vercel__chat

mirror of https://github.com/vercel/chat.git synced 2026-09-14 18:32:29 +08:00

Author	SHA1	Message	Date
C. T. Lin	6714efc3a1	feat: support AI SDK v7 (ai@7) as a peer dependency (#691 ) Closes #690 ## What Widens the AI SDK peer dependency ranges so the Chat SDK installs cleanly next to `ai@7`: - `chat`: `ai@^6.0.182 \|\| ^7.0.0` - `@chat-adapter/web`: `ai@^6 \|\| ^7`, `@ai-sdk/react@^3 \|\| ^4`, `@ai-sdk/svelte@^4 \|\| ^5`, `@ai-sdk/vue@^3 \|\| ^4` This also unbreaks `create-chat-sdk` scaffolds, which install `ai@latest` (now v7) next to `chat` and currently hit a peer conflict out of the box. ## The one real v6 → v7 break In v7, `tool()` with an `execute` function returns `ExecutableTool<Tool<...>>` — an internal type from `@ai-sdk/provider-utils` that `ai` does not re-export. The `chat/ai` tool factories relied on inference, so declaration emit failed with TS2742 (17 errors). The factories now declare explicit `Tool<Input, Output>` return types, which is exactly the shape the previously published `.d.ts` already had — the public type surface is unchanged, and the emitted declarations only reference types from `ai` (portable for consumers on either major). Everything else checked out compatible: - v7 stream parts keep `text-delta` / `finish-step` shapes, so `fromFullStream` duck-typing works unchanged; `fullStream` remains as a deprecated alias - tool-level `needsApproval` is deprecated in v7 but still typed and honored - `createUIMessageStream`, `createUIMessageStreamResponse`, `isTextUIPart`, `UIMessage`, `UIMessageStreamWriter`, `ChatInit`, `DefaultChatTransport` all still exported — `@chat-adapter/web` needed zero source changes ## Other changes - devDependencies move to v7 so the workspace develops/tests against the latest major - `examples/nextjs-chat` and `examples/nuxt-chat` move to `ai@^7` (required — mixing majors across the workspace fails typecheck, since `chat`'s d.ts resolves `ai` types from its own devDependency) - Test-only: the `ToolExecutionOptions` stub type is now derived from `Tool["execute"]` because v7 made the generic parameter required - Changeset included (minor for `chat` and `@chat-adapter/web`) ## Verification The same source was verified against both majors (`ai@6.0.182` and `ai@7.0.17`): `tsc --noEmit` and the full test suites (`chat`: 1035 tests, `@chat-adapter/web`: 21 tests) pass on each. `pnpm validate` (knip + check + typecheck + test + build, including both examples) is green on v7. Note for adopters: `ai@7` itself requires Node.js ≥ 22 and is ESM-only; `chat` keeps `engines.node >= 20` since `ai` is an optional peer. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: chentsulin <chentsulin@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: dancer <josh@afterima.ge>	2026-07-13 21:50:27 +10:00
damianborowy-nexos	1721fa01e7	feat(slack): add Slack Agent messaging experience (agent_view) support (#684 ) ## Summary Add support for Slack's Agent messaging experience (`agent_view`), the 2026 replacement for `assistant_view`. ## Core (`chat`) - New `onAppContextChanged` event carrying the active-view context as a normalized `AppContextEntity[]` (`channel` / `canvas` / `list` / `message` / `unknown`) describing what the user is currently viewing. - `AppHomeOpenedEvent` now carries: - the same folded active-view context as optional `entities` - the opened `tab` (`"home"` / `"messages"`), so handlers can distinguish a Home-tab open from the DM-open signal under `agent_view` ## Slack adapter (`@chat-adapter/slack`) - `agentView` config flag. Under `agent_view`: - `app_home_opened` is the DM-open signal and fires regardless of tab (branch on `event.tab` if you also publish a Home view) - DM messages are threaded per Slack's new model — each user message is a thread root (`thread_ts ?? ts`) - conversation-scoped threads returned by `openDM()` keep working: when that thread is subscribed, incoming top-level DM messages route to it, so `onSubscribedMessage` and per-thread state behave the same as in legacy mode - `app_context_changed` routing with normalized entities. Malformed payloads degrade gracefully: a missing `context` yields `entities: []`, and entities with a null/malformed `value` normalize to `kind: "unknown"` — never a webhook 500. - `getAppContext(message)` helper to read the folded active-view context off a DM message. - `setSuggestedPrompts` accepts an optional thread reference (`agent_view` lets prompts sit at the top of the agent conversation). - Env auth fallback now keys off auth fields: `SLACK_BOT_TOKEN` / `SLACK_CLIENT_ID` / `SLACK_CLIENT_SECRET` fallback is disabled only when an auth-related field (`botToken`, `clientId`, `clientSecret`, `installationProvider`) is passed explicitly, rather than by the presence of any config object. This lets non-auth options compose with env auth — e.g. `createSlackAdapter({ agentView: true })` picks up env credentials — and matches the semantics documented in the adapter's AGENTS.md. (Behavior change for callers passing non-auth-only configs while relying on env vars being ignored.) - Bumped `@slack/web-api` to `^7.18.0` (adds the optional `thread_ts` typing for `setSuggestedPrompts`). ## Docs - New "Agent messaging experience" section on the Slack adapter page (config, manifest snippet, threading model, openDM bridge). - "Handling active-view context" section in handling-events, plus `tab`/`entities` rows on the app-home event table. - Callout: under `agent_view`, bot replies are threaded per user message, so `conversations.history` only returns the user's side of a DM — build AI conversation history from transcripts instead of channel history. ## Example app (`examples/nextjs-chat`) - Plain `SLACK_BOT_TOKEN` adapter branch (previously Slack was only wired via Vercel Connect). - DM AI history built from transcripts instead of channel history (see docs callout above); assistant turns persisted. - The `dm me` trigger regex now matches mention text, which carries the `@bot` prefix on Slack. ## Test plan - `pnpm validate` and `pnpm konsistent` pass. - Unit tests cover the new events, entity normalization (including malformed payloads), `agent_view` DM threading, the openDM subscription bridge, `tab` passthrough, `setSuggestedPrompts` thread handling, and env-fallback behavior; an integration replay test exercises the full webhook flow. - Verified manually against a live `agent_view` workspace: `onAppContextChanged` entities, folded context on `app_home_opened` and DM messages, `tab` values for both tabs, per-message DM threading, the openDM subscription bridge, and signed malformed-payload replays (all return 200). - Legacy regression pass with `agentView` off: conversation-scoped DM threading, Home-tab-only `app_home_opened`, mention flow unchanged. ### Slack references - Agent messaging experience: https://docs.slack.dev/changelog/2026/06/30/agent-messages-tab/ - Active-view context: https://docs.slack.dev/changelog/2026/07/02/app-context/ ## Checklist - [x] All commits are signed and verified - [x] All commits are signed off for the DCO (`git commit -s`) - [x] `pnpm validate` passes - [x] Changeset added - [x] Documentation updated --------- Signed-off-by: Damian Borowy <301205838+damianborowy-nexos@users.noreply.github.com> Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-07-12 19:35:28 +10:00
Rich Haines	1dff4515e2	refactor(docs): migrate chat-sdk.dev to @vercel/geistdocs (#686 ) ## Summary Migrates `apps/docs` from locally-copied geistdocs runtime code to the published [`@vercel/geistdocs`](https://www.npmjs.com/package/@vercel/geistdocs) package (1.8.2), following the official [migration guide](https://preview.geistdocs.com/docs/migration). Net −8,400 lines. ### Package-backed now - Docs page + layouts: `createDocsPage`, `GeistdocsDocsLayout`, `GeistdocsHomeLayout` (JSON-LD + sr-only markdown hints preserved via `renderTop`) - Navbar (OSS product switcher via `navbarOssProducts`), footer, provider, search dialog, page actions (edit source, feedback, copy page, Ask AI, open-in-chat, scroll top) - `/api/search` → `createSearchRoute`, `/api/chat` → `createChatRoute` (AI SDK v6; AI Gateway default, optional `GEISTDOCS_CHAT_PROXY_URL`) - `llms.mdx` → `createDocsMarkdownRoute`, `sitemap.md` → `createSitemapMarkdownRoute` (now includes an Adapters section) - New: `/agents.md` via `createAgentsRoute`, backed by a new `agent` readiness config - `proxy.ts` → `createProxy` with explicit `markdownRoutes` for `/docs` → `llms.mdx` and `/adapters` → `adapters.mdx` (adds AI-agent UA rewrites) - CSS: `@vercel/geistdocs/styles.css` + slim local overrides (shadcn tokens for remaining `components/ui`, body tint, prose inline code, `#nd-` tweaks); code blocks now use the geist Shiki theme - Icons/logos from `@vercel/geistdocs/assets/`; feedback via the package action (same geistdocs.com endpoint + `siteId`) ### Kept local by design - Curated `/llms.txt` index + `/llms-full.txt` corpus — the published `AGENTS.md`/SKILL.md artifacts and integration tests reference this exact contract - The adapters section (README fetching, OG images, JSON-LD, feature matrices, `adapters.mdx` markdown route) — now rendered inside the package docs layout - RSS and OG image routes (app-owned per the migration guide) - Skipped `/.well-known/mcp.json`: no MCP servers configured, and the proxy matcher must keep excluding `.well-known` for the served agent-skills files ### Cleanup - Deleted local copies: `components/geistdocs/` chrome, `components/ai-elements/`, chat hooks/persistence, feedback server actions, unused shadcn primitives, geistcn logo/icon fallbacks covered by package assets - Removed 13 now-unused deps (`ai@5`, `@ai-sdk/react@2`, `dexie`, `jotai`, `cmdk`, `vaul`, `mermaid`, `nanoid`, `react-player`, `use-stick-to-bottom`, `@orama/tokenizers`, `dexie-react-hooks`, `next-themes`) - Updated `docs-llms.test.ts` proxy assertions to the `createProxy` markdown-route shape ### Behavior changes to be aware of - Code blocks use the geist Shiki theme instead of GitHub light/dark - Ask AI history is no longer persisted in IndexedDB (package owns the panel) - Adapters sidebar uses the standard geistdocs tree rendering instead of the bespoke grouped sidebar - Per-page markdown output appends the standard geistdocs footer links (`/sitemap.md`, `/llms.txt`, `/agents.md`) ## Test plan - `pnpm validate` green (knip + check + typecheck + test + build) - Smoke-tested against `next build && next start`: `/`, `/docs`, `/adapters`, `/agents.md`, `/llms.txt`, `/llms-full.txt`, `/sitemap.md`, page-level `.md` URLs for both docs and adapters, `Accept: text/markdown` negotiation, search API, JSON-LD, sr-only markdown hints, edit-source URLs (`apps/docs/content/docs/{path}`), OSS navbar, page actions - Verified compiled CSS chunks contain the home grid, Shiki palette, and geist utilities (note: stale turbopack dev caches from before this change can serve incomplete CSS — `rm -rf apps/docs/.next` fixes it) ## Checklist - [x] All commits are signed and verified - [x] All commits are signed off for the DCO (`git commit -s`) - [x] `pnpm validate` passes - [x] Changeset added (or N/A — docs app + tests only, no package behavior change) - [x] Documentation updated (or N/A) --------- Signed-off-by: molebox <rich@vercel.com>	2026-07-09 15:29:47 +02:00
