });
 ```
 
+### Chat SDK
+
+Spread the helper into the matching `create*Adapter` factory. Each helper
+wires both outbound app-scoped tokens and inbound Connect trigger-forwarded
+webhook verification (Vercel OIDC), so no provider secret lives in your env.
+
+```ts
+import { createSlackAdapter } from '@chat-adapter/slack';
+import { connectSlackAdapter } from '@vercel/connect/chat';
+
+createSlackAdapter({
+  ...connectSlackAdapter('slack/acme-slack'),
+  userName: 'my-bot',
+});
+```
+
+`connectGitHubAdapter` (`installationToken`) and `connectLinearAdapter`
+(`accessToken`) follow the same shape. See the
+[Chat SDK integration guide](https://github.com/vercel/vercel/blob/main/packages/connect/docs/chat-integration.md)
+for connector setup, trigger forwarding, and per-platform examples.
+
 ### Vercel AI SDK + MCP
 
 ```ts

package/dist/chat/github-adapter.d.ts

@@ -0,0 +1,43 @@
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+import type { ConnectGitHubAdapterConfig } from './types.js';
+/**
+ * Token parameters accepted by {@link connectGitHubAdapter}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — the helper acts as the application itself, so `subject`
+ * is pinned to `{ type: "app" }` and cannot be overridden. (The issued
+ * GitHub credential is an installation-scoped access token.)
+ */
+export type ConnectGitHubAdapterParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build a GitHub adapter config fragment backed by a Vercel Connect
+ * connector that stores a GitHub installation access token.
+ *
+ * Spread the result into `createGitHubAdapter` from
+ * `@chat-adapter/github`:
+ *
+ * ```ts
+ * import { createGitHubAdapter } from "@chat-adapter/github";
+ * import { connectGitHubAdapter } from "@vercel/connect/chat";
+ *
+ * createGitHubAdapter({
+ *   ...connectGitHubAdapter("github/acme-github"),
+ *   userName: "my-bot[bot]",
+ * });
+ * ```
+ *
+ * The returned `installationToken` is the installation access token a
+ * GitHub App would normally mint via its private-key JWT exchange — the
+ * adapter uses it directly and skips that exchange. The token is a
+ * function form so rotation, refresh, and installation tenancy stay
+ * delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing GitHub's webhook-secret
+ * check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export declare function connectGitHubAdapter(connector: string, params?: ConnectGitHubAdapterParams, options?: ConnectOptions): ConnectGitHubAdapterConfig;

package/dist/chat/github-adapter.js

@@ -0,0 +1,39 @@
+import { getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a GitHub adapter config fragment backed by a Vercel Connect
+ * connector that stores a GitHub installation access token.
+ *
+ * Spread the result into `createGitHubAdapter` from
+ * `@chat-adapter/github`:
+ *
+ * ```ts
+ * import { createGitHubAdapter } from "@chat-adapter/github";
+ * import { connectGitHubAdapter } from "@vercel/connect/chat";
+ *
+ * createGitHubAdapter({
+ *   ...connectGitHubAdapter("github/acme-github"),
+ *   userName: "my-bot[bot]",
+ * });
+ * ```
+ *
+ * The returned `installationToken` is the installation access token a
+ * GitHub App would normally mint via its private-key JWT exchange — the
+ * adapter uses it directly and skips that exchange. The token is a
+ * function form so rotation, refresh, and installation tenancy stay
+ * delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing GitHub's webhook-secret
+ * check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export function connectGitHubAdapter(connector, params = {}, options) {
+    return {
+        installationToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Public surface of the `@vercel/connect/chat` subpath.
+ *
+ * Holds helpers that adapt the Vercel Connect SDK to the Chat SDK
+ * (`chat`) platform adapters. Each helper returns a config fragment you
+ * spread into the matching `create*Adapter` factory, wiring a Connect
+ * connector for both outbound tokens (`getToken`) and inbound
+ * trigger-forwarded webhooks (Vercel OIDC verification).
+ *
+ * The helpers stay decoupled from `@chat-adapter/*`: they return
+ * structural config types rather than importing the adapter packages,
+ * so this subpath has no Chat SDK dependency.
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ * });
+ * ```
+ */
+export { createConnectWebhookVerifier, type ConnectWebhookVerifier, type ConnectWebhookVerifierOptions, } from './webhook-verifier.js';
+export type { ConnectGitHubAdapterConfig, ConnectLinearAdapterConfig, ConnectTokenResolver, } from './types.js';
+export { connectSlackAdapter, type ConnectSlackAdapterConfig, type ConnectSlackAdapterParams, } from './slack-adapter.js';
+export { connectGitHubAdapter, type ConnectGitHubAdapterParams, } from './github-adapter.js';
+export { connectLinearAdapter, type ConnectLinearAdapterParams, } from './linear-adapter.js';

