@vercel/connect 0.2.9 → 0.3.0

package/README.md

@@ -2,9 +2,10 @@
 
 SDK for obtaining scoped tokens for third-party services on behalf of apps or users. Authenticates the calling Vercel project via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc) and exchanges the OIDC token for a Vercel Connect-issued credential.
 
-Six entrypoints, all ESM:
+Seven entrypoints, all ESM:
 
 - `@vercel/connect` — core token / authorization SDK
+- `@vercel/connect/chat` — adapter helpers for the [Chat SDK](https://chat-sdk.dev) (`chat`): `connectSlackAdapter`, `connectGitHubAdapter`, `connectLinearAdapter` (no Chat SDK dependency — returns structural config)
 - `@vercel/connect/ai-sdk` — [Vercel AI SDK](https://ai-sdk.dev) glue: re-exports `connectAuthProvider` for MCP transports (optional peers: `ai`, `@ai-sdk/mcp`)
 - `@vercel/connect/mcp` — canonical MCP-spec `OAuthClientProvider` for any MCP client (optional peer: `@ai-sdk/mcp`)
 - `@vercel/connect/eve` — adapter helpers for [Eve](https://github.com/vercel/eve) connections (optional peer: `eve`)
@@ -29,6 +30,27 @@ const token = await getToken(process.env.CONNECTOR_LINEAR!, {
 });
 ```
 
+### Chat SDK
+
+Spread the helper into the matching `create*Adapter` factory. Each helper
+wires both outbound app-scoped tokens and inbound Connect trigger-forwarded
+webhook verification (Vercel OIDC), so no provider secret lives in your env.
+
+```ts
+import { createSlackAdapter } from '@chat-adapter/slack';
+import { connectSlackAdapter } from '@vercel/connect/chat';
+
+createSlackAdapter({
+  ...connectSlackAdapter('slack/acme-slack'),
+  userName: 'my-bot',
+});
+```
+
+`connectGitHubAdapter` (`installationToken`) and `connectLinearAdapter`
+(`accessToken`) follow the same shape. See the
+[Chat SDK integration guide](https://github.com/vercel/vercel/blob/main/packages/connect/docs/chat-integration.md)
+for connector setup, trigger forwarding, and per-platform examples.
+
 ### Vercel AI SDK + MCP
 
 ```ts
@@ -68,7 +90,7 @@ SDK's `toolApproval` option or `wrapMcpTools` from `@ai-sdk/policy-opa`.
 Non-AI-SDK MCP clients (the official MCP TypeScript SDK, Mastra, etc.)
 can import the same `connectAuthProvider` from `@vercel/connect/mcp`.
 
-### Eve
+### eve
 
 ```ts
 import { defineMcpClientConnection } from 'eve/connections';
@@ -80,6 +102,10 @@ export default defineMcpClientConnection({
 });
 ```
 
+By default, `connect()` provisions or links the connector for the deploying
+Vercel project on first use. Pass `autoProvision: false` when the connector is
+managed elsewhere.
+
 ### Better Auth
 
 ```ts

package/dist/chat/github-adapter.d.ts

@@ -0,0 +1,43 @@
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+import type { ConnectGitHubAdapterConfig } from './types.js';
+/**
+ * Token parameters accepted by {@link connectGitHubAdapter}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — the helper acts as the application itself, so `subject`
+ * is pinned to `{ type: "app" }` and cannot be overridden. (The issued
+ * GitHub credential is an installation-scoped access token.)
+ */
+export type ConnectGitHubAdapterParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build a GitHub adapter config fragment backed by a Vercel Connect
+ * connector that stores a GitHub installation access token.
