@vercel/connect 0.2.8 → 0.2.10

package/README.md

@@ -68,7 +68,7 @@ SDK's `toolApproval` option or `wrapMcpTools` from `@ai-sdk/policy-opa`.
 Non-AI-SDK MCP clients (the official MCP TypeScript SDK, Mastra, etc.)
 can import the same `connectAuthProvider` from `@vercel/connect/mcp`.
 
-### Eve
+### eve
 
 ```ts
 import { defineMcpClientConnection } from 'eve/connections';
@@ -80,6 +80,10 @@ export default defineMcpClientConnection({
 });
 ```
 
+By default, `connect()` provisions or links the connector for the deploying
+Vercel project on first use. Pass `autoProvision: false` when the connector is
+managed elsewhere.
+
 ### Better Auth
 
 ```ts

package/dist/eve/connection-authorization.d.ts

@@ -115,6 +115,22 @@ export interface EveAuthorizationOptions {
      * and rely on `@vercel/oidc` auto-discovery.
      */
     readonly connectOptions?: ConnectOptions;
+    /**
+     * Create or link the declared connector against the deploying Vercel
+     * project before the first token / authorization call. Defaults to
+     * `true`.
+     *
+     * The provision request is authenticated with the deployment OIDC token
+     * and carries the eve connection's `url` plus this connector UID. Connect
+     * creates the managed OAuth connector when missing, links an existing
+     * OAuth connector when the UID already exists, and scopes the new project
+     * link to the OIDC token's environment and higher promotion targets.
+     *
+     * Set this to `false` for callers that intentionally manage the connector
+     * linkage elsewhere. Opaque connector ids (`scl_...`) and connections
+     * without a URL are skipped automatically.
+     */
+    readonly autoProvision?: boolean;
     /**
      * Re-validate the grant against Vercel Connect on every `getToken`
      * instead of trusting the in-process token cache.
@@ -170,9 +186,10 @@ export type EveAuthorizationInput = string | EveAuthorizationOptions;
  * both forms address the same connector.
  *
  * The marker is purely metadata — it does not influence the runtime
- * token-fetching behaviour, which continues to be driven by the
+ * token-fetching identity, which continues to be driven by the
  * `getToken` / `startAuthorization` / `completeAuthorization`
- * callbacks.
+ * callbacks. When auto-provisioning is enabled, the same connector value is
+ * also sent as the managed OAuth UID.
  */
 export interface VercelConnectMetadata {
     readonly connector: string;

package/dist/eve/connection-authorization.js

@@ -31,6 +31,7 @@
 import { ConnectionAuthorizationFailedError, ConnectionAuthorizationRequiredError, } from 'eve/connections';
 import { startAuthorization } from '../authorization.js';
 import { ConnectorInstallationRequiredError, deleteTokenCacheEntry, getTokenResponse, NoValidTokenError, revokeToken, UserAuthorizationRequiredError, } from '../token.js';
+import { provisionEveOAuthConnector } from './provision-oauth-connector.js';
 export function connect(input) {
     const options = normalizeAuthorizationOptions(input);
     const vercelConnect = { connector: options.connector };
@@ -84,6 +85,7 @@ function buildInteractiveDefinition(options) {
         principalType: 'user',
         async getToken({ principal, connection, }) {
             try {
+                await autoProvisionConnectorIfEnabled(options, connection);
                 const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
@@ -93,30 +95,30 @@ function buildInteractiveDefinition(options) {
         },
         async startAuthorization({ principal, connection, callbackUrl, webhook, }) {
             try {
-                // Eve's `webhook` parameter is semantically a browser-redirect
-                // target — the orchestrator mints it via `createWebhook({
-                // respondWith: buildAuthorizationCompletePage() })` so the
-                // user lands on a friendly "you can close this tab" page after
-                // consent. That maps to Vercel Connect's `callbackUrl:`
-                // semantics, which accepts both `https://` (prod) and
-                // `http://localhost` (vercel dev) — one field covers both.
