skills/vercel__chat
1
0
Fork 0
mirror of https://github.com/vercel/chat.git synced 2026-09-14 18:32:29 +08:00
Code Issues Packages Projects Releases Wiki Activity
924 Commits 95 Branches 713 Tags
@chat-adapter/github@4.40.0
Commit Graph

119 Commits

Author SHA1 Message Date
Hiroki Osame 32a2717e68 ci: fix release pipeline for changesets action v2 (#902) 
## Problem

The Release workflow has failed on every run since Sep 3, so no package
version has been published since then. Every changeset merged to `main`
is stranded waiting for the version PR to regenerate.

The cause is a dependency mismatch introduced by a Dependabot bump. #880
updated the [Changesets GitHub
Action](https://github.com/changesets/action) from v1.9.0 to v2.1.1, but
did not touch `@changesets/cli`, which stayed on v2. The action's v2
release requires Changesets CLI v3 and rejects CLI v2 on every run, so
the workflow fails before it can version or publish anything. The
mismatch went unnoticed because Dependabot manages GitHub Actions and
npm dependencies separately.

## Changes

- Bump `@changesets/cli` from ^2.29.8 to ^3.0.1 to match what the action
requires. The existing `.changeset/config.json` is fully compatible with
CLI v3; nothing else in the release flow changes.
- Update the Release workflow to the action's renamed inputs: `publish`
→ `publish-script`, `commit` → `commit-message`, `title` → `pr-title`.
The v2 action hard-fails on the old names, and it removed `commitMode:
github-api` entirely (GitHub API pushes are now the default behavior, so
removing it preserves what the workflow did before).

Once merged, the Release workflow should go green and update the open
version PR (#878) to include all changesets accumulated since Sep 3,
unblocking the next publish.

Signed-off-by: Hiroki Osame <hiroki.osame@gmail.com>
 2026-09-05 12:59:31 +10:00
Ben Sabic f485255bcf fix(adapters): harden webhook tenant isolation (#877) 
Multi-workspace Slack now ignores commands and interactions when their
installation cannot be found, and channel names stay isolated per
workspace.

Google Chat no longer learns its identity from incoming mentions, and
forward history reads use bounded native pagination.

Webhook logs avoid message content. The example app protects preview
routing, records only successful verified deliveries, and caps recording
size and retention.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Signed-off-by: dancer <josh@afterima.ge>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-09-03 17:30:32 +01:00
Ben Sabic 894fc7c7b3 docs: redirect conversation-history and update Vercel Connect page (#870) 
Redirects /docs/conversation-history to /docs/history, since the History
guide already covers the old transcripts content. Removes the Vercel
Connect beta callout and adds related links to the Chat SDK docs and The
Complete Guide to Vercel Connect.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-08-28 10:31:31 -07:00
dependabot[bot] 4fa1c2bcf9 build(deps-dev): bump postcss from 8.5.25 to 8.5.26 (#795) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.25 to
8.5.26.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.26</h2>
<ul>
<li>Fixed <code>list.split()</code> regression (by <a
href="https://github.com/lazerg"><code>@​lazerg</code></a>).</li>
<li>Track symlinks in path protection in source map loading (by <a
href="https://github.com/drengir1"><code>@​drengir1</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.26</h2>
<ul>
<li>Fixed <code>list.split()</code> regression (by <a
href="https://github.com/lazerg"><code>@​lazerg</code></a>).</li>
<li>Track symlinks in path protection in source map loading (by <a
href="https://github.com/drengir1"><code>@​drengir1</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/07b25773f38f77919f2af02ae3e8896b0deb5988"><code>07b2577</code></a>
Release 8.5.26 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/47de6b9d7c55674cb326c5de7a734a740916defc"><code>47de6b9</code></a>
Update CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/1493a83db7830912316512f55ab6064e7b7dd68e"><code>1493a83</code></a>
Fix Rule#selectors losing the empty selector (<a
href="https://redirect.github.com/postcss/postcss/issues/2129">#2129</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/180db166e250d20e6761b224ae8d8134c9ba3e40"><code>180db16</code></a>
Typo</li>
<li><a
href="https://github.com/postcss/postcss/commit/29e9e00f132c96e46e1de295b816fe88a05354e7"><code>29e9e00</code></a>
Resolve symlinks before the previous-source-map containment check (<a
href="https://redirect.github.com/postcss/postcss/issues/2125">#2125</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/3ba8f84703a884329b58abea579c3615684e0b7e"><code>3ba8f84</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/87e72f671fd0d401c52822b5226c656632d92ec0"><code>87e72f6</code></a>
Update lock file</li>
<li><a
href="https://github.com/postcss/postcss/commit/caaeeb907e4a816c44a23b00b151882bd02325a1"><code>caaeeb9</code></a>
Upgrade nanoid to fix infinite loop on zero size (<a
href="https://redirect.github.com/postcss/postcss/issues/2124">#2124</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/3609b6f4296952d0b5b9ddae42c8d73ee460c041"><code>3609b6f</code></a>
Explain how to type plugin options</li>
<li><a
href="https://github.com/postcss/postcss/commit/fbad419cbd01cd7a9a1a46413447f2cd9b3fce4a"><code>fbad419</code></a>
docs: show ESM and TypeScript plugin declaration (<a
href="https://redirect.github.com/postcss/postcss/issues/2118">#2118</a>)</li>
<li>See full diff in <a
href="https://github.com/postcss/postcss/compare/8.5.25...8.5.26">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-08-28 17:53:22 +10:00
christopherkindl 50af1605d5 chore(docs): use geistdocs 1.23.1 (#864) 
Uses `@vercel/geistdocs@1.23.1`, which includes the desktop navbar fix:
clicking an open navigation trigger closes its menu.

Release:
https://github.com/vercel/geistdocs/releases/tag/%40vercel%2Fgeistdocs%401.23.1

## Validation
- `pnpm install --lockfile-only --ignore-scripts`
- `git diff --check`
 2026-08-25 21:30:51 +10:00
christopherkindl ea716568fa chore(docs): update geistdocs to 1.24.0 (#863) 
Updates the docs app to `@vercel/geistdocs@1.24.0` and refreshes the
pnpm lockfile.

Includes improved agent recovery and discovery from
https://github.com/vercel/geistdocs/pull/255.

## Validation
- `pnpm install --lockfile-only --ignore-scripts`
- `git diff --check`
 2026-08-25 20:16:22 +10:00
christopherkindl a0084cb6e2 chore(docs): update geistdocs to 1.23.1 (#861) 
Updates the docs app to `@vercel/geistdocs@1.23.1` and refreshes the
pnpm lockfile.

## Validation
- `pnpm install --lockfile-only --ignore-scripts`
- `git diff --check`
 2026-08-25 20:02:38 +10:00
Rich Haines b7e4bbfbb0 chore(docs): upgrade Geistdocs to 1.22.0 (#855) 
## Summary

Upgrades the chat-sdk.dev docs app from `@vercel/geistdocs` **1.20.4 →
1.22.0** (published 2026-08-21, Apache-2.0) and `next` **16.2.11 →
16.3.1**, following the bundled 1.22.0 template as the source of truth.

The target release includes all of the behavior-changing PRs for this
round:

- vercel/geistdocs#245 — require Next.js 16.3, scaffold 16.3.1, drop the
dev filesystem-cache flag (shipped in 1.21.1)
- vercel/geistdocs#246 — Cache Components across Geistdocs
- vercel/geistdocs#249 — Partial Prefetching + instant docs navigation
- vercel/geistdocs#250 — stable Next 16.3 APIs, retryable page/Ask AI
error boundaries, full prefetch of package links, no generic page shell
- vercel/geistdocs#251 — tree sidebar preserves scroll position on
folder toggles

## Adapter and configuration changes

- `next.config.ts`: `cacheComponents: true`, `partialPrefetching: true`;
removed `experimental.turbopackFileSystemCacheForDev` (default in 16.3).
Redirects, `/sitemap.xml` rewrite, and image config unchanged.
- New `lib/geistdocs/root-params.ts`; all layouts read `[lang]` via
`next/root-params` instead of `params`. Route handlers keep
route-context `params`.
- Root layout gains `generateStaticParams` returning every configured
language (`en`) — home (`/`), `/adapters`, and `/resources` now
prerender statically (previously dynamic).
- Route adapters no longer re-export `revalidate`/`dynamic` from package
factories (`agents.md`, `sitemap.md`, `llms.mdx`), and custom routes
drop their own `revalidate` exports (`llms.txt`, `llms-full.txt`,
`adapters.mdx`, `rss.xml`, `resources`).
- `llms.mdx` adopts the template form: `sources: [geistdocsSource]` +
`notFound: {}`, enabling smart agent-readable 404/410 responses with
real HTTP statuses.
- `rss.xml` migrated to the template's `"use cache"` +
`cacheLife("max")` form with `getPublicPath` base-path handling.
- `resources` page: `revalidate = 86400` → `"use cache"` +
`cacheLife("days")` (same 1-day lifetime).
- App-owned data fetching moved off `next: { revalidate }` (unsupported
under Cache Components): GitHub README fetches and homepage OSS stats
now use `"use cache"` + `cacheLife("hours")`.
- Homepage Shiki highlighting (`Demo`, `CodePreview`, `highlightCode`)
runs inside `"use cache"` scopes — Shiki reads `Date.now()` internally,
which otherwise fails prerendering.
- App-owned links to statically generated docs pages get
`prefetch={true}` (platform grid, feature matrix, adapter slug list,
"Visit Documentation") per the template's agent guidance; package-owned
sidebar/prev-next links already prefetch fully in 1.22.0.
- `Analytics`/`SpeedInsights` moved into
`components/geistdocs/provider.tsx` per the template.
- CSS: `styles/geistdocs.css` now imports `@vercel/geistdocs/theme.css`
(self-sourcing package dist/streamdown) instead of layering on
`styles.css` from `global.css`; updated the mobile breadcrumb selector
for the new package DOM; kept the site-specific shadcn tokens, dark
background-scale override, prose, TOC, and streamdown fixes.
- Added `apps/docs/AGENTS.md` capturing the packaged-architecture
conventions (cache-components rules, root-params, markdown contract,
proxy mappings).

## PR #251 (tree sidebar scroll) verification

The fix is package-internal (`manualToggleRef` in `SidebarTree`); no
consumer change is needed. This site's sidebars render no collapsible
folder rows (content uses spread folders, `...api` etc.), so I verified
the shipped behavior against the bundled 1.22.0 template with
`sidebarMode="tree"` enabled locally: expanding/collapsing a folder
preserves the exact sidebar scroll position (772 → 772), and a route
change into a collapsed folder still scrolls the active item into view.
8/8 checks pass.

## Static-generation coverage

Production build: 290/290 static pages generated. Every intended
parameter tuple is prerendered with complete content (verified H1/body
in emitted HTML):

- `/en` home, `/en/adapters` listing, `/en/resources` — now fully static
(were `ƒ` on main)
- `/en/docs/*` — 45 pages, complete static HTML + one generic
`[[...slug]]` fallback entry (allowed)
- `/en/adapters/{official,community,vendor-official}/*` — 44 detail
pages + `/en/adapters.mdx/*` markdown for all 44
- `/en/sitemap.md` — SSG

Intentional contract differences (match the 1.22.0 template's own build
output):

- OG image routes (`/og/[...slug]`, adapter `*/og`) render on demand
under Cache Components instead of build-time SSG; Next 16.3 caches the
rendered image per route. URLs and content types verified unchanged.
- `llms.txt`, `llms-full.txt`, `llms.mdx`, `rss.xml`, `agents.md` remain
on-demand route handlers (same as main); `agents.md` reads the request
origin by package design.
- Unknown HTML routes: browsers receive the docs shell with 200 before
not-found UI resolves; crawlers get a real 404. Machine-readable unknown
routes return the new smart 404 body with real 404 status and
`X-Robots-Tag: noindex`.

## Lockfile

`pnpm-lock.yaml` delta: the `docs` importer's `@vercel/geistdocs`
(1.20.4 → 1.22.0) and `next` (16.2.11 → 16.3.1) bumps, their
peer-context re-resolutions, and one mechanical re-keying of `@swc/core`
peer contexts to include `@swc/helpers` across existing entries (no
version changes outside the docs app). Verified with `pnpm install
--frozen-lockfile`.

