@vercel/connect 2.0.4 → 2.2.0

package/README.md

@@ -5,7 +5,7 @@ SDK for obtaining scoped tokens for third-party services on behalf of apps or us
 Seven entrypoints, all ESM:
 
 - `@vercel/connect` — core token / authorization SDK
-- `@vercel/connect/chat` — adapter helpers for the [Chat SDK](https://chat-sdk.dev) (`chat`): `connectSlackAdapter`, `connectDiscordAdapter`, `connectGitHubAdapter`, `connectLinearAdapter`, `connectNotionAdapter`, `connectTelegramAdapter`, `connectSendblueAdapter` (no Chat SDK dependency — returns structural config)
+- `@vercel/connect/chat` — adapter helpers for the [Chat SDK](https://chat-sdk.dev) (`chat`): `connectSlackAdapter`, `connectDiscordAdapter`, `connectGitHubAdapter`, `connectLinearAdapter`, `connectNotionAdapter`, `connectTelegramAdapter`, `connectSendblueAdapter`, `connectTeamsAdapter` (no Chat SDK dependency — returns structural config)
 - `@vercel/connect/ai-sdk` — [Vercel AI SDK](https://ai-sdk.dev) glue: re-exports `connectAuthProvider` for MCP transports (optional peers: `ai`, `@ai-sdk/mcp`)
 - `@vercel/connect/mcp` — canonical MCP-spec `OAuthClientProvider` for any MCP client (optional peer: `@ai-sdk/mcp`)
 - `@vercel/connect/eve` — adapter helpers for [Eve](https://github.com/vercel/eve) connections (optional peer: `eve`)
@@ -62,6 +62,20 @@ createSlackAdapter({
 `connectGitHubAdapter` (`installationToken`), and `connectLinearAdapter`
 (`accessToken`) follow the same shape. `connectSendblueAdapter` supplies a
 lazy Sendblue `accessToken` and Connect OIDC webhook verifier.
+`connectTeamsAdapter` supplies a lazy Microsoft Teams `appId`, a scope-aware
+`token` callback for Bot Framework and Microsoft Graph, and Connect OIDC webhook
+verification. Use it with a Teams adapter release that supports lazy `appId`
+and `webhookVerifier`:
+
+```ts
+import { createTeamsAdapter } from '@chat-adapter/teams';
+import { connectTeamsAdapter } from '@vercel/connect/chat';
+
+createTeamsAdapter({
+  ...connectTeamsAdapter('microsoft-teams/my-bot'),
+});
+```
+
 `connectNotionAdapter` supplies only the outbound `token`; native Notion
 webhooks still require `NOTION_VERIFICATION_TOKEN`. `connectTelegramAdapter`
 supplies only `botToken`; Telegram retains native webhook verification or
@@ -110,10 +124,10 @@ can import the same `connectAuthProvider` from `@vercel/connect/mcp`.
 
 ### Eve
 
-Use `connectSendblueCredentials` with Eve's native Sendblue channel. It
-resolves the app-scoped bearer token and managed sending line together, and
-includes Vercel OIDC webhook verification. When the connector has multiple
-lines, pass `fromNumber` to choose one.
+Use channel-specific credential helpers with Eve's native channels.
+`connectSendblueCredentials` resolves the app-scoped bearer token and managed
+sending line together, and includes Vercel OIDC webhook verification. When the
+connector has multiple lines, pass `fromNumber` to choose one.
 
 ```ts
 import { connectSendblueCredentials } from '@vercel/connect/eve';
@@ -124,6 +138,20 @@ export default sendblueChannel({
 });
 ```
 