+                await autoProvisionConnectorIfEnabled(options, connection);
+                // eve's `webhook` parameter is also the browser-redirect
+                // target when `callbackUrl` is absent — the orchestrator mints
+                // it via `createWebhook({ respondWith:
+                // buildAuthorizationCompletePage() })` so the user lands on a
+                // friendly "you can close this tab" page after consent. That
+                // maps to Vercel Connect's `callbackUrl:` semantics, which
+                // accepts both `https://` (prod) and `http://localhost`
+                // (vercel dev).
+                //
+                // When the eve webhook is HTTPS, also pass it as Vercel
+                // Connect's server-side completion webhook. That lets Connect
+                // resume the eve session even when the OAuth callback fails
+                // before the browser can be redirected back, such as a token
+                // exchange error after provider consent.
+                //
                 // Vercel Connect authenticates the calling Vercel project via
                 // OIDC, which is what lets per-workflow dynamic webhook URLs
                 // work without an OAuth-style redirect-URI allowlist.
-                //
-                // We don't route `https://` URLs into Vercel Connect's
-                // `webhook:` (server-POST) field, even though it would
-                // survive the user closing the consent tab right after IdP
-                // callback. That mode shows the user Vercel Connect's
-                // generic "close this window" page instead of Eve's branded
-                // landing page, and the helper would need to grow
-                // protocol-aware logic that diverges from the simple "Eve
-                // mints one URL, Vercel Connect redirects there" mental
-                // model. Revisit if tab-close timeouts become a real problem
-                // in production.
+                const completionWebhook = connectCompletionWebhook(webhook);
                 const response = await startAuthorization(options.connector, await buildTokenParams(options, principal, connection), {
                     ...options.connectOptions,
                     callbackUrl: callbackUrl ?? webhook,
+                    ...(completionWebhook ? { webhook: completionWebhook } : null),
                     deviceCode: true,
                 });
                 return {
@@ -138,6 +140,7 @@ function buildInteractiveDefinition(options) {
         },
         async completeAuthorization({ principal, connection, }) {
             try {
+                await autoProvisionConnectorIfEnabled(options, connection);
                 const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
@@ -147,11 +150,23 @@ function buildInteractiveDefinition(options) {
         },
     };
 }
+function connectCompletionWebhook(webhook) {
+    if (!webhook) {
+        return null;
+    }
+    try {
+        return new URL(webhook).protocol === 'https:' ? webhook : null;
+    }
+    catch {
+        return null;
+    }
+}
 function buildNonInteractiveDefinition(options) {
     return {
         principalType: 'app',
         async getToken({ principal, connection, }) {
             try {
+                await autoProvisionConnectorIfEnabled(options, connection);
                 const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
@@ -161,6 +176,16 @@ function buildNonInteractiveDefinition(options) {
         },
     };
 }
+async function autoProvisionConnectorIfEnabled(options, connection) {
+    if (options.autoProvision === false) {
+        return;
+    }
+    await provisionEveOAuthConnector({
+        connector: options.connector,
+        connection,
+        connectOptions: options.connectOptions,
+    });
+}
 /**
  * Connect SDK options for `getToken` calls. When {@link
  * EveAuthorizationOptions.validate} is set, forces a cache-bypassing

package/dist/eve/provision-oauth-connector.d.ts

@@ -0,0 +1,9 @@
+import type { ConnectOptions } from '../token.js';
+import type { EveConnectionAuthorizationContext } from './connection-authorization.js';
+interface ProvisionEveOAuthConnectorOptions {
+    readonly connector: string;
