@vercel/connect 2.5.7-snapshot-c4f338842961 → 2.6.0

package/README.md

@@ -237,8 +237,14 @@ export default defineMcpClientConnection({
 By default, `connect()` only uses connectors already linked to the project and
 does not provision or modify connectors at runtime. Pass `autoProvision: true`
 to opt in. When enabled, `connect()` first tries the token or authorization
-request; if the connector is missing or not linked, it provisions or links the
-connector and retries the request once.
+request; if the connector is missing or not linked, it asks Vercel Connect to
+resolve the connector by its project-local UID (`'linear'` above) and retries
+the request once with the returned connector id. Vercel Connect reuses a
+connector already mapped to that UID or linked to the project, or creates one
+linked to the deploying project. It never widens an existing link: when setup
+is required (for example, enabling the connector for another environment), the
+call fails with a non-retryable `connector_setup_required` authorization error.
+Teams without project-local UIDs provision the connector by team UID instead.
 
 ### Better Auth
 

package/dist/eve/connection-authorization.d.ts

@@ -58,9 +58,10 @@ export type EveConnectionAuthorizationContext = Parameters<NonInteractiveAuthori
 export interface EveAuthorizationOptions {
     /**
      * Vercel Connect OAuth connector identifier. Accepts either the
-     * opaque service connector key (`scl_...`) or the human-readable
-     * UID (`oauth/mcp-linear-app`) — both resolve to the same
-     * connector on the Vercel Connect side.
+     * opaque service connector key (`scl_...`) or a human-readable UID.
+     * When the team has project-local UIDs enabled, a UID is resolved first
+     * as the project-local UID of a connector linked to the deploying
+     * project, then as the connector's team UID.
      */
     readonly connector: string;
     /**
@@ -130,14 +131,23 @@ export interface EveAuthorizationOptions {
      * opt in to runtime provisioning.
      *
      * The provision request is authenticated with the deployment OIDC token
-     * and carries the eve connection's `url` plus this connector UID. Connect
-     * creates the managed OAuth connector when missing, links an existing
-     * OAuth connector when the UID already exists, and scopes the new project
-     * link to the OIDC token's authenticated environment.
+     * and carries the eve connection's `url` plus this connector UID as the
+     * project-local UID (`projectUid`). Connect returns the connector already
+     * mapped to that UID in the deploying project, reuses a compatible
+     * connector already linked to the project and environment, or creates a
+     * new connector linked to the project under that UID. Existing links are
+     * never widened; cases that need user-authorized setup fail with a
+     * non-retryable `connector_setup_required` authorization error. Teams
+     * without project-local UIDs fall back to provisioning the connector by
+     * team UID.
      *
-     * Existing linked connectors are always used directly without a
-     * provisioning request. Opaque connector ids (`scl_...`) and connections
-     * without a URL are skipped automatically.
+     * For a few minutes after provisioning, token, authorization, revocation,
+     * and eviction calls address the connector by the id Connect returned,
+     * because a newly created connector may not resolve by UID until Connect's
+     * indexes catch up; afterwards they use the UID again. Existing linked
+     * connectors are used directly without a provisioning request. Opaque
+     * connector ids (`scl_...`) and connections without a URL are skipped
+     * automatically.
      */
     readonly autoProvision?: boolean;
     /**
@@ -224,7 +234,7 @@ export interface Experimental_EveEventsBackend {
  * Token-fetching identity continues to be driven by the
  * `getToken` / `startAuthorization` / `completeAuthorization`
  * callbacks. When auto-provisioning is enabled, the same connector value is
- * also sent as the managed OAuth UID.
+ * also sent as the managed OAuth project-local UID.
  */
 export interface VercelConnectMetadata {
     /** Live capability; compilers must omit this from serializable metadata. */