+ *
+ * Spread the result into `createGitHubAdapter` from
+ * `@chat-adapter/github`:
+ *
+ * ```ts
+ * import { createGitHubAdapter } from "@chat-adapter/github";
+ * import { connectGitHubAdapter } from "@vercel/connect/chat";
+ *
+ * createGitHubAdapter({
+ *   ...connectGitHubAdapter("github/acme-github"),
+ *   userName: "my-bot[bot]",
+ * });
+ * ```
+ *
+ * The returned `installationToken` is the installation access token a
+ * GitHub App would normally mint via its private-key JWT exchange — the
+ * adapter uses it directly and skips that exchange. The token is a
+ * function form so rotation, refresh, and installation tenancy stay
+ * delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing GitHub's webhook-secret
+ * check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export declare function connectGitHubAdapter(connector: string, params?: ConnectGitHubAdapterParams, options?: ConnectOptions): ConnectGitHubAdapterConfig;

package/dist/chat/github-adapter.js

@@ -0,0 +1,39 @@
+import { getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a GitHub adapter config fragment backed by a Vercel Connect
+ * connector that stores a GitHub installation access token.
+ *
+ * Spread the result into `createGitHubAdapter` from
+ * `@chat-adapter/github`:
+ *
+ * ```ts
+ * import { createGitHubAdapter } from "@chat-adapter/github";
+ * import { connectGitHubAdapter } from "@vercel/connect/chat";
+ *
+ * createGitHubAdapter({
+ *   ...connectGitHubAdapter("github/acme-github"),
+ *   userName: "my-bot[bot]",
+ * });
+ * ```
+ *
+ * The returned `installationToken` is the installation access token a
+ * GitHub App would normally mint via its private-key JWT exchange — the
+ * adapter uses it directly and skips that exchange. The token is a
+ * function form so rotation, refresh, and installation tenancy stay
+ * delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing GitHub's webhook-secret
+ * check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export function connectGitHubAdapter(connector, params = {}, options) {
+    return {
+        installationToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Public surface of the `@vercel/connect/chat` subpath.
+ *
+ * Holds helpers that adapt the Vercel Connect SDK to the Chat SDK
+ * (`chat`) platform adapters. Each helper returns a config fragment you
+ * spread into the matching `create*Adapter` factory, wiring a Connect
+ * connector for both outbound tokens (`getToken`) and inbound
+ * trigger-forwarded webhooks (Vercel OIDC verification).
+ *
+ * The helpers stay decoupled from `@chat-adapter/*`: they return
+ * structural config types rather than importing the adapter packages,
+ * so this subpath has no Chat SDK dependency.
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ * });
+ * ```
+ */
+export { createConnectWebhookVerifier, type ConnectWebhookVerifier, type ConnectWebhookVerifierOptions, } from './webhook-verifier.js';
+export type { ConnectGitHubAdapterConfig, ConnectLinearAdapterConfig, ConnectTokenResolver, } from './types.js';
+export { connectSlackAdapter, type ConnectSlackAdapterConfig, type ConnectSlackAdapterParams, } from './slack-adapter.js';
+export { connectGitHubAdapter, type ConnectGitHubAdapterParams, } from './github-adapter.js';
+export { connectLinearAdapter, type ConnectLinearAdapterParams, } from './linear-adapter.js';

package/dist/chat/index.js

@@ -0,0 +1,26 @@
+/**
+ * Public surface of the `@vercel/connect/chat` subpath.
+ *
+ * Holds helpers that adapt the Vercel Connect SDK to the Chat SDK
+ * (`chat`) platform adapters. Each helper returns a config fragment you
+ * spread into the matching `create*Adapter` factory, wiring a Connect
+ * connector for both outbound tokens (`getToken`) and inbound
+ * trigger-forwarded webhooks (Vercel OIDC verification).
+ *
+ * The helpers stay decoupled from `@chat-adapter/*`: they return
+ * structural config types rather than importing the adapter packages,
+ * so this subpath has no Chat SDK dependency.
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ * });
+ * ```
+ */
+export { createConnectWebhookVerifier, } from './webhook-verifier.js';
+export { connectSlackAdapter, } from './slack-adapter.js';
+export { connectGitHubAdapter, } from './github-adapter.js';
+export { connectLinearAdapter, } from './linear-adapter.js';

package/dist/chat/linear-adapter.d.ts

@@ -0,0 +1,40 @@
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+import type { ConnectLinearAdapterConfig } from './types.js';
+/**
+ * Token parameters accepted by {@link connectLinearAdapter}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Linear app tokens are app-scoped, so `subject` is pinned
+ * to `{ type: "app" }` by this helper and cannot be overridden.