josh	ef2542c5fd	feat(x): add X (Twitter) adapter (#682 ) ## summary new `@chat-adapter/x` adapter for X (Twitter), built on the X API v2 and the X Activity API. write bot logic once and reply to mentions, hold DM conversations, post from the account, and like posts, like the other Chat SDK adapters what it supports: - reply to public mentions (`post.mention.create`) and top-level posts via `channel.post` - send and receive direct messages (`dm.received` / `dm.sent`) - edit and delete owned posts, delete own DM events - likes as the only reaction (`emoji.heart` or `"like"`) - buffered streaming: accumulates an LLM stream and posts once instead of post+edit churn on a public timeline - OAuth 2.0 user context with managed token refresh (rotating refresh token persisted in the state adapter, optional AES-256-GCM encryption) - webhook CRC and `x-twitter-webhooks-signature` verification key design decisions: - DMs are threaded by the other participant's user id (`x:dm:{userId}`) because X DM webhooks carry no conversation id, only participants - OAuth 2.0 only at runtime: DM send and read are verified to work on OAuth 2.0 user tokens, so no OAuth 1.0a in the adapter (subscription and webhook setup is one-time and handled in the X developer console) - parsers were written against real captured payloads: mentions use the v2 shape (author hydrated in `includes.users`), DMs use the legacy Account Activity shape (`direct_message_events`, `message_create.message_data`, a `users` map, and no conversation id) also includes the `chat/adapters` catalog entry, docs page, CLI scaffold spec, and `sample-messages.md` with real captured payloads <details><summary>usage</summary> ```typescript import { Chat } from "chat"; import { createXAdapter } from "@chat-adapter/x"; const bot = new Chat({ userName: "mybot", adapters: { x: createXAdapter() }, }); bot.onNewMention(async (thread, message) => { await thread.post(`hi @${message.author.userName}!`); }); bot.onDirectMessage(async (thread) => { await thread.post("hello from X"); }); ``` </details> ## test plan - adapter unit tests pass against the real captured payload shapes, with regression tests for author-from-`includes` (mentions) and the legacy `direct_message_events` shape (DMs) - real captured `post.mention.create` and `dm.received` payloads verified end-to-end through `handleWebhook`: signature verification, routing, author resolution, and participant threading, plus bad-signature rejection returns 401 - every write and read path fired live against the X API through the adapter: top-level post, reply to a mention, like and unlike, edit, delete, DM send, DM read, DM delete - OAuth 2.0 managed token refresh exercised live (access and refresh token rotation) --------- Signed-off-by: dancer <josh@afterima.ge>	2026-07-07 23:07:36 +01:00
dependabot[bot]	5267669563	build(deps): bump nuxt from 4.3.1 to 4.4.7 (#680 ) Bumps [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) from 4.3.1 to 4.4.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nuxt/nuxt/releases">nuxt's releases</a>.</em></p> <blockquote> <h2>v4.4.7</h2> <blockquote> <p>4.4.7 is a security hotfix release.</p> </blockquote> <p>👉 make sure to check <a href="https://github.com/nuxt/nuxt/security/advisories">https://github.com/nuxt/nuxt/security/advisories</a> to view open advisories resolved by this release.</p> <h2>👉 Changelog</h2> <p><a href="https://github.com/nuxt/nuxt/compare/v4.4.6...v4.4.7">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li><strong>nitro:</strong> Assign <code>noSSR</code> before deciding payload extraction (<a href="https://redirect.github.com/nuxt/nuxt/pull/35108">#35108</a>)</li> <li><strong>vite:</strong> Avoid filtering out dirs with shared prefix from <code>allowDirs</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/35112">#35112</a>)</li> <li><strong>nuxt:</strong> Use resolve from <code>pathe</code> for buildCache path boundary check (<a href="https://redirect.github.com/nuxt/nuxt/pull/35111">#35111</a>)</li> <li><strong>nuxt:</strong> Prevent sibling-directory traversal in test component wrapper (<a href="https://redirect.github.com/nuxt/nuxt/pull/35110">#35110</a>)</li> <li><strong>nitro:</strong> Pass event data to <code>isValid</code> in dev clipboard-copy listener (<a href="https://redirect.github.com/nuxt/nuxt/pull/35109">#35109</a>)</li> <li><strong>nuxt:</strong> Validate protocols in <code>reloadNuxtApp</code> path before reload (<a href="https://redirect.github.com/nuxt/nuxt/pull/35115">#35115</a>)</li> <li><strong>vite:</strong> Prefix public asset virtuals with null byte (<a href="https://github.com/nuxt/nuxt/commit/9e303b438">9e303b438</a>)</li> <li><strong>nuxt:</strong> Re-run <code>getCachedData</code> after initial fetch (<a href="https://redirect.github.com/nuxt/nuxt/pull/35122">#35122</a>)</li> <li><strong>nuxt:</strong> Propagate <code>useFetch</code>/<code>useAsyncData</code> factory types (<a href="https://redirect.github.com/nuxt/nuxt/pull/35133">#35133</a>)</li> <li><strong>vite:</strong> Close vite dev server on nuxt close (<a href="https://github.com/nuxt/nuxt/commit/a10a68abc">a10a68abc</a>)</li> <li><strong>kit,nuxt:</strong> Handle cancelling prompts to install packages (<a href="https://github.com/nuxt/nuxt/commit/e84813229">e84813229</a>)</li> <li><strong>kit:</strong> Avoid excluding node-context files in legacy tsconfig (<a href="https://redirect.github.com/nuxt/nuxt/pull/35152">#35152</a>)</li> <li><strong>nuxt:</strong> Handle missing payload in chunkError listener (<a href="https://redirect.github.com/nuxt/nuxt/pull/35155">#35155</a>)</li> <li><strong>nuxt:</strong> Await in-lifght template generation when closing nuxt (<a href="https://redirect.github.com/nuxt/nuxt/pull/35181">#35181</a>)</li> <li><strong>nuxt:</strong> Clarify page and layout usage warnings (<a href="https://redirect.github.com/nuxt/nuxt/pull/35184">#35184</a>)</li> <li><strong>webpack:</strong> Surface compilation errors when stats.toString is empty (<a href="https://github.com/nuxt/nuxt/commit/073b07851">073b07851</a>)</li> <li><strong>nuxt:</strong> Reject prototype-chain keys in the island registry (<a href="https://redirect.github.com/nuxt/nuxt/pull/35205">#35205</a>)</li> <li><strong>nuxt:</strong> Apply <code>isScriptProtocol</code> guard to <code>navigateTo</code> open option (<a href="https://redirect.github.com/nuxt/nuxt/pull/35206">#35206</a>)</li> <li><strong>nuxt:</strong> Prevent server-only page island from recursing via <code><NuxtPage></code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/35198">#35198</a>)</li> <li><strong>rspack,webpack:</strong> Require loopback host when missing same-origin signals (<a href="https://redirect.github.com/nuxt/nuxt/pull/35200">#35200</a>)</li> <li><strong>nitro:</strong> Gate chrome devtools workspace endpoint to local requests (<a href="https://redirect.github.com/nuxt/nuxt/pull/35201">#35201</a>)</li> <li><strong>nuxt:</strong> Escape props in <code><NuxtClientFallback></code> ssr output (<a href="https://redirect.github.com/nuxt/nuxt/pull/35199">#35199</a>)</li> <li><strong>kit:</strong> Improve TS extension stripping/substitutions (<a href="https://redirect.github.com/nuxt/nuxt/pull/35233">#35233</a>)</li> <li><strong>nuxt:</strong> Preserve <code>.d.mts</code>/<code>.d.cts</code> in <code>resolveTypePaths</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/35235">#35235</a>)</li> <li><strong>nuxt:</strong> Escape <code><NoScript></code> slot content (<a href="https://github.com/nuxt/nuxt/commit/4b054e9d9">4b054e9d9</a>)</li> <li><strong>nuxt:</strong> Match route rules case-insensitively to mirror <code>vue-router</code> (<a href="https://github.com/nuxt/nuxt/commit/07e39cd6f">07e39cd6f</a>)</li> <li><strong>nuxt:</strong> Reject script-capable protocols in <code><NuxtLink></code> href (<a href="https://github.com/nuxt/nuxt/commit/0103ce06f">0103ce06f</a>)</li> <li><strong>nuxt:</strong> Block path-normalization open redirect in <code>navigateTo</code> (<a href="https://github.com/nuxt/nuxt/commit/2cce6fb02">2cce6fb02</a>)</li> <li><strong>nuxt:</strong> Reject cross-origin paths in <code>reloadNuxtApp</code> (<a href="https://github.com/nuxt/nuxt/commit/e447a793c">e447a793c</a>)</li> <li><strong>vite:</strong> Bind vite-node IPC to a permissioned filesystem socket (<a href="https://github.com/nuxt/nuxt/commit/1f9f4767a">1f9f4767a</a>)</li> </ul> <h3>💅 Refactors</h3> <ul> <li><strong>kit,nuxt,vite:</strong> Use <code>es2023</code> array methods (<a href="https://redirect.github.com/nuxt/nuxt/pull/34980">#34980</a>)</li> <li><strong>nuxt:</strong> Replace <code>runInNewContext</code> with AST walker (<a href="https://github.com/nuxt/nuxt/commit/d72a89ef4">d72a89ef4</a>)</li> </ul> <h3>📖 Documentation</h3> <ul> <li>Document vite client and server options (<a href="https://redirect.github.com/nuxt/nuxt/pull/35090">#35090</a>)</li> <li>Add dedicated module dependencies page (<a href="https://redirect.github.com/nuxt/nuxt/pull/35171">#35171</a>)</li> <li>Add nodeTsConfig and sharedTsConfig options (<a href="https://redirect.github.com/nuxt/nuxt/pull/35231">#35231</a>)</li> <li>Edit for clarity and grammar (<a href="https://redirect.github.com/nuxt/nuxt/pull/35214">#35214</a>)</li> </ul> <h3>🏡 Chore</h3> <ul> <li>Use <code>execFileSync</code> for safety in release scripts (<a href="https://github.com/nuxt/nuxt/commit/1d7baaf01">1d7baaf01</a>)</li> <li>Assert there is always a tag (<a href="https://github.com/nuxt/nuxt/commit/e98c47c3c">e98c47c3c</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nuxt/nuxt/commit/b7d57903b947e788fadfcfdf88be7951943731bf"><code>b7d5790</code></a> v4.4.7</li> <li><a href="https://github.com/nuxt/nuxt/commit/dbc58965ca7ffa21d7cc4207a4c40a62e0762f4a"><code>dbc5896</code></a> chore: lint</li> <li><a href="https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1"><code>e447a79</code></a> fix(nuxt): reject cross-origin paths in <code>reloadNuxtApp</code></li> <li><a href="https://github.com/nuxt/nuxt/commit/d72a89ef451965a8a1abb58d3bd6eab4865631a0"><code>d72a89e</code></a> refactor(nuxt): replace <code>runInNewContext</code> with AST walker</li> <li><a href="https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d"><code>2cce6fb</code></a> fix(nuxt): block path-normalization open redirect in <code>navigateTo</code></li> <li><a href="https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3"><code>0103ce0</code></a> fix(nuxt): reject script-capable protocols in <code>\<NuxtLink></code> href</li> <li><a href="https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb"><code>07e39cd</code></a> fix(nuxt): match route rules case-insensitively to mirror <code>vue-router</code></li> <li><a href="https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e"><code>4b054e9</code></a> fix(nuxt): escape <code>\<NoScript></code> slot content</li> <li><a href="https://github.com/nuxt/nuxt/commit/03d83bfab531b27fbc1dac7cdea9227b3707476e"><code>03d83bf</code></a> fix(nuxt): preserve <code>.d.mts</code>/<code>.d.cts</code> in <code>resolveTypePaths</code> (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35235">#35235</a>)</li> <li><a href="https://github.com/nuxt/nuxt/commit/46960b2b18e79d64f212b2b77d879b3f88ab72cb"><code>46960b2</code></a> fix(nuxt): escape props in <code>\<NuxtClientFallback></code> ssr output (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35199">#35199</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nuxt/nuxt/commits/v4.4.7/packages/nuxt">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nuxt&package-manager=npm_and_yarn&previous-version=4.3.1&new-version=4.4.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-07 23:27:39 +10:00
Ben Sabic	ac5a54ee1d	test(adapters): adopt shared @chat-adapter/tests factories and matchers (#674 ) Wires `@chat-adapter/tests` as a devDependency and registers its matchers via `setupFiles: ["@chat-adapter/tests/setup"]` across all 11 platform adapters, then replaces bespoke local `mockLogger`/`createMockState`/`createMockChatInstance` with the shared factories and adopts `toHaveDispatched`/`not.toHaveDispatched` where clean. - 10 adapters migrated (gchat, messenger, teams, whatsapp, telegram, discord, twilio, linear, github, slack). Positional `createMockChatInstance(...)` call sites converted to the options API (slack 100, linear 35). - `web` left as-is — its suite uses the real `Chat`/`createMemoryState` for e2e, so the shared factories don't apply. - Platform SDK mocks (Octokit, WebClient, socket-mode, `@linear/sdk`, `fetch`) and the Phase 1 `connectWebhookContract` descriptors are left intact. Net ~−540 lines of duplicated test scaffolding. Stacked on #673. Tests-only, no changeset. --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-07-07 23:20:32 +10:00