package/dist/eve/connection-authorization.js

@@ -33,7 +33,7 @@ import { startAuthorization } from '../authorization.js';
 import { experimental_connectEventsAdapter, } from '../ai-sdk/connect-events-adapter.js';
 import { verifyMcpEvent } from '../mcp/verify-event.js';
 import { ConnectError, ConnectorInstallationRequiredError, deleteTokenCacheEntry, getTokenResponse, NoValidTokenError, revokeToken, UserAuthorizationRequiredError, } from '../token.js';
-import { provisionEveOAuthConnector } from './provision-oauth-connector.js';
+import { ConnectorProvisioningInProgressError, ConnectorSetupRequiredError, findProvisionedConnector, forgetProvisionedConnector, getProvisionedConnector, getProvisionedConnectorIds, provisionEveOAuthConnector, resolveProvisionScope, } from './provision-oauth-connector.js';
 export function connect(input) {
     const options = normalizeAuthorizationOptions(input);
     const requirement = options.service === undefined
@@ -83,7 +83,7 @@ function makeEvict(options) {
                 // token included) and clears the in-process cache. Best-effort —
                 // a failed or duplicate revoke must not mask the auth error that
                 // triggered eviction.
-                await revokeToken(options.connector, {
+                await revokeToken(resolveRevocationConnector(options, connection), {
                     subject: params.subject,
                     installationId: params.installationId,
                 }, options.connectOptions);
@@ -94,9 +94,33 @@ function makeEvict(options) {
                 // gone even when the server-side revoke failed.
             }
         }
+        // Tokens fetched shortly after provisioning are cached under the
+        // provisioned connector id, possibly by another `connect()` definition
+        // for the same connector, so drop those entries too.
         deleteTokenCacheEntry(options.connector, params);
+        for (const id of getProvisionedConnectorIds(options.connector)) {
+            deleteTokenCacheEntry(id, params);
+        }
     };
 }
+/**
+ * Picks the connector reference revocation should address, using the same
+ * policy as token retrieval: only `autoProvision` definitions address a
+ * recently provisioned id, so an opted-out definition never revokes a grant
+ * on a connector another definition provisioned. Without a connection, the
+ * id is looked up across server URLs and used only when unambiguous.
+ */
+function resolveRevocationConnector(options, connection) {
+    if (options.autoProvision !== true) {
+        return options.connector;
+    }
+    if (connection === undefined) {
+        return (findProvisionedConnector(options.connector, options.connectOptions) ??
+            options.connector);
+    }
+    const scope = resolveProvisionScope(options.connector, connection, options.connectOptions);
+    return (scope && getProvisionedConnector(scope)) ?? options.connector;
+}
 function buildEventsBackend(options) {
     return {
         verify: verifyMcpEvent,
@@ -138,7 +162,7 @@ function buildInteractiveDefinition(options) {
         async getToken({ principal, connection, }) {
             try {
                 const params = await buildTokenParams(options, principal, connection);
-                const response = await withConnectorProvisioningFallback(options, connection, () => getTokenResponse(options.connector, params, getTokenConnectOptions(options)));
+                const response = await withConnectorProvisioningFallback(options, connection, connector => getTokenResponse(connector, params, getTokenConnectOptions(options)));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -167,7 +191,7 @@ function buildInteractiveDefinition(options) {
                 // work without an OAuth-style redirect-URI allowlist.
                 const completionWebhook = connectCompletionWebhook(webhook);
                 const params = await buildTokenParams(options, principal, connection);
-                const response = await withConnectorProvisioningFallback(options, connection, () => startAuthorization(options.connector, params, {
+                const response = await withConnectorProvisioningFallback(options, connection, connector => startAuthorization(connector, params, {
                     ...options.connectOptions,
                     callbackUrl: callbackUrl ?? webhook,
                     ...(completionWebhook ? { webhook: completionWebhook } : null),
@@ -202,7 +226,7 @@ function buildInteractiveDefinition(options) {
         async completeAuthorization({ principal, connection, }) {
             try {
                 const params = await buildTokenParams(options, principal, connection);
-                const response = await withConnectorProvisioningFallback(options, connection, () => getTokenResponse(options.connector, params, options.connectOptions));
+                const response = await withConnectorProvisioningFallback(options, connection, connector => getTokenResponse(connector, params, options.connectOptions));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -228,7 +252,7 @@ function buildNonInteractiveDefinition(options) {
         async getToken({ principal, connection, }) {
             try {
                 const params = await buildTokenParams(options, principal, connection);
-                const response = await withConnectorProvisioningFallback(options, connection, () => getTokenResponse(options.connector, params, getTokenConnectOptions(options)));
+                const response = await withConnectorProvisioningFallback(options, connection, connector => getTokenResponse(connector, params, getTokenConnectOptions(options)));
                 return { token: response.token, expiresAt: response.expiresAt };
             }
             catch (error) {
@@ -238,21 +262,29 @@ function buildNonInteractiveDefinition(options) {
     };
 }
 async function withConnectorProvisioningFallback(options, connection, operation) {
+    const scope = options.autoProvision === true
+        ? resolveProvisionScope(options.connector, connection, options.connectOptions)
+        : undefined;
+    if (scope === undefined) {
+        return operation(options.connector);
+    }
+    const attempted = getProvisionedConnector(scope) ?? options.connector;
     try {
-        return await operation();
+        return await operation(attempted);
     }
     catch (error) {
-        if (options.autoProvision !== true ||
-            !isMissingConnectorOrProjectLink(error)) {
+        if (!isMissingConnectorOrProjectLink(error)) {
             throw error;
         }
     }
-    await provisionEveOAuthConnector({
-        connector: options.connector,
-        connection,
-        connectOptions: options.connectOptions,
-    });
-    return operation();
+    forgetProvisionedConnector(scope, attempted);
+    // A concurrent caller may already have provisioned a replacement.
+    const current = getProvisionedConnector(scope);
+    if (current !== undefined && current !== attempted) {
+        return operation(current);
+    }
+    const provisioned = await provisionEveOAuthConnector(scope, options.connectOptions);
+    return operation(provisioned ?? options.connector);
 }
 function isMissingConnectorOrProjectLink(error) {
     if (!(error instanceof ConnectError)) {
@@ -354,6 +386,20 @@ function translate(error, phase, options) {
             message: error.message,
         });
     }
+    if (error instanceof ConnectorSetupRequiredError) {
+        return new ConnectionAuthorizationFailedError('connect', {
+            message: error.message,
+            reason: 'connector_setup_required',
+            retryable: false,
+        });
+    }
+    if (error instanceof ConnectorProvisioningInProgressError) {
+        return new ConnectionAuthorizationFailedError('connect', {
+            message: error.message,
+            reason: 'connector_provisioning_in_progress',
+            retryable: true,
+        });
+    }
     // `ConnectorInstallationRequiredError` is terminal in both modes:
     // the operator has not installed the Vercel Connect connector for
     // this team.