+For managed Microsoft Teams bots, `connectTeamsCredentials` resolves the
+public bot application id and short-lived Bot Framework token without exposing
+the managed app's federated credential. It also verifies Connect-forwarded
+activities with Vercel OIDC.
+
+```ts
+import { connectTeamsCredentials } from '@vercel/connect/eve';
+import { teamsChannel } from 'eve/channels/teams';
+
+export default teamsChannel({
+  credentials: connectTeamsCredentials('microsoft-teams/my-agent'),
+});
+```
+
 ```ts
 import { defineMcpClientConnection } from 'eve/connections';
 import { connect } from '@vercel/connect/eve';

package/dist/chat/index.d.ts

@@ -21,7 +21,7 @@
  * ```
  */
 export { createConnectWebhookVerifier, type ConnectWebhookVerifier, type ConnectWebhookVerifierOptions, } from './webhook-verifier.js';
-export type { ConnectDiscordAdapterConfig, ConnectGitHubAdapterConfig, ConnectLinearAdapterConfig, ConnectLinqAdapterConfig, ConnectLinqCredentials, ConnectNotionAdapterConfig, ConnectSendblueAdapterConfig, ConnectTelegramAdapterConfig, ConnectTokenResolver, } from './types.js';
+export type { ConnectDiscordAdapterConfig, ConnectGitHubAdapterConfig, ConnectLinearAdapterConfig, ConnectLinqAdapterConfig, ConnectLinqCredentials, ConnectNotionAdapterConfig, ConnectSendblueAdapterConfig, ConnectTeamsAdapterConfig, ConnectTelegramAdapterConfig, ConnectTokenResolver, } from './types.js';
 export { connectDiscordAdapter, type ConnectDiscordAdapterParams, } from './discord-adapter.js';
 export { connectSlackAdapter, type ConnectSlackAdapterConfig, type ConnectSlackAdapterParams, } from './slack-adapter.js';
 export { connectGitHubAdapter, type ConnectGitHubAdapterParams, } from './github-adapter.js';
@@ -30,3 +30,4 @@ export { connectLinqAdapter, type ConnectLinqAdapterParams, } from './linq-adapt
 export { connectNotionAdapter, type ConnectNotionAdapterParams, } from './notion-adapter.js';
 export { connectTelegramAdapter, type ConnectTelegramAdapterParams, } from './telegram-adapter.js';
 export { connectSendblueAdapter, type ConnectSendblueAdapterParams, } from './sendblue-adapter.js';
+export { connectTeamsAdapter, type ConnectTeamsAdapterParams, } from './teams-adapter.js';

package/dist/chat/index.js

@@ -29,3 +29,4 @@ export { connectLinqAdapter, } from './linq-adapter.js';
 export { connectNotionAdapter, } from './notion-adapter.js';
 export { connectTelegramAdapter, } from './telegram-adapter.js';
 export { connectSendblueAdapter, } from './sendblue-adapter.js';
+export { connectTeamsAdapter, } from './teams-adapter.js';

package/dist/chat/teams-adapter.d.ts

@@ -0,0 +1,31 @@
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+import type { ConnectTeamsAdapterConfig } from './types.js';
+/**
+ * Teams bot tokens are app-scoped. The adapter selects the resource scopes
+ * for each call, so neither `subject` nor `scopes` can be overridden here.
+ */
+export type ConnectTeamsAdapterParams = Omit<ConnectTokenParams, 'subject' | 'scopes'>;
+/**
+ * Build a Microsoft Teams adapter config backed by a managed Connect bot.
+ *
+ * ```ts
+ * import { createTeamsAdapter } from '@chat-adapter/teams';
+ * import { connectTeamsAdapter } from '@vercel/connect/chat';
+ *
+ * createTeamsAdapter({
+ *   ...connectTeamsAdapter('microsoft-teams/my-bot'),
+ * });
+ * ```
+ *
+ * The app id is resolved lazily from public connector metadata. The token
+ * callback requests separate Bot Framework and Microsoft Graph tokens using
+ * the adapter's scopes, with caching and refresh handled by Connect. Graph
+ * access requires the bot's resource-specific permissions to be granted when
+ * it is installed in a team.
+ *
+ * Connect selects the managed bot's home tenant, so the token callback's
+ * tenant argument does not change token selection. The webhook verifier
+ * validates Connect-forwarded activities with Vercel OIDC after Connect has
+ * verified Microsoft's native JWT.
+ */
+export declare function connectTeamsAdapter(connector: string, params?: ConnectTeamsAdapterParams, options?: ConnectOptions): ConnectTeamsAdapterConfig;

