skills/vercel__chat
1
0
Fork 0
mirror of https://github.com/vercel/chat.git synced 2026-09-14 18:32:29 +08:00
Code Issues Packages Projects Releases Wiki Activity
863 Commits 95 Branches 713 Tags
@chat-adapter/github@4.38.0
Commit Graph

110 Commits

Author SHA1 Message Date
Bryan Hunter bdeb2bf1b1 fix(workflow): isolate chat serializers from node runtime (#806) 
## Failure

Workflow SDK `5.0.0-beta.40` produces an invalid workflow bundle when a
Chat SDK serializable class such as `Message`, `ThreadImpl`, or
`ChannelImpl` crosses a workflow step boundary.

The Workflow compiler imports the emitted module containing each class
to register its `@workflow/serde` methods. In Chat SDK `4.37.0`, tsup
emits those classes in `dist/index.js`. The root entry also imports the
conversation-scoping implementation added in #751, which uses
`AsyncLocalStorage` from `node:async_hooks`. Serializer registration
therefore pulls Node-only code into the sandboxed workflow bundle before
any workflow or step executes.

Build warning:

```text
Serde warning for classes "ChannelImpl", "Message", "ThreadImpl":
Workflow bundle contains Node.js built-in imports: async_hooks.
These will fail at runtime in the workflow sandbox.
```

Deployed workflows then fail during module initialization:

```text
var import_async_hooks = require("async_hooks");
                         ^

ReferenceError: require is not defined
```

## Minimal reproduction

```json
{
  "dependencies": {
    "chat": "4.37.0",
    "workflow": "5.0.0-beta.40"
  }
}
```

```ts
import { Message } from "chat";

async function createMessageStep(value: string): Promise<Message> {
  "use step";

  return new Message({
    id: "message",
    threadId: "slack:C123:123.456",
    text: value,
    formatted: {
      type: "root",
      children: [
        {
          type: "paragraph",
          children: [{ type: "text", value }],
        },
      ],
    },
    raw: {},
    author: {
      userId: "U123",
      userName: "user",
      fullName: "User",
      isBot: false,
      isMe: false,
    },
    metadata: { dateSent: new Date(), edited: false },
    attachments: [],
  });
}

export async function testWorkflow(value: string): Promise<string> {
  "use workflow";

  const message = await createMessageStep(value);
  return message.text;
}
```

Running `workflow build` on `4.37.0` emits the warning; deploying the
output produces the runtime failure above.

## Fix

- Add a dedicated `chat/serialization` package entry for `Message`,
`ThreadImpl`, `ChannelImpl`, `reviver`, and their serialized DTO types.
- Make serializer code a second tsup entry and explicitly enable
splitting. The serializer-bearing classes are now emitted into a shared
chunk with no dependency on `Chat` or its Node-only conversation
context.
- Preserve the existing root exports and automatic `@workflow/serde`
behavior. Existing `import { Message } from "chat"` workflow code
remains valid.
- Add a post-build module-graph assertion that fails if any emitted
serializer registration can transitively import a Node.js builtin.
- Test against Workflow SDK `5.0.0-beta.40`, the compiler version that
exposed the invalid bundle.
- Add a minor changeset for the fixed-version Chat SDK packages,
producing the `4.38.0` release line.

After the change, the emitted serializer classes live in a sandbox-safe
shared chunk while `AsyncLocalStorage` remains in a separate Node
runtime chunk. The exact reproduction compiles successfully with `5
steps, 1 workflow` and no Serde warning.

## Control cases

The failure requires a serializable Chat class to cross a durable
boundary. These cases were already safe and remain unchanged:

- `AsyncLocalStorage` used entirely inside a `"use step"` function.
- A Chat `Message` created and consumed within one step while returning
plain data.
- Request handlers that convert Chat objects to plain workflow DTOs
before starting a workflow.
- `@vercel/sandbox` used entirely inside a step.

## Validation

- Committed beta.40 reproduction fixture: type-correct and compiled
during every Chat package build with no Node builtin / Serde warning.
- Emitted serializer module graph: no transitive Node.js builtins.
- Chat package: 1,113 tests pass.
- Chat package typecheck passes.
- Repository formatting and lint checks pass.
- Package build passes.

Full repository validation reaches the pre-existing `knip` baseline and
reports unrelated unused dependencies and unlisted binaries in examples
and adapter packages.

---------

Signed-off-by: bryan-hunter <bryan.hunter@vercel.com>
 2026-08-10 09:03:49 -05:00
Rich Haines 9188fd7ed4 chore(docs): update @vercel/geistdocs to 1.19.6 (#807) 
Updates `@vercel/geistdocs` from 1.19.4 to 1.19.6.
 2026-08-10 19:33:57 +10:00
Ben Sabic 2a2b2c5500 feat(instagram): add native DM adapter (#770) 
Adds a first-party Instagram Direct Messages adapter backed by Meta's
Instagram API with Instagram Login.

- Verifies webhook challenges and HMAC signatures, then normalizes DMs,
story replies, media, quick replies, postbacks, and reactions.
- Sends plain text, cards, quick replies, typing indicators, URL
attachments, and uploaded media through `graph.instagram.com`.
- Maps authentication, rate-limit, and 24-hour messaging-window failures
to typed adapter errors.
- Registers Instagram in the adapter catalog, CLI scaffold, official
docs, replay suite, and Next.js example.

## Usage

```ts
import { createInstagramAdapter } from "@chat-adapter/instagram";
import { Chat } from "chat";

const bot = new Chat({
  userName: "mystore",
  adapters: { instagram: createInstagramAdapter() },
});
```

## Webhook

```ts
export async function POST(request: Request) {
  return bot.webhooks.instagram(request);
}
```

## Verification

- `pnpm --filter @chat-adapter/instagram test`
- `pnpm --filter @chat-adapter/instagram typecheck`
- `pnpm --filter example-nextjs-chat typecheck`
- `pnpm --filter example-nextjs-chat build`
- `pnpm check`
- `pnpm konsistent`

## Live Testing

<table>
  <tr>
<td><img width="1440" height="2109" alt="1000000502"
src="https://github.com/user-attachments/assets/9fdb8c3b-4e41-4c81-9426-08756a5e4201"
/></td>
<td><img width="1440" height="1995" alt="1000000503"
src="https://github.com/user-attachments/assets/8a572493-c57a-4412-9049-5737aaa9dfd0"
/></td>
  </tr>
</table>

Closes #729 / Co-Authored by @ivandujaut

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-08-07 17:38:15 +01:00
Ben Sabic 0ec6a7361b feat(notion): add Notion comments adapter (#689) 
Adds `@chat-adapter/notion`, an official adapter that lets a Chat SDK
bot take part in **Notion comment discussions** (page-level and
block/discussion threads) with the same handler code used for Slack,
Linear, GitHub, etc. Inbound events arrive via Notion webhooks
(`comment.created`) with HMAC signature verification; outbound actions
use the Comments REST API. Because Notion lets a connection edit its own
comments, the adapter supports **Post+Edit streaming**.

### Highlights

- **Webhooks** — `comment.created` verified with `X-Notion-Signature`
HMAC over the raw body (timing-safe), plus the one-time
`verification_token` handshake. Returns a fast 200 with idempotent,
state-backed dedupe.
- **Post+Edit streaming** — posts the first chunk, then `PATCH`es the
comment as tokens arrive, throttled to Notion's ~3 req/s limit (global
token bucket, `Retry-After` aware). Long bodies are split into
sequential comments to stay under the 2000-char rich-text cap.
- **Mentions** — three modes: `mention` (default; plain-text `@userName`
/ `@botUserId`), `all-comments`, and `keyword`.
- **`message.subject`** — resolves the parent page via the Pages API
(title, url, archived status, author).
- **File uploads** — up to 3 native attachments via the File Uploads API
(binary `single_part`; public URLs via `external_url` with bounded
polling); overflow and failures fall back to markdown links.
- **History** — `fetchMessages` over list-comments (open comments only),
direction-aware.
- Cards render as markdown fallback; reactions / typing / DMs are typed
no-ops or errors. Registered in the `chat/adapters` catalog and the
`create-chat-sdk` scaffold; pinned to `Notion-Version: 2026-03-11`.

### Usage

```ts
// lib/bot.ts
import { Chat } from "chat";
import { createNotionAdapter } from "@chat-adapter/notion";
import { createRedisState } from "@chat-adapter/state-redis";

export const bot = new Chat({
  userName: "notion-bot",
  adapters: { notion: createNotionAdapter() }, // reads NOTION_TOKEN + NOTION_VERIFICATION_TOKEN
  state: createRedisState(),
});

bot.onNewMention(async (thread, message) => {
  const subject = await message.subject; // parent page metadata (title, url, …)
  await thread.post(`Thanks for the mention on **${subject?.title ?? "this page"}**!`);
});
```

```ts
// app/api/webhooks/notion/route.ts
import { bot } from "@/lib/bot";

export const POST = (request: Request): Promise<Response> => bot.webhooks.notion(request);
```

### Configuration

Auto-detects `NOTION_TOKEN` and `NOTION_VERIFICATION_TOKEN`, plus
optional `NOTION_BOT_USERNAME`, `NOTION_MENTION_MODE`,
`NOTION_KEYWORDS`, and `NOTION_VERSION`; everything is overridable via
`createNotionAdapter({ … })`. The docs page covers the full connection +
webhook setup (capabilities, content access, and the webhook-URL-lock
warning).

Changeset bumps `@chat-adapter/notion`, `chat`, and `create-chat-sdk`
(minor). Layered as four commits: `feat` (adapter +
catalog/scaffold/emoji), `docs`, `test`, `chore(example)`.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-08-05 14:15:44 +01:00
christopherkindl 0334e97b62 chore(docs): upgrade geistdocs to 1.19.4 (#783) 
Bumps `@vercel/geistdocs` in the docs app from 1.19.2 to 1.19.4 (to fix
safari logo bug)
 2026-08-05 11:48:40 +10:00
josh 7714d766e6 fix: remove duplicate lockfile entries (#766) 
## summary

`pnpm-lock.yaml` on main has duplicated `nanoid@3.3.16` and
`postcss@8.5.25` keys after #740 and #744 merged back to back, so `pnpm
install --frozen-lockfile` fails and every ci job on main is red

```
ERR_PNPM_BROKEN_LOCKFILE  duplicated mapping key (10069:3)
```