package/dist/eve/index.d.ts

@@ -7,6 +7,7 @@
  * everything from `@vercel/connect/eve`.
  */
 export { connect, type EveAuthorizationInput, type EveAuthorizationOptions, type EveConnectAuthorizationDefinition, type EveConnectionAuthorizationContext, type ConnectAuthorizationPhase, type VercelConnectMetadata, type Experimental_EveEventsBackend, } from './connection-authorization.js';
+export { ConnectorProvisioningInProgressError, ConnectorSetupRequiredError, } from './provision-oauth-connector.js';
 export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from './connect-oauth.js';
 export { connectDiscordCredentials, type ConnectDiscordCredentialsParams, } from './discord-credentials.js';
 export { connectGitHubCredentials, type ConnectGitHubCredentialsParams, } from './github-credentials.js';

package/dist/eve/index.js

@@ -7,6 +7,7 @@
  * everything from `@vercel/connect/eve`.
  */
 export { connect, } from './connection-authorization.js';
+export { ConnectorProvisioningInProgressError, ConnectorSetupRequiredError, } from './provision-oauth-connector.js';
 export { CONNECT_OAUTH_ISSUER, connectOAuth, } from './connect-oauth.js';
 export { connectDiscordCredentials, } from './discord-credentials.js';
 export { connectGitHubCredentials, } from './github-credentials.js';