+ */
+export type ConnectLinearAdapterParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Build a Linear adapter config fragment backed by a Vercel Connect
+ * connector that stores a Linear app access token.
+ *
+ * Spread the result into `createLinearAdapter` from
+ * `@chat-adapter/linear`:
+ *
+ * ```ts
+ * import { createLinearAdapter } from "@chat-adapter/linear";
+ * import { connectLinearAdapter } from "@vercel/connect/chat";
+ *
+ * createLinearAdapter({
+ *   ...connectLinearAdapter("linear/acme-linear"),
+ *   mode: "agent-sessions",
+ * });
+ * ```
+ *
+ * The returned `accessToken` is the token the adapter uses for Linear
+ * GraphQL calls. It is a function form so rotation, refresh, and
+ * multi-workspace tenancy stay delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Linear's
+ * webhook-secret check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export declare function connectLinearAdapter(connector: string, params?: ConnectLinearAdapterParams, options?: ConnectOptions): ConnectLinearAdapterConfig;

package/dist/chat/linear-adapter.js

@@ -0,0 +1,37 @@
+import { getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a Linear adapter config fragment backed by a Vercel Connect
+ * connector that stores a Linear app access token.
+ *
+ * Spread the result into `createLinearAdapter` from
+ * `@chat-adapter/linear`:
+ *
+ * ```ts
+ * import { createLinearAdapter } from "@chat-adapter/linear";
+ * import { connectLinearAdapter } from "@vercel/connect/chat";
+ *
+ * createLinearAdapter({
+ *   ...connectLinearAdapter("linear/acme-linear"),
+ *   mode: "agent-sessions",
+ * });
+ * ```
+ *
+ * The returned `accessToken` is the token the adapter uses for Linear
+ * GraphQL calls. It is a function form so rotation, refresh, and
+ * multi-workspace tenancy stay delegated to Vercel Connect.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Linear's
+ * webhook-secret check.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export function connectLinearAdapter(connector, params = {}, options) {
+    return {
+        accessToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/slack-adapter.d.ts

@@ -0,0 +1,52 @@
+import type { SlackAdapterConfig } from '@chat-adapter/slack';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectSlackAdapter}.
+ *
+ * Mirrors {@link ConnectTokenParams} from `@vercel/connect`, minus
+ * `subject` — Slack bot tokens are always app-scoped, so `subject`
+ * is pinned to `{ type: "app" }` by this helper and cannot be
+ * overridden.
+ */
+export type ConnectSlackAdapterParams = Omit<ConnectTokenParams, 'subject'>;
+/**
+ * Slack adapter config fragment produced by {@link connectSlackAdapter}.
+ *
+ * Derived from `@chat-adapter/slack`'s `SlackAdapterConfig` so the helper's
+ * output is type-checked against the real adapter config at compile time.
+ * `@chat-adapter/slack` is an optional peer dependency used for types only —
+ * there is no runtime dependency on the Chat SDK.
+ */
+export type ConnectSlackAdapterConfig = Required<Pick<SlackAdapterConfig, 'botToken' | 'webhookVerifier'>>;
+/**
+ * Build a Slack adapter config fragment backed by a Vercel Connect
+ * connector that stores a Slack workspace's bot token.
+ *
+ * Spread the result into `createSlackAdapter` from `@chat-adapter/slack`:
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ *   userName: "my-bot",
+ * });
+ * ```
+ *
+ * The returned `botToken` is a function form, invoked once per Slack
+ * API call so the adapter always picks up a fresh token from Vercel
+ * Connect (rotation, refresh, and multi-workspace tenancy are handled
+ * server-side). Slack bot tokens are app-scoped — one token per
+ * workspace install — so this helper calls Vercel Connect with
+ * `subject: { type: "app" }`.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Slack's signing-secret
+ * check. Omit `signingSecret` / `SLACK_SIGNING_SECRET` when using this.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export declare function connectSlackAdapter(connector: string, params?: ConnectSlackAdapterParams, options?: ConnectOptions): ConnectSlackAdapterConfig;

package/dist/chat/slack-adapter.js

@@ -0,0 +1,39 @@
+import { getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a Slack adapter config fragment backed by a Vercel Connect
+ * connector that stores a Slack workspace's bot token.