## Test results

- `pnpm install --frozen-lockfile` ✓
- `pnpm check` ✓ (1 pre-existing warning in untouched
`lib/read-more.ts`)
- `pnpm typecheck` — 43/43 ✓
- `pnpm knip` ✓, `pnpm konsistent` ✓
- `pnpm test` — 47/47 turbo tasks ✓
- Clean production build (removed `.next`/`.source`) ✓ 290/290
- Production-server (`next start`) contract checks: HTML docs,
`.md`/`.mdx`, `Accept: text/markdown`, agent-UA negotiation, `llms.txt`,
`llms-full.txt`, `sitemap.md`, `agents.md`, `/.well-known/mcp.json`
(intentional 404), `rss.xml`, `robots.txt`, `/sitemap.xml` rewrite, OG
images, `AGENTS.md`, all redirects (308s), `/api/search` JSON and not
rewritten as markdown, `/docs.md` section root ✓
- Browser checks (Playwright, Chrome, `next start`) — 16/16: instant
sidebar + prev/next client navigation with complete content and no
loading shell, single visible H1 (Activity-preserved routes stay
hidden), Copy Page, page actions menu, search → result navigation, Ask
AI panel with suggestions, theme switch (dark applies the site's
background scale), mobile navbar menu and docs sheet navigation, unknown
page shows not-found UI, zero console/page errors and failed requests
- Ask AI scoped failure: with no local AI Gateway credentials the chat
surfaces the error, the surrounding page stays intact, and resubmission
retries cleanly
- Visual parity screenshots vs production (home/docs/adapters, light +
dark) match

## Preview

- Preview:
https://chat-git-richardhaines-geistdocs-122-upgrade.vercel.sh —
deployment **Ready**, build passed on Vercel.
- The preview sits behind Vercel SSO (Fork Protection), so automated
route checks aren't possible without a bypass token; please spot-check
through SSO: `/docs/getting-started`, `/docs/getting-started.md`,
`/adapters`, `/llms.txt`, and a client navigation between docs pages.

Signed-off-by: molebox <rich@vercel.com>
 2026-08-24 12:22:40 +02:00
Rich Haines 4c18ec98e8 chore(docs): update Geistdocs to 1.20.4 (#845) 
Updates Geistdocs so link-preview bots receive HTML and preserve rich
unfurls instead of being served Markdown.
 2026-08-20 10:47:53 +10:00
Bryan Hunter bdeb2bf1b1 fix(workflow): isolate chat serializers from node runtime (#806) 
## Failure

Workflow SDK `5.0.0-beta.40` produces an invalid workflow bundle when a
Chat SDK serializable class such as `Message`, `ThreadImpl`, or
`ChannelImpl` crosses a workflow step boundary.

The Workflow compiler imports the emitted module containing each class
to register its `@workflow/serde` methods. In Chat SDK `4.37.0`, tsup
emits those classes in `dist/index.js`. The root entry also imports the
conversation-scoping implementation added in #751, which uses
`AsyncLocalStorage` from `node:async_hooks`. Serializer registration
therefore pulls Node-only code into the sandboxed workflow bundle before
any workflow or step executes.

Build warning:

```text
Serde warning for classes "ChannelImpl", "Message", "ThreadImpl":
Workflow bundle contains Node.js built-in imports: async_hooks.
These will fail at runtime in the workflow sandbox.
```

Deployed workflows then fail during module initialization:

```text
var import_async_hooks = require("async_hooks");
                         ^

ReferenceError: require is not defined
```

## Minimal reproduction

```json
{
  "dependencies": {
    "chat": "4.37.0",
    "workflow": "5.0.0-beta.40"
  }
}
```

```ts
import { Message } from "chat";

async function createMessageStep(value: string): Promise<Message> {
  "use step";

  return new Message({
    id: "message",
    threadId: "slack:C123:123.456",
    text: value,
    formatted: {
      type: "root",
      children: [
        {
          type: "paragraph",
          children: [{ type: "text", value }],
        },
      ],
    },
    raw: {},
    author: {
      userId: "U123",
      userName: "user",
      fullName: "User",
      isBot: false,
      isMe: false,
    },
    metadata: { dateSent: new Date(), edited: false },
    attachments: [],
  });
}

export async function testWorkflow(value: string): Promise<string> {
  "use workflow";

  const message = await createMessageStep(value);
  return message.text;
}
```

Running `workflow build` on `4.37.0` emits the warning; deploying the
output produces the runtime failure above.

## Fix

- Add a dedicated `chat/serialization` package entry for `Message`,
`ThreadImpl`, `ChannelImpl`, `reviver`, and their serialized DTO types.
- Make serializer code a second tsup entry and explicitly enable
splitting. The serializer-bearing classes are now emitted into a shared
chunk with no dependency on `Chat` or its Node-only conversation
context.
- Preserve the existing root exports and automatic `@workflow/serde`
behavior. Existing `import { Message } from "chat"` workflow code
remains valid.
- Add a post-build module-graph assertion that fails if any emitted
serializer registration can transitively import a Node.js builtin.
- Test against Workflow SDK `5.0.0-beta.40`, the compiler version that
exposed the invalid bundle.
- Add a minor changeset for the fixed-version Chat SDK packages,
producing the `4.38.0` release line.

After the change, the emitted serializer classes live in a sandbox-safe
shared chunk while `AsyncLocalStorage` remains in a separate Node
runtime chunk. The exact reproduction compiles successfully with `5
steps, 1 workflow` and no Serde warning.

## Control cases

The failure requires a serializable Chat class to cross a durable
boundary. These cases were already safe and remain unchanged:

- `AsyncLocalStorage` used entirely inside a `"use step"` function.
- A Chat `Message` created and consumed within one step while returning
plain data.
- Request handlers that convert Chat objects to plain workflow DTOs
before starting a workflow.
- `@vercel/sandbox` used entirely inside a step.

## Validation

- Committed beta.40 reproduction fixture: type-correct and compiled
during every Chat package build with no Node builtin / Serde warning.
- Emitted serializer module graph: no transitive Node.js builtins.
- Chat package: 1,113 tests pass.
- Chat package typecheck passes.
- Repository formatting and lint checks pass.
- Package build passes.

Full repository validation reaches the pre-existing `knip` baseline and
reports unrelated unused dependencies and unlisted binaries in examples
and adapter packages.

---------

Signed-off-by: bryan-hunter <bryan.hunter@vercel.com>
 2026-08-10 09:03:49 -05:00
Rich Haines 9188fd7ed4 chore(docs): update @vercel/geistdocs to 1.19.6 (#807) 
Updates `@vercel/geistdocs` from 1.19.4 to 1.19.6.
 2026-08-10 19:33:57 +10:00
Ben Sabic 2a2b2c5500 feat(instagram): add native DM adapter (#770) 
Adds a first-party Instagram Direct Messages adapter backed by Meta's
Instagram API with Instagram Login.

- Verifies webhook challenges and HMAC signatures, then normalizes DMs,
story replies, media, quick replies, postbacks, and reactions.
- Sends plain text, cards, quick replies, typing indicators, URL
attachments, and uploaded media through `graph.instagram.com`.
- Maps authentication, rate-limit, and 24-hour messaging-window failures
to typed adapter errors.
- Registers Instagram in the adapter catalog, CLI scaffold, official
docs, replay suite, and Next.js example.

## Usage

```ts
import { createInstagramAdapter } from "@chat-adapter/instagram";
import { Chat } from "chat";

const bot = new Chat({
  userName: "mystore",
  adapters: { instagram: createInstagramAdapter() },
});
```

## Webhook

```ts
export async function POST(request: Request) {
  return bot.webhooks.instagram(request);
}
```

## Verification

- `pnpm --filter @chat-adapter/instagram test`
- `pnpm --filter @chat-adapter/instagram typecheck`
- `pnpm --filter example-nextjs-chat typecheck`
- `pnpm --filter example-nextjs-chat build`
- `pnpm check`
- `pnpm konsistent`

## Live Testing

<table>
  <tr>
<td><img width="1440" height="2109" alt="1000000502"
src="https://github.com/user-attachments/assets/9fdb8c3b-4e41-4c81-9426-08756a5e4201"
/></td>
<td><img width="1440" height="1995" alt="1000000503"
src="https://github.com/user-attachments/assets/8a572493-c57a-4412-9049-5737aaa9dfd0"
/></td>
  </tr>
</table>

Closes #729 / Co-Authored by @ivandujaut

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-08-07 17:38:15 +01:00
Ben Sabic 0ec6a7361b feat(notion): add Notion comments adapter (#689) 
Adds `@chat-adapter/notion`, an official adapter that lets a Chat SDK
bot take part in **Notion comment discussions** (page-level and
block/discussion threads) with the same handler code used for Slack,
Linear, GitHub, etc. Inbound events arrive via Notion webhooks
(`comment.created`) with HMAC signature verification; outbound actions
use the Comments REST API. Because Notion lets a connection edit its own
comments, the adapter supports **Post+Edit streaming**.

### Highlights

- **Webhooks** — `comment.created` verified with `X-Notion-Signature`
HMAC over the raw body (timing-safe), plus the one-time
`verification_token` handshake. Returns a fast 200 with idempotent,
state-backed dedupe.
- **Post+Edit streaming** — posts the first chunk, then `PATCH`es the
comment as tokens arrive, throttled to Notion's ~3 req/s limit (global
token bucket, `Retry-After` aware). Long bodies are split into
sequential comments to stay under the 2000-char rich-text cap.
- **Mentions** — three modes: `mention` (default; plain-text `@userName`
/ `@botUserId`), `all-comments`, and `keyword`.
- **`message.subject`** — resolves the parent page via the Pages API
(title, url, archived status, author).
- **File uploads** — up to 3 native attachments via the File Uploads API
(binary `single_part`; public URLs via `external_url` with bounded
polling); overflow and failures fall back to markdown links.
- **History** — `fetchMessages` over list-comments (open comments only),
direction-aware.
- Cards render as markdown fallback; reactions / typing / DMs are typed
no-ops or errors. Registered in the `chat/adapters` catalog and the
`create-chat-sdk` scaffold; pinned to `Notion-Version: 2026-03-11`.

### Usage

```ts
// lib/bot.ts
import { Chat } from "chat";
import { createNotionAdapter } from "@chat-adapter/notion";
import { createRedisState } from "@chat-adapter/state-redis";

export const bot = new Chat({
  userName: "notion-bot",
  adapters: { notion: createNotionAdapter() }, // reads NOTION_TOKEN + NOTION_VERIFICATION_TOKEN
  state: createRedisState(),
});

bot.onNewMention(async (thread, message) => {
  const subject = await message.subject; // parent page metadata (title, url, …)
  await thread.post(`Thanks for the mention on **${subject?.title ?? "this page"}**!`);
});
```

```ts
// app/api/webhooks/notion/route.ts
import { bot } from "@/lib/bot";

export const POST = (request: Request): Promise<Response> => bot.webhooks.notion(request);
```

### Configuration

Auto-detects `NOTION_TOKEN` and `NOTION_VERIFICATION_TOKEN`, plus
optional `NOTION_BOT_USERNAME`, `NOTION_MENTION_MODE`,
`NOTION_KEYWORDS`, and `NOTION_VERSION`; everything is overridable via
`createNotionAdapter({ … })`. The docs page covers the full connection +
webhook setup (capabilities, content access, and the webhook-URL-lock
warning).

Changeset bumps `@chat-adapter/notion`, `chat`, and `create-chat-sdk`
(minor). Layered as four commits: `feat` (adapter +
catalog/scaffold/emoji), `docs`, `test`, `chore(example)`.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-08-05 14:15:44 +01:00
christopherkindl 0334e97b62 chore(docs): upgrade geistdocs to 1.19.4 (#783) 
Bumps `@vercel/geistdocs` in the docs app from 1.19.2 to 1.19.4 (to fix
safari logo bug)
 2026-08-05 11:48:40 +10:00
josh 7714d766e6 fix: remove duplicate lockfile entries (#766) 
## summary