Ben Sabic	840c0d16e9	test(adapters): migrate Vercel Connect webhook tests to connectWebhookContract (#673 ) Adopts the shared `connectWebhookContract` from `@chat-adapter/tests` in the Slack, GitHub, and Linear suites, replacing the bespoke `webhookVerifier` blocks (verifier pass → 200, throw/falsy → 401, invoked with request + raw body, precedence over a native secret). Adapter-specific Connect tests are kept (token resolvers, GitHub bot-id capture, type-level mutual exclusivity, 400-on-invalid-JSON, Linear identity/`withInstallation`). Each descriptor keeps `initialize()` network-free (GitHub `botUserId`, Slack `_botUserId` to skip `auth.test`, Linear stubs `resolveConnectIdentity`). Twilio is intentionally not included — it has a single generic `webhookVerifier` usage with no 200/401 gating suite to migrate. First of three stacked test-generalization PRs. Tests-only, no changeset. Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-07-07 23:14:05 +10:00
Ben Sabic	03d274283f	feat(examples): add nuxt-chat example app (#609 ) Adds `examples/nuxt-chat`, a Nuxt 4 reference app for Chat SDK scoped to the Slack and web adapters. The Nitro server exposes `/api/webhooks/{platform}` for Slack events and `/api/chat` for the browser UI, with H3-to-Fetch conversion that preserves the raw request body for signature verification. Bot handlers are ported from `nextjs-chat` — interactive cards, modals, slash commands, transcripts, reactions, and AI streaming — without the workflow demos. The `/chat` page is a client-only Vue UI using `@chat-adapter/web/vue` and the AI SDK. A Slack app manifest ships with the scopes and events needed for pins, reactions, channel joins, and interactivity. Monorepo plumbing covers changeset ignore, CI build exclusion, `AGENTS.md`, knip entry paths for the Nuxt 4 `app/` directory, and biome globals for Nitro auto-imports. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-07-07 23:04:48 +10:00
Ben Sabic	ba687cb13c	docs(slack): document Vercel Connect support (#648 ) Documents authenticating the Slack adapter with Vercel Connect via `connectSlackAdapter()` from `@vercel/connect/chat`. The Slack adapter already supports a `botToken` resolver and a `webhookVerifier`, so this is a documentation-only change (no changeset). Stacked on #647 (base `vercel-connect/base`). ## Companion `@vercel/connect/chat` subpath: vercel/vercel#16826. <img width="824" height="527" alt="CleanShot 2026-06-30 at 12 03 26" src="https://github.com/user-attachments/assets/cbced069-8913-4848-9cf1-df0e5f614353" /> --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-07-03 01:01:51 +10:00
dependabot[bot]	df825b3a56	build(deps-dev): bump postcss from 8.5.15 to 8.5.16 (#658 ) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/92ccc93ff15bd193491d67fad9763e62d489dfad"><code>92ccc93</code></a> Release 8.5.16 version</li> <li><a href="https://github.com/postcss/postcss/commit/818bdd6043359af773ccc3ca8663053d61a707c8"><code>818bdd6</code></a> Update formatting</li> <li><a href="https://github.com/postcss/postcss/commit/46e451068ee6160b837865b715cf6972f28fabd5"><code>46e4510</code></a> Fix <code>Input#origin()</code> returning incorrect position (<a href="https://redirect.github.com/postcss/postcss/issues/2036">#2036</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/34942ce76c0b0c9ee65b1421017ac71855e722c4"><code>34942ce</code></a> Fix tests</li> <li><a href="https://github.com/postcss/postcss/commit/d4feed645314ee421edf80ee9ebe453cc75c997f"><code>d4feed6</code></a> Don't clone root-less child nodes in container constructor (<a href="https://redirect.github.com/postcss/postcss/issues/2097">#2097</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/da323fc8d327a38199a21987dcbf7e27e3bc34f3"><code>da323fc</code></a> Revert version update to fix old Node.js on CI</li> <li><a href="https://github.com/postcss/postcss/commit/886336919497516df8f140d0fb327bd125e35053"><code>8863369</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/3828982213fec6bc13d0791b1adf40393be0935e"><code>3828982</code></a> Preserve node raws when rehydrating a JSON AST (<a href="https://redirect.github.com/postcss/postcss/issues/2100">#2100</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/d1e80b830386b08dcd5b962fd466d1c51f28e82d"><code>d1e80b8</code></a> Fix Node#rangeBy() ignoring index 0 (<a href="https://redirect.github.com/postcss/postcss/issues/2091">#2091</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/b91e4a63907325d98b75d11fda546bdd91acc608"><code>b91e4a6</code></a> Fix Node.js 26 tests</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.15...8.5.16">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for postcss since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.15&new-version=8.5.16)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-01 13:22:22 +01:00
dependabot[bot]	bb6e52f058	build(deps): bump piscina from 4.9.2 to 4.9.3 (#627 ) Bumps [piscina](https://github.com/piscinajs/piscina) from 4.9.2 to 4.9.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/piscinajs/piscina/blob/v4.9.3/CHANGELOG.md">piscina's changelog</a>.</em></p> <blockquote> <h3><a href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">4.9.3</a> (2026-06-12)</h3> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/piscinajs/piscina/commit/4440ae15037b2462549943ba9ab66da0b87f906d"><code>4440ae1</code></a> chore(release): 4.9.3</li> <li><a href="https://github.com/piscinajs/piscina/commit/8703d3e353936c05dd3386508955e0e30c2ffc57"><code>8703d3e</code></a> Merge</li> <li><a href="https://github.com/piscinajs/piscina/commit/63532c5a7595dba7647f4c521d9aed39475a6d0f"><code>63532c5</code></a> docs: Update Fastify listen() calls to use { port: 3000 } in docs and example...</li> <li><a href="https://github.com/piscinajs/piscina/commit/67591a20a78c894de9170f782a038365784874bc"><code>67591a2</code></a> chores: gh actions least privilege (<a href="https://redirect.github.com/piscinajs/piscina/issues/1013">#1013</a>) (<a href="https://redirect.github.com/piscinajs/piscina/issues/1014">#1014</a>)</li> <li><a href="https://github.com/piscinajs/piscina/commit/7c4220706fa45ff1ea629891854ef45ed0ecdc30"><code>7c42207</code></a> chore: enhance contributing guidelines (<a href="https://redirect.github.com/piscinajs/piscina/issues/972">#972</a>)</li> <li><a href="https://github.com/piscinajs/piscina/commit/04c2c52b7c7bdfd7471668d2c052848fd91d9347"><code>04c2c52</code></a> chore: pin actions (<a href="https://redirect.github.com/piscinajs/piscina/issues/848">#848</a>) (<a href="https://redirect.github.com/piscinajs/piscina/issues/850">#850</a>)</li> <li><a href="https://github.com/piscinajs/piscina/commit/d157099670fbb55a5a6f8d730d44bff131d04387"><code>d157099</code></a> [Backport v4] chore: edit ignore files (<a href="https://redirect.github.com/piscinajs/piscina/issues/826">#826</a>)</li> <li>See full diff in <a href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=piscina&package-manager=npm_and_yarn&previous-version=4.9.2&new-version=4.9.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-01 03:36:56 +01:00
Ben Sabic	e0a155e718	fix(examples): add @vercel/oidc to fix nextjs-chat Vercel build (#645 ) - The `nextjs-chat` example's generated workflow step route (`/.well-known/workflow/v1/step`) bundles `@workflow/world-vercel → @vercel/queue`, and `@vercel/queue` has an unconditional `import "@vercel/oidc"`. - `@vercel/oidc` is only a deep transitive dependency, so it isn't hoisted into the example app. Vercel's isolated build can't resolve it and fails with `Module not found: Can't resolve '@vercel/oidc'`. (It resolves locally only because pnpm symlinks it, which is why the GitHub Actions build — which excludes the example — stays green.) - Declaring `@vercel/oidc` as a direct dependency of the example fixes resolution for the bundler. No changeset needed — `example-*` packages are private and excluded from versioning. --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-06-27 08:42:13 +10:00
Ben Sabic	64b66864b1	chore(changesets): ignore all example-* packages and enforce the convention (#626 ) Replace the explicit per-example entries in the changesets `ignore` list with an `example-` name glob (matched by micromatch). All example apps are private and never published, so listing them individually only adds version and changelog churn to release PRs, and each new example required editing this CODEOWNERS-gated file. Add an integration test that resolves the changesets config against the workspace and asserts every examples/ package is in the resolved ignore list and follows the `example-*` naming convention, so an off-convention example app fails CI instead of silently leaking into releases. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-06-22 23:25:43 +10:00
Shujan Islam	f3de12823c	Added Express.js chat-sdk example project (#551 ) ## Summary Added a new example project demonstrating how to use `chat-sdk` with Express.js. Previously, there was no example showing how to integrate `chat-sdk` in a simple Express.js setup. This PR adds a minimal Express.js project with a Discord bot integration to demonstrate how `chat-sdk` can be used in a practical server-side workflow. Closes #519 ## Test plan - Ran the example project locally - Verified the Express.js server starts successfully - Verified the Discord bot connects and responds as expected - Confirmed the example demonstrates basic `chat-sdk` usage with Express.js ## Checklist - [x] All commits are signed and verified - [x] `pnpm validate` passes - [ ] Changeset added (or N/A — see [CONTRIBUTING.md](./CONTRIBUTING.md)) - [x] Documentation updated (or N/A) --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-06-20 13:15:14 +10:00
Ben Sabic	8f3af76565	feat: add `create-chat-sdk` CLI (#603 ) Adds `create-chat-sdk`, a CLI that scaffolds a Next.js Chat SDK bot project: ```bash npm create chat-sdk@latest my-bot # non-interactive npm create chat-sdk@latest -- my-bot --adapter slack redis -y ``` The user picks platform and state adapters interactively or via `--adapter`, and the CLI generates a webhook-only project with `src/lib/bot.ts`, `.env.example`, `next.config.ts`, `package.json`, and a README, then optionally runs `git init` and installs dependencies. There are no pages or client UI in the template. Adapter choices come straight from the `chat/adapters` catalog, so the CLI has no adapter registry of its own. When a coding agent such as Cursor or Claude Code runs the CLI, it uses non-interactive defaults and requires an explicit platform adapter. `--interactive` forces prompts. ## also in this pr - `google-chat` is renamed to `gchat` everywhere, including docs pages, the OG image, and adapter catalog. Old URLs redirect permanently, including language-prefixed and `/og` paths - a new docs page is available at `chat-sdk.dev/docs/create-chat-sdk`, and the CLI is promoted on the homepage, package READMEs, and agent skill - `create-chat-sdk` releases independently with a minor changeset for its initial `0.1.0` release --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: dancer <josh@afterima.ge>	2026-06-16 08:48:38 +01:00
OSS Polar Bear	b14114a714	test(slack): expand emulator coverage for emulate.dev 0.6.0 APIs (#591 ) Upgrade @emulators/* to 0.6.0 and add integration tests for DMs, reactions, fetch history, modals, scheduled messages, file uploads, member joins, and bookmarks against the in-process Slack emulator. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-06-09 12:54:30 +10:00