the duplicate blocks are byte identical, so this deletes the extras and
changes no versions. regenerating the lockfile was not an option:
`.npmrc` sets `min-release-age=2`, which re-resolves to older packages
and would have reverted both bumps
 2026-08-01 00:59:16 +01:00
dependabot[bot] 7cda0e008e build(deps-dev): bump postcss from 8.5.16 to 8.5.18 (#744) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to
8.5.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/4c0d194c136fd374495d0993c890d794cab65b81"><code>4c0d194</code></a>
Release 8.5.18 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/92b4e7891ec7b811821d01acc8aa0f010caf41e2"><code>92b4e78</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"><code>95663d3</code></a>
Limit where source map can be loaded for security reasons</li>
<li><a
href="https://github.com/postcss/postcss/commit/74e25ae9f4efaa56a41a449064a655d7da78072c"><code>74e25ae</code></a>
Release 8.5.17 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/d1518afd5a88f42728b30b87f8917210f363f9f1"><code>d1518af</code></a>
Fix Maximum call stack size exceeded error</li>
<li><a
href="https://github.com/postcss/postcss/commit/2421312ffea96ba77b35ce24a1b2d9c2e22b5e83"><code>2421312</code></a>
Fix linter</li>
<li><a
href="https://github.com/postcss/postcss/commit/a50352c583df991710f92ccac25b36304695161a"><code>a50352c</code></a>
Fix CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/33948f0969bb858acdd52c9692e3a785a3ed0a73"><code>33948f0</code></a>
Prevent prototype hijacking in fromJSON</li>
<li><a
href="https://github.com/postcss/postcss/commit/2131909351161cd2c5fc2be58b14919a873ea824"><code>2131909</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/93440abcca92793b31c5d1fdf5f2da7b58b27599"><code>93440ab</code></a>
Fix non-closed <code>\&lt;div align=&quot;center&quot;&gt;</code> in
README (<a
href="https://redirect.github.com/postcss/postcss/issues/2110">#2110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.16...8.5.18">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 00:43:07 +01:00
dependabot[bot] 379842f2b2 build(deps): bump next from 16.2.6 to 16.2.11 (#740) 
Bumps [next](https://github.com/vercel/next.js) from 16.2.6 to 16.2.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.2.11</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v16.2.10</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 16.2.4.</p>
<h2>v16.2.9</h2>
<p>Empty release to ensure <code>next@latest</code> points at a stable
release. Next.js only allows publishing with Trusted Publishing enabled.
In order to fix NPM dist-tags, we have to release a new version.
Updating dist-tags is not possible with Trusted Publishing.</p>
<h2>v16.2.8</h2>
<p>Release with no changes in an attempt to fix <code>next@latest</code>
pointing at a prerelease version.</p>
<h2>v16.2.7</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Backport documentation fixes for v16.2 (<a
href="https://redirect.github.com/vercel/next.js/issues/93804">#93804</a>)</li>
<li>[backport] Patch <code>playwright-core</code> to resolve
<code>_finishedPromise</code> on <code>requestFailed</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93920">#93920</a>)</li>
<li>[backport] Fix dev mode hydration failure when page is served from
HTTP cache (<a
href="https://redirect.github.com/vercel/next.js/issues/93492">#93492</a>)</li>
<li>[backport] Fix catch-all <code>router.query</code> corruption with
<code>basePath</code> + <code>rewrites</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93917">#93917</a>)</li>
<li>[backport] Encode non-ASCII characters in cache tags at construction
(<a
href="https://redirect.github.com/vercel/next.js/issues/93918">#93918</a>)</li>
<li>[backport] Fix server action forwarding loop with middleware
rewrites (<a
href="https://redirect.github.com/vercel/next.js/issues/93919">#93919</a>)</li>
<li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a
href="https://redirect.github.com/vercel/next.js/issues/93932">#93932</a>)</li>
<li>[ci] Disable hanging node 24 typescript tests on 16.2 backport
branch (<a
href="https://redirect.github.com/vercel/next.js/issues/94164">#94164</a>)</li>
<li>[backport] Fix &quot;type: module&quot; in project dir when using
standalone or adapters (<a
href="https://redirect.github.com/vercel/next.js/issues/94050">#94050</a>)</li>
<li>[backport] Propagate adapter preferred regions (<a
href="https://redirect.github.com/vercel/next.js/issues/94200">#94200</a>)</li>
<li>[16.2.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94240">#94240</a>)</li>
<li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS
config resolution (<a
href="https://redirect.github.com/vercel/next.js/issues/94284">#94284</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a
href="https://github.com/icyJoseph"><code>@​icyJoseph</code></a>, <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a>, <a
href="https://github.com/mischnic"><code>@​mischnic</code></a>, <a
href="https://github.com/bgw"><code>@​bgw</code></a>, <a
href="https://github.com/timneutkens"><code>@​timneutkens</code></a>,
and <a
href="https://github.com/lukesandberg"><code>@​lukesandberg</code></a>
for helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/9beca0821cf4606ae33466ed6f4fc75f2887a4da"><code>9beca08</code></a>
v16.2.11</li>
<li><a
href="https://github.com/vercel/next.js/commit/3c48c7af78f2c01691065cb303da1b107a2c8617"><code>3c48c7a</code></a>
[16.x] Fix Turbopack middleware matcher with i18n single locale</li>
<li><a
href="https://github.com/vercel/next.js/commit/ac1eff3f7a7285176396ecc69c3b160a3d6ad1a2"><code>ac1eff3</code></a>
[16.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17"><code>9a4651e</code></a>
[16.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b"><code>b512063</code></a>
[16.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599"><code>d303326</code></a>
[16.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a"><code>73b9487</code></a>
[16.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/bf9d17fb30501829f6fd7c0ee8e44e2794565742"><code>bf9d17f</code></a>
[16.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/fe28768f533582ea8f6ee7d7a7498715927d45f5"><code>fe28768</code></a>
[16.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/d8afb8d550ac4ac5c106ea1410c3af43eaf1d469"><code>d8afb8d</code></a>
[16.x] Performance improvements when decoding React Server function
payloads</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.2.6...v16.2.11">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 00:42:41 +01:00
christopherkindl 3ae34b3ed1 feat(docs): migrate the homepage to geistdocs 1.19 and the Geist design system (#762) 
Third repo in the design sync, after `vercel/geistdocs#216`/`#218` and
`vercel/flags#457`. Upgrades the docs site to `@vercel/geistdocs@1.19.2`
and brings the homepage onto the Geist design system.

`apps/docs` is `private: true`, so no changeset.

## Dependency

`1.19.2` peers on `next: ^16.2.11` and the app pinned `16.2.6`, so
**next moves to `16.2.12`** alongside it — without that pnpm reports an
unmet peer. Installed via `pnpm add --save-exact` per AGENTS.md. All 20
geistdocs subpaths this app imports still exist in 1.19.2; no API
breakage.

The footer needed no work: 1.16 already shipped the prop-less
Vercel-directory `<Footer />`.

## Layout — `home-grid.css` is gone

Deleted `app/styles/home-grid.css` (368 lines) and its `global.css`
import, and rebuilt each section on `grid-cols-12` / `col-span-*`:

| section | before (CSS) | after |
|---|---|---|
| OSS stats | 2×2 → 4×1 @768 | `col-span-6 min-[768px]:col-span-3` |
| Features | 2-up + full-width 3rd → 3×1 @961 | `col-span-12
sm:col-span-6 lg:col-span-4` |
| Code | stacked → sidebar 1/3 + code 2/3 @961 | `lg:col-span-8` /
`lg:col-span-4`, pinned with `col-start` + `row-start` |
| Integrations | 1×5 → tall left + 2×2 @961 | `lg:col-span-4
lg:row-span-2` + four `lg:col-span-4` |

The code section needs explicit `col-start`/`row-start` because the
sidebar follows the code in the DOM but sits left of it from `lg`.

Other layout changes:

- **Single gutter at the page root** (`mx-auto w-full max-w-[1448px]
px-4 sm:px-6`); removed the per-section horizontal padding that
duplicated it, so every section's content lands on the navbar/footer
content edge.
- **Content widened 1114px → 1400px**, the navbar's content span (1448 −
2×24).
- **Bottom gap above the footer trimmed ~320px → ~176px** — layout
`pb-32` → `pb-16` and page `pb-24 sm:pb-36` → `pb-12 sm:pb-16`. Three
paddings were stacking.

The 768px stats breakpoint is preserved with `min-[768px]:` — there's no
Tailwind equivalent here (`md`=601, `lg`=961) and four KPI columns at
601px would be ~140px each.

## Design — ported from vercel.com/ai-sdk

Read off the flagged source in `front/apps/vercel-marketing/.../ai-sdk`,
not the live site.

- **Code showcase tabs** → the `SlidingTabs` primitive: pill labels with
an animated indicator, full keyboard nav (arrows/Home/End, roving
tabindex), and an invisible-bold label so the tab doesn't shift width
when it bolds. Four tabs per group with dot pagination for the rest,
tabs above the code block. Copied into `components/ui/sliding-tabs.tsx`
with `cn` rewired and the `no-scrollbar` utility inlined (geistdocs
doesn't define it).
- **"Scale with confidence"** → heading and paragraph on one
bottom-aligned row (cols 1–4 / 8–12), then four bordered cards
`col-span-12 md:col-span-6 lg:col-span-3`. Type mapped from their
primitives: `SectionHeading size="48"` → `text-heading-40
lg:text-heading-48`, `SectionParagraph size="18"` → `text-copy-16
lg:text-copy-18`.
- **Feature row** → icon + muted eyebrow over a prominent statement.
Note this **inverts the previous emphasis**: the heading is now the
small muted label and the description the larger line, matching the
reference. Icons come from geistdocs' own set so they match Geist's line
weight: `IconLinked`, `IconWorkflow`, `IconAcronymTs`.
- **Get-started install snippet** → the shared `CommandPrompt`, with its
buttons on one row from `lg`.
- Remaining headings converted to `text-heading-*`.
- Navbar logo drops `height={22}` to take `LogoChatSdk`'s new 18px
default (renders 106.9×22 → 87.4×18).

## Two fixes worth calling out

**`lib/utils.ts` — `cn` was silently dropping typography.** Geist's
`text-copy-*`/`text-heading-*` share the `text-` prefix with colour
utilities, so stock `tailwind-merge` classifies them as colours and
drops the size whenever both appear in one `cn()` call. geistdocs ships
a `cn` that registers them as `font-size` for exactly this reason but
doesn't export it, so the config is replicated here. This was a latent
bug across the app, not just the new code.

**`Analytics`/`SpeedInsights` moved out of the `"use client"` provider**
into the server layout. Both emit `<script>`, and scripts rendered
inside a client tree never execute — so analytics wasn't firing on
client navigations. React 19.2.7 (pulled in by this bump) now warns
about it; the bug predates it.

## Verification

- `pnpm --filter docs build` passes (270 pages), `tsc --noEmit` clean,
`biome check` clean.
- Rendered output spot-checked for the tab strip, dot pagination, card
classes, and feature icons.

**`pnpm validate` could not be run** — it needs Node ≥20.19 and this
machine is on v20.11.1 (`pnpm check` dies on `styleText` from
`node:util`). Biome, tsc and build were run directly instead, but the
knip and test legs are unrun and should be confirmed in CI.

Signed-off-by: christopherkindl <53372002+christopherkindl@users.noreply.github.com>
 2026-07-31 23:53:17 +01:00
Santiago Medina caa63253c5 feat(x): add XChat encrypted messaging support (#745) 
## summary

new `@chat-adapter/xchat` adapter for XChat, X's encrypted messaging.
write bot logic once and hold encrypted 1:1 and group conversations like
the other Chat SDK adapters — all crypto handled inside the adapter via
`@xdevplatform/chat-xdk` (wasm), all REST via the typed
`@xdevplatform/xdk` client.

## background: chat-xdk


[`@xdevplatform/chat-xdk`](https://www.npmjs.com/package/@xdevplatform/chat-xdk)
is the official XChat cryptography SDK — a Rust core compiled to
WebAssembly that implements the XChat encryption protocol. it handles
per-conversation symmetric keys and key exchange, message
encryption/decryption, event signing and signature verification, and
encrypted media (secretstream). the bot's private keys live in a
PIN-protected [Juicebox](https://juicebox.xyz) store (secret-shared
across independent realms), so no key material sits in env vars or on
disk — the adapter unlocks with a PIN at startup. this adapter is the
glue: chat-xdk produces and consumes the encrypted envelopes, the typed
`@xdevplatform/xdk` client moves them over the X API, and everything is
normalized to the Chat SDK's `Thread`/`Message` model.

what it supports:
- encrypted send/receive in DMs and groups (webhook push + polling),
signature verification on by default
- mention detection from structured mention entities, swipe-replies to
the bot, and a plain-text `@handle` fallback; group replies go out as
quoted replies with TTL propagated
- `openDM(userId)`: starts (or reuses) an encrypted 1:1 —
cached/history-recovered conversation key, else a full key exchange so
the bot can message first
- media both ways: inbound attachments with lazy download+decrypt,
outbound encrypted (secretstream) via the 3-step upload flow
- edit and delete of the bot's own messages: edits are encrypted events
targeting the original's sequence id; deletes are locally signed
delete-for-all actions recipients verify
- reactions in and out, typing keep-alive while handlers run,
configurable group welcome message
- read receipts sent per delivered inbound message (`sendReadReceipts`,
default on)
- cards by degradation: text + tappable entities, link buttons as
`label: url` lines, primary link as a URL preview attachment with
optional encrypted banner

key design decisions:
- mdast stays the canonical format; markdown passes through as raw text
(XChat clients render plain text — no markdown), with URLs and @mentions
made tappable via entity spans and tables degraded to ASCII code blocks
- thread ids are `xchat:{conversationId}` (groups `g…`, 1:1s the sorted
participant pair)
- the first edit of a fresh message is age-gated (`editSafetyDelayMs`,
default 5000ms): receiving clients park an edit whose original hasn't
arrived, leaving the message permanently invisible — the gate prevents
that race
- undecryptable or unverified events are dropped, never delivered as
empty messages
- no core changes: the adapter implements the standard `Adapter`
interface only

also includes the `chat/adapters` catalog entry, docs page (with OG
image), `adapters.json` registry entry, and `create-chat-sdk` scaffold
spec, modeled on the `x` adapter's registration.

<details><summary>usage</summary>

```bash
XCHAT_BOT_TOKEN=...    # OAuth2 user access token (identity resolved from GET /2/users/me)
XCHAT_PIN=...          # Juicebox PIN that unlocks the bot's keys
X_CONSUMER_SECRET=...  # optional: verifies webhook signatures
```

```typescript
import { Chat } from "chat";
import { createXchatAdapter } from "@chat-adapter/xchat";
import { createMemoryState } from "@chat-adapter/state-memory";

const bot = new Chat({
  userName: "mybot",
  adapters: { xchat: createXchatAdapter() }, // credentials from env
  state: createMemoryState(),
});

// DMs always
bot.onDirectMessage(async (thread, message) => {
  await thread.post(`You said: ${message.text}`);
});

// group chats when the bot is @mentioned
bot.onNewMention(async (thread, message) => {
  await thread.post("You rang?");
});

// wire the webhook (e.g. a Next.js route)
export async function POST(request: Request) {
  return bot.webhooks.xchat(request);
}
```

</details>

testing: 109 unit tests, including real-wasm-crypto round trips against
vendored fixture vectors (decrypt + signature verification, webhook
delivery, read receipts, edit age-gating, signed deletes). verified live
against production XChat: DMs, group mentions, media, reactions, edits,
deletes, openDM, cards.

note on the lockfile: `@xdevplatform/xdk@0.6.6` was published <48h ago,
so it was resolved with a one-shot `--config.minimumReleaseAge=0`
override; the locked integrity hash was verified against the npm
registry. the repo policy file is untouched.

---------

Co-authored-by: dancer <josh@afterima.ge>
 2026-07-31 23:52:18 +01:00
christopherkindl f6b64318d9 chore(docs): upgrade geistdocs to 1.16.0 (#747) 
Upgrades the docs to `@vercel/geistdocs@1.16.0`.

