@vercel/connect 2.7.0 → 2.8.0-snapshot-b8e5bb846796

package/README.md

@@ -2,9 +2,10 @@
 
 SDK for obtaining scoped tokens for third-party services on behalf of apps or users. Authenticates the calling Vercel project via [`@vercel/oidc`](https://www.npmjs.com/package/@vercel/oidc) and exchanges the OIDC token for a Vercel Connect-issued credential.
 
-Eight entrypoints, all ESM:
+Entrypoints, all ESM:
 
 - `@vercel/connect` — core token / authorization SDK
+- `@vercel/connect/aws` — AWS credentials and a lazy AWS SDK credentials provider (no AWS SDK runtime dependency)
 - `@vercel/connect/chat` — adapter helpers for the [Chat SDK](https://chat-sdk.dev) (`chat`): `connectSlackAdapter`, `connectDiscordAdapter`, `connectGitHubAdapter`, `connectLinearAdapter`, `connectNotionAdapter`, `connectTelegramAdapter`, `connectSendblueAdapter`, `connectTeamsAdapter` (no Chat SDK dependency — returns structural config)
 - `@vercel/connect/ai-sdk` — [Vercel AI SDK](https://ai-sdk.dev) glue: re-exports `connectAuthProvider` for MCP transports (optional peers: `ai`, `@ai-sdk/mcp`)
 - `@vercel/connect/mcp` — canonical MCP-spec `OAuthClientProvider` for any MCP client (no SDK dependency; returns a self-contained `ConnectOAuthClientProvider` assignable to `@ai-sdk/mcp` and `@modelcontextprotocol/sdk`)
@@ -58,6 +59,42 @@ const { url } = await startAuthorization(
 );
 ```
 
+### AWS SDK
+
+Use an AWS OIDC connector with any AWS SDK client that accepts a credentials
+provider:
+
+```ts
+import { S3Client } from '@aws-sdk/client-s3';
+import { connectAwsCredentialsProvider } from '@vercel/connect/aws';
+
+const s3 = new S3Client({
+  region: 'us-east-1',
+  credentials: connectAwsCredentialsProvider('aws/production', {
+    roleArn: 'arn:aws:iam::123456789012:role/MyRole',
+  }),
+});
+```
+
+Both helpers accept `(connector, params?, options?)` and request app-scoped
+credentials. The optional `params.roleArn` selects the IAM role; omit it to use
+the connector's configured default role.
+
+For a single credential lookup:
+
+```ts
+import { getAwsCredentials } from '@vercel/connect/aws';
+
+const credentials = await getAwsCredentials('aws/production');
+```
+
+`getAwsCredentials` parses the JSON returned by `getToken`. The provider also
+includes the token response's expiration as a `Date`, so long-lived AWS SDK
+clients can refresh credentials. Both use Connect's token cache and accept the
+standard options, including `vercelToken`, `region`, and `forceRefresh`. The
+Connect `region` option controls API routing; configure the AWS region on the
+AWS client separately.
+
 ### Chat SDK
 
 Spread the helper into the matching `create*Adapter` factory. Each helper

package/dist/aws/credentials.d.ts

@@ -0,0 +1,32 @@
+import { type ConnectOptions } from '../token.js';
+/** AWS SDK-compatible credentials, without a dependency on AWS SDK types. */
+export interface ConnectAwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    /** Provided by {@link connectAwsCredentialsProvider} for SDK refreshes. */
+    expiration?: Date;
+}
+export interface ConnectAwsCredentialsParams {
+    /** IAM role ARN to assume. Defaults to the connector's configured role. */
+    roleArn?: string;
+}
+/**
+ * Get AWS credentials from a Vercel Connect AWS OIDC connector.
+ *
+ * Parses the JSON returned by {@link getToken} into AWS SDK credential fields.
+ * Requests an app-scoped token and uses Connect's token cache.
+ *
+ * For long-lived AWS SDK clients, use {@link connectAwsCredentialsProvider} so