+ *
+ * Spread the result into `createSlackAdapter` from `@chat-adapter/slack`:
+ *
+ * ```ts
+ * import { createSlackAdapter } from "@chat-adapter/slack";
+ * import { connectSlackAdapter } from "@vercel/connect/chat";
+ *
+ * createSlackAdapter({
+ *   ...connectSlackAdapter("slack/acme-slack"),
+ *   userName: "my-bot",
+ * });
+ * ```
+ *
+ * The returned `botToken` is a function form, invoked once per Slack
+ * API call so the adapter always picks up a fresh token from Vercel
+ * Connect (rotation, refresh, and multi-workspace tenancy are handled
+ * server-side). Slack bot tokens are app-scoped — one token per
+ * workspace install — so this helper calls Vercel Connect with
+ * `subject: { type: "app" }`.
+ *
+ * `webhookVerifier` validates Connect trigger-forwarded webhooks via the
+ * Vercel OIDC token Connect attaches, replacing Slack's signing-secret
+ * check. Omit `signingSecret` / `SLACK_SIGNING_SECRET` when using this.
+ *
+ * The optional `params` and `options` arguments mirror the signature of
+ * {@link getToken}, allowing callers to pass through fields like
+ * `installationId`, `scopes`, or `validityBufferMs`.
+ */
+export function connectSlackAdapter(connector, params = {}, options) {
+    return {
+        botToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/types.d.ts

@@ -0,0 +1,28 @@
+import type { ConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Function form of a Chat SDK adapter token field. The adapter invokes
+ * it per API call, so it composes naturally with Vercel Connect's
+ * short-lived tokens — each call returns a fresh token (the
+ * `@vercel/connect` SDK caches and refreshes server-side).
+ */
+export type ConnectTokenResolver = () => Promise<string>;
+/**
+ * Partial GitHub adapter config backed by Vercel Connect.
+ *
+ * Structurally matches the `installationToken` and `webhookVerifier`
+ * options of `createGitHubAdapter` from `@chat-adapter/github`.
+ */
+export interface ConnectGitHubAdapterConfig {
+    installationToken: ConnectTokenResolver;
+    webhookVerifier: ConnectWebhookVerifier;
+}
+/**
+ * Partial Linear adapter config backed by Vercel Connect.
+ *
+ * Structurally matches the `accessToken` and `webhookVerifier` options
+ * of `createLinearAdapter` from `@chat-adapter/linear`.
+ */
+export interface ConnectLinearAdapterConfig {
+    accessToken: ConnectTokenResolver;
+    webhookVerifier: ConnectWebhookVerifier;
+}

package/dist/chat/types.js

@@ -0,0 +1 @@
+export {};

package/dist/chat/webhook-verifier.d.ts

@@ -0,0 +1,51 @@
+import { verifyVercelOidcToken } from '@vercel/oidc';
+/**
+ * Webhook verifier signature used by Chat SDK adapters. Returning a
+ * truthy value marks the request as verified; throwing (or returning a
+ * falsy value) makes the adapter respond `401`.
+ *
+ * Mirrors the `webhookVerifier` option accepted by the Slack, GitHub,
+ * and Linear adapters from the `chat` package, so the helpers in this
+ * subpath stay decoupled from `@chat-adapter/*` while remaining
+ * structurally compatible.
+ */
+export type ConnectWebhookVerifier = (request: Request, body: string) => Promise<unknown> | unknown;
+/**
+ * Options forwarded to {@link verifyVercelOidcToken}. Defaults to
+ * matching `project_id` / `environment` against the current Vercel
+ * deployment's `VERCEL_PROJECT_ID` and `VERCEL_TARGET_ENV` / `VERCEL_ENV`.