- Bump `@vercel/geistdocs` 1.15.5 → 1.16.0
- Drop the removed `config` prop from `<Footer />` (1.16.0 replaces the
footer with the Vercel product directory and no longer accepts props)
- Load Geist Sans from the `geist` npm package so the new `ss11`
stylistic set (alternate "I") renders — Google Fonts strips it
 2026-07-28 00:27:52 +10:00
christopherkindl 1d0295f996 chore(docs): upgrade geistdocs to 1.15.5 (#743) 
- Upgrade `@vercel/geistdocs` to 1.15.5
- New navbar flyout menu style + nav items in flyout menu are rendered
server-side to be in the html for crawlers (as requested by Malte)
- Homepage section titles use Geist sans heading tokens (new vercel.com
style)

| **New flyout menu**  | **Improved docs mobile layout** |
| ------------- | ------------- |
| <video
src="https://github.com/user-attachments/assets/7baf37d9-7a87-4853-91fb-6c3febf974cb"
/> | <img width="499" height="747" alt="image"
src="https://github.com/user-attachments/assets/b48a955e-0e15-4e03-ada2-fbc52c2fdcb7"
/> |

**Preview:** https://chat-git-chore-geistdocs-1155.vercel.sh/
 2026-07-24 21:03:56 +01:00
Utopia 5eb8b846a7 feat(teams): support outbound reactions (#734) 
Outbound Teams reactions were originally implemented as part of #302,
then removed because the Teams feature was not fully rolled out. In [the
follow-up
discussion](https://github.com/vercel/chat/pull/302#issuecomment-4147056867),
the Teams SDK maintainer said they were happy to add the support back
once the rollout was ready. Microsoft now documents agent reaction
support without a preview caveat.

This PR restores that support against the current Teams SDK API:

- implement `addReaction` and `removeReaction` with
`conversations.addReaction` / `conversations.deleteReaction`
- pass native Teams reaction IDs through unchanged and map common
normalized Chat SDK emoji names to their Teams IDs
- upgrade the aligned `@microsoft/teams.*` dependencies to 2.0.14
- update the Teams feature matrices and add a minor changeset

The implementation stays within the existing adapter methods and does
not add another abstraction or affect streaming behavior.

---------

Signed-off-by: Utopia <154325211+Utopi-a@users.noreply.github.com>
 2026-07-23 10:52:00 +10:00
dependabot[bot] b4a93bdbc5 build(deps-dev): bump @hono/node-server from 2.0.2 to 2.0.10 (#733) 
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
2.0.2 to 2.0.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases">@​hono/node-server's
releases</a>.</em></p>
<blockquote>
<h2>v2.0.10</h2>
<h2>Security fixes</h2>
<p>This release includes a fix for the following security issue:</p>
<h3>Unauthenticated memory-leak DoS via aborted WebSocket handshake</h3>
<p>Affects: <code>upgradeWebSocket</code>. A WebSocket upgrade request
with a missing or malformed <code>Sec-WebSocket-Key</code> header leaked
the request's <code>IncomingMessage</code> and left a promise pending,
even though no connection was established. Since the route is reachable
pre-handshake without authentication, an attacker could flood it to
gradually exhaust memory. <a
href="https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg">GHSA-9mqv-5hh9-4cgg</a></p>
<hr />
<p>Users of <code>upgradeWebSocket</code> are encouraged to upgrade to
this version.</p>
<h2>v2.0.9</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(websocket): polyfill missing ErrorEvent global by <a
href="https://github.com/otnc"><code>@​otnc</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li>
<li>fix(serve-static): correct Range header parsing edge cases by <a
href="https://github.com/otnc"><code>@​otnc</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/372">honojs/node-server#372</a></li>
<li>fix: recover complete request bodies after client disconnect by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/375">honojs/node-server#375</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/otnc"><code>@​otnc</code></a> made their
first contribution in <a
href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9">https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9</a></p>
<h2>v2.0.8</h2>
<h2>What's Changed</h2>
<ul>
<li>ci(release): add <code>--no-git-checks</code> option for <code>pnpm
stage publish</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/369">honojs/node-server#369</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8">https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8</a></p>
<h2>v2.0.7</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: migrate to pnpm by <a
href="https://github.com/BlankParticle"><code>@​BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/node-server/pull/367">honojs/node-server#367</a></li>
<li>fix(serve-static): serve precompressed files for
application/octet-stream by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/366">honojs/node-server#366</a></li>
<li>chore: bump <code>supertest</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/368">honojs/node-server#368</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7">https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7</a></p>
<h2>v2.0.6</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: publish to npm from CI with OIDC trusted publishing and bump
<code>np</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/361">honojs/node-server#361</a></li>
<li>ci: use npm Staged publishing by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/364">honojs/node-server#364</a></li>
<li>fix: preserve status and statusText when cloning a Response with
liveheaders by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/363">honojs/node-server#363</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6">https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6</a></p>
<h2>v2.0.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/7c1457ed5536c02fdd2f001129fae67bcbca54a1"><code>7c1457e</code></a>
2.0.10</li>
<li><a
href="https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1"><code>3a21938</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/98420217e53a17a238ef1aa1a6bef0b2b70136c5"><code>9842021</code></a>
2.0.9</li>
<li><a
href="https://github.com/honojs/node-server/commit/51f3bf56f56d9691ec0f7e1562a96f0b485a7dd9"><code>51f3bf5</code></a>
fix: recover complete request bodies after client disconnect (<a
href="https://redirect.github.com/honojs/node-server/issues/375">#375</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/fdb87badbe313cfbfe6bb2355e9893dc0698d2bd"><code>fdb87ba</code></a>
fix(serve-static): correct Range header parsing edge cases (<a
href="https://redirect.github.com/honojs/node-server/issues/372">#372</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/912e3fd80c4311756f724bd566de1433c8d772d9"><code>912e3fd</code></a>
fix(websocket): polyfill missing ErrorEvent global (<a
href="https://redirect.github.com/honojs/node-server/issues/371">#371</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/114c15efb38dabaf81af774ddb764409e3d156d8"><code>114c15e</code></a>
2.0.8</li>
<li><a
href="https://github.com/honojs/node-server/commit/5db2d5df662cd69ff5c4cc23b8ecb3a6f63e4e38"><code>5db2d5d</code></a>
ci(release): add <code>--no-git-checks</code> option for <code>pnpm
stage publish</code> (<a
href="https://redirect.github.com/honojs/node-server/issues/369">#369</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/a528a77ed2c28dc12775c849abc6b6df6d4cb44c"><code>a528a77</code></a>
2.0.7</li>
<li><a
href="https://github.com/honojs/node-server/commit/b2d610c1e37a96639fbb2eae662e858800aa8906"><code>b2d610c</code></a>
chore: bump <code>supertest</code> (<a
href="https://redirect.github.com/honojs/node-server/issues/368">#368</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/node-server/compare/v2.0.2...v2.0.10">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​hono/node-server</code> since your current
version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@hono/node-server&package-manager=npm_and_yarn&previous-version=2.0.2&new-version=2.0.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 13:15:31 +10:00
Ben Sabic 4cb7e5d58e feat(chat): durable human-in-the-loop approvals via chat/workflow (#728) 
Adds a `chat/workflow` subpath export with `requestApproval()`. This is
the DX from #284, rebuilt on Workflow SDK so the approval survives
deploys, restarts, and arbitrarily long waits. No in-memory promises, no
approvals registry, no restart-recovery machinery: the workflow suspends
on a webhook and resumes when a button is clicked.

`requestApproval()` posts a card with Approve/Deny buttons whose
`callbackUrl` targets a `createWebhook()` URL, suspends the workflow
until a decision (or optional durable-sleep timeout), validates
approvers, finalizes the card in place with the outcome (removing the
buttons, leaving an audit trail), and returns the decision.

```typescript
import { requestApproval } from "chat/workflow";
import type { Thread } from "chat";
export async function deployApproval(opts: { thread: Thread; version: string }) {
  "use workflow";
  const { approved, user, timedOut } = await requestApproval(opts.thread, {
    title: `Deploy ${opts.version}?`,
    fields: { Version: opts.version },
    timeout: "24h",
    approvers: ["U_ALICE", "U_BOB"],
  });
  if (approved) {
    await deploy(opts.version);
  }
}
```

Starting it from a handler is one line. `Thread` instances serialize
across the workflow boundary automatically via the existing
`@workflow/serde` hooks on `ThreadImpl` (requires
`chat.registerSingleton()`):

```typescript
import { start } from "workflow/api";
bot.onNewMention(async (thread, message) => {
  await start(deployApproval, [{ thread, version: parseVersion(message.text) }]);
});
```

**Details**

- `workflow` is a new **optional** peer dependency (same pattern as
`ai`); the subpath is the only code that imports it
- Unauthorized clicks (when `approvers` is set) and unrecognizable
payloads post a notice / are ignored, and the workflow keeps waiting
- On timeout the card is finalized as timed out and the result has
`timedOut: true`
- Card builders (`buildApprovalCard`, `buildResolvedCard`) are exported
for custom flows
- Verified the published `dist` preserves the `"use step"` directives
and down-levels `using` correctly, so the app-side Workflow SDK compiler
handles the library code
- Docs page under Interactivity; changeset (`chat` minor); 8 unit tests
mocking the `workflow` primitives

**Deliberate deviation from #284:** no `thread.requestApproval()`
method. The function must suspend at workflow level, so hanging it off
`ThreadImpl` would make `workflow` a hard dependency of core (or require
prototype patching). The standalone `requestApproval(thread, options)`
keeps the dependency optional.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-22 10:18:38 +10:00
Rich Haines d616072f45 chore(docs): update @vercel/geistdocs to 1.13.0 (#727) 
## Summary

- update the Chat SDK docs app to `@vercel/geistdocs` 1.13.0
- use the package-owned Tailwind sources introduced since 1.10.0
- align docs content spacing and breadcrumb visibility with the new
container-responsive sidebar


https://chat-git-chore-update-geistdocs.vercel.sh/docs


## Testing

- `pnpm install --force --frozen-lockfile`
- `pnpm --filter docs exec tsc --noEmit`
- `pnpm --filter docs build`
- `pnpm exec turbo typecheck --filter='!example-nuxt-chat'`
- `pnpm exec turbo test --filter='!example-nextjs-chat' --filter='!docs'
--filter='!example-nuxt-chat'`
- production route smoke tests for HTML, `.md`, `Accept: text/markdown`,
agent requests, `llms.txt`, `sitemap.md`, `agents.md`, and `/api/search`
- desktop and mobile browser checks with no runtime errors or horizontal
overflow

`pnpm validate` is locally blocked by the unrelated `example-nuxt-chat`
`oxc-parser` native resolution failure; all remaining workspace
typechecks and tests pass.

Upstream release: https://github.com/vercel/geistdocs/pull/160

Signed-off-by: molebox <rich@vercel.com>
 2026-07-20 11:09:18 +02:00
C. T. Lin 6714efc3a1 feat: support AI SDK v7 (ai@7) as a peer dependency (#691) 
Closes #690

## What

Widens the AI SDK peer dependency ranges so the Chat SDK installs
cleanly next to `ai@7`:

- `chat`: `ai@^6.0.182 || ^7.0.0`
- `@chat-adapter/web`: `ai@^6 || ^7`, `@ai-sdk/react@^3 || ^4`,
`@ai-sdk/svelte@^4 || ^5`, `@ai-sdk/vue@^3 || ^4`

This also unbreaks `create-chat-sdk` scaffolds, which install
`ai@latest` (now v7) next to `chat` and currently hit a peer conflict
out of the box.

## The one real v6 → v7 break

In v7, `tool()` with an `execute` function returns
`ExecutableTool<Tool<...>>` — an internal type from
`@ai-sdk/provider-utils` that `ai` does not re-export. The `chat/ai`
tool factories relied on inference, so declaration emit failed with
TS2742 (17 errors). The factories now declare explicit `Tool<Input,
Output>` return types, which is exactly the shape the previously
published `.d.ts` already had — the public type surface is unchanged,
and the emitted declarations only reference types from `ai` (portable
for consumers on either major).

Everything else checked out compatible:

- v7 stream parts keep `text-delta` / `finish-step` shapes, so
`fromFullStream` duck-typing works unchanged; `fullStream` remains as a
deprecated alias
- tool-level `needsApproval` is deprecated in v7 but still typed and
honored
- `createUIMessageStream`, `createUIMessageStreamResponse`,
`isTextUIPart`, `UIMessage`, `UIMessageStreamWriter`, `ChatInit`,
`DefaultChatTransport` all still exported — `@chat-adapter/web` needed
zero source changes

## Other changes

- devDependencies move to v7 so the workspace develops/tests against the
latest major
- `examples/nextjs-chat` and `examples/nuxt-chat` move to `ai@^7`
(required — mixing majors across the workspace fails typecheck, since
`chat`'s d.ts resolves `ai` types from its own devDependency)
- Test-only: the `ToolExecutionOptions` stub type is now derived from
`Tool["execute"]` because v7 made the generic parameter required
- Changeset included (minor for `chat` and `@chat-adapter/web`)

## Verification

The same source was verified against **both majors** (`ai@6.0.182` and
`ai@7.0.17`): `tsc --noEmit` and the full test suites (`chat`: 1035
tests, `@chat-adapter/web`: 21 tests) pass on each. `pnpm validate`
(knip + check + typecheck + test + build, including both examples) is
green on v7.

Note for adopters: `ai@7` itself requires Node.js ≥ 22 and is ESM-only;
`chat` keeps `engines.node >= 20` since `ai` is an optional peer.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: chentsulin <chentsulin@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-07-13 21:50:27 +10:00
damianborowy-nexos 1721fa01e7 feat(slack): add Slack Agent messaging experience (agent_view) support (#684) 
## Summary

Add support for Slack's Agent messaging experience (`agent_view`), the
2026 replacement for `assistant_view`.

