@vercel/connect 0.2.4 → 0.2.5

package/dist/eve/connection-authorization.d.ts

@@ -35,6 +35,23 @@ import type { ConnectOptions, ConnectTokenParams, ConnectTokenSubject } from '..
  * so consumers can branch their error translation per callback.
  */
 export type ConnectAuthorizationPhase = 'getToken' | 'startAuthorization' | 'completeAuthorization';
+/**
+ * Eve's per-connection authorization context — the `connection` argument
+ * Eve's runtime hands to every `getToken` / `startAuthorization` /
+ * `completeAuthorization` callback alongside the resolved principal.
+ * Currently carries the connection's declared server `url`; Eve documents
+ * the shape as strictly additive, so destructuring only the fields you
+ * need stays forward-compatible.
+ *
+ * eve 0.6.0-beta.1 declares this type as
+ * `ConnectionAuthorizationContext` but does not re-export it from
+ * `eve/connections` (or any other public subpath), so it is derived
+ * structurally here from the exported authorization definition — this is
+ * exactly the type Eve passes at runtime. Once eve exports the type
+ * directly, this alias can switch to a plain re-export without a
+ * breaking change.
+ */
+export type EveConnectionAuthorizationContext = Parameters<NonInteractiveAuthorizationDefinition['getToken']>[0]['connection'];
 /** Options accepted by {@link connect}. */
 export interface EveAuthorizationOptions {
     /**
@@ -69,11 +86,27 @@ export interface EveAuthorizationOptions {
      * `authorizationDetails`. Passed through verbatim.
      */
     readonly tokenParams?: Omit<ConnectTokenParams, 'subject'>;
+    /**
+     * Builds the Vercel Connect token subject from the framework-resolved
+     * principal plus the connection's authorization context (Eve's
+     * per-connection metadata — currently the declared server `url`).
+     *
+     * Needed by jwt-bearer-style connectors whose subject/assertion
+     * depends on more than the principal: custom claims, the connection
+     * URL, or an audience derived from it. Takes precedence over the
+     * deprecated {@link principalToSubject}. When neither is set, the
+     * default mapping applies — app principals map to `{ type: "app" }`
+     * and user principals map to `{ type: "user", id, issuer }`.
+     */
+    readonly createSubject?: (principal: ConnectionPrincipal, ctx: EveConnectionAuthorizationContext) => ConnectTokenSubject | Promise<ConnectTokenSubject>;
     /**
      * Override how Eve's framework-resolved principal is mapped to a
      * Vercel Connect token subject. When omitted, app principals map to
      * `{ type: "app" }` and user principals map to
      * `{ type: "user", id, issuer }`.
+     *
+     * @deprecated Use {@link createSubject}, which also receives the
+     * connection authorization context.
      */
     readonly principalToSubject?: (principal: ConnectionPrincipal) => ConnectTokenSubject | Promise<ConnectTokenSubject>;
     /**
@@ -173,9 +206,17 @@ export type EveConnectAuthorizationDefinition<TAuthorization extends Interactive
      * failed or duplicate revoke is swallowed so it never masks the error
      * that triggered eviction, and the local cache entry is dropped either
      * way.
+     *
+     * Pass `connection` (Eve's per-connection authorization context) when
+     * the connection uses {@link EveAuthorizationOptions.createSubject}:
+     * the cache entry is keyed by the resolved subject, and a
+     * context-dependent subject can only be reproduced with the context in
+     * hand. Without it, eviction falls back to the legacy
+     * principal-only mapping and may miss the entry.
      */
     readonly evict: (opts: {
         readonly principal: ConnectionPrincipal;
+        readonly connection?: EveConnectionAuthorizationContext;
         readonly revoke?: boolean;
     }) => Promise<void>;
 };