+ */
+export type ConnectWebhookVerifierOptions = Parameters<typeof verifyVercelOidcToken>[1];
+/**
+ * Build a webhook verifier for Vercel Connect trigger-forwarded
+ * webhooks.
+ *
+ * When Vercel Connect forwards a verified provider webhook to your
+ * project, it attaches a Vercel OIDC token as a `Bearer` credential in
+ * the `Authorization` header. This verifier extracts that token and
+ * validates it against Vercel's JWKS via
+ * {@link verifyVercelOidcToken}, replacing the provider's native
+ * signature check (Slack signing secret, GitHub webhook secret, Linear
+ * webhook secret).
+ *
+ * Trust boundary: by default the token must be issued by
+ * `https://oidc.vercel.com` (issuer is hard-pinned) and match the
+ * current deployment's project and environment (`projectId` defaults to
+ * `VERCEL_PROJECT_ID`, `environment` to `VERCEL_TARGET_ENV` then
+ * `VERCEL_ENV`). Verification fails closed — if those values are absent
+ * and not supplied via `options`, every request is rejected. The
+ * accepted set is therefore "any Vercel OIDC token for this
+ * project + environment"; it is not pinned to a specific Connect
+ * connector or to a single deployment. To tighten or broaden it (extra
+ * audiences, multiple environments, an explicit project id), pass
+ * `options` through to {@link verifyVercelOidcToken}.
+ *
+ * Pass it as the `webhookVerifier` option to a Chat SDK adapter:
+ *
+ * ```ts
+ * createSlackAdapter({
+ *   webhookVerifier: createConnectWebhookVerifier(),
+ * });
+ * ```
+ */
+export declare function createConnectWebhookVerifier(options?: ConnectWebhookVerifierOptions): ConnectWebhookVerifier;

package/dist/chat/webhook-verifier.js

@@ -0,0 +1,47 @@
+import { verifyVercelOidcToken } from '@vercel/oidc';
+const BEARER_TOKEN_PATTERN = /^Bearer\s+(.+)$/i;
+/**
+ * Build a webhook verifier for Vercel Connect trigger-forwarded
+ * webhooks.
+ *
+ * When Vercel Connect forwards a verified provider webhook to your
+ * project, it attaches a Vercel OIDC token as a `Bearer` credential in
+ * the `Authorization` header. This verifier extracts that token and
+ * validates it against Vercel's JWKS via
+ * {@link verifyVercelOidcToken}, replacing the provider's native
+ * signature check (Slack signing secret, GitHub webhook secret, Linear
+ * webhook secret).
+ *
+ * Trust boundary: by default the token must be issued by
+ * `https://oidc.vercel.com` (issuer is hard-pinned) and match the
+ * current deployment's project and environment (`projectId` defaults to
+ * `VERCEL_PROJECT_ID`, `environment` to `VERCEL_TARGET_ENV` then
+ * `VERCEL_ENV`). Verification fails closed — if those values are absent
+ * and not supplied via `options`, every request is rejected. The
+ * accepted set is therefore "any Vercel OIDC token for this
+ * project + environment"; it is not pinned to a specific Connect
+ * connector or to a single deployment. To tighten or broaden it (extra
+ * audiences, multiple environments, an explicit project id), pass
+ * `options` through to {@link verifyVercelOidcToken}.
+ *
+ * Pass it as the `webhookVerifier` option to a Chat SDK adapter:
+ *
+ * ```ts
+ * createSlackAdapter({
+ *   webhookVerifier: createConnectWebhookVerifier(),
+ * });
+ * ```
+ */
+export function createConnectWebhookVerifier(options) {
+    return async (request, _body) => {
+        const token = request.headers
+            .get('authorization')
+            ?.match(BEARER_TOKEN_PATTERN)?.[1]
+            ?.trim();
+        if (!token) {
+            throw new Error('Missing Authorization bearer token');
+        }
+        await verifyVercelOidcToken(token, options);
+        return true;
+    };
+}

package/dist/eve/connection-authorization.d.ts

@@ -115,6 +115,22 @@ export interface EveAuthorizationOptions {
      * and rely on `@vercel/oidc` auto-discovery.