## Core (`chat`)

- New `onAppContextChanged` event carrying the active-view context as a
normalized `AppContextEntity[]` (`channel` / `canvas` / `list` /
`message` / `unknown`) describing what the user is currently viewing.
- `AppHomeOpenedEvent` now carries:
  - the same folded active-view context as optional `entities`
- the opened `tab` (`"home"` / `"messages"`), so handlers can
distinguish a Home-tab open from the DM-open signal under `agent_view`

## Slack adapter (`@chat-adapter/slack`)

- **`agentView` config flag.** Under `agent_view`:
- `app_home_opened` is the DM-open signal and fires regardless of tab
(branch on `event.tab` if you also publish a Home view)
- DM messages are threaded per Slack's new model — each user message is
a thread root (`thread_ts ?? ts`)
- conversation-scoped threads returned by `openDM()` keep working: when
that thread is subscribed, incoming top-level DM messages route to it,
so `onSubscribedMessage` and per-thread state behave the same as in
legacy mode
- **`app_context_changed` routing** with normalized entities. Malformed
payloads degrade gracefully: a missing `context` yields `entities: []`,
and entities with a null/malformed `value` normalize to `kind:
"unknown"` — never a webhook 500.
- **`getAppContext(message)`** helper to read the folded active-view
context off a DM message.
- **`setSuggestedPrompts`** accepts an optional thread reference
(`agent_view` lets prompts sit at the top of the agent conversation).
- **Env auth fallback now keys off auth fields**: `SLACK_BOT_TOKEN` /
`SLACK_CLIENT_ID` / `SLACK_CLIENT_SECRET` fallback is disabled only when
an auth-related field (`botToken`, `clientId`, `clientSecret`,
`installationProvider`) is passed explicitly, rather than by the
presence of any config object. This lets non-auth options compose with
env auth — e.g. `createSlackAdapter({ agentView: true })` picks up env
credentials — and matches the semantics documented in the adapter's
AGENTS.md. *(Behavior change for callers passing non-auth-only configs
while relying on env vars being ignored.)*
- Bumped `@slack/web-api` to `^7.18.0` (adds the optional `thread_ts`
typing for `setSuggestedPrompts`).

## Docs

- New "Agent messaging experience" section on the Slack adapter page
(config, manifest snippet, threading model, openDM bridge).
- "Handling active-view context" section in handling-events, plus
`tab`/`entities` rows on the app-home event table.
- Callout: under `agent_view`, bot replies are threaded per user
message, so `conversations.history` only returns the user's side of a DM
— build AI conversation history from transcripts instead of channel
history.

## Example app (`examples/nextjs-chat`)

- Plain `SLACK_BOT_TOKEN` adapter branch (previously Slack was only
wired via Vercel Connect).
- DM AI history built from transcripts instead of channel history (see
docs callout above); assistant turns persisted.
- The `dm me` trigger regex now matches mention text, which carries the
`@bot` prefix on Slack.

## Test plan

- `pnpm validate` and `pnpm konsistent` pass.
- Unit tests cover the new events, entity normalization (including
malformed payloads), `agent_view` DM threading, the openDM subscription
bridge, `tab` passthrough, `setSuggestedPrompts` thread handling, and
env-fallback behavior; an integration replay test exercises the full
webhook flow.
- Verified manually against a live `agent_view` workspace:
`onAppContextChanged` entities, folded context on `app_home_opened` and
DM messages, `tab` values for both tabs, per-message DM threading, the
openDM subscription bridge, and signed malformed-payload replays (all
return 200).
- Legacy regression pass with `agentView` off: conversation-scoped DM
threading, Home-tab-only `app_home_opened`, mention flow unchanged.

### Slack references

- Agent messaging experience:
https://docs.slack.dev/changelog/2026/06/30/agent-messages-tab/
- Active-view context:
https://docs.slack.dev/changelog/2026/07/02/app-context/

## Checklist

- [x] All commits are signed and verified
- [x] All commits are signed off for the DCO (`git commit -s`)
- [x] `pnpm validate` passes
- [x] Changeset added
- [x] Documentation updated

---------

Signed-off-by: Damian Borowy <301205838+damianborowy-nexos@users.noreply.github.com>
Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-12 19:35:28 +10:00
Rich Haines 1dff4515e2 refactor(docs): migrate chat-sdk.dev to @vercel/geistdocs (#686) 
## Summary

Migrates `apps/docs` from locally-copied geistdocs runtime code to the
published
[`@vercel/geistdocs`](https://www.npmjs.com/package/@vercel/geistdocs)
package (1.8.2), following the official [migration
guide](https://preview.geistdocs.com/docs/migration). Net **−8,400
lines**.

### Package-backed now

- Docs page + layouts: `createDocsPage`, `GeistdocsDocsLayout`,
`GeistdocsHomeLayout` (JSON-LD + sr-only markdown hints preserved via
`renderTop`)
- Navbar (OSS product switcher via `navbarOssProducts`), footer,
provider, search dialog, page actions (edit source, feedback, copy page,
Ask AI, open-in-chat, scroll top)
- `/api/search` → `createSearchRoute`, `/api/chat` → `createChatRoute`
(AI SDK v6; AI Gateway default, optional `GEISTDOCS_CHAT_PROXY_URL`)
- `llms.mdx` → `createDocsMarkdownRoute`, `sitemap.md` →
`createSitemapMarkdownRoute` (now includes an **Adapters** section)
- **New**: `/agents.md` via `createAgentsRoute`, backed by a new `agent`
readiness config
- `proxy.ts` → `createProxy` with explicit `markdownRoutes` for `/docs`
→ `llms.mdx` and `/adapters` → `adapters.mdx` (adds AI-agent UA
rewrites)
- CSS: `@vercel/geistdocs/styles.css` + slim local overrides (shadcn
tokens for remaining `components/ui`, body tint, prose inline code,
`#nd-*` tweaks); code blocks now use the geist Shiki theme
- Icons/logos from `@vercel/geistdocs/assets/*`; feedback via the
package action (same geistdocs.com endpoint + `siteId`)

### Kept local by design

- Curated `/llms.txt` index + `/llms-full.txt` corpus — the published
`AGENTS.md`/SKILL.md artifacts and integration tests reference this
exact contract
- The adapters section (README fetching, OG images, JSON-LD, feature
matrices, `adapters.mdx` markdown route) — now rendered inside the
package docs layout
- RSS and OG image routes (app-owned per the migration guide)
- Skipped `/.well-known/mcp.json`: no MCP servers configured, and the
proxy matcher must keep excluding `.well-known` for the served
agent-skills files

### Cleanup

- Deleted local copies: `components/geistdocs/*` chrome,
`components/ai-elements/*`, chat hooks/persistence, feedback server
actions, unused shadcn primitives, geistcn logo/icon fallbacks covered
by package assets
- Removed 13 now-unused deps (`ai@5`, `@ai-sdk/react@2`, `dexie`,
`jotai`, `cmdk`, `vaul`, `mermaid`, `nanoid`, `react-player`,
`use-stick-to-bottom`, `@orama/tokenizers`, `dexie-react-hooks`,
`next-themes`)
- Updated `docs-llms.test.ts` proxy assertions to the `createProxy`
markdown-route shape

### Behavior changes to be aware of

- Code blocks use the geist Shiki theme instead of GitHub light/dark
- Ask AI history is no longer persisted in IndexedDB (package owns the
panel)
- Adapters sidebar uses the standard geistdocs tree rendering instead of
the bespoke grouped sidebar
- Per-page markdown output appends the standard geistdocs footer links
(`/sitemap.md`, `/llms.txt`, `/agents.md`)

## Test plan

- `pnpm validate` green (knip + check + typecheck + test + build)
- Smoke-tested against `next build && next start`: `/`, `/docs`,
`/adapters`, `/agents.md`, `/llms.txt`, `/llms-full.txt`, `/sitemap.md`,
page-level `.md` URLs for both docs and adapters, `Accept:
text/markdown` negotiation, search API, JSON-LD, sr-only markdown hints,
edit-source URLs (`apps/docs/content/docs/{path}`), OSS navbar, page
actions
- Verified compiled CSS chunks contain the home grid, Shiki palette, and
geist utilities (note: stale turbopack dev caches from before this
change can serve incomplete CSS — `rm -rf apps/docs/.next` fixes it)

## Checklist

- [x] All commits are signed and verified
- [x] All commits are signed off for the DCO (`git commit -s`)
- [x] `pnpm validate` passes
- [x] Changeset added (or N/A — docs app + tests only, no package
behavior change)
- [x] Documentation updated (or N/A)

---------

Signed-off-by: molebox <rich@vercel.com>
 2026-07-09 15:29:47 +02:00
josh ef2542c5fd feat(x): add X (Twitter) adapter (#682) 
## summary

new `@chat-adapter/x` adapter for X (Twitter), built on the X API v2 and
the X Activity API. write bot logic once and reply to mentions, hold DM
conversations, post from the account, and like posts, like the other
Chat SDK adapters

what it supports:
- reply to public mentions (`post.mention.create`) and top-level posts
via `channel.post`
- send and receive direct messages (`dm.received` / `dm.sent`)
- edit and delete owned posts, delete own DM events
- likes as the only reaction (`emoji.heart` or `"like"`)
- buffered streaming: accumulates an LLM stream and posts once instead
of post+edit churn on a public timeline
- OAuth 2.0 user context with managed token refresh (rotating refresh
token persisted in the state adapter, optional AES-256-GCM encryption)
- webhook CRC and `x-twitter-webhooks-signature` verification

key design decisions:
- DMs are threaded by the other participant's user id (`x:dm:{userId}`)
because X DM webhooks carry no conversation id, only participants
- OAuth 2.0 only at runtime: DM send and read are verified to work on
OAuth 2.0 user tokens, so no OAuth 1.0a in the adapter (subscription and
webhook setup is one-time and handled in the X developer console)
- parsers were written against real captured payloads: mentions use the
v2 shape (author hydrated in `includes.users`), DMs use the legacy
Account Activity shape (`direct_message_events`,
`message_create.message_data`, a `users` map, and no conversation id)

also includes the `chat/adapters` catalog entry, docs page, CLI scaffold
spec, and `sample-messages.md` with real captured payloads

<details><summary>usage</summary>

```typescript
import { Chat } from "chat";
import { createXAdapter } from "@chat-adapter/x";

const bot = new Chat({
  userName: "mybot",
  adapters: { x: createXAdapter() },
});

bot.onNewMention(async (thread, message) => {
  await thread.post(`hi @${message.author.userName}!`);
});

bot.onDirectMessage(async (thread) => {
  await thread.post("hello from X");
});
```
</details>

## test plan

- adapter unit tests pass against the real captured payload shapes, with
regression tests for author-from-`includes` (mentions) and the legacy
`direct_message_events` shape (DMs)
- real captured `post.mention.create` and `dm.received` payloads
verified end-to-end through `handleWebhook`: signature verification,
routing, author resolution, and participant threading, plus
bad-signature rejection returns 401
- every write and read path fired live against the X API through the
adapter: top-level post, reply to a mention, like and unlike, edit,
delete, DM send, DM read, DM delete
- OAuth 2.0 managed token refresh exercised live (access and refresh
token rotation)