package/dist/chat/index.js

@@ -0,0 +1,26 @@
+/**
+ * Public surface of the `@vercel/connect/chat` subpath.
+ *
+ * Holds helpers that adapt the Vercel Connect SDK to the Chat SDK
+ * (`chat`) platform adapters. Each helper returns a config fragment you
+ * spread into the matching `create*Adapter` factory, wiring a Connect
+ * connector for both outbound tokens (`getToken`) and inbound
+ * trigger-forwarded webhooks (Vercel OIDC verification).
+ *
+ * The helpers stay decoupled from `@chat-adapter/*`: they return
+ * structural config types rather than importing the adapter packages,
+ * so this subpath has no Chat SDK dependency.
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ * });
+ * ```
+ */
+export { createConnectWebhookVerifier, } from './webhook-verifier.js';
+export { connectSlackAdapter, } from './slack-adapter.js';
+export { connectGitHubAdapter, } from './github-adapter.js';
+export { connectLinearAdapter, } from './linear-adapter.js';

package/dist/chat/linear-adapter.d.ts

@@ -0,0 +1,40 @@
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+import type { ConnectLinearAdapterConfig } from './types.js';
+/**
+ * Token parameters accepted by {@link connectLinearAdapter}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Linear app tokens are app-scoped, so `subject` is pinned
+ * to `{ type: "app" }` by this helper and cannot be overridden.
+ */
+export type ConnectLinearAdapterParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build a Linear adapter config fragment backed by a Vercel Connect
+ * connector that stores a Linear app access token.
+ *
+ * Spread the result into `createLinearAdapter` from
+ * `@chat-adapter/linear`:
+ *
+ * ```ts
+ * import { createLinearAdapter } from "@chat-adapter/linear";
+ * import { connectLinearAdapter } from "@vercel/connect/chat";
+ *
+ * createLinearAdapter({
+ *   ...connectLinearAdapter("linear/acme-linear"),
+ *   mode: "agent-sessions",
+ * });
+ * ```
+ *
+ * The returned `accessToken` is the token the adapter uses for Linear
+ * GraphQL calls. It is a function form so rotation, refresh, and
+ * multi-workspace tenancy stay delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Linear's
+ * webhook-secret check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export declare function connectLinearAdapter(connector: string, params?: ConnectLinearAdapterParams, options?: ConnectOptions): ConnectLinearAdapterConfig;

package/dist/chat/linear-adapter.js

@@ -0,0 +1,37 @@
+import { getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a Linear adapter config fragment backed by a Vercel Connect
+ * connector that stores a Linear app access token.
+ *
+ * Spread the result into `createLinearAdapter` from
+ * `@chat-adapter/linear`:
+ *
+ * ```ts
+ * import { createLinearAdapter } from "@chat-adapter/linear";
+ * import { connectLinearAdapter } from "@vercel/connect/chat";
+ *
+ * createLinearAdapter({
+ *   ...connectLinearAdapter("linear/acme-linear"),
+ *   mode: "agent-sessions",
+ * });
+ * ```
+ *
+ * The returned `accessToken` is the token the adapter uses for Linear
+ * GraphQL calls. It is a function form so rotation, refresh, and
+ * multi-workspace tenancy stay delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Linear's
+ * webhook-secret check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export function connectLinearAdapter(connector, params = {}, options) {
+    return {
+        accessToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/slack-adapter.d.ts

@@ -0,0 +1,52 @@
+import type { SlackAdapterConfig } from '@chat-adapter/slack';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectSlackAdapter}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Slack bot tokens are always app-scoped, so `subject`
+ * is pinned to `{ type: "app" }` by this helper and cannot be
+ * overridden.
+ */
+export type ConnectSlackAdapterParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Slack adapter config fragment produced by {@link connectSlackAdapter}.
+ *
+ * Derived from `@chat-adapter/slack`'s `SlackAdapterConfig` so the helper's
+ * output is type-checked against the real adapter config at compile time.
+ * `@chat-adapter/slack` is an optional peer dependency used for types only —
+ * there is no runtime dependency on the Chat SDK.
+ */
+export type ConnectSlackAdapterConfig = Required<Pick<SlackAdapterConfig, 'botToken' | 'webhookVerifier'>>;
+/**
+ * Build a Slack adapter config fragment backed by a Vercel Connect
+ * connector that stores a Slack workspace's bot token.
+ *
+ * Spread the result into `createSlackAdapter` from `@chat-adapter/slack`:
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ *   userName: "my-bot",
+ * });
+ * ```
+ *
+ * The returned `botToken` is a function form, invoked once per Slack
+ * API call so the adapter always picks up a fresh token from Vercel
+ * Connect (rotation, refresh, and multi-workspace tenancy are handled
+ * server-side). Slack bot tokens are app-scoped — one token per
+ * workspace install — so this helper calls Vercel Connect with
+ * `subject: { type: "app" }`.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Slack's signing-secret
+ * check. Omit `signingSecret` / `SLACK_SIGNING_SECRET` when using this.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export declare function connectSlackAdapter(connector: string, params?: ConnectSlackAdapterParams, options?: ConnectOptions): ConnectSlackAdapterConfig;