package/dist/chat/teams-adapter.js

@@ -0,0 +1,43 @@
+import { getConnectorMetadata, getToken, } from '../index.js';
+import { createConnectWebhookVerifier } from './webhook-verifier.js';
+/**
+ * Build a Microsoft Teams adapter config backed by a managed Connect bot.
+ *
+ * ```ts
+ * import { createTeamsAdapter } from '@chat-adapter/teams';
+ * import { connectTeamsAdapter } from '@vercel/connect/chat';
+ *
+ * createTeamsAdapter({
+ *   ...connectTeamsAdapter('microsoft-teams/my-bot'),
+ * });
+ * ```
+ *
+ * The app id is resolved lazily from public connector metadata. The token
+ * callback requests separate Bot Framework and Microsoft Graph tokens using
+ * the adapter's scopes, with caching and refresh handled by Connect. Graph
+ * access requires the bot's resource-specific permissions to be granted when
+ * it is installed in a team.
+ *
+ * Connect selects the managed bot's home tenant, so the token callback's
+ * tenant argument does not change token selection. The webhook verifier
+ * validates Connect-forwarded activities with Vercel OIDC after Connect has
+ * verified Microsoft's native JWT.
+ */
+export function connectTeamsAdapter(connector, params = {}, options) {
+    return {
+        appId: async () => {
+            const metadata = await getConnectorMetadata(connector, options);
+            const appId = metadata.vendor.appId;
+            if (typeof appId !== 'string' || appId.length === 0) {
+                throw new Error(`Vercel Connect connector ${connector} did not return a Microsoft Teams app id.`);
+            }
+            return appId;
+        },
+        token: scope => getToken(connector, {
+            ...params,
+            subject: { type: 'app' },
+            scopes: Array.isArray(scope) ? scope : [scope],
+        }, options),
+        webhookVerifier: createConnectWebhookVerifier(),
+    };
+}

package/dist/chat/types.d.ts

@@ -76,6 +76,17 @@ export interface ConnectNotionAdapterConfig {
 export interface ConnectTelegramAdapterConfig {
     botToken: ConnectTokenResolver;
 }
+/**
+ * Partial Microsoft Teams adapter config backed by Vercel Connect.
+ *
+ * Structurally matches the lazy `appId`, scope-aware `token`, and
+ * `webhookVerifier` options of `createTeamsAdapter` from `@chat-adapter/teams`.
+ */
+export interface ConnectTeamsAdapterConfig {
+    appId: ConnectTokenResolver;
+    token: (scope: string | string[], tenantId?: string) => Promise<string>;
+    webhookVerifier: ConnectWebhookVerifier;
+}
 /**
  * Partial Sendblue adapter config backed by Vercel Connect.
  *

package/dist/eve/index.d.ts

@@ -12,6 +12,7 @@ export { connectDiscordCredentials, type ConnectDiscordCredentialsParams, } from
 export { connectGitHubCredentials, type ConnectGitHubCredentialsParams, } from './github-credentials.js';
 export { connectLinearCredentials, type ConnectLinearCredentialsParams, } from './linear-credentials.js';
 export { connectLinqCredentials, type ConnectLinqCredentials, type ConnectLinqCredentialsParams, } from './linq-credentials.js';
+export { connectTeamsCredentials, type ConnectTeamsCredentialsParams, } from './microsoft-teams-credentials.js';
 export { connectPhotonCredentials, type ConnectPhotonCredentialProvider, type PhotonCredentials, type ConnectPhotonCredentialsParams, } from './photon-credentials.js';
 export { connectSlackCredentials, type ConnectSlackCredentialsParams, } from './slack-credentials.js';
 export { connectSendblueCredentials, type ConnectSendblueCredentials, type ConnectSendblueCredentialsParams, } from './sendblue-credentials.js';