---------

Signed-off-by: dancer <josh@afterima.ge>
 2026-07-07 23:07:36 +01:00
dependabot[bot] 5267669563 build(deps): bump nuxt from 4.3.1 to 4.4.7 (#680) 
Bumps [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) from
4.3.1 to 4.4.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nuxt/nuxt/releases">nuxt's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.7</h2>
<blockquote>
<p>4.4.7 is a security hotfix release.</p>
</blockquote>
<p>👉 make sure to check <a
href="https://github.com/nuxt/nuxt/security/advisories">https://github.com/nuxt/nuxt/security/advisories</a>
to view open advisories resolved by this release.</p>
<h2>👉 Changelog</h2>
<p><a
href="https://github.com/nuxt/nuxt/compare/v4.4.6...v4.4.7">compare
changes</a></p>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>nitro:</strong> Assign <code>noSSR</code> before deciding
payload extraction (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35108">#35108</a>)</li>
<li><strong>vite:</strong> Avoid filtering out dirs with shared prefix
from <code>allowDirs</code> (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35112">#35112</a>)</li>
<li><strong>nuxt:</strong> Use resolve from <code>pathe</code> for
buildCache path boundary check (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35111">#35111</a>)</li>
<li><strong>nuxt:</strong> Prevent sibling-directory traversal in test
component wrapper (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35110">#35110</a>)</li>
<li><strong>nitro:</strong> Pass event data to <code>isValid</code> in
dev clipboard-copy listener (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35109">#35109</a>)</li>
<li><strong>nuxt:</strong> Validate protocols in
<code>reloadNuxtApp</code> path before reload (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35115">#35115</a>)</li>
<li><strong>vite:</strong> Prefix public asset virtuals with null byte
(<a
href="https://github.com/nuxt/nuxt/commit/9e303b438">9e303b438</a>)</li>
<li><strong>nuxt:</strong> Re-run <code>getCachedData</code> after
initial fetch (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35122">#35122</a>)</li>
<li><strong>nuxt:</strong> Propagate
<code>useFetch</code>/<code>useAsyncData</code> factory types (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35133">#35133</a>)</li>
<li><strong>vite:</strong> Close vite dev server on nuxt close (<a
href="https://github.com/nuxt/nuxt/commit/a10a68abc">a10a68abc</a>)</li>
<li><strong>kit,nuxt:</strong> Handle cancelling prompts to install
packages (<a
href="https://github.com/nuxt/nuxt/commit/e84813229">e84813229</a>)</li>
<li><strong>kit:</strong> Avoid excluding node-context files in legacy
tsconfig (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35152">#35152</a>)</li>
<li><strong>nuxt:</strong> Handle missing payload in chunkError listener
(<a
href="https://redirect.github.com/nuxt/nuxt/pull/35155">#35155</a>)</li>
<li><strong>nuxt:</strong> Await in-lifght template generation when
closing nuxt (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35181">#35181</a>)</li>
<li><strong>nuxt:</strong> Clarify page and layout usage warnings (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35184">#35184</a>)</li>
<li><strong>webpack:</strong> Surface compilation errors when
stats.toString is empty (<a
href="https://github.com/nuxt/nuxt/commit/073b07851">073b07851</a>)</li>
<li><strong>nuxt:</strong> Reject prototype-chain keys in the island
registry (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35205">#35205</a>)</li>
<li><strong>nuxt:</strong> Apply <code>isScriptProtocol</code> guard to
<code>navigateTo</code> open option (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35206">#35206</a>)</li>
<li><strong>nuxt:</strong> Prevent server-only page island from
recursing via <code>&lt;NuxtPage&gt;</code> (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35198">#35198</a>)</li>
<li><strong>rspack,webpack:</strong> Require loopback host when missing
same-origin signals (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35200">#35200</a>)</li>
<li><strong>nitro:</strong> Gate chrome devtools workspace endpoint to
local requests (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35201">#35201</a>)</li>
<li><strong>nuxt:</strong> Escape props in
<code>&lt;NuxtClientFallback&gt;</code> ssr output (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35199">#35199</a>)</li>
<li><strong>kit:</strong> Improve TS extension stripping/substitutions
(<a
href="https://redirect.github.com/nuxt/nuxt/pull/35233">#35233</a>)</li>
<li><strong>nuxt:</strong> Preserve
<code>.d.mts</code>/<code>.d.cts</code> in <code>resolveTypePaths</code>
(<a
href="https://redirect.github.com/nuxt/nuxt/pull/35235">#35235</a>)</li>
<li><strong>nuxt:</strong> Escape <code>&lt;NoScript&gt;</code> slot
content (<a
href="https://github.com/nuxt/nuxt/commit/4b054e9d9">4b054e9d9</a>)</li>
<li><strong>nuxt:</strong> Match route rules case-insensitively to
mirror <code>vue-router</code> (<a
href="https://github.com/nuxt/nuxt/commit/07e39cd6f">07e39cd6f</a>)</li>
<li><strong>nuxt:</strong> Reject script-capable protocols in
<code>&lt;NuxtLink&gt;</code> href (<a
href="https://github.com/nuxt/nuxt/commit/0103ce06f">0103ce06f</a>)</li>
<li><strong>nuxt:</strong> Block path-normalization open redirect in
<code>navigateTo</code> (<a
href="https://github.com/nuxt/nuxt/commit/2cce6fb02">2cce6fb02</a>)</li>
<li><strong>nuxt:</strong> Reject cross-origin paths in
<code>reloadNuxtApp</code> (<a
href="https://github.com/nuxt/nuxt/commit/e447a793c">e447a793c</a>)</li>
<li><strong>vite:</strong> Bind vite-node IPC to a permissioned
filesystem socket (<a
href="https://github.com/nuxt/nuxt/commit/1f9f4767a">1f9f4767a</a>)</li>
</ul>
<h3>💅 Refactors</h3>
<ul>
<li><strong>kit,nuxt,vite:</strong> Use <code>es2023</code> array
methods (<a
href="https://redirect.github.com/nuxt/nuxt/pull/34980">#34980</a>)</li>
<li><strong>nuxt:</strong> Replace <code>runInNewContext</code> with AST
walker (<a
href="https://github.com/nuxt/nuxt/commit/d72a89ef4">d72a89ef4</a>)</li>
</ul>
<h3>📖 Documentation</h3>
<ul>
<li>Document vite client and server options (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35090">#35090</a>)</li>
<li>Add dedicated module dependencies page (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35171">#35171</a>)</li>
<li>Add nodeTsConfig and sharedTsConfig options (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35231">#35231</a>)</li>
<li>Edit for clarity and grammar (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35214">#35214</a>)</li>
</ul>
<h3>🏡 Chore</h3>
<ul>
<li>Use <code>execFileSync</code> for safety in release scripts (<a
href="https://github.com/nuxt/nuxt/commit/1d7baaf01">1d7baaf01</a>)</li>
<li>Assert there is always a tag (<a
href="https://github.com/nuxt/nuxt/commit/e98c47c3c">e98c47c3c</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nuxt/nuxt/commit/b7d57903b947e788fadfcfdf88be7951943731bf"><code>b7d5790</code></a>
v4.4.7</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/dbc58965ca7ffa21d7cc4207a4c40a62e0762f4a"><code>dbc5896</code></a>
chore: lint</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1"><code>e447a79</code></a>
fix(nuxt): reject cross-origin paths in <code>reloadNuxtApp</code></li>
<li><a
href="https://github.com/nuxt/nuxt/commit/d72a89ef451965a8a1abb58d3bd6eab4865631a0"><code>d72a89e</code></a>
refactor(nuxt): replace <code>runInNewContext</code> with AST
walker</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d"><code>2cce6fb</code></a>
fix(nuxt): block path-normalization open redirect in
<code>navigateTo</code></li>
<li><a
href="https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3"><code>0103ce0</code></a>
fix(nuxt): reject script-capable protocols in
<code>\&lt;NuxtLink&gt;</code> href</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb"><code>07e39cd</code></a>
fix(nuxt): match route rules case-insensitively to mirror
<code>vue-router</code></li>
<li><a
href="https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e"><code>4b054e9</code></a>
fix(nuxt): escape <code>\&lt;NoScript&gt;</code> slot content</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/03d83bfab531b27fbc1dac7cdea9227b3707476e"><code>03d83bf</code></a>
fix(nuxt): preserve <code>.d.mts</code>/<code>.d.cts</code> in
<code>resolveTypePaths</code> (<a
href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35235">#35235</a>)</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/46960b2b18e79d64f212b2b77d879b3f88ab72cb"><code>46960b2</code></a>
fix(nuxt): escape props in <code>\&lt;NuxtClientFallback&gt;</code> ssr
output (<a
href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35199">#35199</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nuxt/nuxt/commits/v4.4.7/packages/nuxt">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nuxt&package-manager=npm_and_yarn&previous-version=4.3.1&new-version=4.4.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 23:27:39 +10:00
Ben Sabic ac5a54ee1d test(adapters): adopt shared @chat-adapter/tests factories and matchers (#674) 
Wires `@chat-adapter/tests` as a devDependency and registers its
matchers via `setupFiles: ["@chat-adapter/tests/setup"]` across all 11
platform adapters, then replaces bespoke local
`mockLogger`/`createMockState`/`createMockChatInstance` with the shared
factories and adopts `toHaveDispatched`/`not.toHaveDispatched` where
clean.

- 10 adapters migrated (gchat, messenger, teams, whatsapp, telegram,
discord, twilio, linear, github, slack). Positional
`createMockChatInstance(...)` call sites converted to the options API
(slack 100, linear 35).
- `web` left as-is — its suite uses the real `Chat`/`createMemoryState`
for e2e, so the shared factories don't apply.
- Platform SDK mocks (Octokit, WebClient, socket-mode, `@linear/sdk`,
`fetch`) and the Phase 1 `connectWebhookContract` descriptors are left
intact.

Net ~−540 lines of duplicated test scaffolding. Stacked on #673.
Tests-only, no changeset.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-07 23:20:32 +10:00
Ben Sabic 840c0d16e9 test(adapters): migrate Vercel Connect webhook tests to connectWebhookContract (#673) 
Adopts the shared `connectWebhookContract` from `@chat-adapter/tests` in
the Slack, GitHub, and Linear suites, replacing the bespoke
`webhookVerifier` blocks (verifier pass → 200, throw/falsy → 401,
invoked with request + raw body, precedence over a native secret).
Adapter-specific Connect tests are kept (token resolvers, GitHub bot-id
capture, type-level mutual exclusivity, 400-on-invalid-JSON, Linear
identity/`withInstallation`).

Each descriptor keeps `initialize()` network-free (GitHub `botUserId`,
Slack `_botUserId` to skip `auth.test`, Linear stubs
`resolveConnectIdentity`). Twilio is intentionally not included — it has
a single generic `webhookVerifier` usage with no 200/401 gating suite to
migrate.

First of three stacked test-generalization PRs. Tests-only, no
changeset.

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-07 23:14:05 +10:00
Ben Sabic 03d274283f feat(examples): add nuxt-chat example app (#609) 
Adds `examples/nuxt-chat`, a Nuxt 4 reference app for Chat SDK scoped to
the Slack and web adapters.

The Nitro server exposes `/api/webhooks/{platform}` for Slack events and
`/api/chat` for the browser UI, with H3-to-Fetch conversion that
preserves the raw request body for signature verification. Bot handlers
are ported from `nextjs-chat` — interactive cards, modals, slash
commands, transcripts, reactions, and AI streaming — without the
workflow demos.

The `/chat` page is a client-only Vue UI using `@chat-adapter/web/vue`
and the AI SDK. A Slack app manifest ships with the scopes and events
needed for pins, reactions, channel joins, and interactivity.

Monorepo plumbing covers changeset ignore, CI build exclusion,
`AGENTS.md`, knip entry paths for the Nuxt 4 `app/` directory, and biome
globals for Nitro auto-imports.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-07 23:04:48 +10:00
Ben Sabic ba687cb13c docs(slack): document Vercel Connect support (#648) 
Documents authenticating the Slack adapter with Vercel Connect via
`connectSlackAdapter()` from `@vercel/connect/chat`. The Slack adapter
already supports a `botToken` resolver and a `webhookVerifier`, so this
is a documentation-only change (no changeset).

Stacked on #647 (base `vercel-connect/base`).

## Companion

`@vercel/connect/chat` subpath: vercel/vercel#16826.

<img width="824" height="527" alt="CleanShot 2026-06-30 at 12 03 26"
src="https://github.com/user-attachments/assets/cbced069-8913-4848-9cf1-df0e5f614353"
/>

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-03 01:01:51 +10:00
dependabot[bot] df825b3a56 build(deps-dev): bump postcss from 8.5.15 to 8.5.16 (#658) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to
8.5.16.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/92ccc93ff15bd193491d67fad9763e62d489dfad"><code>92ccc93</code></a>
Release 8.5.16 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/818bdd6043359af773ccc3ca8663053d61a707c8"><code>818bdd6</code></a>
Update formatting</li>
<li><a
href="https://github.com/postcss/postcss/commit/46e451068ee6160b837865b715cf6972f28fabd5"><code>46e4510</code></a>
Fix <code>Input#origin()</code> returning incorrect position (<a
href="https://redirect.github.com/postcss/postcss/issues/2036">#2036</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/34942ce76c0b0c9ee65b1421017ac71855e722c4"><code>34942ce</code></a>
Fix tests</li>
<li><a
href="https://github.com/postcss/postcss/commit/d4feed645314ee421edf80ee9ebe453cc75c997f"><code>d4feed6</code></a>
Don't clone root-less child nodes in container constructor (<a
href="https://redirect.github.com/postcss/postcss/issues/2097">#2097</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/da323fc8d327a38199a21987dcbf7e27e3bc34f3"><code>da323fc</code></a>
Revert version update to fix old Node.js on CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/886336919497516df8f140d0fb327bd125e35053"><code>8863369</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/3828982213fec6bc13d0791b1adf40393be0935e"><code>3828982</code></a>
Preserve node raws when rehydrating a JSON AST (<a
href="https://redirect.github.com/postcss/postcss/issues/2100">#2100</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/d1e80b830386b08dcd5b962fd466d1c51f28e82d"><code>d1e80b8</code></a>
Fix Node#rangeBy() ignoring index 0 (<a
href="https://redirect.github.com/postcss/postcss/issues/2091">#2091</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/b91e4a63907325d98b75d11fda546bdd91acc608"><code>b91e4a6</code></a>
Fix Node.js 26 tests</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.15...8.5.16">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for postcss since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.15&new-version=8.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-01 13:22:22 +01:00
dependabot[bot] bb6e52f058 build(deps): bump piscina from 4.9.2 to 4.9.3 (#627) 
Bumps [piscina](https://github.com/piscinajs/piscina) from 4.9.2 to
4.9.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/piscinajs/piscina/blob/v4.9.3/CHANGELOG.md">piscina's
changelog</a>.</em></p>
<blockquote>
<h3><a
href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">4.9.3</a>
(2026-06-12)</h3>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/piscinajs/piscina/commit/4440ae15037b2462549943ba9ab66da0b87f906d"><code>4440ae1</code></a>
chore(release): 4.9.3</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/8703d3e353936c05dd3386508955e0e30c2ffc57"><code>8703d3e</code></a>
Merge</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/63532c5a7595dba7647f4c521d9aed39475a6d0f"><code>63532c5</code></a>
docs: Update Fastify listen() calls to use { port: 3000 } in docs and
example...</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/67591a20a78c894de9170f782a038365784874bc"><code>67591a2</code></a>
chores: gh actions least privilege (<a
href="https://redirect.github.com/piscinajs/piscina/issues/1013">#1013</a>)
(<a
href="https://redirect.github.com/piscinajs/piscina/issues/1014">#1014</a>)</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/7c4220706fa45ff1ea629891854ef45ed0ecdc30"><code>7c42207</code></a>
chore: enhance contributing guidelines (<a
href="https://redirect.github.com/piscinajs/piscina/issues/972">#972</a>)</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/04c2c52b7c7bdfd7471668d2c052848fd91d9347"><code>04c2c52</code></a>
chore: pin actions (<a
href="https://redirect.github.com/piscinajs/piscina/issues/848">#848</a>)
(<a
href="https://redirect.github.com/piscinajs/piscina/issues/850">#850</a>)</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/d157099670fbb55a5a6f8d730d44bff131d04387"><code>d157099</code></a>
[Backport v4] chore: edit ignore files (<a
href="https://redirect.github.com/piscinajs/piscina/issues/826">#826</a>)</li>
<li>See full diff in <a
href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=piscina&package-manager=npm_and_yarn&previous-version=4.9.2&new-version=4.9.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-01 03:36:56 +01:00
Ben Sabic e0a155e718 fix(examples): add @vercel/oidc to fix nextjs-chat Vercel build (#645) 
- The `nextjs-chat` example's generated workflow step route
(`/.well-known/workflow/v1/step`) bundles `@workflow/world-vercel →
@vercel/queue`, and `@vercel/queue` has an unconditional `import
"@vercel/oidc"`.
- `@vercel/oidc` is only a deep transitive dependency, so it isn't
hoisted into the example app. Vercel's isolated build can't resolve it
and fails with `Module not found: Can't resolve '@vercel/oidc'`. (It
resolves locally only because pnpm symlinks it, which is why the GitHub
Actions build — which excludes the example — stays green.)
- Declaring `@vercel/oidc` as a direct dependency of the example fixes
resolution for the bundler.