Ben Sabic	9b8d8c4518	Discoverability lift: link KB guides, broaden npm keywords, mirror to AGENTS.md (#560 ) Broad SEO/AEO pass across the docs site, adapter READMEs and AGENTS.md files, and npm package metadata so Chat SDK content shows up better in search engines, in LLM-driven package recommendations, and in IDE/coding-agent context. Docs site - Adds a `## Resources` section to the Getting Started and AI overview pages and to the Slack, Discord, GitHub, Liveblocks, and Sendblue adapter pages, each linking to applicable guides/templates with descriptions sourced from `resources-edge-config.json` and a cross-link back to the central `/resources` hub. Adapter packages - Mirrors the same Resources sections into the Slack, Discord, and GitHub READMEs (so they surface on npm) and into their AGENTS.md files (so coding agents see them alongside the API notes). - Expands `keywords` on every published adapter and state package — adds `chat-sdk`, `chatbot`, `ai-agent`, `ai-sdk`, `vercel`, plus platform-specific terms like `slack-bot`, `block-kit`, `slash-commands`, `github-app`, `whatsapp-business`, `state-adapter`. Resources registry - Registers four new entries in `resources-edge-config.json` (Human-in-the-Loop guide, Liveblocks AI agent guide, Slack + Vercel Blob guide, Durable iMessage Agent template) and runs `pnpm sync-resources` so the bundled `chat` package guides, `templates.json`, and `skills/chat/SKILL.md` all pick them up. - Fixes the synced Slack AI agent guide to import `toAiMessages` from `chat/ai` instead of the deprecated `chat` re-export path (the upstream KB source has also been updated, so future syncs will preserve this). Drive-by fixes - Resend adapter doc quick start: corrects `MemoryStateAdapter` class import to the `createMemoryState()` factory (matching every other adapter doc). - Zalo adapter doc: drops the "community adapter" callout that duplicated frontmatter. Tooling / CI - Adds `tsx` as a root devDependency so `pnpm sync-resources` works out of the box (it previously relied on `npx tsx`, which hung when not pre-cached). - Loosens the CI changeset gate to also skip `packages/chat/resources/` (generated data), matching the existing `*.md` carve-out. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-29 11:41:23 +10:00
josh	25ebc3b925	feat(twilio): add sms, mms, and voice helpers (#558 ) ## summary adds a first-class Twilio adapter for SMS and MMS bots, plus low-level voice helpers for custom Twilio voice routes this includes webhook parsing and signature verification, outbound Messages API helpers, phone-number and Messaging Service sending, inbound MMS attachments with authenticated `fetchData`, plain text card fallback rendering, markdown conversion, and runtime-light `api`, `webhook`, `voice`, and `format` subpaths the adapter intentionally avoids the `twilio` npm runtime dependency so apps can use the low-level helpers without pulling in the full SDK	2026-05-27 15:39:23 -07:00
dependabot[bot]	c3091eb9f9	build(deps): bump rollup from 4.54.0 to 4.60.4 (#525 ) Bumps [rollup](https://github.com/rollup/rollup) from 4.54.0 to 4.60.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.60.4</h2> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor"><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu"><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi"><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.60.2</h2> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6346">#6346</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6347">#6347</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6348">#6348</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6349">#6349</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6350">#6350</a>: fix: reset variable render names between outputs in the same generate (<a href="https://github.com/barry3406"><code>@barry3406</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6351">#6351</a>: chore(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6352">#6352</a>: chore(deps): update cross-platform-actions/action action to v1 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6353">#6353</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6354">#6354</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6355">#6355</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6356">#6356</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6358">#6358</a>: chore: remove cross-env from devDeps (<a href="https://github.com/K-tecchan"><code>@K-tecchan</code></a>)</li> </ul> <h2>v4.60.1</h2> <h2>4.60.1</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor"><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu"><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi"><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.60.3</h2> <p><em>2026-05-04</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure nested "exports" variables are not renamed (<a href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6360">#6360</a>: fix: do not rename nested "exports" bindings that do not conflict (<a href="https://github.com/tariqrafique"><code>@tariqrafique</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6364">#6364</a>: chore(deps): update msys2/setup-msys2 digest to e989830 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6365">#6365</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6366">#6366</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6367">#6367</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6368">#6368</a>: docs: add missing backticks in <code>plugin-development</code> (<a href="https://github.com/lumirlumir"><code>@lumirlumir</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/d311a84b0bb4d4a6f50d19ffd2c29cca28660c88"><code>d311a84</code></a> 4.60.4</li> <li><a href="https://github.com/rollup/rollup/commit/6aa324854482e273b711972955d2d1b3bb445bcc"><code>6aa3248</code></a> fix: stabilize chunk assignment across parallel file reads (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/82a0fe76b1372a2cf509fc4067d69f25569b83f5"><code>82a0fe7</code></a> Resolve vulnerabilities (<a href="https://redirect.github.com/rollup/rollup/issues/6375">#6375</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/71f5ebc893d7ff76b5571d63b04ea2ed4a4ddd9d"><code>71f5ebc</code></a> chore(deps): update dependency lru-cache to v11 (<a href="https://redirect.github.com/rollup/rollup/issues/6371">#6371</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/af91d778cdf564dd1ae1bfd6e92604ec031824a7"><code>af91d77</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/rollup/rollup/issues/6373">#6373</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/65e7b94ddda9f02334fa8f12ff6bf699c1f07833"><code>65e7b94</code></a> chore(deps): update react monorepo to v19 (major) (<a href="https://redirect.github.com/rollup/rollup/issues/6372">#6372</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/642587f3d9c5b4aa482a5027672f0fa8ea76da12"><code>642587f</code></a> fix(deps): update minor/patch updates (<a href="https://redirect.github.com/rollup/rollup/issues/6370">#6370</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/b47bdabeccbb7aa1b1d4117f2f4a781a9f6de297"><code>b47bdab</code></a> 4.60.3</li> <li><a href="https://github.com/rollup/rollup/commit/15c5f33083c8c6b1b2cbae548124fffbba2553bb"><code>15c5f33</code></a> Add again some unneeded dev dependencies, to make some builds succeed</li> <li><a href="https://github.com/rollup/rollup/commit/12195dcebbd21f0f2d91e26720cd053526edbfe3"><code>12195dc</code></a> fix: do not rename nested "exports" bindings that do not conflict (<a href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v4.54.0...v4.60.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-20 06:25:31 -07:00
dependabot[bot]	db61173386	build(deps-dev): bump postcss from 8.5.14 to 8.5.15 (#541 ) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to 8.5.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/eae46db765d752cf8f40c4fa2b0b85030079c43d"><code>eae46db</code></a> Release 8.5.15 version</li> <li><a href="https://github.com/postcss/postcss/commit/79508ffa59e42c02056aca61b88bc393c8b516c4"><code>79508ff</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b128e2131288a411c6e28071d0929542c49e74eb"><code>b128e21</code></a> Speed up declaration parsing by avoiding creating new array on each token</li> <li><a href="https://github.com/postcss/postcss/commit/9825dca02c33cf610e2a842be767468b67fbecf9"><code>9825dca</code></a> Fix code format</li> <li><a href="https://github.com/postcss/postcss/commit/55789c865281e2be194fa5b4e41dd046be3a2307"><code>55789c8</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/84fbbe9009cb3cc3bbb4cc3a9b65d468f4844d95"><code>84fbbe9</code></a> Install older pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/9f860bd78ec1dbc4f0ae72d693f03f956baa38cb"><code>9f860bd</code></a> Revert pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/08771986d47359545f502e009763e223b66bfcf6"><code>0877198</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b2d1a335cea818f8b27e5cfb90147648afe3e582"><code>b2d1a33</code></a> Fix linter warnings</li> <li><a href="https://github.com/postcss/postcss/commit/0700dac92283bc259977dff2743ca74a00f58267"><code>0700dac</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2088">#2088</a> from rootvector2/add-oss-fuzz-harness</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.14...8.5.15">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.14&new-version=8.5.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-20 06:01:52 -07:00
dependabot[bot]	b4f3a00821	build(deps): bump ws from 8.18.3 to 8.20.1 (#539 ) Bumps [ws](https://github.com/websockets/ws) from 8.18.3 to 8.20.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.20.1</h2> <h1>Bug fixes</h1> <ul> <li>Fixed an uninitialized memory disclosure issue in <code>websocket.close()</code> (c0327ec1).</li> </ul> <p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>) as the <code>reason</code> argument for <code>websocket.close()</code>, rather than the supported string or <code>Buffer</code> types, caused uninitialized memory to be disclosed to the remote peer.</p> <pre lang="js"><code>import { deepStrictEqual } from 'node:assert'; import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer( { port: 0, skipUTF8Validation: true }, function () { const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>, { skipUTF8Validation: true });</p> <pre><code>ws.on('close', function (code, reason) { deepStrictEqual(reason, Buffer.alloc(80)); }); </code></pre> <p>} );</p> <p>wss.on('connection', function (ws) { ws.close(1000, new Float32Array(20)); }); </code></pre></p> <p>The issue was privately reported by <a href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p> <h2>8.20.0</h2> <h1>Features</h1> <ul> <li>Added exports for the <code>PerMessageDeflate</code> class and utilities for the <code>Sec-WebSocket-Extensions</code> and <code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li> </ul> <h2>8.19.0</h2> <h1>Features</h1> <ul> <li>Added the <code>closeTimeout</code> option (<a href="https://redirect.github.com/websockets/ws/issues/2308">#2308</a>).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Handled a forthcoming breaking change in Node.js core (19984854).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li><a href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a> [dist] 8.20.0</li> <li><a href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a> [minor] Export the <code>PerMessageDeflate</code> class and header utils</li> <li><a href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a> [api] Convert the <code>isServer</code> and <code>maxPayload</code> parameters to options</li> <li><a href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a> [doc] Add missing space</li> <li><a href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a> [pkg] Update eslint to version 10.0.1</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-20 05:19:49 -07:00