package/dist/eve/index.js

@@ -12,6 +12,7 @@ export { connectDiscordCredentials, } from './discord-credentials.js';
 export { connectGitHubCredentials, } from './github-credentials.js';
 export { connectLinearCredentials, } from './linear-credentials.js';
 export { connectLinqCredentials, } from './linq-credentials.js';
+export { connectTeamsCredentials, } from './microsoft-teams-credentials.js';
 export { connectPhotonCredentials, } from './photon-credentials.js';
 export { connectSlackCredentials, } from './slack-credentials.js';
 export { connectSendblueCredentials, } from './sendblue-credentials.js';

package/dist/eve/microsoft-teams-credentials.d.ts

@@ -0,0 +1,30 @@
+import type { TeamsChannelCredentials } from 'eve/channels/teams';
+import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
+/**
+ * Token parameters accepted by {@link connectTeamsCredentials}.
+ *
+ * Mirrors {@link ConnectTokenParams}, except that Teams bot credentials are
+ * always app-scoped and must request the Bot Framework resource. `subject`
+ * and `scopes` are therefore pinned by the helper.
+ */
+export type ConnectTeamsCredentialsParams = Omit<ConnectTokenParams, 'subject' | 'scopes'>;
+/**
+ * Build {@link TeamsChannelCredentials} backed by a managed Vercel Connect
+ * Microsoft Teams connector.
+ *
+ * The helper resolves the managed bot's public application id from connector
+ * metadata and obtains short-lived Bot Framework access tokens through
+ * Vercel Connect. It never exposes the managed app's federated credential.
+ * Vercel OIDC verifies trigger-forwarded Bot Framework activities, after
+ * Connect has verified their native bearer JWT.
+ *
+ * ```ts
+ * import { connectTeamsCredentials } from '@vercel/connect/eve';
+ * import { teamsChannel } from 'eve/channels/teams';
+ *
+ * export default teamsChannel({
+ *   credentials: connectTeamsCredentials('microsoft-teams/my-agent'),
+ * });
+ * ```
+ */
+export declare function connectTeamsCredentials(connector: string, params?: ConnectTeamsCredentialsParams, options?: ConnectOptions): TeamsChannelCredentials;

package/dist/eve/microsoft-teams-credentials.js

@@ -0,0 +1,44 @@
+import { vercelOidc } from 'eve/channels/auth';
+import { getConnectorMetadata, getTokenResponse, } from '../index.js';
+const BOT_FRAMEWORK_SCOPE = 'https://api.botframework.com/.default';
+/**
+ * Build {@link TeamsChannelCredentials} backed by a managed Vercel Connect
+ * Microsoft Teams connector.
+ *
+ * The helper resolves the managed bot's public application id from connector
+ * metadata and obtains short-lived Bot Framework access tokens through
+ * Vercel Connect. It never exposes the managed app's federated credential.
+ * Vercel OIDC verifies trigger-forwarded Bot Framework activities, after
+ * Connect has verified their native bearer JWT.
+ *
+ * ```ts
+ * import { connectTeamsCredentials } from '@vercel/connect/eve';
+ * import { teamsChannel } from 'eve/channels/teams';
+ *
+ * export default teamsChannel({
+ *   credentials: connectTeamsCredentials('microsoft-teams/my-agent'),
+ * });
+ * ```
+ */
+export function connectTeamsCredentials(connector, params = {}, options) {
+    return {
+        appId: () => getTeamsAppId(connector, options),
+        tokenProvider: async () => {
+            const response = await getTokenResponse(connector, {
+                ...params,
+                subject: { type: 'app' },
+                scopes: [BOT_FRAMEWORK_SCOPE],
+            }, options);
+            return { accessToken: response.token, expiresAt: response.expiresAt };
+        },
+        webhookVerifier: vercelOidc(),
+    };
+}
+async function getTeamsAppId(connector, options) {
+    const metadata = await getConnectorMetadata(connector, options);
+    const appId = metadata.vendor.appId;
+    if (typeof appId !== 'string' || appId.length === 0) {
+        throw new Error(`Vercel Connect connector ${connector} did not return a Microsoft Teams app id.`);
+    }
+    return appId;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "2.0.4",
+  "version": "2.2.0",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -42,7 +42,7 @@
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "3.8.7"
+    "@vercel/oidc": "3.8.8"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",