package/dist/eve/provision-oauth-connector.d.ts

@@ -1,9 +1,83 @@
-import type { ConnectOptions } from '../token.js';
+import type { ConnectErrorOptions, ConnectOptions } from '../token.js';
+import { ConnectError } from '../token.js';
 import type { EveConnectionAuthorizationContext } from './connection-authorization.js';
-interface ProvisionEveOAuthConnectorOptions {
+/**
+ * Vercel Connect could not resolve the connection's project UID to a
+ * connector without user-authorized setup, such as enabling the connector
+ * for this environment or choosing between ambiguous connectors. Retrying
+ * the request does not help until the setup is done.
+ */
+export declare class ConnectorSetupRequiredError extends ConnectError {
+    /** Machine-readable cause reported by Vercel Connect. */
+    readonly reason?: string;
+    /**
+     * Connector the setup applies to, when Vercel Connect identifies one,
+     * such as a connector that was removed from the project and can be
+     * reconnected.
+     */
+    readonly connectorId?: string;
+    constructor(message: string, options?: ConnectErrorOptions & {
+        readonly reason?: string;
+        readonly connectorId?: string;
+    });
+}
+/** Another request is provisioning the same connector; retry shortly. */
+export declare class ConnectorProvisioningInProgressError extends ConnectError {
+    constructor(message: string, options?: ConnectErrorOptions);
+}
+/**
+ * Identifies one provisionable connector reference: the authored UID, the
+ * connection's server URL, the Vercel API it is provisioned against, and an
+ * explicitly configured Vercel token. The ambient deployment OIDC token is
+ * not part of the scope: it always belongs to the same project, and leaving
+ * it out keeps lookups synchronous so cached token reads need no OIDC token.
+ */
+export interface ProvisionScope {
+    readonly key: string;
     readonly connector: string;
-    readonly connection: EveConnectionAuthorizationContext;
-    readonly connectOptions?: ConnectOptions;
+    readonly serverUrl: string;
+    readonly endpoint: string;
+    readonly vercelToken: string | undefined;
 }
-export declare function provisionEveOAuthConnector({ connector, connection, connectOptions, }: ProvisionEveOAuthConnectorOptions): Promise<void>;
-export {};
+/**
+ * Returns the provisioning scope for a connector reference, or `undefined`
+ * when it cannot be provisioned (opaque ids, reserved UIDs, connections
+ * without a URL).
+ */
+export declare function resolveProvisionScope(connector: string, connection: EveConnectionAuthorizationContext | undefined, connectOptions: ConnectOptions | undefined): ProvisionScope | undefined;
+/**
+ * Returns the connector id provisioning recently resolved for `scope`, if
+ * any. Synchronous and free of network or OIDC lookups.
+ */
+export declare function getProvisionedConnector(scope: ProvisionScope): string | undefined;
+/**
+ * Returns the connector id recently provisioned for `connector` against the
+ * same Vercel API and explicitly configured Vercel token, when exactly one
+ * server URL has one. Used to target revocation when the caller did not pass
+ * the connection; ambiguous matches return `undefined` so the caller falls
+ * back to the UID rather than guessing.
+ */
+export declare function findProvisionedConnector(connector: string, connectOptions: ConnectOptions | undefined): string | undefined;
+/**
+ * Returns every live connector id provisioned for the authored `connector`
+ * across scopes, so eviction can drop token cache entries stored under them
+ * without knowing the connection.
+ */
+export declare function getProvisionedConnectorIds(connector: string): string[];
+/**
+ * Drops `id` for `scope` after Vercel Connect rejected it. Leaves the entry
+ * alone when another caller has already replaced it.
+ */
+export declare function forgetProvisionedConnector(scope: ProvisionScope, id: string): void;
+/**
+ * Resolves or provisions the managed OAuth connector `scope` refers to and
+ * returns its connector id. The authored connector is sent as the
+ * project-local UID (`projectUid`), so Vercel Connect resolves it within the
+ * deployment's project and environment rather than across the team. Teams
+ * without project UIDs fall back to provisioning by team-global UID.
+ *
+ * The returned id is remembered for {@link getProvisionedConnector}.
+ * Returns `undefined` for non-OAuth connectors or when Vercel Connect does
+ * not report an id.
+ */
+export declare function provisionEveOAuthConnector(scope: ProvisionScope, connectOptions: ConnectOptions | undefined): Promise<string | undefined>;