package/dist/chat/slack-adapter.js

@@ -0,0 +1,39 @@
+import { getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a Slack adapter config fragment backed by a Vercel Connect
+ * connector that stores a Slack workspace's bot token.
+ *
+ * Spread the result into `createSlackAdapter` from `@chat-adapter/slack`:
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ *   userName: "my-bot",
+ * });
+ * ```
+ *
+ * The returned `botToken` is a function form, invoked once per Slack
+ * API call so the adapter always picks up a fresh token from Vercel
+ * Connect (rotation, refresh, and multi-workspace tenancy are handled
+ * server-side). Slack bot tokens are app-scoped — one token per
+ * workspace install — so this helper calls Vercel Connect with
+ * `subject: { type: "app" }`.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Slack's signing-secret
+ * check. Omit `signingSecret` / `SLACK_SIGNING_SECRET` when using this.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export function connectSlackAdapter(connector, params = {}, options) {
+    return {
+        botToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/types.d.ts

@@ -0,0 +1,28 @@
+import type { ConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Function form of a Chat SDK adapter token field. The adapter invokes
+ * it per API call, so it composes naturally with Vercel Connect's
+ * short-lived tokens — each call returns a fresh token (the
+ * `@vercel/connect` SDK caches and refreshes server-side).
+ */
+export type ConnectTokenResolver = () => Promise<string>;
+/**
+ * Partial GitHub adapter config backed by Vercel Connect.
+ *
+ * Structurally matches the `installationToken` and `webhookVerifier`
+ * options of `createGitHubAdapter` from `@chat-adapter/github`.
+ */
+export interface ConnectGitHubAdapterConfig {
+    installationToken: ConnectTokenResolver;
+    webhookVerifier: ConnectWebhookVerifier;
+}
+/**
+ * Partial Linear adapter config backed by Vercel Connect.
+ *
+ * Structurally matches the `accessToken` and `webhookVerifier` options
+ * of `createLinearAdapter` from `@chat-adapter/linear`.
+ */
+export interface ConnectLinearAdapterConfig {
+    accessToken: ConnectTokenResolver;
+    webhookVerifier: ConnectWebhookVerifier;
+}

package/dist/chat/types.js

@@ -0,0 +1 @@
+export {};

package/dist/chat/webhook-verifier.d.ts

@@ -0,0 +1,51 @@
+import { verifyVercelOidcToken } from '@vercel/oidc';
+/**
+ * Webhook verifier signature used by Chat SDK adapters. Returning a
+ * truthy value marks the request as verified; throwing (or returning a
+ * falsy value) makes the adapter respond `401`.
+ *
+ * Mirrors the `webhookVerifier` option accepted by the Slack, GitHub,
+ * and Linear adapters from the `chat` package, so the helpers in this
+ * subpath stay decoupled from `@chat-adapter/*` while remaining
+ * structurally compatible.
+ */
+export type ConnectWebhookVerifier = (request: Request, body: string) => Promise<unknown> | unknown;
+/**
+ * Options forwarded to {@link verifyVercelOidcToken}. Defaults to
+ * matching `project_id` / `environment` against the current Vercel
+ * deployment's `VERCEL_PROJECT_ID` and `VERCEL_TARGET_ENV` / `VERCEL_ENV`.
+ */
+export type ConnectWebhookVerifierOptions = Parameters<typeof verifyVercelOidcToken>[1];
+/**
+ * Build a webhook verifier for Vercel Connect trigger-forwarded
+ * webhooks.
+ *
+ * When Vercel Connect forwards a verified provider webhook to your
+ * project, it attaches a Vercel OIDC token as a `Bearer` credential in
+ * the `Authorization` header. This verifier extracts that token and
+ * validates it against Vercel's JWKS via
+ * {@link verifyVercelOidcToken}, replacing the provider's native
+ * signature check (Slack signing secret, GitHub webhook secret, Linear
+ * webhook secret).
+ *
+ * Trust boundary: by default the token must be issued by
+ * `https://oidc.vercel.com` (issuer is hard-pinned) and match the
+ * current deployment's project and environment (`projectId` defaults to
+ * `VERCEL_PROJECT_ID`, `environment` to `VERCEL_TARGET_ENV` then
+ * `VERCEL_ENV`). Verification fails closed — if those values are absent
+ * and not supplied via `options`, every request is rejected. The
+ * accepted set is therefore "any Vercel OIDC token for this
+ * project + environment"; it is not pinned to a specific Connect
+ * connector or to a single deployment. To tighten or broaden it (extra
+ * audiences, multiple environments, an explicit project id), pass
+ * `options` through to {@link verifyVercelOidcToken}.
+ *
+ * Pass it as the `webhookVerifier` option to a Chat SDK adapter:
+ *
+ * ```ts
+ * createSlackAdapter({
+ *   webhookVerifier: createConnectWebhookVerifier(),
+ * });
+ * ```
+ */
+export declare function createConnectWebhookVerifier(options?: ConnectWebhookVerifierOptions): ConnectWebhookVerifier;