      */
     readonly connectOptions?: ConnectOptions;
+    /**
+     * Create or link the declared connector against the deploying Vercel
+     * project before the first token / authorization call. Defaults to
+     * `true`.
+     *
+     * The provision request is authenticated with the deployment OIDC token
+     * and carries the eve connection's `url` plus this connector UID. Connect
+     * creates the managed OAuth connector when missing, links an existing
+     * OAuth connector when the UID already exists, and scopes the new project
+     * link to the OIDC token's environment and higher promotion targets.
+     *
+     * Set this to `false` for callers that intentionally manage the connector
+     * linkage elsewhere. Opaque connector ids (`scl_...`) and connections
+     * without a URL are skipped automatically.
+     */
+    readonly autoProvision?: boolean;
     /**
      * Re-validate the grant against Vercel Connect on every `getToken`
      * instead of trusting the in-process token cache.
@@ -170,9 +186,10 @@ export type EveAuthorizationInput = string | EveAuthorizationOptions;
  * both forms address the same connector.
  *
  * The marker is purely metadata — it does not influence the runtime
- * token-fetching behaviour, which continues to be driven by the
+ * token-fetching identity, which continues to be driven by the
  * `getToken` / `startAuthorization` / `completeAuthorization`
- * callbacks.
+ * callbacks. When auto-provisioning is enabled, the same connector value is
+ * also sent as the managed OAuth UID.
  */
 export interface VercelConnectMetadata {
     readonly connector: string;

package/dist/eve/connection-authorization.js

@@ -31,6 +31,7 @@
 import { ConnectionAuthorizationFailedError, ConnectionAuthorizationRequiredError, } from 'eve/connections';
 import { startAuthorization } from '../authorization.js';
 import { ConnectorInstallationRequiredError, deleteTokenCacheEntry, getTokenResponse, NoValidTokenError, revokeToken, UserAuthorizationRequiredError, } from '../token.js';
+import { provisionEveOAuthConnector } from './provision-oauth-connector.js';
 export function connect(input) {
     const options = normalizeAuthorizationOptions(input);
     const vercelConnect = { connector: options.connector };
@@ -84,6 +85,7 @@ function buildInteractiveDefinition(options) {
         principalType: 'user',
         async getToken({ principal, connection, }) {
             try {
+                await autoProvisionConnectorIfEnabled(options, connection);
                 const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
@@ -93,30 +95,30 @@ function buildInteractiveDefinition(options) {
         },
         async startAuthorization({ principal, connection, callbackUrl, webhook, }) {
             try {
-                // Eve's `webhook` parameter is semantically a browser-redirect
-                // target — the orchestrator mints it via `createWebhook({
-                // respondWith: buildAuthorizationCompletePage() })` so the
-                // user lands on a friendly "you can close this tab" page after
-                // consent. That maps to Vercel Connect's `callbackUrl:`
-                // semantics, which accepts both `https://` (prod) and
-                // `http://localhost` (vercel dev) — one field covers both.
+                await autoProvisionConnectorIfEnabled(options, connection);
+                // eve's `webhook` parameter is also the browser-redirect
+                // target when `callbackUrl` is absent — the orchestrator mints
+                // it via `createWebhook({ respondWith:
+                // buildAuthorizationCompletePage() })` so the user lands on a
+                // friendly "you can close this tab" page after consent. That
+                // maps to Vercel Connect's `callbackUrl:` semantics, which
+                // accepts both `https://` (prod) and `http://localhost`
+                // (vercel dev).
+                //
+                // When the eve webhook is HTTPS, also pass it as Vercel
+                // Connect's server-side completion webhook. That lets Connect
+                // resume the eve session even when the OAuth callback fails
+                // before the browser can be redirected back, such as a token
+                // exchange error after provider consent.
+                //
                 // Vercel Connect authenticates the calling Vercel project via
                 // OIDC, which is what lets per-workflow dynamic webhook URLs
                 // work without an OAuth-style redirect-URI allowlist.