`pnpm-lock.yaml` on main has duplicated `nanoid@3.3.16` and
`postcss@8.5.25` keys after #740 and #744 merged back to back, so `pnpm
install --frozen-lockfile` fails and every ci job on main is red

```
ERR_PNPM_BROKEN_LOCKFILE  duplicated mapping key (10069:3)
```

the duplicate blocks are byte identical, so this deletes the extras and
changes no versions. regenerating the lockfile was not an option:
`.npmrc` sets `min-release-age=2`, which re-resolves to older packages
and would have reverted both bumps
 2026-08-01 00:59:16 +01:00
dependabot[bot] 7cda0e008e build(deps-dev): bump postcss from 8.5.16 to 8.5.18 (#744) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to
8.5.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.18</h2>
<ul>
<li>Restricted loading previous source maps file to the
<code>opts.from</code> folder for security reasons (use <code>unsafeMap:
true</code> to disable the check).</li>
</ul>
<h2>8.5.17</h2>
<ul>
<li>Fixed <code>Maximum call stack size exceeded</code> error.</li>
<li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li>
<li>Fixed <code>Input#origin()</code> for unmapped end position (by <a
href="https://github.com/chatman-media"><code>@​chatman-media</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/4c0d194c136fd374495d0993c890d794cab65b81"><code>4c0d194</code></a>
Release 8.5.18 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/92b4e7891ec7b811821d01acc8aa0f010caf41e2"><code>92b4e78</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"><code>95663d3</code></a>
Limit where source map can be loaded for security reasons</li>
<li><a
href="https://github.com/postcss/postcss/commit/74e25ae9f4efaa56a41a449064a655d7da78072c"><code>74e25ae</code></a>
Release 8.5.17 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/d1518afd5a88f42728b30b87f8917210f363f9f1"><code>d1518af</code></a>
Fix Maximum call stack size exceeded error</li>
<li><a
href="https://github.com/postcss/postcss/commit/2421312ffea96ba77b35ce24a1b2d9c2e22b5e83"><code>2421312</code></a>
Fix linter</li>
<li><a
href="https://github.com/postcss/postcss/commit/a50352c583df991710f92ccac25b36304695161a"><code>a50352c</code></a>
Fix CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/33948f0969bb858acdd52c9692e3a785a3ed0a73"><code>33948f0</code></a>
Prevent prototype hijacking in fromJSON</li>
<li><a
href="https://github.com/postcss/postcss/commit/2131909351161cd2c5fc2be58b14919a873ea824"><code>2131909</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/93440abcca92793b31c5d1fdf5f2da7b58b27599"><code>93440ab</code></a>
Fix non-closed <code>\&lt;div align=&quot;center&quot;&gt;</code> in
README (<a
href="https://redirect.github.com/postcss/postcss/issues/2110">#2110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.16...8.5.18">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 00:43:07 +01:00
dependabot[bot] 379842f2b2 build(deps): bump next from 16.2.6 to 16.2.11 (#740) 
Bumps [next](https://github.com/vercel/next.js) from 16.2.6 to 16.2.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v16.2.11</h2>
<p>This release contains security fixes for the following
advisories:</p>
<p>High:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial
of Service in App Router using Server Actions</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware
/ Proxy bypass in App Router applications using Turbopack and single
locale</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side
Request Forgery in rewrites via attacker-controlled destination
hostname</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side
Request Forgery in Server Actions on custom servers</a></li>
</ul>
<p>Moderate:</p>
<ul>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache
confusion of response bodies for requests with bodies</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache
confusion of response bodies for requests with bodies containing invalid
UTF-8 byte sequences</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial
of Service in the Image Optimization API using SVGs</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated
disclosure of internal Server Function endpoints</a></li>
<li><a
href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded
Server Action payload in Edge runtime</a></li>
</ul>
<h2>v16.2.10</h2>
<p>Contains no changes except publishing <code>@next/swc-wasm-web</code>
which was accidentally not published since 16.2.4.</p>
<h2>v16.2.9</h2>
<p>Empty release to ensure <code>next@latest</code> points at a stable
release. Next.js only allows publishing with Trusted Publishing enabled.
In order to fix NPM dist-tags, we have to release a new version.
Updating dist-tags is not possible with Trusted Publishing.</p>
<h2>v16.2.8</h2>
<p>Release with no changes in an attempt to fix <code>next@latest</code>
pointing at a prerelease version.</p>
<h2>v16.2.7</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong>
include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Backport documentation fixes for v16.2 (<a
href="https://redirect.github.com/vercel/next.js/issues/93804">#93804</a>)</li>
<li>[backport] Patch <code>playwright-core</code> to resolve
<code>_finishedPromise</code> on <code>requestFailed</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93920">#93920</a>)</li>
<li>[backport] Fix dev mode hydration failure when page is served from
HTTP cache (<a
href="https://redirect.github.com/vercel/next.js/issues/93492">#93492</a>)</li>
<li>[backport] Fix catch-all <code>router.query</code> corruption with
<code>basePath</code> + <code>rewrites</code> (<a
href="https://redirect.github.com/vercel/next.js/issues/93917">#93917</a>)</li>
<li>[backport] Encode non-ASCII characters in cache tags at construction
(<a
href="https://redirect.github.com/vercel/next.js/issues/93918">#93918</a>)</li>
<li>[backport] Fix server action forwarding loop with middleware
rewrites (<a
href="https://redirect.github.com/vercel/next.js/issues/93919">#93919</a>)</li>
<li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a
href="https://redirect.github.com/vercel/next.js/issues/93932">#93932</a>)</li>
<li>[ci] Disable hanging node 24 typescript tests on 16.2 backport
branch (<a
href="https://redirect.github.com/vercel/next.js/issues/94164">#94164</a>)</li>
<li>[backport] Fix &quot;type: module&quot; in project dir when using
standalone or adapters (<a
href="https://redirect.github.com/vercel/next.js/issues/94050">#94050</a>)</li>
<li>[backport] Propagate adapter preferred regions (<a
href="https://redirect.github.com/vercel/next.js/issues/94200">#94200</a>)</li>
<li>[16.2.x] Don't drop <code>FormData</code> entries (<a
href="https://redirect.github.com/vercel/next.js/issues/94240">#94240</a>)</li>
<li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS
config resolution (<a
href="https://redirect.github.com/vercel/next.js/issues/94284">#94284</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a
href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a
href="https://github.com/icyJoseph"><code>@​icyJoseph</code></a>, <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a>, <a
href="https://github.com/mischnic"><code>@​mischnic</code></a>, <a
href="https://github.com/bgw"><code>@​bgw</code></a>, <a
href="https://github.com/timneutkens"><code>@​timneutkens</code></a>,
and <a
href="https://github.com/lukesandberg"><code>@​lukesandberg</code></a>
for helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/next.js/commit/9beca0821cf4606ae33466ed6f4fc75f2887a4da"><code>9beca08</code></a>
v16.2.11</li>
<li><a
href="https://github.com/vercel/next.js/commit/3c48c7af78f2c01691065cb303da1b107a2c8617"><code>3c48c7a</code></a>
[16.x] Fix Turbopack middleware matcher with i18n single locale</li>
<li><a
href="https://github.com/vercel/next.js/commit/ac1eff3f7a7285176396ecc69c3b160a3d6ad1a2"><code>ac1eff3</code></a>
[16.x] Improve performance of checking valid MPA form submissions</li>
<li><a
href="https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17"><code>9a4651e</code></a>
[16.x] Enforce <code>serverActions.bodySizeLimit</code> for Server
Actions in Edge runtime</li>
<li><a
href="https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b"><code>b512063</code></a>
[16.x] Set correct origin for internal redirects in custom server</li>
<li><a
href="https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599"><code>d303326</code></a>
[16.x] Ensure exotic rewrite param values are properly encoded</li>
<li><a
href="https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a"><code>73b9487</code></a>
[16.x] fix(fetch-cache): key fetch(Request, init) by the effective
request</li>
<li><a
href="https://github.com/vercel/next.js/commit/bf9d17fb30501829f6fd7c0ee8e44e2794565742"><code>bf9d17f</code></a>
[16.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodies</li>
<li><a
href="https://github.com/vercel/next.js/commit/fe28768f533582ea8f6ee7d7a7498715927d45f5"><code>fe28768</code></a>
[16.x] fix(next/image): improve performance of detectContentType()</li>
<li><a
href="https://github.com/vercel/next.js/commit/d8afb8d550ac4ac5c106ea1410c3af43eaf1d469"><code>d8afb8d</code></a>
[16.x] Performance improvements when decoding React Server function
payloads</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v16.2.6...v16.2.11">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 00:42:41 +01:00
christopherkindl 3ae34b3ed1 feat(docs): migrate the homepage to geistdocs 1.19 and the Geist design system (#762) 
Third repo in the design sync, after `vercel/geistdocs#216`/`#218` and
`vercel/flags#457`. Upgrades the docs site to `@vercel/geistdocs@1.19.2`
and brings the homepage onto the Geist design system.

`apps/docs` is `private: true`, so no changeset.

## Dependency

`1.19.2` peers on `next: ^16.2.11` and the app pinned `16.2.6`, so
**next moves to `16.2.12`** alongside it — without that pnpm reports an
unmet peer. Installed via `pnpm add --save-exact` per AGENTS.md. All 20
geistdocs subpaths this app imports still exist in 1.19.2; no API
breakage.

The footer needed no work: 1.16 already shipped the prop-less
Vercel-directory `<Footer />`.

## Layout — `home-grid.css` is gone

Deleted `app/styles/home-grid.css` (368 lines) and its `global.css`
import, and rebuilt each section on `grid-cols-12` / `col-span-*`:

| section | before (CSS) | after |
|---|---|---|
| OSS stats | 2×2 → 4×1 @768 | `col-span-6 min-[768px]:col-span-3` |
| Features | 2-up + full-width 3rd → 3×1 @961 | `col-span-12
sm:col-span-6 lg:col-span-4` |
| Code | stacked → sidebar 1/3 + code 2/3 @961 | `lg:col-span-8` /
`lg:col-span-4`, pinned with `col-start` + `row-start` |
| Integrations | 1×5 → tall left + 2×2 @961 | `lg:col-span-4
lg:row-span-2` + four `lg:col-span-4` |

The code section needs explicit `col-start`/`row-start` because the
sidebar follows the code in the DOM but sits left of it from `lg`.

Other layout changes:

- **Single gutter at the page root** (`mx-auto w-full max-w-[1448px]
px-4 sm:px-6`); removed the per-section horizontal padding that
duplicated it, so every section's content lands on the navbar/footer
content edge.
- **Content widened 1114px → 1400px**, the navbar's content span (1448 −
2×24).
- **Bottom gap above the footer trimmed ~320px → ~176px** — layout
`pb-32` → `pb-16` and page `pb-24 sm:pb-36` → `pb-12 sm:pb-16`. Three
paddings were stacking.

The 768px stats breakpoint is preserved with `min-[768px]:` — there's no
Tailwind equivalent here (`md`=601, `lg`=961) and four KPI columns at
601px would be ~140px each.

## Design — ported from vercel.com/ai-sdk

Read off the flagged source in `front/apps/vercel-marketing/.../ai-sdk`,
not the live site.

- **Code showcase tabs** → the `SlidingTabs` primitive: pill labels with
an animated indicator, full keyboard nav (arrows/Home/End, roving
tabindex), and an invisible-bold label so the tab doesn't shift width
when it bolds. Four tabs per group with dot pagination for the rest,
tabs above the code block. Copied into `components/ui/sliding-tabs.tsx`
with `cn` rewired and the `no-scrollbar` utility inlined (geistdocs
doesn't define it).
- **"Scale with confidence"** → heading and paragraph on one
bottom-aligned row (cols 1–4 / 8–12), then four bordered cards
`col-span-12 md:col-span-6 lg:col-span-3`. Type mapped from their
primitives: `SectionHeading size="48"` → `text-heading-40
lg:text-heading-48`, `SectionParagraph size="18"` → `text-copy-16
lg:text-copy-18`.
- **Feature row** → icon + muted eyebrow over a prominent statement.
Note this **inverts the previous emphasis**: the heading is now the
small muted label and the description the larger line, matching the
reference. Icons come from geistdocs' own set so they match Geist's line
weight: `IconLinked`, `IconWorkflow`, `IconAcronymTs`.
- **Get-started install snippet** → the shared `CommandPrompt`, with its
buttons on one row from `lg`.
- Remaining headings converted to `text-heading-*`.
- Navbar logo drops `height={22}` to take `LogoChatSdk`'s new 18px
default (renders 106.9×22 → 87.4×18).

## Two fixes worth calling out

**`lib/utils.ts` — `cn` was silently dropping typography.** Geist's
`text-copy-*`/`text-heading-*` share the `text-` prefix with colour
utilities, so stock `tailwind-merge` classifies them as colours and
drops the size whenever both appear in one `cn()` call. geistdocs ships
a `cn` that registers them as `font-size` for exactly this reason but
doesn't export it, so the config is replicated here. This was a latent
bug across the app, not just the new code.

**`Analytics`/`SpeedInsights` moved out of the `"use client"` provider**
into the server layout. Both emit `<script>`, and scripts rendered
inside a client tree never execute — so analytics wasn't firing on
client navigations. React 19.2.7 (pulled in by this bump) now warns
about it; the bug predates it.

## Verification

- `pnpm --filter docs build` passes (270 pages), `tsc --noEmit` clean,
`biome check` clean.
- Rendered output spot-checked for the tab strip, dot pagination, card
classes, and feature icons.

**`pnpm validate` could not be run** — it needs Node ≥20.19 and this
machine is on v20.11.1 (`pnpm check` dies on `styleText` from
`node:util`). Biome, tsc and build were run directly instead, but the
knip and test legs are unrun and should be confirmed in CI.

Signed-off-by: christopherkindl <53372002+christopherkindl@users.noreply.github.com>
 2026-07-31 23:53:17 +01:00
Santiago Medina caa63253c5 feat(x): add XChat encrypted messaging support (#745) 
## summary

new `@chat-adapter/xchat` adapter for XChat, X's encrypted messaging.
write bot logic once and hold encrypted 1:1 and group conversations like
the other Chat SDK adapters — all crypto handled inside the adapter via
`@xdevplatform/chat-xdk` (wasm), all REST via the typed
`@xdevplatform/xdk` client.