No changeset needed — `example-*` packages are private and excluded from
versioning.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-27 08:42:13 +10:00
Ben Sabic 64b66864b1 chore(changesets): ignore all example-* packages and enforce the convention (#626) 
Replace the explicit per-example entries in the changesets `ignore` list
with an `example-*` name glob (matched by micromatch). All example apps
are
private and never published, so listing them individually only adds
version
and changelog churn to release PRs, and each new example required
editing
this CODEOWNERS-gated file.

Add an integration test that resolves the changesets config against the
workspace and asserts every examples/* package is in the resolved ignore
list and follows the `example-*` naming convention, so an off-convention
example app fails CI instead of silently leaking into releases.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-22 23:25:43 +10:00
Shujan Islam f3de12823c Added Express.js chat-sdk example project (#551) 
## Summary

Added a new example project demonstrating how to use `chat-sdk` with
Express.js.

Previously, there was no example showing how to integrate `chat-sdk` in
a simple Express.js setup. This PR adds a minimal Express.js project
with a Discord bot integration to demonstrate how `chat-sdk` can be used
in a practical server-side workflow.

Closes #519

## Test plan

- Ran the example project locally
- Verified the Express.js server starts successfully
- Verified the Discord bot connects and responds as expected
- Confirmed the example demonstrates basic `chat-sdk` usage with
Express.js

## Checklist

- [x] All commits are signed and verified
- [x] `pnpm validate` passes
- [ ] Changeset added (or N/A — see
[CONTRIBUTING.md](./CONTRIBUTING.md))
- [x] Documentation updated (or N/A)

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-20 13:15:14 +10:00
Ben Sabic 8f3af76565 feat: add create-chat-sdk CLI (#603) 
Adds `create-chat-sdk`, a CLI that scaffolds a Next.js Chat SDK bot
project:

```bash
npm create chat-sdk@latest my-bot

# non-interactive
npm create chat-sdk@latest -- my-bot --adapter slack redis -y
```

The user picks platform and state adapters interactively or via
`--adapter`, and the CLI generates a webhook-only project with
`src/lib/bot.ts`, `.env.example`, `next.config.ts`, `package.json`, and
a README, then optionally runs `git init` and installs dependencies.
There are no pages or client UI in the template.

Adapter choices come straight from the `chat/adapters` catalog, so the
CLI has no adapter registry of its own. When a coding agent such as
Cursor or Claude Code runs the CLI, it uses non-interactive defaults and
requires an explicit platform adapter. `--interactive` forces prompts.

## also in this pr

- `google-chat` is renamed to `gchat` everywhere, including docs pages,
the OG image, and adapter catalog. Old URLs redirect permanently,
including language-prefixed and `/og` paths
- a new docs page is available at `chat-sdk.dev/docs/create-chat-sdk`,
and the CLI is promoted on the homepage, package READMEs, and agent
skill
- `create-chat-sdk` releases independently with a minor changeset for
its initial `0.1.0` release

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-06-16 08:48:38 +01:00
OSS Polar Bear b14114a714 test(slack): expand emulator coverage for emulate.dev 0.6.0 APIs (#591) 
Upgrade @emulators/* to 0.6.0 and add integration tests for DMs,
reactions, fetch history, modals, scheduled messages, file uploads,
member joins, and bookmarks against the in-process Slack emulator.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-09 12:54:30 +10:00
Ben Sabic 9b8d8c4518 Discoverability lift: link KB guides, broaden npm keywords, mirror to AGENTS.md (#560) 
Broad SEO/AEO pass across the docs site, adapter READMEs and AGENTS.md
files, and npm package metadata so Chat SDK content shows up better in
search engines, in LLM-driven package recommendations, and in
IDE/coding-agent context.

**Docs site**

- Adds a `## Resources` section to the Getting Started and AI overview
pages and to the Slack, Discord, GitHub, Liveblocks, and Sendblue
adapter pages, each linking to applicable guides/templates with
descriptions sourced from `resources-edge-config.json` and a cross-link
back to the central `/resources` hub.

**Adapter packages**

- Mirrors the same Resources sections into the Slack, Discord, and
GitHub READMEs (so they surface on npm) and into their AGENTS.md files
(so coding agents see them alongside the API notes).
- Expands `keywords` on every published adapter and state package — adds
`chat-sdk`, `chatbot`, `ai-agent`, `ai-sdk`, `vercel`, plus
platform-specific terms like `slack-bot`, `block-kit`, `slash-commands`,
`github-app`, `whatsapp-business`, `state-adapter`.

**Resources registry**

- Registers four new entries in `resources-edge-config.json`
(Human-in-the-Loop guide, Liveblocks AI agent guide, Slack + Vercel Blob
guide, Durable iMessage Agent template) and runs `pnpm sync-resources`
so the bundled `chat` package guides, `templates.json`, and
`skills/chat/SKILL.md` all pick them up.
- Fixes the synced Slack AI agent guide to import `toAiMessages` from
`chat/ai` instead of the deprecated `chat` re-export path (the upstream
KB source has also been updated, so future syncs will preserve this).

**Drive-by fixes**

- Resend adapter doc quick start: corrects `MemoryStateAdapter` class
import to the `createMemoryState()` factory (matching every other
adapter doc).
- Zalo adapter doc: drops the "community adapter" callout that
duplicated frontmatter.

**Tooling / CI**

- Adds `tsx` as a root devDependency so `pnpm sync-resources` works out
of the box (it previously relied on `npx tsx`, which hung when not
pre-cached).
- Loosens the CI changeset gate to also skip `packages/chat/resources/`
(generated data), matching the existing `*.md` carve-out.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-05-29 11:41:23 +10:00
josh 25ebc3b925 feat(twilio): add sms, mms, and voice helpers (#558) 
## summary

adds a first-class Twilio adapter for SMS and MMS bots, plus low-level
voice helpers for custom Twilio voice routes

this includes webhook parsing and signature verification, outbound
Messages API helpers, phone-number and Messaging Service sending,
inbound MMS attachments with authenticated `fetchData`, plain text card
fallback rendering, markdown conversion, and runtime-light `api`,
`webhook`, `voice`, and `format` subpaths