dependabot[bot]	63cd869f20	build(deps-dev): bump turbo from 2.8.12 to 2.9.14	2026-05-20 02:40:28 +01:00
dependabot[bot]	39130a8898	build(deps): bump vite from 7.3.1 to 7.3.3	2026-05-20 02:35:34 +01:00
dependabot[bot]	10c58c2721	build(deps): bump path-to-regexp from 0.1.13 to 8.4.2	2026-05-20 02:25:15 +01:00
dependabot[bot]	b18e99625e	build(deps): bump lodash from 4.17.21 to 4.18.1	2026-05-20 02:24:38 +01:00
dependabot[bot]	ceb1fdfa4b	build(deps): bump minimatch from 5.1.9 to 10.2.5	2026-05-20 02:20:51 +01:00
dependabot[bot]	4139283a17	build(deps): bump picomatch from 2.3.1 to 4.0.4	2026-05-20 02:20:43 +01:00
dependabot[bot]	e4bd4a6ce8	build(deps): bump axios from 1.13.6 to 1.16.1	2026-05-20 02:20:36 +01:00
dependabot[bot]	b93ffa78a1	build(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#511 ) Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.55.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>svelte@5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> <li> <p>fix: abort running obsolete async branches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a> chore: bump devalue (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a> fix: keep dependencies of <code>$state.eager</code>/<code>pending</code> (alternative approach) (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li> <li><a href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a> fix: duplicated "of" in events.js comment (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a> fix: treat batches as a linked list (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:26:31 -07:00
dependabot[bot]	c9559c89ee	build(deps): bump next from 16.2.3 to 16.2.6 (#488 ) Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li> <li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 20:22:55 -07:00
Ben Sabic	ac8a20779c	feat(chat): add `chat/ai` subpath for AI SDK utilities (#492 ) ## Summary Introduces a dedicated `chat/ai` subpath as the home for every Vercel AI SDK helper that ships with Chat SDK. Importing from this subpath keeps the optional `ai` and `zod` peer dependencies out of bundles that don't use them. ### What's new - `createChatTools` — exposes Chat SDK operations as ready-to-use AI SDK tools so an agent can read, post, react, edit, delete, and manage thread subscriptions across every adapter the supplied `Chat` instance has registered. - Write operations require user approval by default (`requireApproval: true`); toggle globally or per-tool. - Three presets — `reader`, `messenger`, `moderator` — scope the toolset. - Individual tools can also be cherry-picked (`import { postMessage, addReaction } from "chat/ai"`). - `toAiMessages` (and the `Ai` / `ToAiMessagesOptions` types) now live alongside the tools at `chat/ai`. The previous `chat` re-exports continue to work, but are flagged `@deprecated` with an editor hint pointing to the new home — migration is a one-line import change. - Docs* — new `/docs/ai` section between Usage and Adapters in the sidebar: - `/docs/ai` — Overview - `/docs/ai/ai-sdk-tools` — `createChatTools` guide - `/docs/ai/to-ai-messages` — `toAiMessages` reference - `/docs/ai/types` — Reference for every type exported from `chat/ai` - Example app — `examples/nextjs-chat` now demos the new surface via a "Run Agent Demo" button on the welcome card and a free-form `/agent <prompt>` slash command (streaming, with a placeholder so users get immediate feedback in channel contexts where Slack's typing-status API is a no-op). ### Future plans `createChatTools` currently exposes the cross-adapter Chat SDK surface only. A natural follow-up is to also support platform-specific tools — e.g. expose Slack-only `pin`/`unpin`, Discord-only thread archiving, GitHub-only issue commenting, etc., so users can further extend what their agent can do without dropping back to raw adapter calls. The shape would likely be additional opt-in factories under `chat/ai` (or per-adapter subpaths like `@chat-adapter/slack/ai`) that return tools layered on top of the platform-specific adapter clients, while keeping the cross-platform `createChatTools` API as the lowest common denominator. ### Coverage - `createChatTools` orchestrator: 100% statements / 94.7% branches. - Every tool factory's `execute()` is exercised end-to-end (29 tests in `index.test.ts`). - `toAiMessages` keeps its existing 35-test suite covering role mapping, attachment handling, links, transforms, and unsupported-attachment fallbacks. - Tools folder overall: 99.0% statements / 86.1% branches / 97.4% functions / 98.9% lines. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: dancer <josh@afterima.ge>	2026-05-14 20:13:42 -07:00
Hugo	716e934aa2	feat(web-adapter): first class support for Vue and Svelte (#498 ) ## Summary <!-- What does this PR do? --> ## Test plan <!-- How did you verify the changes? --> ## Checklist - [ ] All commits are signed and verified - [ ] `pnpm validate` passes - [ ] Changeset added (or N/A — see [CONTRIBUTING.md](./CONTRIBUTING.md)) - [ ] Documentation updated (or N/A) --------- Co-authored-by: dancer <josh@afterima.ge>	2026-05-14 19:18:24 -07:00
Ben Sabic	cd7b6af1c8	test(integration-tests): add Emulate.dev-backed tests for the GitHub adapter (#479 ) ## Summary Add an Emulate.dev-backed integration-test suite for the GitHub adapter, mirroring the structure of the Slack work in #477. Tests drive the adapter against an in-process [`@emulators/github`](https://emulate.dev/docs/github) server and assert on its stateful store (comments, reviews) rather than `mock.calls`, catching wire-format and contract issues that pure Octokit mocks miss. - New private devDeps in `packages/integration-tests`: `@emulators/github`, `@emulators/core`, `@hono/node-server`, plus a workspace dep on `@chat-adapter/github`. (`@emulators/core` and `@hono/node-server` are also declared by #477; this PR is independent of merge order.) - New harness `packages/integration-tests/src/github-emulator-utils.ts` boots the emulator on an ephemeral `127.0.0.1` port, seeds a deterministic user / repo / issue / PR / starter review comment, and exposes a near-passthrough HTTP forwarder. No re-signing needed here. `@emulators/core`'s `WebhookDispatcher` already signs deliveries with `X-Hub-Signature-256: sha256=<hex>` exactly as the GitHub adapter expects. The harness also adds a small URL rewriter for Octokit's `pulls.createReplyForReviewComment` shortcut endpoint, translating it into the canonical review-comment POST that the emulator implements. - Four new test files (12 tests), wired to the adapter via its existing `apiUrl` + `webhookSecret` config zero source changes to `packages/adapter-github`: - `emulator-github-auth.test.ts` (2) `GET /user` populates `botUserId` during `initialize()`. - `emulator-github-comments.test.ts` (4) `thread.post` / `edit` / `delete` on issue and PR-conversation threads. - `emulator-github-reviews.test.ts` (3) review-comment replies routed through `pulls.createReplyForReviewComment` with the right \`in_reply_to_id\`, plus edit / delete. - `emulator-github-events.test.ts` (3) full inbound `issue_comment` / `pull_request_review_comment` round-trip, including bot self-message filtering. ```mermaid flowchart LR subgraph Test["Vitest test process"] SDK[GitHubAdapter + Chat] Forwarder["HTTP forwarder<br/>passthrough"] Emu["@emulators/github<br/>(in-process Hono)"] end SDK -->\|"issues.createComment / pulls.* / GET /user<br/>(apiUrl override)"\| Emu Emu -->\|"X-Hub-Signature-256 + x-github-event"\| Forwarder Forwarder -->\|"chat.webhooks.github(request)"\| SDK ``` ### Out of scope (deliberate) - Reactions `@emulators/github` does not implement the `/reactions` endpoints used by the adapter. Reaction logic is still covered by the existing mock-based tests in `packages/adapter-github/src/index.test.ts`. - GitHub App auth (JWT \u2192 installation token via `POST /app/installations/:id/access_tokens`) the adapter and emulator both support it, but PAT-mode was the agreed scope here. - Multi-tenant install flows via `installation` webhook events. - Branches/refs, releases, search, actions, checks not used by the adapter. ## Test plan - [x] `pnpm --filter @chat-adapter/integration-tests test` 407 tests pass across 34 files (including the 12 new emulator-github tests, ~480 ms total). - [x] `pnpm check` and `pnpm knip` clean. - [x] CI safety verified: ephemeral ports (`port: 0`), loopback-only binds (`127.0.0.1`), deterministic teardown via `httpServer.close()`, no env vars, no external network egress. ## Checklist - [x] All commits are signed and verified - [x] \`pnpm validate\` passes - [x] Changeset added (or N/A see [CONTRIBUTING.md](./CONTRIBUTING.md)) N/A: \`@chat-adapter/integration-tests\` is \`private: true\` and the change is test-only. - [x] Documentation updated (or N/A) \`packages/integration-tests/README.md\` describes the new emulator-github test category. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-13 07:12:55 +10:00
Ben Sabic	14b1434998	test(integration-tests): add Emulate.dev-backed tests for the Slack adapter (#477 ) * chore(integration-tests): add Emulate.dev Slack emulator devDeps Add @emulators/slack, @emulators/core, and @hono/node-server as devDependencies of the private integration-tests package. These power the upcoming in-process Slack emulator harness used to drive the Slack adapter against a stateful, Slack-shaped HTTP server instead of mocks. * test(integration-tests): add Slack emulator test harness Introduce slack-emulator-utils.ts, a test-only helper that boots the @emulators/slack Hono app on an ephemeral 127.0.0.1 port via @hono/node-server and pre-seeds a deterministic team / channel / bot / human user / OAuth app. The Slack adapter is wired to it via its existing apiUrl config; no source changes required. Also exposes startSlackWebhookForwarder, a tiny in-process Node http forwarder that re-signs the emulator's outbound event_callback deliveries with x-slack-signature / x-slack-request-timestamp before handing them to chat.webhooks.slack(...). The emulator's core WebhookDispatcher only emits GitHub-style X-Hub-Signature-256 headers, so this bridge is what makes inbound flows exercise the SDK's real HMAC verification path. The handle returns direct access to the emulator's Store and WebhookDispatcher so tests can assert on persisted state instead of mock call records. * test(integration-tests): cover Slack auth, postMessage, and reactions via emulator Add three test files that drive the SlackAdapter's outbound WebClient calls through the in-process emulator and assert on its stateful store rather than on mock call records: - emulator-slack-auth.test.ts (3 tests): auth.test populates botUserId during initialize(); explicit botUserId is respected; multi-workspace mode skips the call entirely. - emulator-slack-post-message.test.ts (5 tests): plain text and threaded thread.post round-trip into the messages collection and are visible via conversations.replies; editMessage updates via chat.update; deleteMessage removes via chat.delete; markdown posts succeed. - emulator-slack-reactions.test.ts (3 tests): addReaction / removeReaction round-trip via reactions.add / reactions.remove and show up via reactions.get; multi-user reactions accumulate correctly. These exercise the full HTTP path against a Slack-shaped server, catching wire-format and contract issues that pure mocks miss. * test(integration-tests): cover Slack inbound events and OAuth v2 install via emulator Add two test files that drive end-to-end flows previously only verifiable against real Slack: - emulator-slack-events.test.ts (4 tests): a human posts to the emulator, which dispatches an event_callback to the local forwarder, which signs the body and hands it to chat.webhooks.slack(...). The SDK's onNewMention and onNewMessage handlers run with a live Thread and the bot's