## background: chat-xdk


[`@xdevplatform/chat-xdk`](https://www.npmjs.com/package/@xdevplatform/chat-xdk)
is the official XChat cryptography SDK — a Rust core compiled to
WebAssembly that implements the XChat encryption protocol. it handles
per-conversation symmetric keys and key exchange, message
encryption/decryption, event signing and signature verification, and
encrypted media (secretstream). the bot's private keys live in a
PIN-protected [Juicebox](https://juicebox.xyz) store (secret-shared
across independent realms), so no key material sits in env vars or on
disk — the adapter unlocks with a PIN at startup. this adapter is the
glue: chat-xdk produces and consumes the encrypted envelopes, the typed
`@xdevplatform/xdk` client moves them over the X API, and everything is
normalized to the Chat SDK's `Thread`/`Message` model.

what it supports:
- encrypted send/receive in DMs and groups (webhook push + polling),
signature verification on by default
- mention detection from structured mention entities, swipe-replies to
the bot, and a plain-text `@handle` fallback; group replies go out as
quoted replies with TTL propagated
- `openDM(userId)`: starts (or reuses) an encrypted 1:1 —
cached/history-recovered conversation key, else a full key exchange so
the bot can message first
- media both ways: inbound attachments with lazy download+decrypt,
outbound encrypted (secretstream) via the 3-step upload flow
- edit and delete of the bot's own messages: edits are encrypted events
targeting the original's sequence id; deletes are locally signed
delete-for-all actions recipients verify
- reactions in and out, typing keep-alive while handlers run,
configurable group welcome message
- read receipts sent per delivered inbound message (`sendReadReceipts`,
default on)
- cards by degradation: text + tappable entities, link buttons as
`label: url` lines, primary link as a URL preview attachment with
optional encrypted banner

key design decisions:
- mdast stays the canonical format; markdown passes through as raw text
(XChat clients render plain text — no markdown), with URLs and @mentions
made tappable via entity spans and tables degraded to ASCII code blocks
- thread ids are `xchat:{conversationId}` (groups `g…`, 1:1s the sorted
participant pair)
- the first edit of a fresh message is age-gated (`editSafetyDelayMs`,
default 5000ms): receiving clients park an edit whose original hasn't
arrived, leaving the message permanently invisible — the gate prevents
that race
- undecryptable or unverified events are dropped, never delivered as
empty messages
- no core changes: the adapter implements the standard `Adapter`
interface only

also includes the `chat/adapters` catalog entry, docs page (with OG
image), `adapters.json` registry entry, and `create-chat-sdk` scaffold
spec, modeled on the `x` adapter's registration.

<details><summary>usage</summary>

```bash
XCHAT_BOT_TOKEN=...    # OAuth2 user access token (identity resolved from GET /2/users/me)
XCHAT_PIN=...          # Juicebox PIN that unlocks the bot's keys
X_CONSUMER_SECRET=...  # optional: verifies webhook signatures
```

```typescript
import { Chat } from "chat";
import { createXchatAdapter } from "@chat-adapter/xchat";
import { createMemoryState } from "@chat-adapter/state-memory";

const bot = new Chat({
  userName: "mybot",
  adapters: { xchat: createXchatAdapter() }, // credentials from env
  state: createMemoryState(),
});

// DMs always
bot.onDirectMessage(async (thread, message) => {
  await thread.post(`You said: ${message.text}`);
});

// group chats when the bot is @mentioned
bot.onNewMention(async (thread, message) => {
  await thread.post("You rang?");
});

// wire the webhook (e.g. a Next.js route)
export async function POST(request: Request) {
  return bot.webhooks.xchat(request);
}
```

</details>

testing: 109 unit tests, including real-wasm-crypto round trips against
vendored fixture vectors (decrypt + signature verification, webhook
delivery, read receipts, edit age-gating, signed deletes). verified live
against production XChat: DMs, group mentions, media, reactions, edits,
deletes, openDM, cards.

note on the lockfile: `@xdevplatform/xdk@0.6.6` was published <48h ago,
so it was resolved with a one-shot `--config.minimumReleaseAge=0`
override; the locked integrity hash was verified against the npm
registry. the repo policy file is untouched.

---------

Co-authored-by: dancer <josh@afterima.ge>
 2026-07-31 23:52:18 +01:00
christopherkindl f6b64318d9 chore(docs): upgrade geistdocs to 1.16.0 (#747) 
Upgrades the docs to `@vercel/geistdocs@1.16.0`.

- Bump `@vercel/geistdocs` 1.15.5 → 1.16.0
- Drop the removed `config` prop from `<Footer />` (1.16.0 replaces the
footer with the Vercel product directory and no longer accepts props)
- Load Geist Sans from the `geist` npm package so the new `ss11`
stylistic set (alternate "I") renders — Google Fonts strips it
 2026-07-28 00:27:52 +10:00
christopherkindl 1d0295f996 chore(docs): upgrade geistdocs to 1.15.5 (#743) 
- Upgrade `@vercel/geistdocs` to 1.15.5
- New navbar flyout menu style + nav items in flyout menu are rendered
server-side to be in the html for crawlers (as requested by Malte)
- Homepage section titles use Geist sans heading tokens (new vercel.com
style)

| **New flyout menu**  | **Improved docs mobile layout** |
| ------------- | ------------- |
| <video
src="https://github.com/user-attachments/assets/7baf37d9-7a87-4853-91fb-6c3febf974cb"
/> | <img width="499" height="747" alt="image"
src="https://github.com/user-attachments/assets/b48a955e-0e15-4e03-ada2-fbc52c2fdcb7"
/> |

**Preview:** https://chat-git-chore-geistdocs-1155.vercel.sh/
 2026-07-24 21:03:56 +01:00
Utopia 5eb8b846a7 feat(teams): support outbound reactions (#734) 
Outbound Teams reactions were originally implemented as part of #302,
then removed because the Teams feature was not fully rolled out. In [the
follow-up
discussion](https://github.com/vercel/chat/pull/302#issuecomment-4147056867),
the Teams SDK maintainer said they were happy to add the support back
once the rollout was ready. Microsoft now documents agent reaction
support without a preview caveat.

This PR restores that support against the current Teams SDK API:

- implement `addReaction` and `removeReaction` with
`conversations.addReaction` / `conversations.deleteReaction`
- pass native Teams reaction IDs through unchanged and map common
normalized Chat SDK emoji names to their Teams IDs
- upgrade the aligned `@microsoft/teams.*` dependencies to 2.0.14
- update the Teams feature matrices and add a minor changeset

The implementation stays within the existing adapter methods and does
not add another abstraction or affect streaming behavior.

---------

Signed-off-by: Utopia <154325211+Utopi-a@users.noreply.github.com>
 2026-07-23 10:52:00 +10:00
dependabot[bot] b4a93bdbc5 build(deps-dev): bump @hono/node-server from 2.0.2 to 2.0.10 (#733) 
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
2.0.2 to 2.0.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases">@​hono/node-server's
releases</a>.</em></p>
<blockquote>
<h2>v2.0.10</h2>
<h2>Security fixes</h2>
<p>This release includes a fix for the following security issue:</p>
<h3>Unauthenticated memory-leak DoS via aborted WebSocket handshake</h3>
<p>Affects: <code>upgradeWebSocket</code>. A WebSocket upgrade request
with a missing or malformed <code>Sec-WebSocket-Key</code> header leaked
the request's <code>IncomingMessage</code> and left a promise pending,
even though no connection was established. Since the route is reachable
pre-handshake without authentication, an attacker could flood it to
gradually exhaust memory. <a
href="https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg">GHSA-9mqv-5hh9-4cgg</a></p>
<hr />
<p>Users of <code>upgradeWebSocket</code> are encouraged to upgrade to
this version.</p>
<h2>v2.0.9</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(websocket): polyfill missing ErrorEvent global by <a
href="https://github.com/otnc"><code>@​otnc</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li>
<li>fix(serve-static): correct Range header parsing edge cases by <a
href="https://github.com/otnc"><code>@​otnc</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/372">honojs/node-server#372</a></li>
<li>fix: recover complete request bodies after client disconnect by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/375">honojs/node-server#375</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/otnc"><code>@​otnc</code></a> made their
first contribution in <a
href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9">https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9</a></p>
<h2>v2.0.8</h2>
<h2>What's Changed</h2>
<ul>
<li>ci(release): add <code>--no-git-checks</code> option for <code>pnpm
stage publish</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/369">honojs/node-server#369</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8">https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8</a></p>
<h2>v2.0.7</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: migrate to pnpm by <a
href="https://github.com/BlankParticle"><code>@​BlankParticle</code></a>
in <a
href="https://redirect.github.com/honojs/node-server/pull/367">honojs/node-server#367</a></li>
<li>fix(serve-static): serve precompressed files for
application/octet-stream by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/366">honojs/node-server#366</a></li>
<li>chore: bump <code>supertest</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/368">honojs/node-server#368</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7">https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7</a></p>
<h2>v2.0.6</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: publish to npm from CI with OIDC trusted publishing and bump
<code>np</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/361">honojs/node-server#361</a></li>
<li>ci: use npm Staged publishing by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/364">honojs/node-server#364</a></li>
<li>fix: preserve status and statusText when cloning a Response with
liveheaders by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/363">honojs/node-server#363</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6">https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6</a></p>
<h2>v2.0.5</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/7c1457ed5536c02fdd2f001129fae67bcbca54a1"><code>7c1457e</code></a>
2.0.10</li>
<li><a
href="https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1"><code>3a21938</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/98420217e53a17a238ef1aa1a6bef0b2b70136c5"><code>9842021</code></a>
2.0.9</li>
<li><a
href="https://github.com/honojs/node-server/commit/51f3bf56f56d9691ec0f7e1562a96f0b485a7dd9"><code>51f3bf5</code></a>
fix: recover complete request bodies after client disconnect (<a
href="https://redirect.github.com/honojs/node-server/issues/375">#375</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/fdb87badbe313cfbfe6bb2355e9893dc0698d2bd"><code>fdb87ba</code></a>
fix(serve-static): correct Range header parsing edge cases (<a
href="https://redirect.github.com/honojs/node-server/issues/372">#372</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/912e3fd80c4311756f724bd566de1433c8d772d9"><code>912e3fd</code></a>
fix(websocket): polyfill missing ErrorEvent global (<a
href="https://redirect.github.com/honojs/node-server/issues/371">#371</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/114c15efb38dabaf81af774ddb764409e3d156d8"><code>114c15e</code></a>
2.0.8</li>
<li><a
href="https://github.com/honojs/node-server/commit/5db2d5df662cd69ff5c4cc23b8ecb3a6f63e4e38"><code>5db2d5d</code></a>
ci(release): add <code>--no-git-checks</code> option for <code>pnpm
stage publish</code> (<a
href="https://redirect.github.com/honojs/node-server/issues/369">#369</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/a528a77ed2c28dc12775c849abc6b6df6d4cb44c"><code>a528a77</code></a>
2.0.7</li>
<li><a
href="https://github.com/honojs/node-server/commit/b2d610c1e37a96639fbb2eae662e858800aa8906"><code>b2d610c</code></a>
chore: bump <code>supertest</code> (<a
href="https://redirect.github.com/honojs/node-server/issues/368">#368</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/node-server/compare/v2.0.2...v2.0.10">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for <code>@​hono/node-server</code> since your current
version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@hono/node-server&package-manager=npm_and_yarn&previous-version=2.0.2&new-version=2.0.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 13:15:31 +10:00
Ben Sabic 4cb7e5d58e feat(chat): durable human-in-the-loop approvals via chat/workflow (#728) 
Adds a `chat/workflow` subpath export with `requestApproval()`. This is
the DX from #284, rebuilt on Workflow SDK so the approval survives
deploys, restarts, and arbitrarily long waits. No in-memory promises, no
approvals registry, no restart-recovery machinery: the workflow suspends
on a webhook and resumes when a button is clicked.

`requestApproval()` posts a card with Approve/Deny buttons whose
`callbackUrl` targets a `createWebhook()` URL, suspends the workflow
until a decision (or optional durable-sleep timeout), validates
approvers, finalizes the card in place with the outcome (removing the
buttons, leaving an audit trail), and returns the decision.

```typescript
import { requestApproval } from "chat/workflow";
import type { Thread } from "chat";
export async function deployApproval(opts: { thread: Thread; version: string }) {
  "use workflow";
  const { approved, user, timedOut } = await requestApproval(opts.thread, {
    title: `Deploy ${opts.version}?`,
    fields: { Version: opts.version },
    timeout: "24h",
    approvers: ["U_ALICE", "U_BOB"],
  });
  if (approved) {
    await deploy(opts.version);
  }
}
```

Starting it from a handler is one line. `Thread` instances serialize
across the workflow boundary automatically via the existing
`@workflow/serde` hooks on `ThreadImpl` (requires
`chat.registerSingleton()`):

```typescript
import { start } from "workflow/api";
bot.onNewMention(async (thread, message) => {
  await start(deployApproval, [{ thread, version: parseVersion(message.text) }]);
});
```

**Details**

- `workflow` is a new **optional** peer dependency (same pattern as
`ai`); the subpath is the only code that imports it
- Unauthorized clicks (when `approvers` is set) and unrecognizable
payloads post a notice / are ignored, and the workflow keeps waiting
- On timeout the card is finalized as timed out and the result has
`timedOut: true`
- Card builders (`buildApprovalCard`, `buildResolvedCard`) are exported
for custom flows
- Verified the published `dist` preserves the `"use step"` directives
and down-levels `using` correctly, so the app-side Workflow SDK compiler
handles the library code
- Docs page under Interactivity; changeset (`chat` minor); 8 unit tests
mocking the `workflow` primitives

**Deliberate deviation from #284:** no `thread.requestApproval()`
method. The function must suspend at workflow level, so hanging it off
`ThreadImpl` would make `workflow` a hard dependency of core (or require
prototype patching). The standalone `requestApproval(thread, options)`
keeps the dependency optional.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-22 10:18:38 +10:00
Rich Haines d616072f45 chore(docs): update @vercel/geistdocs to 1.13.0 (#727) 
## Summary

- update the Chat SDK docs app to `@vercel/geistdocs` 1.13.0
- use the package-owned Tailwind sources introduced since 1.10.0
- align docs content spacing and breadcrumb visibility with the new
container-responsive sidebar


https://chat-git-chore-update-geistdocs.vercel.sh/docs


## Testing

- `pnpm install --force --frozen-lockfile`
- `pnpm --filter docs exec tsc --noEmit`
- `pnpm --filter docs build`
- `pnpm exec turbo typecheck --filter='!example-nuxt-chat'`
- `pnpm exec turbo test --filter='!example-nextjs-chat' --filter='!docs'
--filter='!example-nuxt-chat'`
- production route smoke tests for HTML, `.md`, `Accept: text/markdown`,
agent requests, `llms.txt`, `sitemap.md`, `agents.md`, and `/api/search`
- desktop and mobile browser checks with no runtime errors or horizontal
overflow

`pnpm validate` is locally blocked by the unrelated `example-nuxt-chat`
`oxc-parser` native resolution failure; all remaining workspace
typechecks and tests pass.