the adapter intentionally avoids the `twilio` npm runtime dependency so
apps can use the low-level helpers without pulling in the full SDK
 2026-05-27 15:39:23 -07:00
dependabot[bot] c3091eb9f9 build(deps): bump rollup from 4.54.0 to 4.60.4 (#525) 
Bumps [rollup](https://github.com/rollup/rollup) from 4.54.0 to 4.60.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/releases">rollup's
releases</a>.</em></p>
<blockquote>
<h2>v4.60.4</h2>
<h2>4.60.4</h2>
<p><em>2026-05-14</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Improve stability of chunk hashes (<a
href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>:
fix: stabilize chunk assignment across parallel file reads (<a
href="https://github.com/sonukapoor"><code>@​sonukapoor</code></a>, <a
href="https://github.com/Sonu"><code>@​Sonu</code></a> Kapoor, <a
href="https://github.com/TrickyPi"><code>@​TrickyPi</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>:
chore(deps): update react monorepo to v19 (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>:
Resolve vulnerabilities (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>v4.60.2</h2>
<h2>4.60.2</h2>
<p><em>2026-04-18</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Resolve a variable rendering bug when generating different formats
from the same build (<a
href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>:
docs: fix various typos in source and documentation (<a
href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>:
chore(deps): update codecov/codecov-action action to v6 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>:
chore(deps): update dependency eslint-plugin-unicorn to v64 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>:
fix(deps): update rust crate swc_compiler_base to v51 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6346">#6346</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6347">#6347</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6348">#6348</a>:
fix(deps): update swc monorepo (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6349">#6349</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6350">#6350</a>:
fix: reset variable render names between outputs in the same generate
(<a href="https://github.com/barry3406"><code>@​barry3406</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6351">#6351</a>:
chore(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6352">#6352</a>:
chore(deps): update cross-platform-actions/action action to v1 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6353">#6353</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6354">#6354</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6355">#6355</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6356">#6356</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6358">#6358</a>:
chore: remove cross-env from devDeps (<a
href="https://github.com/K-tecchan"><code>@​K-tecchan</code></a>)</li>
</ul>
<h2>v4.60.1</h2>
<h2>4.60.1</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's
changelog</a>.</em></p>
<blockquote>
<h2>4.60.4</h2>
<p><em>2026-05-14</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Improve stability of chunk hashes (<a
href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>:
fix: stabilize chunk assignment across parallel file reads (<a
href="https://github.com/sonukapoor"><code>@​sonukapoor</code></a>, <a
href="https://github.com/Sonu"><code>@​Sonu</code></a> Kapoor, <a
href="https://github.com/TrickyPi"><code>@​TrickyPi</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>:
chore(deps): update react monorepo to v19 (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>:
Resolve vulnerabilities (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.60.3</h2>
<p><em>2026-05-04</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Ensure nested &quot;exports&quot; variables are not renamed (<a
href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6360">#6360</a>:
fix: do not rename nested &quot;exports&quot; bindings that do not
conflict (<a
href="https://github.com/tariqrafique"><code>@​tariqrafique</code></a>,
<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6364">#6364</a>:
chore(deps): update msys2/setup-msys2 digest to e989830 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6365">#6365</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6366">#6366</a>:
fix(deps): update swc monorepo (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6367">#6367</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6368">#6368</a>:
docs: add missing backticks in <code>plugin-development</code> (<a
href="https://github.com/lumirlumir"><code>@​lumirlumir</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.60.2</h2>
<p><em>2026-04-18</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Resolve a variable rendering bug when generating different formats
from the same build (<a
href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>:
docs: fix various typos in source and documentation (<a
href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>:
chore(deps): update codecov/codecov-action action to v6 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>:
chore(deps): update dependency eslint-plugin-unicorn to v64 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>:
fix(deps): update rust crate swc_compiler_base to v51 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rollup/rollup/commit/d311a84b0bb4d4a6f50d19ffd2c29cca28660c88"><code>d311a84</code></a>
4.60.4</li>
<li><a
href="https://github.com/rollup/rollup/commit/6aa324854482e273b711972955d2d1b3bb445bcc"><code>6aa3248</code></a>
fix: stabilize chunk assignment across parallel file reads (<a
href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/82a0fe76b1372a2cf509fc4067d69f25569b83f5"><code>82a0fe7</code></a>
Resolve vulnerabilities (<a
href="https://redirect.github.com/rollup/rollup/issues/6375">#6375</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/71f5ebc893d7ff76b5571d63b04ea2ed4a4ddd9d"><code>71f5ebc</code></a>
chore(deps): update dependency lru-cache to v11 (<a
href="https://redirect.github.com/rollup/rollup/issues/6371">#6371</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/af91d778cdf564dd1ae1bfd6e92604ec031824a7"><code>af91d77</code></a>
chore(deps): lock file maintenance (<a
href="https://redirect.github.com/rollup/rollup/issues/6373">#6373</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/65e7b94ddda9f02334fa8f12ff6bf699c1f07833"><code>65e7b94</code></a>
chore(deps): update react monorepo to v19 (major) (<a
href="https://redirect.github.com/rollup/rollup/issues/6372">#6372</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/642587f3d9c5b4aa482a5027672f0fa8ea76da12"><code>642587f</code></a>
fix(deps): update minor/patch updates (<a
href="https://redirect.github.com/rollup/rollup/issues/6370">#6370</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/b47bdabeccbb7aa1b1d4117f2f4a781a9f6de297"><code>b47bdab</code></a>
4.60.3</li>
<li><a
href="https://github.com/rollup/rollup/commit/15c5f33083c8c6b1b2cbae548124fffbba2553bb"><code>15c5f33</code></a>
Add again some unneeded dev dependencies, to make some builds
succeed</li>
<li><a
href="https://github.com/rollup/rollup/commit/12195dcebbd21f0f2d91e26720cd053526edbfe3"><code>12195dc</code></a>
fix: do not rename nested &quot;exports&quot; bindings that do not
conflict (<a
href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rollup/rollup/compare/v4.54.0...v4.60.4">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 06:25:31 -07:00
dependabot[bot] db61173386 build(deps-dev): bump postcss from 8.5.14 to 8.5.15 (#541) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to
8.5.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/eae46db765d752cf8f40c4fa2b0b85030079c43d"><code>eae46db</code></a>
Release 8.5.15 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/79508ffa59e42c02056aca61b88bc393c8b516c4"><code>79508ff</code></a>
Update CI actions</li>
<li><a
href="https://github.com/postcss/postcss/commit/b128e2131288a411c6e28071d0929542c49e74eb"><code>b128e21</code></a>
Speed up declaration parsing by avoiding creating new array on each
token</li>
<li><a
href="https://github.com/postcss/postcss/commit/9825dca02c33cf610e2a842be767468b67fbecf9"><code>9825dca</code></a>
Fix code format</li>
<li><a
href="https://github.com/postcss/postcss/commit/55789c865281e2be194fa5b4e41dd046be3a2307"><code>55789c8</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/84fbbe9009cb3cc3bbb4cc3a9b65d468f4844d95"><code>84fbbe9</code></a>
Install older pnpm action for old Node.js</li>
<li><a
href="https://github.com/postcss/postcss/commit/9f860bd78ec1dbc4f0ae72d693f03f956baa38cb"><code>9f860bd</code></a>
Revert pnpm action for old Node.js</li>
<li><a
href="https://github.com/postcss/postcss/commit/08771986d47359545f502e009763e223b66bfcf6"><code>0877198</code></a>
Update CI actions</li>
<li><a
href="https://github.com/postcss/postcss/commit/b2d1a335cea818f8b27e5cfb90147648afe3e582"><code>b2d1a33</code></a>
Fix linter warnings</li>
<li><a
href="https://github.com/postcss/postcss/commit/0700dac92283bc259977dff2743ca74a00f58267"><code>0700dac</code></a>
Merge pull request <a
href="https://redirect.github.com/postcss/postcss/issues/2088">#2088</a>
from rootvector2/add-oss-fuzz-harness</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.14...8.5.15">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.14&new-version=8.5.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 06:01:52 -07:00
dependabot[bot] b4f3a00821 build(deps): bump ws from 8.18.3 to 8.20.1 (#539) 
Bumps [ws](https://github.com/websockets/ws) from 8.18.3 to 8.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>8.20.1</h2>
<h1>Bug fixes</h1>
<ul>
<li>Fixed an uninitialized memory disclosure issue in
<code>websocket.close()</code>
(c0327ec1).</li>
</ul>
<p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>)
as the <code>reason</code> argument for
<code>websocket.close()</code>, rather than the supported string or
<code>Buffer</code> types, caused
uninitialized memory to be disclosed to the remote peer.</p>
<pre lang="js"><code>import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
<p>const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(<code>ws://localhost:${port}</code>, {
skipUTF8Validation: true
});</p>
<pre><code>ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});
</code></pre>
<p>}
);</p>
<p>wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});
</code></pre></p>
<p>The issue was privately reported by <a
href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p>
<h2>8.20.0</h2>
<h1>Features</h1>
<ul>
<li>Added exports for the <code>PerMessageDeflate</code> class and
utilities for the
<code>Sec-WebSocket-Extensions</code> and
<code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li>
</ul>
<h2>8.19.0</h2>
<h1>Features</h1>
<ul>
<li>Added the <code>closeTimeout</code> option (<a
href="https://redirect.github.com/websockets/ws/issues/2308">#2308</a>).</li>
</ul>
<h1>Bug fixes</h1>
<ul>
<li>Handled a forthcoming breaking change in Node.js core
(19984854).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a>
[dist] 8.20.1</li>
<li><a
href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a>
[security] Fix uninitialized memory disclosure in
<code>websocket.close()</code></li>
<li><a
href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a>
[ci] Test on node 26</li>
<li><a
href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a>
[ci] Do not test on node 25</li>
<li><a
href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a>
[ci] Run the lint step on node 24</li>
<li><a
href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a>
[dist] 8.20.0</li>
<li><a
href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a>
[minor] Export the <code>PerMessageDeflate</code> class and header
utils</li>
<li><a
href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a>
[api] Convert the <code>isServer</code> and <code>maxPayload</code>
parameters to options</li>
<li><a
href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a>
[doc] Add missing space</li>
<li><a
href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a>
[pkg] Update eslint to version 10.0.1</li>
<li>Additional commits viewable in <a
href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 05:19:49 -07:00
dependabot[bot] 63cd869f20 build(deps-dev): bump turbo from 2.8.12 to 2.9.14 2026-05-20 02:40:28 +01:00
dependabot[bot] 39130a8898 build(deps): bump vite from 7.3.1 to 7.3.3 2026-05-20 02:35:34 +01:00
dependabot[bot] 10c58c2721 build(deps): bump path-to-regexp from 0.1.13 to 8.4.2 2026-05-20 02:25:15 +01:00
dependabot[bot] b18e99625e build(deps): bump lodash from 4.17.21 to 4.18.1 2026-05-20 02:24:38 +01:00
dependabot[bot] ceb1fdfa4b build(deps): bump minimatch from 5.1.9 to 10.2.5 2026-05-20 02:20:51 +01:00
dependabot[bot] 4139283a17 build(deps): bump picomatch from 2.3.1 to 4.0.4 2026-05-20 02:20:43 +01:00
dependabot[bot] e4bd4a6ce8 build(deps): bump axios from 1.13.6 to 1.16.1 2026-05-20 02:20:36 +01:00
dependabot[bot] b93ffa78a1 build(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#511) 
Bumps
[svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)
from 5.55.5 to 5.55.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/svelte/releases">svelte's
releases</a>.</em></p>
<blockquote>
<h2>svelte@5.55.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: prevent XSS on <code>hydratable</code> from user contents (<a
href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p>
</li>
<li>
<p>chore: bump devalue (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p>
</li>
<li>
<p>fix: disallow empty attribute names during SSR (<a
href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p>
</li>
<li>
<p>fix: harden regex (<a
href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p>
</li>
<li>
<p>fix: move Svelte runtime properties to symbols (<a
href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p>
</li>
</ul>
<h2>svelte@5.55.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: leave stale promises to wait for a later resolution, instead of
rejecting (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p>
</li>
<li>
<p>fix: keep dependencies of <code>$state.eager/pending</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p>
</li>
<li>
<p>fix: reapply context after transforming error during SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p>
</li>
<li>
<p>fix: don't rebase just-created batches (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p>
</li>
<li>
<p>chore: allow <code>null</code> for <code>pending</code> in typings
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p>
</li>
<li>
<p>fix: flush eager effects in production (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p>
</li>
<li>
<p>fix: rethrow error of failed iterable after calling
<code>return()</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p>
</li>
<li>
<p>fix: account for proxified instance when updating
<code>bind:this</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p>
</li>
<li>
<p>fix: ensure scheduled batch is flushed if not obsolete (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p>
</li>
<li>
<p>fix: resolve stale deriveds with latest value (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p>
</li>
<li>
<p>chore: remove unnecessary <code>increment_pending</code> calls (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p>
</li>
<li>
<p>fix: correctly compile component member expressions for SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p>
</li>
<li>
<p>fix: reset <code>source.updated</code> stack traces after
<code>flush</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p>
</li>
<li>
<p>fix: replacing async 'blocking' strategy with 'merging' (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p>
</li>
<li>
<p>fix: allow <code>@debug</code> tags to reference awaited variables
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p>
</li>
<li>
<p>fix: re-run fallback props if dependencies update (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p>
</li>
<li>
<p>fix: abort running obsolete async branches (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's
changelog</a>.</em></p>
<blockquote>
<h2>5.55.7</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: prevent XSS on <code>hydratable</code> from user contents (<a
href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p>
</li>
<li>
<p>chore: bump devalue (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p>
</li>
<li>
<p>fix: disallow empty attribute names during SSR (<a
href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p>
</li>
<li>
<p>fix: harden regex (<a
href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p>
</li>
<li>
<p>fix: move Svelte runtime properties to symbols (<a
href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p>
</li>
</ul>
<h2>5.55.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: leave stale promises to wait for a later resolution, instead of
rejecting (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p>
</li>
<li>
<p>fix: keep dependencies of <code>$state.eager/pending</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p>
</li>
<li>
<p>fix: reapply context after transforming error during SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p>
</li>
<li>
<p>fix: don't rebase just-created batches (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p>
</li>
<li>
<p>chore: allow <code>null</code> for <code>pending</code> in typings
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p>
</li>
<li>
<p>fix: flush eager effects in production (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p>
</li>
<li>
<p>fix: rethrow error of failed iterable after calling
<code>return()</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p>
</li>
<li>
<p>fix: account for proxified instance when updating
<code>bind:this</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p>
</li>
<li>
<p>fix: ensure scheduled batch is flushed if not obsolete (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p>
</li>
<li>
<p>fix: resolve stale deriveds with latest value (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p>
</li>
<li>
<p>chore: remove unnecessary <code>increment_pending</code> calls (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p>
</li>
<li>
<p>fix: correctly compile component member expressions for SSR (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p>
</li>
<li>
<p>fix: reset <code>source.updated</code> stack traces after
<code>flush</code> (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p>
</li>
<li>
<p>fix: replacing async 'blocking' strategy with 'merging' (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p>
</li>
<li>
<p>fix: allow <code>@debug</code> tags to reference awaited variables
(<a
href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p>
</li>
<li>
<p>fix: re-run fallback props if dependencies update (<a
href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a>
chore: bump devalue (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a>
Version Packages (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a>
fix: keep dependencies of <code>$state.eager</code>/<code>pending</code>
(alternative approach) (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a>
fix: duplicated &quot;of&quot; in events.js comment (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li>
<li><a
href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a>
fix: treat batches as a linked list (<a
href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-14 20:26:31 -07:00
dependabot[bot] c9559c89ee build(deps): bump next from 16.2.3 to 16.2.6 (#488) 
Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.2.6</h2>
<blockquote>
<p>[!NOTE]
This release contains security fixes and backported bug fixes. It does
<strong>not</strong> include all pending features/changes on canary.</p>
</blockquote>
<h3>Security Fixes</h3>
<p>The following advisories have been addressed:</p>
<p><strong>High:</strong></p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj:
Denial of Service with Server Components</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f:
Middleware / Proxy bypass in App Router applications via
segment-prefetch routes</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6:
Middleware / Proxy bypass in App Router applications via
segment-prefetch routes - <strong>Incomplete Fix
Follow-Up</strong></a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx:
Denial of Service via connection exhaustion in applications using Cache
Components</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv:
Middleware / Proxy bypass through dynamic route parameter
injection</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r:
Server-side request forgery in applications using WebSocket
upgrades</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5:
Middleware / Proxy bypass in Pages Router applications using
i18n</a></li>
</ul>
<p><strong>Moderate:</strong></p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q:
Cross-site scripting in App Router applications using CSP
nonces</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h:
Cross-site scripting in beforeInteractive scripts with untrusted
input</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh:
Denial of Service in the Image Optimization API</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7:
Cache poisoning in React Server Component responses</a></li>
</ul>
<p><strong>Low:</strong></p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949:
Cache poisoning via collisions in React Server Component
cache-busting</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq:
Middleware / Proxy redirects can be cache-poisoned</a></li>
</ul>
<h3>Core Changes</h3>
<ul>
<li>fix: preserve HTTP access fallbacks during prerender recovery (<a
href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li>
<li>Fix fallback route params case in app-page handler (<a
href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li>
<li>Fix invalid HTML response for route-level RSC requests in deployment
adapter (<a
href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li>
<li>Patch setHeader for direct route handlers (<a
href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li>
<li>Include deployment id in <code>cacheHandlers</code> keys (<a
href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li>
<li>Fix double-encoding of URL pathname parts in client param parsing
(<a
href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li>
</ul>
<h2>v16.2.5</h2>
<blockquote>
<p>[!NOTE]
This release contains security fixes and backported bug fixes. It does
<strong>not</strong> include all pending features/changes on canary.</p>
</blockquote>
<h3>Security Fixes</h3>
<p>The following advisories have been addressed:</p>
<p><strong>High:</strong></p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj:
Denial of Service with Server Components</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f:
Middleware / Proxy bypass in App Router applications via
segment-prefetch routes</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx:
Denial of Service via connection exhaustion in applications using Cache
Components</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv:
Middleware / Proxy bypass through dynamic route parameter
injection</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r:
Server-side request forgery in applications using WebSocket
upgrades</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a>
v16.2.6</li>
<li><a
href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a>
Turbopack: Match proxy matchers with webpack implementation (<a
href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li>
<li><a
href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a>
Turbopack: Fix middleware matcher suffix (<a
href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li>
<li><a
href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a>
[backport] Disable build caches for production/staging/force-preview
deploys ...</li>
<li><a
href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a>
[backport][test] Pin package manager to patch versions (<a
href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li>
<li><a
href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a>
[backport] Turbopack: more strict vergen setup (<a
href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li>
<li><a
href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a>
v16.2.5</li>
<li><a
href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a>
fix: add explicit checks for RSC header (<a
href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a
href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li>
<li><a
href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a>
fix proxy matching for segment prefetch URLs (<a
href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a
href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li>
<li><a
href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a>
Strip next-resume header from incoming requests (<a
href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.6">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for next since your current version.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-14 20:22:55 -07:00
Ben Sabic ac8a20779c feat(chat): add chat/ai subpath for AI SDK utilities (#492) 
## Summary

Introduces a dedicated `chat/ai` subpath as the home for every Vercel AI
SDK helper that ships with Chat SDK. Importing from this subpath keeps
the optional `ai` and `zod` peer dependencies out of bundles that don't
use them.