+ * the SDK receives credential expiration and can refresh automatically.
+ */
+export declare function getAwsCredentials(connector: string, params?: ConnectAwsCredentialsParams, options?: ConnectOptions): Promise<ConnectAwsCredentials>;
+/**
+ * Create a lazy AWS SDK credentials provider backed by Vercel Connect.
+ *
+ * Accepts the same arguments as {@link getAwsCredentials}. The provider includes
+ * the token response's expiration as a `Date`, allowing AWS SDK clients to
+ * refresh temporary credentials. This is a conservative refresh deadline and
+ * may be earlier than the AWS credentials' actual expiration.
+ */
+export declare function connectAwsCredentialsProvider(connector: string, params?: ConnectAwsCredentialsParams, options?: ConnectOptions): () => Promise<ConnectAwsCredentials>;

package/dist/aws/credentials.js

@@ -0,0 +1,37 @@
+import { getToken, getTokenResponse, } from '../token.js';
+/**
+ * Get AWS credentials from a Vercel Connect AWS OIDC connector.
+ *
+ * Parses the JSON returned by {@link getToken} into AWS SDK credential fields.
+ * Requests an app-scoped token and uses Connect's token cache.
+ *
+ * For long-lived AWS SDK clients, use {@link connectAwsCredentialsProvider} so
+ * the SDK receives credential expiration and can refresh automatically.
+ */
+export async function getAwsCredentials(connector, params, options) {
+    const token = await getToken(connector, tokenParams(params), options);
+    return JSON.parse(token);
+}
+/**
+ * Create a lazy AWS SDK credentials provider backed by Vercel Connect.
+ *
+ * Accepts the same arguments as {@link getAwsCredentials}. The provider includes
+ * the token response's expiration as a `Date`, allowing AWS SDK clients to
+ * refresh temporary credentials. This is a conservative refresh deadline and
+ * may be earlier than the AWS credentials' actual expiration.
+ */
+export function connectAwsCredentialsProvider(connector, params, options) {
+    return (async () => {
+        const { token, expiresAt } = await getTokenResponse(connector, tokenParams(params), options);
+        return {
+            ...JSON.parse(token),
+            expiration: new Date(expiresAt),
+        };
+    });
+}
+function tokenParams({ roleArn, } = {}) {
+    return {
+        subject: { type: 'app' },
+        ...(roleArn === undefined ? {} : { scopes: [roleArn] }),
+    };
+}

package/dist/aws/index.d.ts

@@ -0,0 +1 @@
+export { connectAwsCredentialsProvider, getAwsCredentials, type ConnectAwsCredentials, type ConnectAwsCredentialsParams, } from './credentials.js';

package/dist/aws/index.js

@@ -0,0 +1 @@
+export { connectAwsCredentialsProvider, getAwsCredentials, } from './credentials.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "2.7.0",
+  "version": "2.8.0-snapshot-b8e5bb846796",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -13,6 +13,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./aws": {
+      "types": "./dist/aws/index.d.ts",
+      "default": "./dist/aws/index.js"
+    },
     "./chat": {
       "types": "./dist/chat/index.d.ts",
       "default": "./dist/chat/index.js"
@@ -50,7 +54,7 @@
     "dist"
   ],
   "dependencies": {
-    "@vercel/oidc": "4.0.5"
+    "@vercel/oidc": "4.0.6-snapshot-b8e5bb846796"
   },
   "peerDependencies": {
     "@ai-sdk/mcp": "^1 || ^2",
@@ -89,6 +93,7 @@
     "@auth/core": "0.41.3",
     "@chat-adapter/slack": "4.31.0",
     "@modelcontextprotocol/sdk": "1.29.0",
+    "@smithy/types": "3.3.0",
     "@tanstack/ai-mcp": "0.3.10",
     "ai": "7.0.26",
     "better-auth": "1.5.5",