-                //
-                // We don't route `https://` URLs into Vercel Connect's
-                // `webhook:` (server-POST) field, even though it would
-                // survive the user closing the consent tab right after IdP
-                // callback. That mode shows the user Vercel Connect's
-                // generic "close this window" page instead of Eve's branded
-                // landing page, and the helper would need to grow
-                // protocol-aware logic that diverges from the simple "Eve
-                // mints one URL, Vercel Connect redirects there" mental
-                // model. Revisit if tab-close timeouts become a real problem
-                // in production.
+                const completionWebhook = connectCompletionWebhook(webhook);
                 const response = await startAuthorization(options.connector, await buildTokenParams(options, principal, connection), {
                     ...options.connectOptions,
                     callbackUrl: callbackUrl ?? webhook,
+                    ...(completionWebhook ? { webhook: completionWebhook } : null),
                     deviceCode: true,
                 });
                 return {
@@ -138,6 +140,7 @@ function buildInteractiveDefinition(options) {
         },
         async completeAuthorization({ principal, connection, }) {
             try {
+                await autoProvisionConnectorIfEnabled(options, connection);
                 const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), options.connectOptions);
                 return { token: response.token, expiresAt: response.expiresAt };
             }
@@ -147,11 +150,23 @@ function buildInteractiveDefinition(options) {
         },
     };
 }
+function connectCompletionWebhook(webhook) {
+    if (!webhook) {
+        return null;
+    }
+    try {
+        return new URL(webhook).protocol === 'https:' ? webhook : null;
+    }
+    catch {
+        return null;
+    }
+}
 function buildNonInteractiveDefinition(options) {
     return {
         principalType: 'app',
         async getToken({ principal, connection, }) {
             try {
+                await autoProvisionConnectorIfEnabled(options, connection);
                 const response = await getTokenResponse(options.connector, await buildTokenParams(options, principal, connection), getTokenConnectOptions(options));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
@@ -161,6 +176,16 @@ function buildNonInteractiveDefinition(options) {
         },
     };
 }
+async function autoProvisionConnectorIfEnabled(options, connection) {
+    if (options.autoProvision === false) {
+        return;
+    }
+    await provisionEveOAuthConnector({
+        connector: options.connector,
+        connection,
+        connectOptions: options.connectOptions,
+    });
+}
 /**
  * Connect SDK options for `getToken` calls. When {@link
  * EveAuthorizationOptions.validate} is set, forces a cache-bypassing

package/dist/eve/provision-oauth-connector.d.ts

@@ -0,0 +1,9 @@
+import type { ConnectOptions } from '../token.js';
+import type { EveConnectionAuthorizationContext } from './connection-authorization.js';
+interface ProvisionEveOAuthConnectorOptions {
+    readonly connector: string;
+    readonly connection: EveConnectionAuthorizationContext;
+    readonly connectOptions?: ConnectOptions;
+}
+export declare function provisionEveOAuthConnector({ connector, connection, connectOptions, }: ProvisionEveOAuthConnectorOptions): Promise<void>;
+export {};

package/dist/eve/provision-oauth-connector.js

@@ -0,0 +1,96 @@
+import { getVercelOidcToken } from '@vercel/oidc';
+import { ConnectError, createConnectErrorFromResponse } from '../token.js';
+const MANAGED_OAUTH_CONNECTOR_ENDPOINT = 'https://api.vercel.com/v1/connect/connectors/managed/oauth';
+const RESERVED_UID_PATTERN = /^(vc\/|[^/]*\.vercel\.com\/)/;
+const ALLOWED_RESERVED_UID_PREFIXES = ['mcp.vercel.com/'];
+const RESERVED_ID_PREFIXES = ['scl_', 'sca_', 'store_', 'ir_'];
+const INVALID_UID_CHARS = /[\s%#]/;
+const provisionCache = new Map();
+export async function provisionEveOAuthConnector({ connector, connection, connectOptions, }) {