Upstream release: https://github.com/vercel/geistdocs/pull/160

Signed-off-by: molebox <rich@vercel.com>
 2026-07-20 11:09:18 +02:00
C. T. Lin 6714efc3a1 feat: support AI SDK v7 (ai@7) as a peer dependency (#691) 
Closes #690

## What

Widens the AI SDK peer dependency ranges so the Chat SDK installs
cleanly next to `ai@7`:

- `chat`: `ai@^6.0.182 || ^7.0.0`
- `@chat-adapter/web`: `ai@^6 || ^7`, `@ai-sdk/react@^3 || ^4`,
`@ai-sdk/svelte@^4 || ^5`, `@ai-sdk/vue@^3 || ^4`

This also unbreaks `create-chat-sdk` scaffolds, which install
`ai@latest` (now v7) next to `chat` and currently hit a peer conflict
out of the box.

## The one real v6 → v7 break

In v7, `tool()` with an `execute` function returns
`ExecutableTool<Tool<...>>` — an internal type from
`@ai-sdk/provider-utils` that `ai` does not re-export. The `chat/ai`
tool factories relied on inference, so declaration emit failed with
TS2742 (17 errors). The factories now declare explicit `Tool<Input,
Output>` return types, which is exactly the shape the previously
published `.d.ts` already had — the public type surface is unchanged,
and the emitted declarations only reference types from `ai` (portable
for consumers on either major).

Everything else checked out compatible:

- v7 stream parts keep `text-delta` / `finish-step` shapes, so
`fromFullStream` duck-typing works unchanged; `fullStream` remains as a
deprecated alias
- tool-level `needsApproval` is deprecated in v7 but still typed and
honored
- `createUIMessageStream`, `createUIMessageStreamResponse`,
`isTextUIPart`, `UIMessage`, `UIMessageStreamWriter`, `ChatInit`,
`DefaultChatTransport` all still exported — `@chat-adapter/web` needed
zero source changes

## Other changes

- devDependencies move to v7 so the workspace develops/tests against the
latest major
- `examples/nextjs-chat` and `examples/nuxt-chat` move to `ai@^7`
(required — mixing majors across the workspace fails typecheck, since
`chat`'s d.ts resolves `ai` types from its own devDependency)
- Test-only: the `ToolExecutionOptions` stub type is now derived from
`Tool["execute"]` because v7 made the generic parameter required
- Changeset included (minor for `chat` and `@chat-adapter/web`)

## Verification

The same source was verified against **both majors** (`ai@6.0.182` and
`ai@7.0.17`): `tsc --noEmit` and the full test suites (`chat`: 1035
tests, `@chat-adapter/web`: 21 tests) pass on each. `pnpm validate`
(knip + check + typecheck + test + build, including both examples) is
green on v7.

Note for adopters: `ai@7` itself requires Node.js ≥ 22 and is ESM-only;
`chat` keeps `engines.node >= 20` since `ai` is an optional peer.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: chentsulin <chentsulin@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-07-13 21:50:27 +10:00
damianborowy-nexos 1721fa01e7 feat(slack): add Slack Agent messaging experience (agent_view) support (#684) 
## Summary

Add support for Slack's Agent messaging experience (`agent_view`), the
2026 replacement for `assistant_view`.

## Core (`chat`)

- New `onAppContextChanged` event carrying the active-view context as a
normalized `AppContextEntity[]` (`channel` / `canvas` / `list` /
`message` / `unknown`) describing what the user is currently viewing.
- `AppHomeOpenedEvent` now carries:
  - the same folded active-view context as optional `entities`
- the opened `tab` (`"home"` / `"messages"`), so handlers can
distinguish a Home-tab open from the DM-open signal under `agent_view`

## Slack adapter (`@chat-adapter/slack`)

- **`agentView` config flag.** Under `agent_view`:
- `app_home_opened` is the DM-open signal and fires regardless of tab
(branch on `event.tab` if you also publish a Home view)
- DM messages are threaded per Slack's new model — each user message is
a thread root (`thread_ts ?? ts`)
- conversation-scoped threads returned by `openDM()` keep working: when
that thread is subscribed, incoming top-level DM messages route to it,
so `onSubscribedMessage` and per-thread state behave the same as in
legacy mode
- **`app_context_changed` routing** with normalized entities. Malformed
payloads degrade gracefully: a missing `context` yields `entities: []`,
and entities with a null/malformed `value` normalize to `kind:
"unknown"` — never a webhook 500.
- **`getAppContext(message)`** helper to read the folded active-view
context off a DM message.
- **`setSuggestedPrompts`** accepts an optional thread reference
(`agent_view` lets prompts sit at the top of the agent conversation).
- **Env auth fallback now keys off auth fields**: `SLACK_BOT_TOKEN` /
`SLACK_CLIENT_ID` / `SLACK_CLIENT_SECRET` fallback is disabled only when
an auth-related field (`botToken`, `clientId`, `clientSecret`,
`installationProvider`) is passed explicitly, rather than by the
presence of any config object. This lets non-auth options compose with
env auth — e.g. `createSlackAdapter({ agentView: true })` picks up env
credentials — and matches the semantics documented in the adapter's
AGENTS.md. *(Behavior change for callers passing non-auth-only configs
while relying on env vars being ignored.)*
- Bumped `@slack/web-api` to `^7.18.0` (adds the optional `thread_ts`
typing for `setSuggestedPrompts`).

## Docs

- New "Agent messaging experience" section on the Slack adapter page
(config, manifest snippet, threading model, openDM bridge).
- "Handling active-view context" section in handling-events, plus
`tab`/`entities` rows on the app-home event table.
- Callout: under `agent_view`, bot replies are threaded per user
message, so `conversations.history` only returns the user's side of a DM
— build AI conversation history from transcripts instead of channel
history.

## Example app (`examples/nextjs-chat`)

- Plain `SLACK_BOT_TOKEN` adapter branch (previously Slack was only
wired via Vercel Connect).
- DM AI history built from transcripts instead of channel history (see
docs callout above); assistant turns persisted.
- The `dm me` trigger regex now matches mention text, which carries the
`@bot` prefix on Slack.

## Test plan

- `pnpm validate` and `pnpm konsistent` pass.
- Unit tests cover the new events, entity normalization (including
malformed payloads), `agent_view` DM threading, the openDM subscription
bridge, `tab` passthrough, `setSuggestedPrompts` thread handling, and
env-fallback behavior; an integration replay test exercises the full
webhook flow.
- Verified manually against a live `agent_view` workspace:
`onAppContextChanged` entities, folded context on `app_home_opened` and
DM messages, `tab` values for both tabs, per-message DM threading, the
openDM subscription bridge, and signed malformed-payload replays (all
return 200).
- Legacy regression pass with `agentView` off: conversation-scoped DM
threading, Home-tab-only `app_home_opened`, mention flow unchanged.

### Slack references

- Agent messaging experience:
https://docs.slack.dev/changelog/2026/06/30/agent-messages-tab/
- Active-view context:
https://docs.slack.dev/changelog/2026/07/02/app-context/

## Checklist

- [x] All commits are signed and verified
- [x] All commits are signed off for the DCO (`git commit -s`)
- [x] `pnpm validate` passes
- [x] Changeset added
- [x] Documentation updated

---------

Signed-off-by: Damian Borowy <301205838+damianborowy-nexos@users.noreply.github.com>
Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-12 19:35:28 +10:00
Rich Haines 1dff4515e2 refactor(docs): migrate chat-sdk.dev to @vercel/geistdocs (#686) 
## Summary

Migrates `apps/docs` from locally-copied geistdocs runtime code to the
published
[`@vercel/geistdocs`](https://www.npmjs.com/package/@vercel/geistdocs)
package (1.8.2), following the official [migration
guide](https://preview.geistdocs.com/docs/migration). Net **−8,400
lines**.

### Package-backed now

- Docs page + layouts: `createDocsPage`, `GeistdocsDocsLayout`,
`GeistdocsHomeLayout` (JSON-LD + sr-only markdown hints preserved via
`renderTop`)
- Navbar (OSS product switcher via `navbarOssProducts`), footer,
provider, search dialog, page actions (edit source, feedback, copy page,
Ask AI, open-in-chat, scroll top)
- `/api/search` → `createSearchRoute`, `/api/chat` → `createChatRoute`
(AI SDK v6; AI Gateway default, optional `GEISTDOCS_CHAT_PROXY_URL`)
- `llms.mdx` → `createDocsMarkdownRoute`, `sitemap.md` →
`createSitemapMarkdownRoute` (now includes an **Adapters** section)
- **New**: `/agents.md` via `createAgentsRoute`, backed by a new `agent`
readiness config
- `proxy.ts` → `createProxy` with explicit `markdownRoutes` for `/docs`
→ `llms.mdx` and `/adapters` → `adapters.mdx` (adds AI-agent UA
rewrites)
- CSS: `@vercel/geistdocs/styles.css` + slim local overrides (shadcn
tokens for remaining `components/ui`, body tint, prose inline code,
`#nd-*` tweaks); code blocks now use the geist Shiki theme
- Icons/logos from `@vercel/geistdocs/assets/*`; feedback via the
package action (same geistdocs.com endpoint + `siteId`)

### Kept local by design

- Curated `/llms.txt` index + `/llms-full.txt` corpus — the published
`AGENTS.md`/SKILL.md artifacts and integration tests reference this
exact contract
- The adapters section (README fetching, OG images, JSON-LD, feature
matrices, `adapters.mdx` markdown route) — now rendered inside the
package docs layout
- RSS and OG image routes (app-owned per the migration guide)
- Skipped `/.well-known/mcp.json`: no MCP servers configured, and the
proxy matcher must keep excluding `.well-known` for the served
agent-skills files

### Cleanup

- Deleted local copies: `components/geistdocs/*` chrome,
`components/ai-elements/*`, chat hooks/persistence, feedback server
actions, unused shadcn primitives, geistcn logo/icon fallbacks covered
by package assets
- Removed 13 now-unused deps (`ai@5`, `@ai-sdk/react@2`, `dexie`,
`jotai`, `cmdk`, `vaul`, `mermaid`, `nanoid`, `react-player`,
`use-stick-to-bottom`, `@orama/tokenizers`, `dexie-react-hooks`,
`next-themes`)
- Updated `docs-llms.test.ts` proxy assertions to the `createProxy`
markdown-route shape

### Behavior changes to be aware of

- Code blocks use the geist Shiki theme instead of GitHub light/dark
- Ask AI history is no longer persisted in IndexedDB (package owns the
panel)
- Adapters sidebar uses the standard geistdocs tree rendering instead of
the bespoke grouped sidebar
- Per-page markdown output appends the standard geistdocs footer links
(`/sitemap.md`, `/llms.txt`, `/agents.md`)

## Test plan

- `pnpm validate` green (knip + check + typecheck + test + build)
- Smoke-tested against `next build && next start`: `/`, `/docs`,
`/adapters`, `/agents.md`, `/llms.txt`, `/llms-full.txt`, `/sitemap.md`,
page-level `.md` URLs for both docs and adapters, `Accept:
text/markdown` negotiation, search API, JSON-LD, sr-only markdown hints,
edit-source URLs (`apps/docs/content/docs/{path}`), OSS navbar, page
actions
- Verified compiled CSS chunks contain the home grid, Shiki palette, and
geist utilities (note: stale turbopack dev caches from before this
change can serve incomplete CSS — `rm -rf apps/docs/.next` fixes it)