package/dist/eve/provision-oauth-connector.js

@@ -6,37 +6,186 @@ const RESERVED_UID_PATTERN = /^(vc\/|[^/]*\.vercel\.com\/)/;
 const ALLOWED_RESERVED_UID_PREFIXES = ['mcp.vercel.com/'];
 const RESERVED_ID_PREFIXES = ['scl_', 'sca_', 'store_', 'ir_'];
 const INVALID_UID_CHARS = /[\s%#]/;
-const provisionCache = new Map();
-export async function provisionEveOAuthConnector({ connector, connection, connectOptions, }) {
-    const serverUrl = resolveServerUrl(connection);
+/**
+ * Vercel Connect could not resolve the connection's project UID to a
+ * connector without user-authorized setup, such as enabling the connector
+ * for this environment or choosing between ambiguous connectors. Retrying
+ * the request does not help until the setup is done.
+ */
+export class ConnectorSetupRequiredError extends ConnectError {
+    /** Machine-readable cause reported by Vercel Connect. */
+    reason;
+    /**
+     * Connector the setup applies to, when Vercel Connect identifies one,
+     * such as a connector that was removed from the project and can be
+     * reconnected.
+     */
+    connectorId;
+    constructor(message, options = {}) {
+        super(message, options);
+        this.name = 'ConnectorSetupRequiredError';
+        this.reason = options.reason;
+        this.connectorId = options.connectorId;
+    }
+}
+/** Another request is provisioning the same connector; retry shortly. */
+export class ConnectorProvisioningInProgressError extends ConnectError {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ConnectorProvisioningInProgressError';
+    }
+}
+/**
+ * How long a provisioned connector id is preferred over its UID. Vercel
+ * Connect resolves UIDs through eventually consistent indexes, so a connector
+ * created moments ago may not resolve by UID yet; the opaque id does. Once
+ * the indexes have caught up the UID resolves to the same connector, so
+ * dropping back to it picks up later changes such as a user remapping the
+ * UID to another connector.
+ */
+const PROVISIONED_CONNECTOR_TTL_MS = 5 * 60 * 1000;
+const MAX_PROVISIONED_CONNECTORS = 100;
+/** Provisioned connector ids by {@link ProvisionScope.key}. */
+const provisionedConnectors = new Map();
+/**
+ * In-flight provisioning requests by {@link ProvisionScope.key}. Concurrent
+ * callers share one request; entries are dropped as soon as the request
+ * settles.
+ */
+const inFlightProvisioning = new Map();
+/**
+ * Returns the provisioning scope for a connector reference, or `undefined`
+ * when it cannot be provisioned (opaque ids, reserved UIDs, connections
+ * without a URL).
+ */
+export function resolveProvisionScope(connector, connection, connectOptions) {
+    const serverUrl = connection === undefined ? undefined : resolveServerUrl(connection);
     if (serverUrl === undefined || !isProvisionableConnectorUid(connector)) {
-        return;
+        return undefined;
     }
-    const vercelToken = connectOptions?.vercelToken ?? (await getVercelOidcToken());
     const endpoint = `${resolveBaseUrl(connectOptions)}${MANAGED_OAUTH_CONNECTOR_PATH}`;
-    const cacheKey = JSON.stringify({
+    const key = JSON.stringify({
         connector,
         serverUrl,
         endpoint,
-        token: await tokenCacheKeyPart(vercelToken),
+        token: connectOptions?.vercelToken ?? null,
     });
-    let promise = provisionCache.get(cacheKey);
-    if (promise === undefined) {
-        promise = provisionManagedOAuthConnector({
-            connector,
-            serverUrl,
-            vercelToken,
-            endpoint,
-        }).catch(error => {
-            if (isNonOAuthConnectorConflict(error)) {
-                return;
-            }
-            provisionCache.delete(cacheKey);
-            throw error;
-        });
-        provisionCache.set(cacheKey, promise);
+    return {
+        key,
+        connector,
+        serverUrl,
+        endpoint,
+        vercelToken: connectOptions?.vercelToken,
+    };
+}
+/**
+ * Returns the connector id provisioning recently resolved for `scope`, if
+ * any. Synchronous and free of network or OIDC lookups.
+ */
+export function getProvisionedConnector(scope) {
+    const entry = provisionedConnectors.get(scope.key);
+    if (entry === undefined) {
+        return undefined;
+    }
+    if (entry.expiresAt <= Date.now()) {
+        provisionedConnectors.delete(scope.key);
+        return undefined;
+    }