package/dist/eve/connection-authorization.js

@@ -51,8 +51,8 @@ export function connect(input) {
  * local cache drop if the revoke request fails).
  */
 function makeEvict(options) {
-    return async ({ principal, revoke }) => {
-        const params = await buildTokenParams(options, principal);
+    return async ({ principal, connection, revoke }) => {
+        const params = await buildTokenParams(options, principal, connection);
         if (revoke) {
             try {
                 // Destructive: tears down the grant at Vercel Connect (refresh
@@ -82,16 +82,16 @@ function normalizeAuthorizationOptions(input) {
 function buildInteractiveDefinition(options) {
     return {
         principalType: 'user',
-        async getToken({ principal }) {
+        async getToken({ principal, connection, }) {
             try {
-                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), getTokenConnectOptions(options));
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
                 throw translate(error, 'getToken', options);
             }
         },
-        async startAuthorization({ principal, callbackUrl, webhook, }) {
+        async startAuthorization({ principal, connection, callbackUrl, webhook, }) {
             try {
                 // Eve's `webhook` parameter is semantically a browser-redirect
                 // target — the orchestrator mints it via `createWebhook({
@@ -114,7 +114,7 @@ function buildInteractiveDefinition(options) {
                 // mints one URL, Vercel Connect redirects there" mental
                 // model. Revisit if tab-close timeouts become a real problem
                 // in production.
-                const response = await startAuthorization(options.connector, await buildTokenParams(options, principal), {
+                const response = await startAuthorization(options.connector, await buildTokenParams(options, principal, connection), {
                     ...options.connectOptions,
                     callbackUrl: callbackUrl ?? webhook,
                     deviceCode: true,
@@ -136,9 +136,9 @@ function buildInteractiveDefinition(options) {
                 throw translate(error, 'startAuthorization', options);
             }
         },
-        async completeAuthorization({ principal, }) {
+        async completeAuthorization({ principal, connection, }) {
             try {
-                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), options.connectOptions);
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -150,9 +150,9 @@ function buildInteractiveDefinition(options) {
 function buildNonInteractiveDefinition(options) {
     return {
         principalType: 'app',
-        async getToken({ principal }) {
+        async getToken({ principal, connection, }) {
             try {
-                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal), getTokenConnectOptions(options));
+                const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -173,13 +173,35 @@ function getTokenConnectOptions(options) {
     }
     return { ...options.connectOptions, forceRefresh: true };
 }
-async function buildTokenParams(options, principal) {
-    const toSubject = options.principalToSubject ?? principalToSubject;
+async function buildTokenParams(options, principal, connection) {
     return {
         ...options.tokenParams,
-        subject: await toSubject(principal),
+        subject: await resolveSubject(options, principal, connection),
     };
 }
+/**
+ * Resolves the Vercel Connect token subject for `principal`, applying
+ * the documented precedence: {@link EveAuthorizationOptions.createSubject}
+ * (when the connection context is in hand), then the deprecated
+ * {@link EveAuthorizationOptions.principalToSubject}, then the default
+ * principal mapping.
+ *
+ * Eve's runtime passes `connection` to every authorization callback, so
+ * on the `getToken` / `startAuthorization` / `completeAuthorization`
+ * paths `createSubject` always receives it. Only the adapter's own
+ * `evict` entry point may run without a context (its callers predate the
+ * context plumbing); in that case the resolution falls back past
+ * `createSubject` so eviction stays best-effort instead of throwing.
+ */
+function resolveSubject(options, principal, connection) {
+    if (options.createSubject !== undefined && connection !== undefined) {
+        return options.createSubject(principal, connection);
+    }
+    if (options.principalToSubject !== undefined) {
+        return options.principalToSubject(principal);
+    }
+    return principalToSubject(principal);
+}
 function principalToSubject(principal) {
     if (principal.type === 'app') {
         return { type: 'app' };

package/dist/eve/index.d.ts

@@ -6,7 +6,7 @@
  * this barrel re-exports the public API so consumers import
  * everything from `@vercel/connect/eve`.
  */
-export { connect, type EveAuthorizationInput, type EveAuthorizationOptions, type EveConnectAuthorizationDefinition, type ConnectAuthorizationPhase, type VercelConnectMetadata, } from './connection-authorization.js';
+export { connect, type EveAuthorizationInput, type EveAuthorizationOptions, type EveConnectAuthorizationDefinition, type EveConnectionAuthorizationContext, type ConnectAuthorizationPhase, type VercelConnectMetadata, } from './connection-authorization.js';
 export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from './connect-oauth.js';
 export { connectGitHubCredentials, type ConnectGitHubCredentialsParams, } from './github-credentials.js';
 export { connectLinearCredentials, type ConnectLinearCredentialsParams, } from './linear-credentials.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -43,7 +43,7 @@
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",
     "@auth/core": ">=0.37.0",
-    "ai": "^6 || ^7",
+    "ai": "^6 || ^7.0.0-beta.0",
     "better-auth": ">=1.5.0",
     "eve": ">=0.6.0-beta.1"
   },