## Checklist

- [x] All commits are signed and verified
- [x] All commits are signed off for the DCO (`git commit -s`)
- [x] `pnpm validate` passes
- [x] Changeset added (or N/A — docs app + tests only, no package
behavior change)
- [x] Documentation updated (or N/A)

---------

Signed-off-by: molebox <rich@vercel.com>
 2026-07-09 15:29:47 +02:00
josh ef2542c5fd feat(x): add X (Twitter) adapter (#682) 
## summary

new `@chat-adapter/x` adapter for X (Twitter), built on the X API v2 and
the X Activity API. write bot logic once and reply to mentions, hold DM
conversations, post from the account, and like posts, like the other
Chat SDK adapters

what it supports:
- reply to public mentions (`post.mention.create`) and top-level posts
via `channel.post`
- send and receive direct messages (`dm.received` / `dm.sent`)
- edit and delete owned posts, delete own DM events
- likes as the only reaction (`emoji.heart` or `"like"`)
- buffered streaming: accumulates an LLM stream and posts once instead
of post+edit churn on a public timeline
- OAuth 2.0 user context with managed token refresh (rotating refresh
token persisted in the state adapter, optional AES-256-GCM encryption)
- webhook CRC and `x-twitter-webhooks-signature` verification

key design decisions:
- DMs are threaded by the other participant's user id (`x:dm:{userId}`)
because X DM webhooks carry no conversation id, only participants
- OAuth 2.0 only at runtime: DM send and read are verified to work on
OAuth 2.0 user tokens, so no OAuth 1.0a in the adapter (subscription and
webhook setup is one-time and handled in the X developer console)
- parsers were written against real captured payloads: mentions use the
v2 shape (author hydrated in `includes.users`), DMs use the legacy
Account Activity shape (`direct_message_events`,
`message_create.message_data`, a `users` map, and no conversation id)

also includes the `chat/adapters` catalog entry, docs page, CLI scaffold
spec, and `sample-messages.md` with real captured payloads

<details><summary>usage</summary>

```typescript
import { Chat } from "chat";
import { createXAdapter } from "@chat-adapter/x";

const bot = new Chat({
  userName: "mybot",
  adapters: { x: createXAdapter() },
});

bot.onNewMention(async (thread, message) => {
  await thread.post(`hi @${message.author.userName}!`);
});

bot.onDirectMessage(async (thread) => {
  await thread.post("hello from X");
});
```
</details>

## test plan

- adapter unit tests pass against the real captured payload shapes, with
regression tests for author-from-`includes` (mentions) and the legacy
`direct_message_events` shape (DMs)
- real captured `post.mention.create` and `dm.received` payloads
verified end-to-end through `handleWebhook`: signature verification,
routing, author resolution, and participant threading, plus
bad-signature rejection returns 401
- every write and read path fired live against the X API through the
adapter: top-level post, reply to a mention, like and unlike, edit,
delete, DM send, DM read, DM delete
- OAuth 2.0 managed token refresh exercised live (access and refresh
token rotation)

---------

Signed-off-by: dancer <josh@afterima.ge>
 2026-07-07 23:07:36 +01:00
dependabot[bot] 5267669563 build(deps): bump nuxt from 4.3.1 to 4.4.7 (#680) 
Bumps [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) from
4.3.1 to 4.4.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nuxt/nuxt/releases">nuxt's
releases</a>.</em></p>
<blockquote>
<h2>v4.4.7</h2>
<blockquote>
<p>4.4.7 is a security hotfix release.</p>
</blockquote>
<p>👉 make sure to check <a
href="https://github.com/nuxt/nuxt/security/advisories">https://github.com/nuxt/nuxt/security/advisories</a>
to view open advisories resolved by this release.</p>
<h2>👉 Changelog</h2>
<p><a
href="https://github.com/nuxt/nuxt/compare/v4.4.6...v4.4.7">compare
changes</a></p>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>nitro:</strong> Assign <code>noSSR</code> before deciding
payload extraction (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35108">#35108</a>)</li>
<li><strong>vite:</strong> Avoid filtering out dirs with shared prefix
from <code>allowDirs</code> (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35112">#35112</a>)</li>
<li><strong>nuxt:</strong> Use resolve from <code>pathe</code> for
buildCache path boundary check (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35111">#35111</a>)</li>
<li><strong>nuxt:</strong> Prevent sibling-directory traversal in test
component wrapper (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35110">#35110</a>)</li>
<li><strong>nitro:</strong> Pass event data to <code>isValid</code> in
dev clipboard-copy listener (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35109">#35109</a>)</li>
<li><strong>nuxt:</strong> Validate protocols in
<code>reloadNuxtApp</code> path before reload (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35115">#35115</a>)</li>
<li><strong>vite:</strong> Prefix public asset virtuals with null byte
(<a
href="https://github.com/nuxt/nuxt/commit/9e303b438">9e303b438</a>)</li>
<li><strong>nuxt:</strong> Re-run <code>getCachedData</code> after
initial fetch (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35122">#35122</a>)</li>
<li><strong>nuxt:</strong> Propagate
<code>useFetch</code>/<code>useAsyncData</code> factory types (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35133">#35133</a>)</li>
<li><strong>vite:</strong> Close vite dev server on nuxt close (<a
href="https://github.com/nuxt/nuxt/commit/a10a68abc">a10a68abc</a>)</li>
<li><strong>kit,nuxt:</strong> Handle cancelling prompts to install
packages (<a
href="https://github.com/nuxt/nuxt/commit/e84813229">e84813229</a>)</li>
<li><strong>kit:</strong> Avoid excluding node-context files in legacy
tsconfig (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35152">#35152</a>)</li>
<li><strong>nuxt:</strong> Handle missing payload in chunkError listener
(<a
href="https://redirect.github.com/nuxt/nuxt/pull/35155">#35155</a>)</li>
<li><strong>nuxt:</strong> Await in-lifght template generation when
closing nuxt (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35181">#35181</a>)</li>
<li><strong>nuxt:</strong> Clarify page and layout usage warnings (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35184">#35184</a>)</li>
<li><strong>webpack:</strong> Surface compilation errors when
stats.toString is empty (<a
href="https://github.com/nuxt/nuxt/commit/073b07851">073b07851</a>)</li>
<li><strong>nuxt:</strong> Reject prototype-chain keys in the island
registry (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35205">#35205</a>)</li>
<li><strong>nuxt:</strong> Apply <code>isScriptProtocol</code> guard to
<code>navigateTo</code> open option (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35206">#35206</a>)</li>
<li><strong>nuxt:</strong> Prevent server-only page island from
recursing via <code>&lt;NuxtPage&gt;</code> (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35198">#35198</a>)</li>
<li><strong>rspack,webpack:</strong> Require loopback host when missing
same-origin signals (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35200">#35200</a>)</li>
<li><strong>nitro:</strong> Gate chrome devtools workspace endpoint to
local requests (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35201">#35201</a>)</li>
<li><strong>nuxt:</strong> Escape props in
<code>&lt;NuxtClientFallback&gt;</code> ssr output (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35199">#35199</a>)</li>
<li><strong>kit:</strong> Improve TS extension stripping/substitutions
(<a
href="https://redirect.github.com/nuxt/nuxt/pull/35233">#35233</a>)</li>
<li><strong>nuxt:</strong> Preserve
<code>.d.mts</code>/<code>.d.cts</code> in <code>resolveTypePaths</code>
(<a
href="https://redirect.github.com/nuxt/nuxt/pull/35235">#35235</a>)</li>
<li><strong>nuxt:</strong> Escape <code>&lt;NoScript&gt;</code> slot
content (<a
href="https://github.com/nuxt/nuxt/commit/4b054e9d9">4b054e9d9</a>)</li>
<li><strong>nuxt:</strong> Match route rules case-insensitively to
mirror <code>vue-router</code> (<a
href="https://github.com/nuxt/nuxt/commit/07e39cd6f">07e39cd6f</a>)</li>
<li><strong>nuxt:</strong> Reject script-capable protocols in
<code>&lt;NuxtLink&gt;</code> href (<a
href="https://github.com/nuxt/nuxt/commit/0103ce06f">0103ce06f</a>)</li>
<li><strong>nuxt:</strong> Block path-normalization open redirect in
<code>navigateTo</code> (<a
href="https://github.com/nuxt/nuxt/commit/2cce6fb02">2cce6fb02</a>)</li>
<li><strong>nuxt:</strong> Reject cross-origin paths in
<code>reloadNuxtApp</code> (<a
href="https://github.com/nuxt/nuxt/commit/e447a793c">e447a793c</a>)</li>
<li><strong>vite:</strong> Bind vite-node IPC to a permissioned
filesystem socket (<a
href="https://github.com/nuxt/nuxt/commit/1f9f4767a">1f9f4767a</a>)</li>
</ul>
<h3>💅 Refactors</h3>
<ul>
<li><strong>kit,nuxt,vite:</strong> Use <code>es2023</code> array
methods (<a
href="https://redirect.github.com/nuxt/nuxt/pull/34980">#34980</a>)</li>
<li><strong>nuxt:</strong> Replace <code>runInNewContext</code> with AST
walker (<a
href="https://github.com/nuxt/nuxt/commit/d72a89ef4">d72a89ef4</a>)</li>
</ul>
<h3>📖 Documentation</h3>
<ul>
<li>Document vite client and server options (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35090">#35090</a>)</li>
<li>Add dedicated module dependencies page (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35171">#35171</a>)</li>
<li>Add nodeTsConfig and sharedTsConfig options (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35231">#35231</a>)</li>
<li>Edit for clarity and grammar (<a
href="https://redirect.github.com/nuxt/nuxt/pull/35214">#35214</a>)</li>
</ul>
<h3>🏡 Chore</h3>
<ul>
<li>Use <code>execFileSync</code> for safety in release scripts (<a
href="https://github.com/nuxt/nuxt/commit/1d7baaf01">1d7baaf01</a>)</li>
<li>Assert there is always a tag (<a
href="https://github.com/nuxt/nuxt/commit/e98c47c3c">e98c47c3c</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nuxt/nuxt/commit/b7d57903b947e788fadfcfdf88be7951943731bf"><code>b7d5790</code></a>
v4.4.7</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/dbc58965ca7ffa21d7cc4207a4c40a62e0762f4a"><code>dbc5896</code></a>
chore: lint</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1"><code>e447a79</code></a>
fix(nuxt): reject cross-origin paths in <code>reloadNuxtApp</code></li>
<li><a
href="https://github.com/nuxt/nuxt/commit/d72a89ef451965a8a1abb58d3bd6eab4865631a0"><code>d72a89e</code></a>
refactor(nuxt): replace <code>runInNewContext</code> with AST
walker</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d"><code>2cce6fb</code></a>
fix(nuxt): block path-normalization open redirect in
<code>navigateTo</code></li>
<li><a
href="https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3"><code>0103ce0</code></a>
fix(nuxt): reject script-capable protocols in
<code>\&lt;NuxtLink&gt;</code> href</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb"><code>07e39cd</code></a>
fix(nuxt): match route rules case-insensitively to mirror
<code>vue-router</code></li>
<li><a
href="https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e"><code>4b054e9</code></a>
fix(nuxt): escape <code>\&lt;NoScript&gt;</code> slot content</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/03d83bfab531b27fbc1dac7cdea9227b3707476e"><code>03d83bf</code></a>
fix(nuxt): preserve <code>.d.mts</code>/<code>.d.cts</code> in
<code>resolveTypePaths</code> (<a
href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35235">#35235</a>)</li>
<li><a
href="https://github.com/nuxt/nuxt/commit/46960b2b18e79d64f212b2b77d879b3f88ab72cb"><code>46960b2</code></a>
fix(nuxt): escape props in <code>\&lt;NuxtClientFallback&gt;</code> ssr
output (<a
href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35199">#35199</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/nuxt/nuxt/commits/v4.4.7/packages/nuxt">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nuxt&package-manager=npm_and_yarn&previous-version=4.3.1&new-version=4.4.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 23:27:39 +10:00
Ben Sabic ac5a54ee1d test(adapters): adopt shared @chat-adapter/tests factories and matchers (#674) 
Wires `@chat-adapter/tests` as a devDependency and registers its
matchers via `setupFiles: ["@chat-adapter/tests/setup"]` across all 11
platform adapters, then replaces bespoke local
`mockLogger`/`createMockState`/`createMockChatInstance` with the shared
factories and adopts `toHaveDispatched`/`not.toHaveDispatched` where
clean.

- 10 adapters migrated (gchat, messenger, teams, whatsapp, telegram,
discord, twilio, linear, github, slack). Positional
`createMockChatInstance(...)` call sites converted to the options API
(slack 100, linear 35).
- `web` left as-is — its suite uses the real `Chat`/`createMemoryState`
for e2e, so the shared factories don't apply.
- Platform SDK mocks (Octokit, WebClient, socket-mode, `@linear/sdk`,
`fetch`) and the Phase 1 `connectWebhookContract` descriptors are left
intact.