### What's new

- **`createChatTools`** — exposes Chat SDK operations as ready-to-use AI
SDK tools so an agent can read, post, react, edit, delete, and manage
thread subscriptions across every adapter the supplied `Chat` instance
has registered.
- Write operations require user approval by default (`requireApproval:
true`); toggle globally or per-tool.
- Three presets — `reader`, `messenger`, `moderator` — scope the
toolset.
- Individual tools can also be cherry-picked (`import { postMessage,
addReaction } from "chat/ai"`).
- **`toAiMessages`** (and the `Ai*` / `ToAiMessagesOptions` types) now
live alongside the tools at `chat/ai`. The previous `chat` re-exports
continue to work, but are flagged `@deprecated` with an editor hint
pointing to the new home — migration is a one-line import change.
- **Docs** — new `/docs/ai` section between Usage and Adapters in the
sidebar:
  - `/docs/ai` — Overview
  - `/docs/ai/ai-sdk-tools` — `createChatTools` guide
  - `/docs/ai/to-ai-messages` — `toAiMessages` reference
  - `/docs/ai/types` — Reference for every type exported from `chat/ai`
- **Example app** — `examples/nextjs-chat` now demos the new surface via
a "Run Agent Demo" button on the welcome card and a free-form `/agent
<prompt>` slash command (streaming, with a placeholder so users get
immediate feedback in channel contexts where Slack's typing-status API
is a no-op).

### Future plans

`createChatTools` currently exposes the cross-adapter Chat SDK surface
only. A natural follow-up is to also support **platform-specific tools**
— e.g. expose Slack-only `pin`/`unpin`, Discord-only thread archiving,
GitHub-only issue commenting, etc., so users can further extend what
their agent can do without dropping back to raw adapter calls. The shape
would likely be additional opt-in factories under `chat/ai` (or
per-adapter subpaths like `@chat-adapter/slack/ai`) that return tools
layered on top of the platform-specific adapter clients, while keeping
the cross-platform `createChatTools` API as the lowest common
denominator.

### Coverage

- `createChatTools` orchestrator: 100% statements / 94.7% branches.
- Every tool factory's `execute()` is exercised end-to-end (29 tests in
`index.test.ts`).
- `toAiMessages` keeps its existing 35-test suite covering role mapping,
attachment handling, links, transforms, and unsupported-attachment
fallbacks.
- Tools folder overall: 99.0% statements / 86.1% branches / 97.4%
functions / 98.9% lines.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-05-14 20:13:42 -07:00
Hugo 716e934aa2 feat(web-adapter): first class support for Vue and Svelte (#498) 
## Summary

<!-- What does this PR do? -->

## Test plan

<!-- How did you verify the changes? -->

## Checklist

- [ ] All commits are signed and verified
- [ ] `pnpm validate` passes
- [ ] Changeset added (or N/A — see
[CONTRIBUTING.md](./CONTRIBUTING.md))
- [ ] Documentation updated (or N/A)

---------

Co-authored-by: dancer <josh@afterima.ge>
 2026-05-14 19:18:24 -07:00
Ben Sabic cd7b6af1c8 test(integration-tests): add Emulate.dev-backed tests for the GitHub adapter (#479) 
## Summary

Add an Emulate.dev-backed integration-test suite for the GitHub adapter,
mirroring the structure of the Slack work in #477. Tests drive the
adapter against an in-process
[`@emulators/github`](https://emulate.dev/docs/github) server and assert
on its stateful store (comments, reviews) rather than `mock.calls`,
catching wire-format and contract issues that pure Octokit mocks miss.

- New private devDeps in `packages/integration-tests`:
`@emulators/github`, `@emulators/core`, `@hono/node-server`, plus a
workspace dep on `@chat-adapter/github`. (`@emulators/core` and
`@hono/node-server` are also declared by #477; this PR is independent of
merge order.)
- New harness `packages/integration-tests/src/github-emulator-utils.ts`
boots the emulator on an ephemeral `127.0.0.1` port, seeds a
deterministic user / repo / issue / PR / starter review comment, and
exposes a near-passthrough HTTP forwarder. **No re-signing needed**
here. `@emulators/core`'s `WebhookDispatcher` already signs deliveries
with `X-Hub-Signature-256: sha256=<hex>` exactly as the GitHub adapter
expects. The harness also adds a small URL rewriter for Octokit's
`pulls.createReplyForReviewComment` shortcut endpoint, translating it
into the canonical review-comment POST that the emulator implements.
- Four new test files (12 tests), wired to the adapter via its existing
`apiUrl` + `webhookSecret` config **zero source changes** to
`packages/adapter-github`:
- `emulator-github-auth.test.ts` (2) `GET /user` populates `botUserId`
during `initialize()`.
- `emulator-github-comments.test.ts` (4) `thread.post` / `edit` /
`delete` on issue and PR-conversation threads.
- `emulator-github-reviews.test.ts` (3) review-comment replies routed
through `pulls.createReplyForReviewComment` with the right
\`in_reply_to_id\`, plus edit / delete.
- `emulator-github-events.test.ts` (3) full inbound `issue_comment` /
`pull_request_review_comment` round-trip, including bot self-message
filtering.

```mermaid
flowchart LR
  subgraph Test["Vitest test process"]
    SDK[GitHubAdapter + Chat]
    Forwarder["HTTP forwarder<br/>passthrough"]
    Emu["@emulators/github<br/>(in-process Hono)"]
  end

  SDK -->|"issues.createComment / pulls.* / GET /user<br/>(apiUrl override)"| Emu
  Emu -->|"X-Hub-Signature-256 + x-github-event"| Forwarder
  Forwarder -->|"chat.webhooks.github(request)"| SDK
```

### Out of scope (deliberate)

- **Reactions** `@emulators/github` does not implement the `/reactions`
endpoints used by the adapter. Reaction logic is still covered by the
existing mock-based tests in
`packages/adapter-github/src/index.test.ts`.
- **GitHub App auth** (JWT \u2192 installation token via `POST
/app/installations/:id/access_tokens`) the adapter and emulator both
support it, but PAT-mode was the agreed scope here.
- **Multi-tenant install flows** via `installation` webhook events.
- Branches/refs, releases, search, actions, checks not used by the
adapter.

## Test plan

- [x] `pnpm --filter @chat-adapter/integration-tests test` 407 tests
pass across 34 files (including the 12 new emulator-github tests, ~480
ms total).
- [x] `pnpm check` and `pnpm knip` clean.
- [x] CI safety verified: ephemeral ports (`port: 0`), loopback-only
binds (`127.0.0.1`), deterministic teardown via `httpServer.close()`, no
env vars, no external network egress.

## Checklist

- [x] All commits are signed and verified
- [x] \`pnpm validate\` passes
- [x] Changeset added (or N/A see [CONTRIBUTING.md](./CONTRIBUTING.md))
N/A: \`@chat-adapter/integration-tests\` is \`private: true\` and the
change is test-only.
- [x] Documentation updated (or N/A)
\`packages/integration-tests/README.md\` describes the new
emulator-github test category.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-05-13 07:12:55 +10:00
Ben Sabic 14b1434998 test(integration-tests): add Emulate.dev-backed tests for the Slack adapter (#477) 
* chore(integration-tests): add Emulate.dev Slack emulator devDeps

Add @emulators/slack, @emulators/core, and @hono/node-server as
devDependencies of the private integration-tests package. These power
the upcoming in-process Slack emulator harness used to drive the Slack
adapter against a stateful, Slack-shaped HTTP server instead of mocks.

* test(integration-tests): add Slack emulator test harness

Introduce slack-emulator-utils.ts, a test-only helper that boots the
@emulators/slack Hono app on an ephemeral 127.0.0.1 port via
@hono/node-server and pre-seeds a deterministic team / channel / bot /
human user / OAuth app. The Slack adapter is wired to it via its
existing apiUrl config; no source changes required.

Also exposes startSlackWebhookForwarder, a tiny in-process Node http
forwarder that re-signs the emulator's outbound event_callback
deliveries with x-slack-signature / x-slack-request-timestamp before
handing them to chat.webhooks.slack(...). The emulator's core
WebhookDispatcher only emits GitHub-style X-Hub-Signature-256 headers,
so this bridge is what makes inbound flows exercise the SDK's real
HMAC verification path.

The handle returns direct access to the emulator's Store and
WebhookDispatcher so tests can assert on persisted state instead of
mock call records.

* test(integration-tests): cover Slack auth, postMessage, and reactions via emulator

Add three test files that drive the SlackAdapter's outbound WebClient
calls through the in-process emulator and assert on its stateful store
rather than on mock call records:

- emulator-slack-auth.test.ts (3 tests): auth.test populates botUserId
  during initialize(); explicit botUserId is respected; multi-workspace
  mode skips the call entirely.
- emulator-slack-post-message.test.ts (5 tests): plain text and threaded
  thread.post round-trip into the messages collection and are visible
  via conversations.replies; editMessage updates via chat.update;
  deleteMessage removes via chat.delete; markdown posts succeed.
- emulator-slack-reactions.test.ts (3 tests): addReaction /
  removeReaction round-trip via reactions.add / reactions.remove and
  show up via reactions.get; multi-user reactions accumulate correctly.

These exercise the full HTTP path against a Slack-shaped server,
catching wire-format and contract issues that pure mocks miss.

* test(integration-tests): cover Slack inbound events and OAuth v2 install via emulator

Add two test files that drive end-to-end flows previously only
verifiable against real Slack:

- emulator-slack-events.test.ts (4 tests): a human posts to the
  emulator, which dispatches an event_callback to the local forwarder,
  which signs the body and hands it to chat.webhooks.slack(...). The
  SDK's onNewMention and onNewMessage handlers run with a live Thread
  and the bot's reply lands back in the emulator. Bot self-messages
  are correctly filtered. This is the only Slack adapter test in the
  repo that covers the full inbound-then-outbound round-trip without
  hand-crafted webhook payloads.
- emulator-slack-oauth.test.ts (4 tests): handleOAuthCallback
  exchanges a real authorization code via oauth.v2.access against the
  emulator's authorize/callback flow; the resulting installation is
  persisted in the state adapter; invalid codes and mismatched
  client_secrets are rejected; the freshly issued bot token works for
  subsequent chat.postMessage calls via withBotToken.

* docs(integration-tests): document emulator-* test category

Add an "Emulator tests" entry to the package README so newcomers can
distinguish the new emulator-backed suite from the existing unit and
replay tests, and find the harness in slack-emulator-utils.ts.

* fix(integration-tests): keep full token scopes after emulator.reset()

`applyTokenSeed` (used during `reset()`) was granting only
["chat:write", "channels:read"] to seeded tokens, while the initial
`createCoreServer({ tokens })` call granted the full bot/human scope
sets. After the first `reset()` the bot token silently lost
`channels:history`, `users:read`, `reactions:read`, and
`reactions:write`, which would surface as flaky behaviour for any test
that relied on those scopes after a reset.

Unify both call sites on a single `buildTokenSeedEntries` helper so
fresh-boot and post-reset state always grant the same scopes. Add a
regression test in emulator-slack-auth.test.ts that triggers a manual
`emulator.reset()` and re-asserts that the bot token still resolves
via auth.test.

* refactor(integration-tests): reorganize Slack emulator tests under emulator/slack/

Address review feedback (visyat) by moving the flat
`emulator-slack-*.test.ts` files into a per-adapter directory:

  packages/integration-tests/src/emulator/slack/
      utils.ts
      auth.test.ts
      events.test.ts
      oauth.test.ts
      post-message.test.ts
      reactions.test.ts

This scales cleanly as more adapter emulator suites land (e.g.
`emulator/github/`), instead of cluttering the top-level src tree with
adapter-prefixed file names.

Also hoist the duplicated `silentLogger` definition from each test
file into the shared `utils.ts`, removing five identical copies.

No behavior changes. All 20 emulator tests still pass.

* test(integration-tests): cover Slack multi-workspace token resolution via emulator

Add `emulator/slack/multi-workspace.test.ts` exercising the path that
was previously only covered by replay/mock-based tests: the adapter
runs without a hardcoded `botToken`, multiple workspaces are persisted
in the state adapter via `adapter.setInstallation(teamId, ...)`, and
inbound `event_callback`s for either team are routed to the correct
per-tenant bot token end-to-end against the shared emulator.

To make this work, the helper grew two small additions:

- `addEmulatorWorkspace(emulator, seed)` — register an additional
  team + bot + channel + token on an already-booted emulator, so two
  tenants live side-by-side without needing two emulator instances.
- The inbound forwarder's `augmentEventEnvelope` now accepts an
  optional `resolveTeamId(envelope)` callback, defaulting to a constant
  teamId for the existing single-workspace tests. The multi-workspace
  test passes a resolver that looks up the dispatched event's channel
  in the emulator store and returns the owning team's id, so the SDK's
  per-team token resolver sees the right `team_id` on the envelope.

Three new tests: team-A routing, team-B routing, and `getInstallation`
returning null for unknown team ids. Follow-up from review feedback on
PR #477.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-05-12 08:29:02 +10:00