reply lands back in the emulator. Bot self-messages are correctly filtered. This is the only Slack adapter test in the repo that covers the full inbound-then-outbound round-trip without hand-crafted webhook payloads. - emulator-slack-oauth.test.ts (4 tests): handleOAuthCallback exchanges a real authorization code via oauth.v2.access against the emulator's authorize/callback flow; the resulting installation is persisted in the state adapter; invalid codes and mismatched client_secrets are rejected; the freshly issued bot token works for subsequent chat.postMessage calls via withBotToken. * docs(integration-tests): document emulator-* test category Add an "Emulator tests" entry to the package README so newcomers can distinguish the new emulator-backed suite from the existing unit and replay tests, and find the harness in slack-emulator-utils.ts. * fix(integration-tests): keep full token scopes after emulator.reset() `applyTokenSeed` (used during `reset()`) was granting only ["chat:write", "channels:read"] to seeded tokens, while the initial `createCoreServer({ tokens })` call granted the full bot/human scope sets. After the first `reset()` the bot token silently lost `channels:history`, `users:read`, `reactions:read`, and `reactions:write`, which would surface as flaky behaviour for any test that relied on those scopes after a reset. Unify both call sites on a single `buildTokenSeedEntries` helper so fresh-boot and post-reset state always grant the same scopes. Add a regression test in emulator-slack-auth.test.ts that triggers a manual `emulator.reset()` and re-asserts that the bot token still resolves via auth.test. * refactor(integration-tests): reorganize Slack emulator tests under emulator/slack/ Address review feedback (visyat) by moving the flat `emulator-slack-.test.ts` files into a per-adapter directory: packages/integration-tests/src/emulator/slack/ utils.ts auth.test.ts events.test.ts oauth.test.ts post-message.test.ts reactions.test.ts This scales cleanly as more adapter emulator suites land (e.g. `emulator/github/`), instead of cluttering the top-level src tree with adapter-prefixed file names. Also hoist the duplicated `silentLogger` definition from each test file into the shared `utils.ts`, removing five identical copies. No behavior changes. All 20 emulator tests still pass. test(integration-tests): cover Slack multi-workspace token resolution via emulator Add `emulator/slack/multi-workspace.test.ts` exercising the path that was previously only covered by replay/mock-based tests: the adapter runs without a hardcoded `botToken`, multiple workspaces are persisted in the state adapter via `adapter.setInstallation(teamId, ...)`, and inbound `event_callback`s for either team are routed to the correct per-tenant bot token end-to-end against the shared emulator. To make this work, the helper grew two small additions: - `addEmulatorWorkspace(emulator, seed)` — register an additional team + bot + channel + token on an already-booted emulator, so two tenants live side-by-side without needing two emulator instances. - The inbound forwarder's `augmentEventEnvelope` now accepts an optional `resolveTeamId(envelope)` callback, defaulting to a constant teamId for the existing single-workspace tests. The multi-workspace test passes a resolver that looks up the dispatched event's channel in the emulator store and returns the owning team's id, so the SDK's per-team token resolver sees the right `team_id` on the envelope. Three new tests: team-A routing, team-B routing, and `getInstallation` returning null for unknown team ids. Follow-up from review feedback on PR #477. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-12 08:29:02 +10:00
dependabot[bot]	41139a42ff	build(deps): bump mermaid from 11.12.2 to 11.15.0 (#486 ) Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.12.2 to 11.15.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.2...mermaid@11.15.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-12 08:04:39 +10:00
Felix Arntz	06fb8e59ef	chore: set up `konsistent` with basic initial config for package, adapter, and state adapter conventions (#466 ) * set up konsistent with basic initial config * add konsistent to CI * fix konsistent.json formatting * fix(gchat): move GoogleChatAdapterConfig to ./types for konsistent * fix(slack): move SlackAdapterConfig to ./types and drop Partial wrapper from createSlackAdapter * fix(messenger): name createMessengerAdapter parameter MessengerAdapterConfig * fix(web): rename WebAdapterOptions to WebAdapterConfig and import Adapter type in index.ts * fix(whatsapp): align WhatsAppAdapterConfig and creator with konsistent + map kebab to PascalCase * fix(state-memory): add MemoryStateAdapterOptions type for konsistent * fix(state-ioredis): unify URL and client options under IoRedisStateAdapterOptions * fix(state-redis): unify URL and client options under RedisStateAdapterOptions * fix(state-pg): unify URL and client options under PostgresStateAdapterOptions * chore: changeset for konsistent convention alignment * chore: drop CHANGELOG.md from konsistent's required files list CHANGELOG.md is generated automatically by changesets on each release — it's never hand-authored and doesn't exist for a package until its first release lands. Requiring it as a convention check makes CI fail indefinitely for any newly added package, with no honest fix available (an empty placeholder is just noise that gets overwritten on first release). * docs: document konsistent and package shape conventions * fix(web): use WebAdapterConfig in WebAdapter field types after main merge The merge of main into konsistent brought in PR #475's `protected` field modifiers on top of the WebAdapterOptions → WebAdapterConfig rename, leaving two stale references to the (un-imported) old name. Switch them to WebAdapterConfig and update a stale JSDoc reference in als.ts to match. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com>	2026-05-11 19:29:05 +10:00
Ben Sabic	0adf3adef6	feat(tests): add @chat-adapter/tests test kit (#470 ) * feat(tests): add @chat-adapter/tests test kit New package providing Vitest factories, custom matchers, and a setup file for people building Chat SDK adapters and bots. Factories: createMockAdapter, createMockChatInstance, createMockState (with working in-memory subscriptions/locks/KV/queues), createTestMessage, mockLogger / createMockLogger. Matchers: toHavePosted(threadId, textPattern?), toHaveDispatched(handler), toBeSubscribedTo(threadId). Auto-register via the '@chat-adapter/tests/setup' subpath in vitest setupFiles. chat and vitest are peer dependencies. Adapter-specific helpers (e.g. signed Slack webhook builders) belong in each adapter's own /testing subpath, not in this kit. * test(integration-tests): allow @chat-adapter/tests imports in README check * docs: add Testing page covering @chat-adapter/tests New content/docs/testing.mdx walks bot authors and custom-adapter authors through the kit's factories, custom matchers, and setup file. Added under the Usage section in the sidebar, after error-handling. Cross-link from contributing/testing.mdx clarifying that the hand-rolled patterns there are for repo contributors building first-party adapters, while consumers of Chat SDK should use @chat-adapter/tests. * test(integration-tests): allow @chat-adapter/tests imports in docs check * fix(tests): match real Adapter.postMessage signature in toHavePosted Adapter.postMessage is (threadId: string, message: AdapterPostableMessage) — previously the matcher read args[0] as { id: string } and args[1] as { text: string }, neither of which match the actual SDK shape. The matcher's own tests fed the same wrong shape into the mock so they passed locally while the matcher silently failed against any real bot or adapter. Now compares args[0] as a string threadId, and extracts a comparable string from AdapterPostableMessage's union — strings directly, PostableMarkdown .markdown, PostableRaw.raw, and PostableCard.fallbackText. PostableAst and fallback-less cards aren't text-matchable; documented in the JSDoc. Tests updated to call postMessage with the real signature and to cover each comparable AdapterPostableMessage shape. * test(tests): add smoke tests driving matchers against a real Chat Construct a real `Chat` with a `createMockAdapter` + `createMockState` and exercise `Chat.thread().post()` and `.subscribe()` end-to-end. The matchers (toHavePosted, toBeSubscribedTo) then assert against the actual call shape the SDK uses, so a future signature drift breaks here instead of silently agreeing with whatever wrong shape lives in the unit tests. This is the regression guard for the postMessage-shape bug fixed in the prior commit: each new matcher in subsequent PRs should be paired with a smoke case here. * feat(tests): round out adapter mutation matchers Adds toHaveEdited, toHaveDeleted, toHaveReactedWith, toHaveStartedTyping, and toHavePostedToChannel — covering the common Adapter mutation surface that bot authors assert on. Each matcher's signature was checked against packages/chat/src/types.ts, and each is paired with a smoke case that drives a real Chat through the corresponding Thread/Channel API so signature drift breaks the smoke test instead of silently agreeing with the unit tests. Emoji matching accepts both plain strings and EmojiValue ({ name }). Text matching reuses the same extraction rules as toHavePosted — strings, PostableMarkdown.markdown, PostableRaw.raw, and PostableCard.fallbackText. Documented in matcher JSDoc, README, and the Testing docs page. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-09 14:17:36 +10:00
Ben Sabic	2de905cb0c	fix: regenerate pnpm-lock.yaml after merge conflict (#462 ) Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-08 17:40:23 +10:00
josh	c1cd9b5da1	feat(chat): add callbackUrl to buttons and modals (#454 ) * 1 * wfw * 4224 * dfe * wip * f * 22 * tsts * more * ch * dc * t * tm * docs * ex * k * cs * lock * test(chat): expand callbackUrl coverage * docs: document callbackUrl handling for adapter authors * docs: expand changeset for callbackUrl feature * docs(skill): mention callbackUrl on Button and Modal * feat(example): add modal callbackUrl workflow demo * test(integration): add replay tests for callbackUrl flows --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-05-08 17:26:18 +10:00