+    readonly connection: EveConnectionAuthorizationContext;
+    readonly connectOptions?: ConnectOptions;
+}
+export declare function provisionEveOAuthConnector({ connector, connection, connectOptions, }: ProvisionEveOAuthConnectorOptions): Promise<void>;
+export {};

package/dist/eve/provision-oauth-connector.js

@@ -0,0 +1,96 @@
+import { getVercelOidcToken } from '@vercel/oidc';
+import { ConnectError, createConnectErrorFromResponse } from '../token.js';
+const MANAGED_OAUTH_CONNECTOR_ENDPOINT = 'https://api.vercel.com/v1/connect/connectors/managed/oauth';
+const RESERVED_UID_PATTERN = /^(vc\/|[^/]*\.vercel\.com\/)/;
+const ALLOWED_RESERVED_UID_PREFIXES = ['mcp.vercel.com/'];
+const RESERVED_ID_PREFIXES = ['scl_', 'sca_', 'store_', 'ir_'];
+const INVALID_UID_CHARS = /[\s%#]/;
+const provisionCache = new Map();
+export async function provisionEveOAuthConnector({ connector, connection, connectOptions, }) {
+    const serverUrl = resolveServerUrl(connection);
+    if (serverUrl === undefined || !isProvisionableConnectorUid(connector)) {
+        return;
+    }
+    const vercelToken = connectOptions?.vercelToken ?? (await getVercelOidcToken());
+    const cacheKey = JSON.stringify({
+        connector,
+        serverUrl,
+        token: await tokenCacheKeyPart(vercelToken),
+    });
+    let promise = provisionCache.get(cacheKey);
+    if (promise === undefined) {
+        promise = provisionManagedOAuthConnector({
+            connector,
+            serverUrl,
+            vercelToken,
+        }).catch(error => {
+            if (isNonOAuthConnectorConflict(error)) {
+                return;
+            }
+            provisionCache.delete(cacheKey);
+            throw error;
+        });
+        provisionCache.set(cacheKey, promise);
+    }
+    await promise;
+}
+function resolveServerUrl(connection) {
+    const url = connection.url;
+    if (typeof url !== 'string') {
+        return undefined;
+    }
+    const trimmed = url.trim();
+    return trimmed === '' ? undefined : trimmed;
+}
+function isProvisionableConnectorUid(connector) {
+    if (connector === '' || INVALID_UID_CHARS.test(connector)) {
+        return false;
+    }
+    for (let index = 0; index < connector.length; index++) {
+        const code = connector.charCodeAt(index);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) {
+            return false;
+        }
+    }
+    const normalized = connector.toLowerCase();
+    if (RESERVED_ID_PREFIXES.some(prefix => normalized.startsWith(prefix))) {
+        return false;
+    }
+    if (RESERVED_UID_PATTERN.test(normalized) &&
+        !ALLOWED_RESERVED_UID_PREFIXES.some(prefix => normalized.startsWith(prefix))) {
+        return false;
+    }
+    return true;
+}
+async function tokenCacheKeyPart(token) {
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle) {
+        const digest = await subtle.digest('SHA-256', new TextEncoder().encode(token));
+        return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+    }
+    let hash = 2166136261;
+    for (let index = 0; index < token.length; index++) {
+        hash ^= token.charCodeAt(index);
+        hash = Math.imul(hash, 16777619);
+    }
+    return `${token.length}:${hash >>> 0}`;
+}
+function isNonOAuthConnectorConflict(error) {
+    return (error instanceof ConnectError &&
+        error.status === 409 &&
+        /not an OAuth connector/i.test(error.message));
+}
+async function provisionManagedOAuthConnector({ connector, serverUrl, vercelToken, }) {
+    const response = await fetch(MANAGED_OAUTH_CONNECTOR_ENDPOINT, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${vercelToken}`,
+        },
+        body: JSON.stringify({ serverUrl, uid: connector }),
+    });
+    if (!response.ok) {
+        throw await createConnectErrorFromResponse(response, 'Failed to provision connector');
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -38,14 +38,14 @@
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "3.7.0"
+    "@vercel/oidc": "3.7.1"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",
     "@auth/core": ">=0.37.0",
     "ai": "^6 || ^7.0.0-beta.0",
     "better-auth": ">=1.5.0",
-    "eve": ">=0.6.0-beta.1"
+    "eve": ">=0.13.7"
   },
   "peerDependenciesMeta": {
     "@ai-sdk/mcp": {