Net ~−540 lines of duplicated test scaffolding. Stacked on #673.
Tests-only, no changeset.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-07 23:20:32 +10:00
Ben Sabic 840c0d16e9 test(adapters): migrate Vercel Connect webhook tests to connectWebhookContract (#673) 
Adopts the shared `connectWebhookContract` from `@chat-adapter/tests` in
the Slack, GitHub, and Linear suites, replacing the bespoke
`webhookVerifier` blocks (verifier pass → 200, throw/falsy → 401,
invoked with request + raw body, precedence over a native secret).
Adapter-specific Connect tests are kept (token resolvers, GitHub bot-id
capture, type-level mutual exclusivity, 400-on-invalid-JSON, Linear
identity/`withInstallation`).

Each descriptor keeps `initialize()` network-free (GitHub `botUserId`,
Slack `_botUserId` to skip `auth.test`, Linear stubs
`resolveConnectIdentity`). Twilio is intentionally not included — it has
a single generic `webhookVerifier` usage with no 200/401 gating suite to
migrate.

First of three stacked test-generalization PRs. Tests-only, no
changeset.

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-07 23:14:05 +10:00
Ben Sabic 03d274283f feat(examples): add nuxt-chat example app (#609) 
Adds `examples/nuxt-chat`, a Nuxt 4 reference app for Chat SDK scoped to
the Slack and web adapters.

The Nitro server exposes `/api/webhooks/{platform}` for Slack events and
`/api/chat` for the browser UI, with H3-to-Fetch conversion that
preserves the raw request body for signature verification. Bot handlers
are ported from `nextjs-chat` — interactive cards, modals, slash
commands, transcripts, reactions, and AI streaming — without the
workflow demos.

The `/chat` page is a client-only Vue UI using `@chat-adapter/web/vue`
and the AI SDK. A Slack app manifest ships with the scopes and events
needed for pins, reactions, channel joins, and interactivity.

Monorepo plumbing covers changeset ignore, CI build exclusion,
`AGENTS.md`, knip entry paths for the Nuxt 4 `app/` directory, and biome
globals for Nitro auto-imports.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-07 23:04:48 +10:00
Ben Sabic ba687cb13c docs(slack): document Vercel Connect support (#648) 
Documents authenticating the Slack adapter with Vercel Connect via
`connectSlackAdapter()` from `@vercel/connect/chat`. The Slack adapter
already supports a `botToken` resolver and a `webhookVerifier`, so this
is a documentation-only change (no changeset).

Stacked on #647 (base `vercel-connect/base`).

## Companion

`@vercel/connect/chat` subpath: vercel/vercel#16826.

<img width="824" height="527" alt="CleanShot 2026-06-30 at 12 03 26"
src="https://github.com/user-attachments/assets/cbced069-8913-4848-9cf1-df0e5f614353"
/>

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-07-03 01:01:51 +10:00
dependabot[bot] df825b3a56 build(deps-dev): bump postcss from 8.5.15 to 8.5.16 (#658) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to
8.5.16.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.16</h2>
<ul>
<li>Fixed <code>Input#origin()</code> position (by <a
href="https://github.com/mizdra"><code>@​mizdra</code></a>).</li>
<li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
<li>Fixed putting parent-less node in <code>nodes</code> of new node (by
<a
href="https://github.com/MahinAnowar"><code>@​MahinAnowar</code></a>).</li>
<li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by
<a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a>).</li>
<li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/92ccc93ff15bd193491d67fad9763e62d489dfad"><code>92ccc93</code></a>
Release 8.5.16 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/818bdd6043359af773ccc3ca8663053d61a707c8"><code>818bdd6</code></a>
Update formatting</li>
<li><a
href="https://github.com/postcss/postcss/commit/46e451068ee6160b837865b715cf6972f28fabd5"><code>46e4510</code></a>
Fix <code>Input#origin()</code> returning incorrect position (<a
href="https://redirect.github.com/postcss/postcss/issues/2036">#2036</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/34942ce76c0b0c9ee65b1421017ac71855e722c4"><code>34942ce</code></a>
Fix tests</li>
<li><a
href="https://github.com/postcss/postcss/commit/d4feed645314ee421edf80ee9ebe453cc75c997f"><code>d4feed6</code></a>
Don't clone root-less child nodes in container constructor (<a
href="https://redirect.github.com/postcss/postcss/issues/2097">#2097</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/da323fc8d327a38199a21987dcbf7e27e3bc34f3"><code>da323fc</code></a>
Revert version update to fix old Node.js on CI</li>
<li><a
href="https://github.com/postcss/postcss/commit/886336919497516df8f140d0fb327bd125e35053"><code>8863369</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/3828982213fec6bc13d0791b1adf40393be0935e"><code>3828982</code></a>
Preserve node raws when rehydrating a JSON AST (<a
href="https://redirect.github.com/postcss/postcss/issues/2100">#2100</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/d1e80b830386b08dcd5b962fd466d1c51f28e82d"><code>d1e80b8</code></a>
Fix Node#rangeBy() ignoring index 0 (<a
href="https://redirect.github.com/postcss/postcss/issues/2091">#2091</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/b91e4a63907325d98b75d11fda546bdd91acc608"><code>b91e4a6</code></a>
Fix Node.js 26 tests</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.15...8.5.16">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for postcss since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.15&new-version=8.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-01 13:22:22 +01:00
dependabot[bot] bb6e52f058 build(deps): bump piscina from 4.9.2 to 4.9.3 (#627) 
Bumps [piscina](https://github.com/piscinajs/piscina) from 4.9.2 to
4.9.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/piscinajs/piscina/blob/v4.9.3/CHANGELOG.md">piscina's
changelog</a>.</em></p>
<blockquote>
<h3><a
href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">4.9.3</a>
(2026-06-12)</h3>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/piscinajs/piscina/commit/4440ae15037b2462549943ba9ab66da0b87f906d"><code>4440ae1</code></a>
chore(release): 4.9.3</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/8703d3e353936c05dd3386508955e0e30c2ffc57"><code>8703d3e</code></a>
Merge</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/63532c5a7595dba7647f4c521d9aed39475a6d0f"><code>63532c5</code></a>
docs: Update Fastify listen() calls to use { port: 3000 } in docs and
example...</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/67591a20a78c894de9170f782a038365784874bc"><code>67591a2</code></a>
chores: gh actions least privilege (<a
href="https://redirect.github.com/piscinajs/piscina/issues/1013">#1013</a>)
(<a
href="https://redirect.github.com/piscinajs/piscina/issues/1014">#1014</a>)</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/7c4220706fa45ff1ea629891854ef45ed0ecdc30"><code>7c42207</code></a>
chore: enhance contributing guidelines (<a
href="https://redirect.github.com/piscinajs/piscina/issues/972">#972</a>)</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/04c2c52b7c7bdfd7471668d2c052848fd91d9347"><code>04c2c52</code></a>
chore: pin actions (<a
href="https://redirect.github.com/piscinajs/piscina/issues/848">#848</a>)
(<a
href="https://redirect.github.com/piscinajs/piscina/issues/850">#850</a>)</li>
<li><a
href="https://github.com/piscinajs/piscina/commit/d157099670fbb55a5a6f8d730d44bff131d04387"><code>d157099</code></a>
[Backport v4] chore: edit ignore files (<a
href="https://redirect.github.com/piscinajs/piscina/issues/826">#826</a>)</li>
<li>See full diff in <a
href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=piscina&package-manager=npm_and_yarn&previous-version=4.9.2&new-version=4.9.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-01 03:36:56 +01:00
Ben Sabic e0a155e718 fix(examples): add @vercel/oidc to fix nextjs-chat Vercel build (#645) 
- The `nextjs-chat` example's generated workflow step route
(`/.well-known/workflow/v1/step`) bundles `@workflow/world-vercel →
@vercel/queue`, and `@vercel/queue` has an unconditional `import
"@vercel/oidc"`.
- `@vercel/oidc` is only a deep transitive dependency, so it isn't
hoisted into the example app. Vercel's isolated build can't resolve it
and fails with `Module not found: Can't resolve '@vercel/oidc'`. (It
resolves locally only because pnpm symlinks it, which is why the GitHub
Actions build — which excludes the example — stays green.)
- Declaring `@vercel/oidc` as a direct dependency of the example fixes
resolution for the bundler.

No changeset needed — `example-*` packages are private and excluded from
versioning.

---------

Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-27 08:42:13 +10:00
Ben Sabic 64b66864b1 chore(changesets): ignore all example-* packages and enforce the convention (#626) 
Replace the explicit per-example entries in the changesets `ignore` list
with an `example-*` name glob (matched by micromatch). All example apps
are
private and never published, so listing them individually only adds
version
and changelog churn to release PRs, and each new example required
editing
this CODEOWNERS-gated file.

Add an integration test that resolves the changesets config against the
workspace and asserts every examples/* package is in the resolved ignore
list and follows the `example-*` naming convention, so an off-convention
example app fails CI instead of silently leaking into releases.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-22 23:25:43 +10:00
Shujan Islam f3de12823c Added Express.js chat-sdk example project (#551) 
## Summary

Added a new example project demonstrating how to use `chat-sdk` with
Express.js.

Previously, there was no example showing how to integrate `chat-sdk` in
a simple Express.js setup. This PR adds a minimal Express.js project
with a Discord bot integration to demonstrate how `chat-sdk` can be used
in a practical server-side workflow.

Closes #519

## Test plan

- Ran the example project locally
- Verified the Express.js server starts successfully
- Verified the Discord bot connects and responds as expected
- Confirmed the example demonstrates basic `chat-sdk` usage with
Express.js

## Checklist

- [x] All commits are signed and verified
- [x] `pnpm validate` passes
- [ ] Changeset added (or N/A — see
[CONTRIBUTING.md](./CONTRIBUTING.md))
- [x] Documentation updated (or N/A)

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-20 13:15:14 +10:00
Ben Sabic 8f3af76565 feat: add create-chat-sdk CLI (#603) 
Adds `create-chat-sdk`, a CLI that scaffolds a Next.js Chat SDK bot
project:

```bash
npm create chat-sdk@latest my-bot

# non-interactive
npm create chat-sdk@latest -- my-bot --adapter slack redis -y
```

The user picks platform and state adapters interactively or via
`--adapter`, and the CLI generates a webhook-only project with
`src/lib/bot.ts`, `.env.example`, `next.config.ts`, `package.json`, and
a README, then optionally runs `git init` and installs dependencies.
There are no pages or client UI in the template.

Adapter choices come straight from the `chat/adapters` catalog, so the
CLI has no adapter registry of its own. When a coding agent such as
Cursor or Claude Code runs the CLI, it uses non-interactive defaults and
requires an explicit platform adapter. `--interactive` forces prompts.

## also in this pr

- `google-chat` is renamed to `gchat` everywhere, including docs pages,
the OG image, and adapter catalog. Old URLs redirect permanently,
including language-prefixed and `/og` paths
- a new docs page is available at `chat-sdk.dev/docs/create-chat-sdk`,
and the CLI is promoted on the homepage, package READMEs, and agent
skill
- `create-chat-sdk` releases independently with a minor changeset for
its initial `0.1.0` release

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
 2026-06-16 08:48:38 +01:00
OSS Polar Bear b14114a714 test(slack): expand emulator coverage for emulate.dev 0.6.0 APIs (#591) 
Upgrade @emulators/* to 0.6.0 and add integration tests for DMs,
reactions, fetch history, modals, scheduled messages, file uploads,
member joins, and bookmarks against the in-process Slack emulator.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-06-09 12:54:30 +10:00
Ben Sabic 9b8d8c4518 Discoverability lift: link KB guides, broaden npm keywords, mirror to AGENTS.md (#560) 
Broad SEO/AEO pass across the docs site, adapter READMEs and AGENTS.md
files, and npm package metadata so Chat SDK content shows up better in
search engines, in LLM-driven package recommendations, and in
IDE/coding-agent context.

**Docs site**

- Adds a `## Resources` section to the Getting Started and AI overview
pages and to the Slack, Discord, GitHub, Liveblocks, and Sendblue
adapter pages, each linking to applicable guides/templates with
descriptions sourced from `resources-edge-config.json` and a cross-link
back to the central `/resources` hub.

**Adapter packages**

- Mirrors the same Resources sections into the Slack, Discord, and
GitHub READMEs (so they surface on npm) and into their AGENTS.md files
(so coding agents see them alongside the API notes).
- Expands `keywords` on every published adapter and state package — adds
`chat-sdk`, `chatbot`, `ai-agent`, `ai-sdk`, `vercel`, plus
platform-specific terms like `slack-bot`, `block-kit`, `slash-commands`,
`github-app`, `whatsapp-business`, `state-adapter`.

**Resources registry**

- Registers four new entries in `resources-edge-config.json`
(Human-in-the-Loop guide, Liveblocks AI agent guide, Slack + Vercel Blob
guide, Durable iMessage Agent template) and runs `pnpm sync-resources`
so the bundled `chat` package guides, `templates.json`, and
`skills/chat/SKILL.md` all pick them up.
- Fixes the synced Slack AI agent guide to import `toAiMessages` from
`chat/ai` instead of the deprecated `chat` re-export path (the upstream
KB source has also been updated, so future syncs will preserve this).