+    return entry.id;
+}
+/**
+ * Returns the connector id recently provisioned for `connector` against the
+ * same Vercel API and explicitly configured Vercel token, when exactly one
+ * server URL has one. Used to target revocation when the caller did not pass
+ * the connection; ambiguous matches return `undefined` so the caller falls
+ * back to the UID rather than guessing.
+ */
+export function findProvisionedConnector(connector, connectOptions) {
+    const endpoint = `${resolveBaseUrl(connectOptions)}${MANAGED_OAUTH_CONNECTOR_PATH}`;
+    const vercelToken = connectOptions?.vercelToken;
+    const now = Date.now();
+    const ids = new Set();
+    for (const entry of provisionedConnectors.values()) {
+        if (entry.connector === connector &&
+            entry.endpoint === endpoint &&
+            entry.vercelToken === vercelToken &&
+            entry.expiresAt > now) {
+            ids.add(entry.id);
+        }
+    }
+    return ids.size === 1 ? ids.values().next().value : undefined;
+}
+/**
+ * Returns every live connector id provisioned for the authored `connector`
+ * across scopes, so eviction can drop token cache entries stored under them
+ * without knowing the connection.
+ */
+export function getProvisionedConnectorIds(connector) {
+    const now = Date.now();
+    const ids = new Set();
+    for (const entry of provisionedConnectors.values()) {
+        if (entry.connector === connector && entry.expiresAt > now) {
+            ids.add(entry.id);
+        }
+    }
+    return [...ids];
+}
+/**
+ * Drops `id` for `scope` after Vercel Connect rejected it. Leaves the entry
+ * alone when another caller has already replaced it.
+ */
+export function forgetProvisionedConnector(scope, id) {
+    if (provisionedConnectors.get(scope.key)?.id === id) {
+        provisionedConnectors.delete(scope.key);
+    }
+}
+/**
+ * Resolves or provisions the managed OAuth connector `scope` refers to and
+ * returns its connector id. The authored connector is sent as the
+ * project-local UID (`projectUid`), so Vercel Connect resolves it within the
+ * deployment's project and environment rather than across the team. Teams
+ * without project UIDs fall back to provisioning by team-global UID.
+ *
+ * The returned id is remembered for {@link getProvisionedConnector}.
+ * Returns `undefined` for non-OAuth connectors or when Vercel Connect does
+ * not report an id.
+ */
+export function provisionEveOAuthConnector(scope, connectOptions) {
+    const existing = inFlightProvisioning.get(scope.key);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const promise = (async () => {
+        const vercelToken = connectOptions?.vercelToken ?? (await getVercelOidcToken());
+        const id = await provisionManagedOAuthConnector(scope, vercelToken);
+        if (id !== undefined) {
+            rememberProvisionedConnector(scope, id);
+        }
+        return id;
+    })().finally(() => {
+        if (inFlightProvisioning.get(scope.key) === promise) {
+            inFlightProvisioning.delete(scope.key);
+        }
+    });
+    inFlightProvisioning.set(scope.key, promise);
+    return promise;
+}
+function rememberProvisionedConnector(scope, id) {
+    provisionedConnectors.delete(scope.key);
+    provisionedConnectors.set(scope.key, {
+        connector: scope.connector,
+        endpoint: scope.endpoint,
+        vercelToken: scope.vercelToken,
+        id,
+        expiresAt: Date.now() + PROVISIONED_CONNECTOR_TTL_MS,
+    });
+    while (provisionedConnectors.size > MAX_PROVISIONED_CONNECTORS) {
+        const oldest = provisionedConnectors.keys().next().value;
+        if (oldest === undefined) {
+            break;
+        }
+        provisionedConnectors.delete(oldest);
     }
-    await promise;
 }
 function resolveServerUrl(connection) {
     const url = connection.url;
@@ -66,35 +215,107 @@ function isProvisionableConnectorUid(connector) {
     }
     return true;
 }
-async function tokenCacheKeyPart(token) {
-    const subtle = globalThis.crypto?.subtle;
-    if (subtle) {
-        const digest = await subtle.digest('SHA-256', new TextEncoder().encode(token));
-        return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+async function provisionManagedOAuthConnector(scope, vercelToken) {
+    const response = await postManagedOAuthConnector(scope, vercelToken, {
+        serverUrl: scope.serverUrl,