+    const serverUrl = resolveServerUrl(connection);
+    if (serverUrl === undefined || !isProvisionableConnectorUid(connector)) {
+        return;
+    }
+    const vercelToken = connectOptions?.vercelToken ?? (await getVercelOidcToken());
+    const cacheKey = JSON.stringify({
+        connector,
+        serverUrl,
+        token: await tokenCacheKeyPart(vercelToken),
+    });
+    let promise = provisionCache.get(cacheKey);
+    if (promise === undefined) {
+        promise = provisionManagedOAuthConnector({
+            connector,
+            serverUrl,
+            vercelToken,
+        }).catch(error => {
+            if (isNonOAuthConnectorConflict(error)) {
+                return;
+            }
+            provisionCache.delete(cacheKey);
+            throw error;
+        });
+        provisionCache.set(cacheKey, promise);
+    }
+    await promise;
+}
+function resolveServerUrl(connection) {
+    const url = connection.url;
+    if (typeof url !== 'string') {
+        return undefined;
+    }
+    const trimmed = url.trim();
+    return trimmed === '' ? undefined : trimmed;
+}
+function isProvisionableConnectorUid(connector) {
+    if (connector === '' || INVALID_UID_CHARS.test(connector)) {
+        return false;
+    }
+    for (let index = 0; index < connector.length; index++) {
+        const code = connector.charCodeAt(index);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) {
+            return false;
+        }
+    }
+    const normalized = connector.toLowerCase();
+    if (RESERVED_ID_PREFIXES.some(prefix => normalized.startsWith(prefix))) {
+        return false;
+    }
+    if (RESERVED_UID_PATTERN.test(normalized) &&
+        !ALLOWED_RESERVED_UID_PREFIXES.some(prefix => normalized.startsWith(prefix))) {
+        return false;
+    }
+    return true;
+}
+async function tokenCacheKeyPart(token) {
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle) {
+        const digest = await subtle.digest('SHA-256', new TextEncoder().encode(token));
+        return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+    }
+    let hash = 2166136261;
+    for (let index = 0; index < token.length; index++) {
+        hash ^= token.charCodeAt(index);
+        hash = Math.imul(hash, 16777619);
+    }
+    return `${token.length}:${hash >>> 0}`;
+}
+function isNonOAuthConnectorConflict(error) {
+    return (error instanceof ConnectError &&
+        error.status === 409 &&
+        /not an OAuth connector/i.test(error.message));
+}
+async function provisionManagedOAuthConnector({ connector, serverUrl, vercelToken, }) {
+    const response = await fetch(MANAGED_OAUTH_CONNECTOR_ENDPOINT, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json',
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${vercelToken}`,
+        },
+        body: JSON.stringify({ serverUrl, uid: connector }),
+    });
+    if (!response.ok) {
+        throw await createConnectErrorFromResponse(response, 'Failed to provision connector');
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.2.9",
+  "version": "0.3.0",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -13,6 +13,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./chat": {
+      "types": "./dist/chat/index.d.ts",
+      "default": "./dist/chat/index.js"
+    },
     "./eve": {
       "types": "./dist/eve/index.d.ts",
       "default": "./dist/eve/index.js"
@@ -38,11 +42,12 @@
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "3.7.0"
+    "@vercel/oidc": "3.7.1"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",
     "@auth/core": ">=0.37.0",
+    "@chat-adapter/slack": "^4.0.0",
     "ai": "^6 || ^7.0.0-beta.0",
     "better-auth": ">=1.5.0",
     "eve": ">=0.13.7"
@@ -54,6 +59,9 @@
     "@auth/core": {
       "optional": true
     },
+    "@chat-adapter/slack": {
+      "optional": true
+    },
     "ai": {
       "optional": true
     },
@@ -67,6 +75,7 @@
   "devDependencies": {
     "@ai-sdk/mcp": "2.0.0-beta.37",
     "@auth/core": "0.37.4",
+    "@chat-adapter/slack": "4.31.0",
     "ai": "7.0.0-beta.116",
     "better-auth": "1.5.5",
     "eve": "0.6.0-beta.1",