**Drive-by fixes**

- Resend adapter doc quick start: corrects `MemoryStateAdapter` class
import to the `createMemoryState()` factory (matching every other
adapter doc).
- Zalo adapter doc: drops the "community adapter" callout that
duplicated frontmatter.

**Tooling / CI**

- Adds `tsx` as a root devDependency so `pnpm sync-resources` works out
of the box (it previously relied on `npx tsx`, which hung when not
pre-cached).
- Loosens the CI changeset gate to also skip `packages/chat/resources/`
(generated data), matching the existing `*.md` carve-out.

---------

Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
 2026-05-29 11:41:23 +10:00
josh 25ebc3b925 feat(twilio): add sms, mms, and voice helpers (#558) 
## summary

adds a first-class Twilio adapter for SMS and MMS bots, plus low-level
voice helpers for custom Twilio voice routes

this includes webhook parsing and signature verification, outbound
Messages API helpers, phone-number and Messaging Service sending,
inbound MMS attachments with authenticated `fetchData`, plain text card
fallback rendering, markdown conversion, and runtime-light `api`,
`webhook`, `voice`, and `format` subpaths

the adapter intentionally avoids the `twilio` npm runtime dependency so
apps can use the low-level helpers without pulling in the full SDK
 2026-05-27 15:39:23 -07:00
dependabot[bot] c3091eb9f9 build(deps): bump rollup from 4.54.0 to 4.60.4 (#525) 
Bumps [rollup](https://github.com/rollup/rollup) from 4.54.0 to 4.60.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/releases">rollup's
releases</a>.</em></p>
<blockquote>
<h2>v4.60.4</h2>
<h2>4.60.4</h2>
<p><em>2026-05-14</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Improve stability of chunk hashes (<a
href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>:
fix: stabilize chunk assignment across parallel file reads (<a
href="https://github.com/sonukapoor"><code>@​sonukapoor</code></a>, <a
href="https://github.com/Sonu"><code>@​Sonu</code></a> Kapoor, <a
href="https://github.com/TrickyPi"><code>@​TrickyPi</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>:
chore(deps): update react monorepo to v19 (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>:
Resolve vulnerabilities (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>v4.60.2</h2>
<h2>4.60.2</h2>
<p><em>2026-04-18</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Resolve a variable rendering bug when generating different formats
from the same build (<a
href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>:
docs: fix various typos in source and documentation (<a
href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>:
chore(deps): update codecov/codecov-action action to v6 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>:
chore(deps): update dependency eslint-plugin-unicorn to v64 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>:
fix(deps): update rust crate swc_compiler_base to v51 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6346">#6346</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6347">#6347</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6348">#6348</a>:
fix(deps): update swc monorepo (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6349">#6349</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6350">#6350</a>:
fix: reset variable render names between outputs in the same generate
(<a href="https://github.com/barry3406"><code>@​barry3406</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6351">#6351</a>:
chore(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6352">#6352</a>:
chore(deps): update cross-platform-actions/action action to v1 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6353">#6353</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6354">#6354</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6355">#6355</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6356">#6356</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6358">#6358</a>:
chore: remove cross-env from devDeps (<a
href="https://github.com/K-tecchan"><code>@​K-tecchan</code></a>)</li>
</ul>
<h2>v4.60.1</h2>
<h2>4.60.1</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's
changelog</a>.</em></p>
<blockquote>
<h2>4.60.4</h2>
<p><em>2026-05-14</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Improve stability of chunk hashes (<a
href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>:
fix: stabilize chunk assignment across parallel file reads (<a
href="https://github.com/sonukapoor"><code>@​sonukapoor</code></a>, <a
href="https://github.com/Sonu"><code>@​Sonu</code></a> Kapoor, <a
href="https://github.com/TrickyPi"><code>@​TrickyPi</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>:
chore(deps): update dependency lru-cache to v11 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>:
chore(deps): update react monorepo to v19 (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>:
Resolve vulnerabilities (<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.60.3</h2>
<p><em>2026-05-04</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Ensure nested &quot;exports&quot; variables are not renamed (<a
href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6360">#6360</a>:
fix: do not rename nested &quot;exports&quot; bindings that do not
conflict (<a
href="https://github.com/tariqrafique"><code>@​tariqrafique</code></a>,
<a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6364">#6364</a>:
chore(deps): update msys2/setup-msys2 digest to e989830 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6365">#6365</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6366">#6366</a>:
fix(deps): update swc monorepo (major) (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6367">#6367</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6368">#6368</a>:
docs: add missing backticks in <code>plugin-development</code> (<a
href="https://github.com/lumirlumir"><code>@​lumirlumir</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<h2>4.60.2</h2>
<p><em>2026-04-18</em></p>
<h3>Bug Fixes</h3>
<ul>
<li>Resolve a variable rendering bug when generating different formats
from the same build (<a
href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li>
</ul>
<h3>Pull Requests</h3>
<ul>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>:
docs: fix various typos in source and documentation (<a
href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a>, <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>:
fix(deps): update minor/patch updates (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>:
chore(deps): update codecov/codecov-action action to v6 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>:
chore(deps): update dependency eslint-plugin-unicorn to v64 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>:
fix(deps): update rust crate swc_compiler_base to v51 (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot])</li>
<li><a
href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>:
chore(deps): lock file maintenance (<a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot], <a
href="https://github.com/lukastaegert"><code>@​lukastaegert</code></a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rollup/rollup/commit/d311a84b0bb4d4a6f50d19ffd2c29cca28660c88"><code>d311a84</code></a>
4.60.4</li>
<li><a
href="https://github.com/rollup/rollup/commit/6aa324854482e273b711972955d2d1b3bb445bcc"><code>6aa3248</code></a>
fix: stabilize chunk assignment across parallel file reads (<a
href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/82a0fe76b1372a2cf509fc4067d69f25569b83f5"><code>82a0fe7</code></a>
Resolve vulnerabilities (<a
href="https://redirect.github.com/rollup/rollup/issues/6375">#6375</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/71f5ebc893d7ff76b5571d63b04ea2ed4a4ddd9d"><code>71f5ebc</code></a>
chore(deps): update dependency lru-cache to v11 (<a
href="https://redirect.github.com/rollup/rollup/issues/6371">#6371</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/af91d778cdf564dd1ae1bfd6e92604ec031824a7"><code>af91d77</code></a>
chore(deps): lock file maintenance (<a
href="https://redirect.github.com/rollup/rollup/issues/6373">#6373</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/65e7b94ddda9f02334fa8f12ff6bf699c1f07833"><code>65e7b94</code></a>
chore(deps): update react monorepo to v19 (major) (<a
href="https://redirect.github.com/rollup/rollup/issues/6372">#6372</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/642587f3d9c5b4aa482a5027672f0fa8ea76da12"><code>642587f</code></a>
fix(deps): update minor/patch updates (<a
href="https://redirect.github.com/rollup/rollup/issues/6370">#6370</a>)</li>
<li><a
href="https://github.com/rollup/rollup/commit/b47bdabeccbb7aa1b1d4117f2f4a781a9f6de297"><code>b47bdab</code></a>
4.60.3</li>
<li><a
href="https://github.com/rollup/rollup/commit/15c5f33083c8c6b1b2cbae548124fffbba2553bb"><code>15c5f33</code></a>
Add again some unneeded dev dependencies, to make some builds
succeed</li>
<li><a
href="https://github.com/rollup/rollup/commit/12195dcebbd21f0f2d91e26720cd053526edbfe3"><code>12195dc</code></a>
fix: do not rename nested &quot;exports&quot; bindings that do not
conflict (<a
href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rollup/rollup/compare/v4.54.0...v4.60.4">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 06:25:31 -07:00
dependabot[bot] db61173386 build(deps-dev): bump postcss from 8.5.14 to 8.5.15 (#541) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to
8.5.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.15</h2>
<ul>
<li>Fixed declaration parsing performance (by <a
href="https://github.com/homanp"><code>@​homanp</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/eae46db765d752cf8f40c4fa2b0b85030079c43d"><code>eae46db</code></a>
Release 8.5.15 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/79508ffa59e42c02056aca61b88bc393c8b516c4"><code>79508ff</code></a>
Update CI actions</li>
<li><a
href="https://github.com/postcss/postcss/commit/b128e2131288a411c6e28071d0929542c49e74eb"><code>b128e21</code></a>
Speed up declaration parsing by avoiding creating new array on each
token</li>
<li><a
href="https://github.com/postcss/postcss/commit/9825dca02c33cf610e2a842be767468b67fbecf9"><code>9825dca</code></a>
Fix code format</li>
<li><a
href="https://github.com/postcss/postcss/commit/55789c865281e2be194fa5b4e41dd046be3a2307"><code>55789c8</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/84fbbe9009cb3cc3bbb4cc3a9b65d468f4844d95"><code>84fbbe9</code></a>
Install older pnpm action for old Node.js</li>
<li><a
href="https://github.com/postcss/postcss/commit/9f860bd78ec1dbc4f0ae72d693f03f956baa38cb"><code>9f860bd</code></a>
Revert pnpm action for old Node.js</li>
<li><a
href="https://github.com/postcss/postcss/commit/08771986d47359545f502e009763e223b66bfcf6"><code>0877198</code></a>
Update CI actions</li>
<li><a
href="https://github.com/postcss/postcss/commit/b2d1a335cea818f8b27e5cfb90147648afe3e582"><code>b2d1a33</code></a>
Fix linter warnings</li>
<li><a
href="https://github.com/postcss/postcss/commit/0700dac92283bc259977dff2743ca74a00f58267"><code>0700dac</code></a>
Merge pull request <a
href="https://redirect.github.com/postcss/postcss/issues/2088">#2088</a>
from rootvector2/add-oss-fuzz-harness</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.14...8.5.15">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.14&new-version=8.5.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/vercel/chat/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 06:01:52 -07:00
dependabot[bot] b4f3a00821 build(deps): bump ws from 8.18.3 to 8.20.1 (#539) 
Bumps [ws](https://github.com/websockets/ws) from 8.18.3 to 8.20.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>8.20.1</h2>
<h1>Bug fixes</h1>
<ul>
<li>Fixed an uninitialized memory disclosure issue in
<code>websocket.close()</code>
(c0327ec1).</li>
</ul>
<p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>)
as the <code>reason</code> argument for
<code>websocket.close()</code>, rather than the supported string or
<code>Buffer</code> types, caused
uninitialized memory to be disclosed to the remote peer.</p>
<pre lang="js"><code>import { deepStrictEqual } from 'node:assert';
import { WebSocket, WebSocketServer } from 'ws';
<p>const wss = new WebSocketServer(
{ port: 0, skipUTF8Validation: true },
function () {
const { port } = wss.address();
const ws = new WebSocket(<code>ws://localhost:${port}</code>, {
skipUTF8Validation: true
});</p>
<pre><code>ws.on('close', function (code, reason) {
  deepStrictEqual(reason, Buffer.alloc(80));
});
</code></pre>
<p>}
);</p>
<p>wss.on('connection', function (ws) {
ws.close(1000, new Float32Array(20));
});
</code></pre></p>
<p>The issue was privately reported by <a
href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p>
<h2>8.20.0</h2>
<h1>Features</h1>
<ul>
<li>Added exports for the <code>PerMessageDeflate</code> class and
utilities for the
<code>Sec-WebSocket-Extensions</code> and
<code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li>
</ul>
<h2>8.19.0</h2>
<h1>Features</h1>
<ul>
<li>Added the <code>closeTimeout</code> option (<a
href="https://redirect.github.com/websockets/ws/issues/2308">#2308</a>).</li>
</ul>
<h1>Bug fixes</h1>
<ul>
<li>Handled a forthcoming breaking change in Node.js core
(19984854).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a>
[dist] 8.20.1</li>
<li><a
href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a>
[security] Fix uninitialized memory disclosure in
<code>websocket.close()</code></li>
<li><a
href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a>
[ci] Test on node 26</li>
<li><a
href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a>
[ci] Do not test on node 25</li>
<li><a
href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a>
[ci] Run the lint step on node 24</li>
<li><a
href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a>
[dist] 8.20.0</li>
<li><a
href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a>
[minor] Export the <code>PerMessageDeflate</code> class and header
utils</li>
<li><a
href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a>
[api] Convert the <code>isServer</code> and <code>maxPayload</code>
parameters to options</li>
<li><a
href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a>
[doc] Add missing space</li>
<li><a
href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a>
[pkg] Update eslint to version 10.0.1</li>
<li>Additional commits viewable in <a
href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 05:19:49 -07:00
dependabot[bot] 63cd869f20 build(deps-dev): bump turbo from 2.8.12 to 2.9.14 2026-05-20 02:40:28 +01:00
dependabot[bot] 39130a8898 build(deps): bump vite from 7.3.1 to 7.3.3 2026-05-20 02:35:34 +01:00
dependabot[bot] 10c58c2721 build(deps): bump path-to-regexp from 0.1.13 to 8.4.2 2026-05-20 02:25:15 +01:00
dependabot[bot] b18e99625e build(deps): bump lodash from 4.17.21 to 4.18.1 2026-05-20 02:24:38 +01:00