Vishal Yathish	68025ca965	[messenger] add messenger (meta) platform adapter to chat sdk (#461 ) * [messenger] add messenger (meta) platform adapter to chat sdk - Webhook handling with HMAC-SHA256 signature verification - Generic and Button template support for cards - Postback, reaction, delivery/read confirmation handling - Message caching for fetchMessages (Messenger has no history API) - Replay tests and ~98% code coverage Co-authored-by: Dimitar K. Nikolov <mitkodkn@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Fix: The `@chat-adapter/messenger` package version is `4.15.0` while all other packages in the Changesets fixed version group are at `4.27.0`, breaking the fixed versioning contract. This commit fixes the issue reported at packages/adapter-messenger/package.json:3 Bug explanation: The repository uses Changesets with a `"fixed"` configuration: `[["chat", "@chat-adapter/"]]`. This means all packages matching these patterns must always share the same version number. Every package in the group (`chat`, `@chat-adapter/discord`, `@chat-adapter/gchat`, `@chat-adapter/github`, `@chat-adapter/linear`, `@chat-adapter/shared`, `@chat-adapter/slack`, `@chat-adapter/teams`, `@chat-adapter/telegram`, `@chat-adapter/web`, `@chat-adapter/whatsapp`, and the state packages) is at version `4.27.0`, except `@chat-adapter/messenger` which is at `4.15.0`. This is likely because the messenger adapter was newly added to the monorepo (copied from a template or created fresh) and its version was never aligned with the rest of the fixed group. This mismatch will cause problems with the Changesets release workflow — when Changesets tries to bump versions for the fixed group, it may produce inconsistent or errored releases because one package is 12 minor versions behind the others. Fix explanation:* Changed `"version": "4.15.0"` to `"version": "4.27.0"` in `packages/adapter-messenger/package.json` to align it with all other packages in the fixed version group. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> * Fix: Messenger adapter env var guard only checks `FACEBOOK_APP_SECRET` but `createMessengerAdapter` requires all three env vars, causing a `ValidationError` crash at Next.js build time when only `FACEBOOK_APP_SECRET` is set. This commit fixes the issue reported at examples/nextjs-chat/src/lib/adapters.ts:154 Bug Analysis: The build failure is confirmed in the Vercel build log with: ``` Error [ValidationError]: pageAccessToken is required. Set FACEBOOK_PAGE_ACCESS_TOKEN or provide it in config. ``` The root cause is in `examples/nextjs-chat/src/lib/adapters.ts` at line ~154. The messenger adapter guard only checks for `FACEBOOK_APP_SECRET`: ```typescript if (process.env.FACEBOOK_APP_SECRET) { ``` However, `createMessengerAdapter` (in `packages/adapter-messenger/src/index.ts`) validates and throws `ValidationError` for each of three required env vars: `FACEBOOK_APP_SECRET`, `FACEBOOK_PAGE_ACCESS_TOKEN`, and `FACEBOOK_VERIFY_TOKEN`. When only `FACEBOOK_APP_SECRET` is set in the Vercel project environment, the guard passes, `createMessengerAdapter` is called, and it throws a `ValidationError` for the missing `FACEBOOK_PAGE_ACCESS_TOKEN`. Since this code runs at module evaluation time during the Next.js build's "Collecting page data" phase, the uncaught error crashes the entire build. This is inconsistent with other adapters in the same file. For example, the WhatsApp adapter checks both `WHATSAPP_ACCESS_TOKEN` and `WHATSAPP_PHONE_NUMBER_ID`, and the gchat/github/linear/whatsapp adapters all wrap creation in try-catch blocks. Fix: 1. Updated the env var guard to check all three required environment variables (`FACEBOOK_APP_SECRET`, `FACEBOOK_PAGE_ACCESS_TOKEN`, and `FACEBOOK_VERIFY_TOKEN`) before attempting to create the adapter. 2. Wrapped the `createMessengerAdapter` call in a try-catch block (matching the pattern used by gchat, github, linear, and whatsapp adapters) so that any unexpected validation errors are caught and logged as warnings instead of crashing the build. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> --------- Co-authored-by: Dimitar K. Nikolov <mitkodkn@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>	2026-05-08 17:25:54 +10:00
dependabot[bot]	3e4764db4d	build(deps-dev): bump postcss from 8.5.10 to 8.5.11 (#451 ) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.11. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.10...8.5.11) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.11 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-05 17:33:20 -07:00
Ben Sabic	3490a8c84c	feat: add @chat-adapter/web — browser chat UI for chat-sdk bots (#444 ) * feat(chat): expose awaitable Promise from processMessage Return the inner task as Promise<void> instead of void so streaming adapters can await full handler completion and surface user-handler rejections at the wire level. waitUntil semantics for existing webhook adapters are unchanged — the SDK still tracks the work with errors swallowed (and logged) so platforms don't retry on handler bugs. Required by @chat-adapter/web, whose response body is the user handler's stream. * feat(adapter-web): add @chat-adapter/web package A new platform adapter that lets a chat-sdk bot serve a browser chat UI alongside Slack/Teams/Discord/etc. without writing any client-side glue. Speaks the AI SDK UI message stream protocol, so @ai-sdk/react's useChat and the ai-elements component library work out of the box. - `@chat-adapter/web` — server: createWebAdapter({ userName, getUser }) - `@chat-adapter/web/react` — client: useChat() preconfigured with DefaultChatTransport against /api/chat (override via `api`) Defaults that matter for v1: - `isDM: true` — every web message routes through onDirectMessage - `persistMessageHistory: true` — chat-sdk caches each turn in the configured state adapter so handlers can read prior context via thread.messages / channel.messages (no platform history API exists) - channelId === threadId — web has no separate channel concept; this prevents cross-conversation bleed when a single user has multiple useChat sessions - Native `adapter.stream` implementation pumps text-deltas straight onto the SSE response — no post+edit fallback Out of scope for v1: cards/JSX rendering, reactions, modals, file uploads, edit/delete, multi-tab proactive push. * feat(example-nextjs-chat): wire up web adapter and add /chat page - Register the web adapter in lib/adapters.ts with a demo getUser (single shared identity — replace with NextAuth/Clerk/cookie auth in production) - Expose POST /api/chat backed by bot.webhooks.web (using next/after for waitUntil) - Add a minimal /chat page using @chat-adapter/web/react's useChat — same bot.onDirectMessage handler that powers Slack now powers the browser too Bumps `ai` to ^6.0.174 to align with @ai-sdk/react@^3 (avoids dual provider-utils versions in the workspace). * docs: list @chat-adapter/web in registry - Add an entry to adapters.json so the package shows up on /adapters - Add a globe SVG to lib/logos.tsx and wire it into the icon map - Mention the new adapter in docs/adapters.mdx * feat(adapter-web): tighten request handling and message construction - Reject user ids containing ':' with HTTP 400 — the character would corrupt the thread-id round-trip through decodeThreadId - Skip emitting text-start/text-end in postMessage when the resolved text is empty so useChat doesn't render blank assistant bubbles - Derive the parseMessage author from raw.role so rehydrated assistant messages report the bot identity instead of "unknown" - Drop the duplicate handler-error log; chat.processMessage already logs at ERROR level - Document the actual persistMessageHistory default (true) and the state-cache rationale; promote the fetchMessages no-op rationale into its JSDoc * test(adapter-web): add direct coverage for stream() - Aborting request.signal mid-stream short-circuits the iterator and still writes text-end via the finally block - Non-text StreamChunks (task_update, plan_update) are dropped without emitting any delta - The SentMessage returned from thread.post matches the id used in text-start / text-end events * docs(adapter-web): expand README into the full adapter docs page The docs site renders each adapter's README, so flesh out @chat-adapter/web to match the depth of @chat-adapter/slack: authentication boundary, threading semantics, streaming, persistence, React hook reference, configuration table, feature matrix, and troubleshooting. * docs(adapter-web): drop unsupported provider import from streaming example * fix(adapter-web): validate conversationId for reserved colon character * fix(example): show error state in web chat demo * fix(example): add thinking indicator to web chat demo * feat(example): redesign web chat demo with tailwind * chore: remove redundant changeset --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: dancer <josh@afterima.ge>	2026-05-05 15:55:40 -07:00
dependabot[bot]	de55c1e217	build(deps-dev): bump postcss from 8.5.6 to 8.5.10 (#424 ) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.10. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.10) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-27 12:25:41 -07:00
Aamir Jawaid	885a4717c9	Bump Teams SDK to 2.0.8, use User-Agent header (#415 ) * Bump Teams SDK to 2.0.8 and switch to User-Agent header Co-Authored-By: Claude <noreply@anthropic.com> * fix(teams): remove unused ts-expect-error after SDK 2.0.8 upgrade --------- Co-authored-by: dancer <josh@afterima.ge>	2026-04-23 17:22:36 +01:00
Ben Sabic	e8c4b1a6c4	docs: update adapter docs (#412 ) * docs: update adapter docs * docs: update adapter docs * docs: update adapter docs --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-04-22 13:28:20 +10:00
Sergei Patrikeev	b9a1961aa5	fix(telegram): MarkdownV2 rendering + telegram-chat reference example (#407 ) * fix(telegram): switch parse_mode from legacy Markdown to MarkdownV2 The Telegram adapter hardcoded `parse_mode: "Markdown"` (legacy) but rendered messages via the SDK's generic `stringifyMarkdown()`, which emits standard markdown. Two incompatible dialects glued together: - Standard markdown uses `bold`, Telegram legacy uses `bold` - Legacy Markdown has no escape rules — any message with `.`, `!`, `(`, `)`, `-`, `_` in unexpected positions was rejected with `can't parse entities`, which is virtually every LLM-generated response - Legacy Markdown is deprecated by Telegram and lacks support for underline, strikethrough, spoiler, and blockquote This commit: - Switches TELEGRAM_MARKDOWN_PARSE_MODE to "MarkdownV2" - Replaces fromAst() with a proper AST → MarkdownV2 renderer: - Single `bold`, `_italic_`, `~strike~` markers - Context-aware escaping: 20-char matrix for normal text, only `` ` `` and `\` inside code blocks, only `)` and `\` inside link URLs - Headings rendered as bold (MarkdownV2 has no heading syntax) - Ordered/unordered lists with escaped dashes and periods - Blockquotes with per-line `>` prefix - Tables pre-empted and rendered as ASCII code blocks - Explicit handlers for reference-style links, images, HTML, and definitions so nothing is silently dropped - Routes card fallback text through `fromMarkdown` (not raw escape) with `boldFormat: "*"` — @chat-adapter/shared's cardToFallbackText defaults `boldFormat` to "" (Slack mrkdwn), which would render as italic on Telegram. Explicit "*" keeps the card title rendered as real MarkdownV2 bold. - Fixes resolveParseMode so every message routed through the format converter (`{markdown}`, `{ast}`, cards, JSX) gets `parse_mode: "MarkdownV2"`. Previously only `{markdown}` and cards were covered, so `{ast}` messages shipped without parse_mode and rendered asterisks literally. - Documents inbound vs outbound dialects on applyTelegramEntities / escapeMarkdownInEntity (inbound entities → standard markdown) versus the new outbound MarkdownV2 renderer, so future contributors don't confuse the two. Tests: full 20-char MarkdownV2 escape matrix, context-escape tests for code blocks and link URLs, nested-formatting tests, edge cases (empty, whitespace-only, raw HTML), and an end-to-end LLM-output corpus test that asserts MarkdownV2 validity (no unescaped special chars outside entities or code blocks). Regression guards added in index.test.ts for the AST / plain-string / raw parse_mode paths and for card-title MarkdownV2 bold rendering. Fixes #226 feat(examples): add telegram-chat reference bot Polling-mode Telegram bot that exercises the adapter end-to-end: MarkdownV2 rendering, interactive cards with inline keyboards, reactions, file uploads, and streaming edits. Runs with a single `pnpm --filter example-telegram-chat start`; no webhook, no public URL, no external API keys. Menu structure — three categorized sub-menus reached from any DM text: - Text & Markdown: plain, inline emphasis, code block, links, list+table, 20-char torture string, LLM-style corpus, streaming editMessage loop - Cards & Actions: interactive approval card (edits in-place on press), callback_data size probe demonstrating the 64-byte limit, LinkButton - Media & Reactions: on-demand reaction one-shot (briefly subscribes), generated 1×1 PNG upload, generated minimal PDF upload Zero new runtime deps. PNG/PDF are hand-rolled in memory (lib/png.ts, lib/pdf.ts) rather than pulled from a binary-processing library. Failure handling is consistent: every demo runner is try/catch-wrapped and posts an inline ❌ line with the error message. Excluded from npm release via .changeset/config.json. * fix(telegram): produce valid MarkdownV2 when truncating long messages The MarkdownV2 migration widened a latent truncation bug into a reliable 400. The previous truncator sliced at 4096/1024 chars and appended literal "..." — but in MarkdownV2 `.