package/dist/chat/webhook-verifier.js

@@ -0,0 +1,47 @@
+import { verifyVercelOidcToken } from '@vercel/oidc';
+const BEARER_TOKEN_PATTERN = /^Bearer\s+(.+)$/i;
+/**
+ * Build a webhook verifier for Vercel Connect trigger-forwarded
+ * webhooks.
+ *
+ * When Vercel Connect forwards a verified provider webhook to your
+ * project, it attaches a Vercel OIDC token as a `Bearer` credential in
+ * the `Authorization` header. This verifier extracts that token and
+ * validates it against Vercel's JWKS via
+ * {@link verifyVercelOidcToken}, replacing the provider's native
+ * signature check (Slack signing secret, GitHub webhook secret, Linear
+ * webhook secret).
+ *
+ * Trust boundary: by default the token must be issued by
+ * `https://oidc.vercel.com` (issuer is hard-pinned) and match the
+ * current deployment's project and environment (`projectId` defaults to
+ * `VERCEL_PROJECT_ID`, `environment` to `VERCEL_TARGET_ENV` then
+ * `VERCEL_ENV`). Verification fails closed — if those values are absent
+ * and not supplied via `options`, every request is rejected. The
+ * accepted set is therefore "any Vercel OIDC token for this
+ * project + environment"; it is not pinned to a specific Connect
+ * connector or to a single deployment. To tighten or broaden it (extra
+ * audiences, multiple environments, an explicit project id), pass
+ * `options` through to {@link verifyVercelOidcToken}.
+ *
+ * Pass it as the `webhookVerifier` option to a Chat SDK adapter:
+ *
+ * ```ts
+ * createSlackAdapter({
+ *   webhookVerifier: createConnectWebhookVerifier(),
+ * });
+ * ```
+ */
+export function createConnectWebhookVerifier(options) {
+    return async (request, _body) => {
+        const token = request.headers
+            .get('authorization')
+            ?.match(BEARER_TOKEN_PATTERN)?.[1]
+            ?.trim();
+        if (!token) {
+            throw new Error('Missing Authorization bearer token');
+        }
+        await verifyVercelOidcToken(token, options);
+        return true;
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.2.10",
+  "version": "0.3.1",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -13,6 +13,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./chat": {
+      "types": "./dist/chat/index.d.ts",
+      "default": "./dist/chat/index.js"
+    },
     "./eve": {
       "types": "./dist/eve/index.d.ts",
       "default": "./dist/eve/index.js"
@@ -38,11 +42,12 @@
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "3.7.1"
+    "@vercel/oidc": "3.8.0"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",
     "@auth/core": ">=0.37.0",
+    "@chat-adapter/slack": "^4.0.0",
     "ai": "^6 || ^7.0.0-beta.0",
     "better-auth": ">=1.5.0",
     "eve": ">=0.13.7"
@@ -54,6 +59,9 @@
     "@auth/core": {
       "optional": true
     },
+    "@chat-adapter/slack": {
+      "optional": true
+    },
     "ai": {
       "optional": true
     },
@@ -67,6 +75,7 @@
   "devDependencies": {
     "@ai-sdk/mcp": "2.0.0-beta.37",
     "@auth/core": "0.37.4",
+    "@chat-adapter/slack": "4.31.0",
     "ai": "7.0.0-beta.116",
     "better-auth": "1.5.5",
     "eve": "0.6.0-beta.1",