+        projectUid: scope.connector,
+    });
+    if (response.ok) {
+        return connectorIdFromResponse(response);
     }
-    let hash = 2166136261;
-    for (let index = 0; index < token.length; index++) {
-        hash ^= token.charCodeAt(index);
-        hash = Math.imul(hash, 16777619);
+    const setup = await setupDetailsFromResponse(response.clone());
+    const error = await createConnectErrorFromResponse(response, 'Failed to provision connector');
+    if (isProjectUidUnsupported(error)) {
+        return provisionByTeamUid(scope, vercelToken);
     }
-    return `${token.length}:${hash >>> 0}`;
+    throw toProvisioningError(error, setup);
+}
+/**
+ * Teams without project-local connector UIDs reject `projectUid` with
+ * `404 project_uid_unavailable`; Connect versions that predate OIDC
+ * project UIDs reject it with `403`. Explicit user or team API tokens carry
+ * no deployment project, so Connect rejects `projectUid` with `400` for
+ * them. Provision by team-global UID as before in all of these cases.
+ */
+function isProjectUidUnsupported(error) {
+    return ((error.status === 404 && error.code === 'project_uid_unavailable') ||
+        (error.status === 400 &&
+            error.code === 'bad_request' &&
+            /"projectUid" requires "projectId"/.test(error.message)) ||
+        (error.status === 403 &&
+            error.code === 'forbidden' &&
+            /"projectUid" is not allowed/.test(error.message)));
 }
-function isNonOAuthConnectorConflict(error) {
-    return (error instanceof ConnectError &&
-        error.status === 409 &&
-        /not an OAuth connector/i.test(error.message));
+async function provisionByTeamUid(scope, vercelToken) {
+    const response = await postManagedOAuthConnector(scope, vercelToken, {
+        serverUrl: scope.serverUrl,
+        uid: scope.connector,
+    });
+    if (response.ok) {
+        return connectorIdFromResponse(response);
+    }
+    const error = await createConnectErrorFromResponse(response, 'Failed to provision connector');
+    if (error.status === 409 && /not an OAuth connector/i.test(error.message)) {
+        return undefined;
+    }
+    throw error;
 }
-async function provisionManagedOAuthConnector({ connector, serverUrl, vercelToken, endpoint, }) {
-    const response = await fetch(endpoint, {
+function postManagedOAuthConnector(scope, vercelToken, body) {
+    return fetch(scope.endpoint, {
         method: 'POST',
         headers: {
             Accept: 'application/json',
             'Content-Type': 'application/json',
             Authorization: `Bearer ${vercelToken}`,
         },
-        body: JSON.stringify({ serverUrl, uid: connector }),
+        body: JSON.stringify(body),
     });
-    if (!response.ok) {
-        throw await createConnectErrorFromResponse(response, 'Failed to provision connector');
+}
+async function connectorIdFromResponse(response) {
+    try {
+        const body = await response.json();
+        return isRecord(body) && typeof body.id === 'string' && body.id !== ''
+            ? body.id
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function toProvisioningError(error, setup) {
+    const options = {
+        code: error.code,
+        status: error.status,
+        statusText: error.statusText,
+        vendor: error.vendor,
+    };
+    if (error.code === 'connector_setup_required') {
+        return new ConnectorSetupRequiredError(error.message, {
+            ...options,
+            ...setup,
+        });
     }
+    if (error.code === 'connector_provisioning_in_progress') {
+        return new ConnectorProvisioningInProgressError(error.message, options);
+    }
+    return error;
+}
+async function setupDetailsFromResponse(response) {
+    try {
+        const body = await response.json();
+        if (!isRecord(body) || !isRecord(body.error)) {
+            return {};
+        }
+        const { reason, connectorId } = body.error;
+        return {
+            ...(typeof reason === 'string' ? { reason } : {}),
+            ...(typeof connectorId === 'string' ? { connectorId } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "2.5.7-snapshot-c4f338842961",
+  "version": "2.6.0",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -50,7 +50,7 @@
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "4.0.5-snapshot-c4f338842961"
+    "@vercel/oidc": "4.0.5"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",