` is a reserved character, the slice can leave an orphan trailing `\`, and it can cut through a paired entity (`bold`, `` `code` ``) leaving it unclosed. Unify the two truncate methods into one `truncateForTelegram(text, limit, parseMode)` that appends `\.\.\.` for MarkdownV2 and walks back past unbalanced entity delimiters or orphan backslashes. Plain text keeps literal `...`. Adds 8 length-limit tests. Related cleanup: - Move MarkdownV2 string utilities and Bot API limits to markdown.ts. - Type renderMarkdownV2 exhaustively on mdast's `Nodes` union with a `never` assertion so new node kinds fail the build. Replaces the hand-rolled `AstNode` interface. Adds explicit cases for table / tableRow / tableCell (throw — preprocessed by fromAst), footnoteDefinition, footnoteReference, yaml. - Introduce `TelegramParseMode = "MarkdownV2" \| "plain"` replacing `string \| undefined`. `toBotApiParseMode` handles the wire mapping. - Re-export `Nodes` from the chat package; re-export `TelegramReactionType` from the adapter entry. * feat(examples): add length-limit demos to telegram-chat reference bot Three new menu entries exercise the MarkdownV2 truncation path that the prior commit fixed: - Long (5000 plain) — basic truncation, verifies escaped `\.\.\.` ellipsis - Long (bold crosses 4096) — entity-balancing heuristic for unclosed `` - Long (code crosses 4096) — entity-balancing heuristic for unclosed `` ` `` Each button posts a message whose rendered length exceeds Telegram's 4096-char limit and would have produced `can't parse entities` 400s against the previous truncator. Serves as an interactive smoke test alongside the unit tests in packages/adapter-telegram. test(telegram): add unit tests for truncation helpers and MarkdownV2 boundary trimming * docs(telegram): update README to reflect MarkdownV2 parse mode * chore: unexport trimToMarkdownV2SafeBoundary to fix knip --------- Co-authored-by: dancer <josh@afterima.ge>	2026-04-21 05:27:47 -07:00
Hayden Bleasel	7e90d9c8fa	Add Slack Socket Mode support (#162 ) * Add slack/socket mode dependency * Update config types and SlackAdapter class * Add socket mode methods, extract interactive dispatch * Update createSlackAdapter factory function * Write tests for socket mode * Create slack-socket-mode.md * Run fix * Fix polynomial regex issues * Fix: Floating promises in `routeSocketEvent` for slash commands and interactive payloads can cause unhandled promise rejections that crash the Node.js process. This commit fixes the issue reported at packages/adapter-slack/src/index.ts:1152 Bug Analysis: In `routeSocketEvent` (line 1150), which is a synchronous `void` method, two async operations produce floating promises: 1. `this.handleSlashCommand(params)` (line 1165) - `handleSlashCommand` is `async` and always returns a `Promise<Response>`. It calls `await this.lookupUser(userId)` which internally calls `await this.chat.getState().get()` (before the try/catch around the API call), and `this.chat.processSlashCommand()`. Any of these could throw. 2. `this.dispatchInteractivePayload(payload)` (line 1172) - Returns `Response \| Promise<Response>`. When the payload type is `view_submission`, it delegates to `async handleViewSubmission()`, which calls `await this.chat.processModalSubmit()` and accesses `payload.view.state.values` (which could throw on malformed payloads). Since `routeSocketEvent` is synchronous (`void` return type) and called from a sync context within the socket mode event handler (after `await ack()` has already completed), these returned promises are fire-and-forget. If any reject, it triggers an unhandled promise rejection, which in Node.js 15+ terminates the process by default. In contrast, in the webhook code path (`handleWebhook`), these same methods are always `return`-ed from async functions, so their promises are properly chained to the caller. Fix: Added `.catch()` handlers to both floating promises: 1. For `handleSlashCommand`: Added `.catch()` that logs the error via `this.logger.error`. 2. For `dispatchInteractivePayload`: Since it returns `Response \| Promise<Response>` (only a Promise for `view_submission`), used `instanceof Promise` to conditionally attach a `.catch()` handler only when the result is a Promise. This approach was chosen over making `routeSocketEvent` async because: (a) it doesn't change the method signature, (b) the caller doesn't need to await it (the ack has already been sent), and (c) errors are logged rather than silently swallowed. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: haydenbleasel <hello@haydenbleasel.com> * Add socket mode forwarding support to Slack adapter - Export SlackForwardedSocketEvent type - Add x-slack-socket-token check at top of handleWebhook() for forwarded events - Update routeSocketEvent() to accept WebhookOptions and use waitUntil - Add startSocketModeListener(), runSocketModeListener(), forwardSocketEvent() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add tests for socket mode forwarding - Forwarded event accepted/rejected based on appToken - Bypasses signature verification for forwarded events - Options passthrough to handlers - startSocketModeListener returns 200/500 appropriately Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add socket mode cron route and vercel config - New /api/slack/socket-mode route using createPersistentListener - Mirrors Discord gateway pattern (CRON_SECRET auth, Redis coordination) - Cron runs every 9 min, listener duration 10 min Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix signingSecret defaulting to empty string in socket mode Make signingSecret optional (string \| undefined) instead of falling back to "". verifySignature now returns false when no secret is configured, preventing HMAC with an empty key from silently passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Wrap event_callback in try-catch in routeSocketEvent Sync errors from processEventPayload were silently dropped in socket mode. Wrap with try-catch for parity with slash_commands and interactive cases. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Use dedicated socketForwardingSecret for forwarding auth Stop using the Slack app-level token (xapp-...) as the bearer token for HTTP forwarding. Adds socketForwardingSecret config option (auto-detected from SLACK_SOCKET_FORWARDING_SECRET) with fallback to appToken for backwards compatibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Replace double cast with type guard for socket event body Validate body.event exists and construct a properly typed SlackWebhookPayload instead of using `as unknown as`. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Internalize SlackForwardedSocketEvent type Remove export — only used internally by the forwarding mechanism. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix formatting in socketForwardingSecret check Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add socket mode documentation to Slack adapter README Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(slack): use SDK envelope type for socket mode event routing * fix(slack): pass interactive response through ack in socket mode * feat(chat): add clear modal response action to close entire view stack * chore: update changeset for clear modal action --------- Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: dancer <josh@afterima.ge>	2026-04-20 08:09:26 -07:00
Ben Sabic	051245c4b0	feat(docs): add Resources page powered by Edge Config (#393 ) * feat(docs): add Resources page powered by Edge Config Add a /resources page that displays guides and templates in a 3-column card grid. Data is fetched from Vercel Edge Config in production and from a local JSON file in development. Includes CollectionPage JSON-LD markup and revalidates daily. * fix(docs): handle Edge Config unavailability on resources page * feat(docs): add keywords metadata to resources page * feat(docs): add twitter card metadata to resources page --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>	2026-04-16 22:42:04 +10:00
dependabot[bot]	bf9a2a43ce	build(deps): bump next from 16.1.7 to 16.2.3 (#362 ) Bumps [next](https://github.com/vercel/next.js) from 16.1.7 to 16.2.3. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/compare/v16.1.7...v16.2.3) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-14 15:18:07 +10:00
Aamir Jawaid	4f5d20029f	Add modal support for Teams (#325 ) * feat(teams): add dialog (task module) support Teams dialogs require modal content to be returned inline in the HTTP response when a task/fetch invoke fires. This adds: - `actionType: "modal"` on buttons to emit msteams task/fetch hint - `onOpenModal` hook on WebhookOptions for inline modal interception - dialog.open/dialog.submit handlers in Teams adapter with Promise.race - Modal-to-AdaptiveCard converter (modals.ts) - Bridge adapter sends empty body (not "{}") for dialog close responses Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor(teams): use @microsoft/teams.cards builders for Adaptive Cards Replace hand-rolled plain JSON objects and local type definitions with typed builder classes from @microsoft/teams.cards. This gives compile-time type safety and eliminates the local AdaptiveCard/AdaptiveCardElement/ AdaptiveCardAction interfaces. Also fix ephemeral modal button missing actionType="modal", which prevented the dialog from opening on Teams. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(teams): preserve contextId in modal update/push responses Pass the original contextId through to re-rendered modals so subsequent submissions can still retrieve the stored thread/message/channel context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: address review feedback across dialog support - Clean up timeout timer in handleDialogOpen to prevent resource leak - Also race on actionPromise so errors surface instead of silently timing out - Extract buildContinueResponse helper to deduplicate update/push cases - Use typed TextInputOptions/ChoiceSetInputOptions instead of Record<string, unknown> - Make processSlashCommand options parameter explicit (WebhookOptions \| undefined) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(chat): await storeModalContext before opening modal The state write was fire-and-forget, so a fast dialog.submit could arrive before the context was persisted, causing retrieveModalContext to return empty. Also adds changeset for the new public API surface. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(chat): add missing disabled prop to ButtonProps JSX interface The ButtonElement and ButtonOptions already supported disabled, but the JSX ButtonProps interface was missing it, causing <Button disabled> to silently drop the prop. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback for dialog support - Add unit tests for modals.ts (16 tests) and modal button actionType in cards.test.ts - Make dialog open timeout configurable via dialogOpenTimeoutMs in TeamsAdapterConfig - Fix ModalSubmitHandler type to accept Promise<void> returns, remove @ts-expect-error from example - Delete stored modal context after retrieval to prevent state adapter leaks Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: lint fixes and add X-User-Agent header to Teams adapter - Fix import ordering, formatting, and non-null assertions in modals.test.ts - Sort interface members in TeamsAdapterConfig - Add X-User-Agent: Vercel.ChatSDK header to Teams SDK App client Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-07 13:09:25 +10:00

1 2

94 Commits