mirror of
https://github.com/vercel/chat.git
synced 2026-09-14 18:32:29 +08:00
@chat-adapter/web@4.35.0
99 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 christopherkindl
|
1d0295f996 |
chore(docs): upgrade geistdocs to 1.15.5 (#743)
- Upgrade `@vercel/geistdocs` to 1.15.5 - New navbar flyout menu style + nav items in flyout menu are rendered server-side to be in the html for crawlers (as requested by Malte) - Homepage section titles use Geist sans heading tokens (new vercel.com style) | **New flyout menu** | **Improved docs mobile layout** | | ------------- | ------------- | | <video src="https://github.com/user-attachments/assets/7baf37d9-7a87-4853-91fb-6c3febf974cb" /> | <img width="499" height="747" alt="image" src="https://github.com/user-attachments/assets/b48a955e-0e15-4e03-ada2-fbc52c2fdcb7" /> | **Preview:** https://chat-git-chore-geistdocs-1155.vercel.sh/ |
||
|
Utopia
|
5eb8b846a7 |
feat(teams): support outbound reactions (#734)
Outbound Teams reactions were originally implemented as part of #302, then removed because the Teams feature was not fully rolled out. In [the follow-up discussion](https://github.com/vercel/chat/pull/302#issuecomment-4147056867), the Teams SDK maintainer said they were happy to add the support back once the rollout was ready. Microsoft now documents agent reaction support without a preview caveat. This PR restores that support against the current Teams SDK API: - implement `addReaction` and `removeReaction` with `conversations.addReaction` / `conversations.deleteReaction` - pass native Teams reaction IDs through unchanged and map common normalized Chat SDK emoji names to their Teams IDs - upgrade the aligned `@microsoft/teams.*` dependencies to 2.0.14 - update the Teams feature matrices and add a minor changeset The implementation stays within the existing adapter methods and does not add another abstraction or affect streaming behavior. --------- Signed-off-by: Utopia <154325211+Utopi-a@users.noreply.github.com> |
||
|
dependabot[bot]
|
b4a93bdbc5 |
build(deps-dev): bump @hono/node-server from 2.0.2 to 2.0.10 (#733)
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 2.0.2 to 2.0.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/node-server/releases">@hono/node-server's releases</a>.</em></p> <blockquote> <h2>v2.0.10</h2> <h2>Security fixes</h2> <p>This release includes a fix for the following security issue:</p> <h3>Unauthenticated memory-leak DoS via aborted WebSocket handshake</h3> <p>Affects: <code>upgradeWebSocket</code>. A WebSocket upgrade request with a missing or malformed <code>Sec-WebSocket-Key</code> header leaked the request's <code>IncomingMessage</code> and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. <a href="https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg">GHSA-9mqv-5hh9-4cgg</a></p> <hr /> <p>Users of <code>upgradeWebSocket</code> are encouraged to upgrade to this version.</p> <h2>v2.0.9</h2> <h2>What's Changed</h2> <ul> <li>fix(websocket): polyfill missing ErrorEvent global by <a href="https://github.com/otnc"><code>@otnc</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li> <li>fix(serve-static): correct Range header parsing edge cases by <a href="https://github.com/otnc"><code>@otnc</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/372">honojs/node-server#372</a></li> <li>fix: recover complete request bodies after client disconnect by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/375">honojs/node-server#375</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/otnc"><code>@otnc</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9">https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9</a></p> <h2>v2.0.8</h2> <h2>What's Changed</h2> <ul> <li>ci(release): add <code>--no-git-checks</code> option for <code>pnpm stage publish</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/369">honojs/node-server#369</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8">https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8</a></p> <h2>v2.0.7</h2> <h2>What's Changed</h2> <ul> <li>chore: migrate to pnpm by <a href="https://github.com/BlankParticle"><code>@BlankParticle</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/367">honojs/node-server#367</a></li> <li>fix(serve-static): serve precompressed files for application/octet-stream by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/366">honojs/node-server#366</a></li> <li>chore: bump <code>supertest</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/368">honojs/node-server#368</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7">https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7</a></p> <h2>v2.0.6</h2> <h2>What's Changed</h2> <ul> <li>ci: publish to npm from CI with OIDC trusted publishing and bump <code>np</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/361">honojs/node-server#361</a></li> <li>ci: use npm Staged publishing by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/364">honojs/node-server#364</a></li> <li>fix: preserve status and statusText when cloning a Response with liveheaders by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/363">honojs/node-server#363</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6">https://github.com/honojs/node-server/compare/v2.0.5...v2.0.6</a></p> <h2>v2.0.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/node-server/commit/7c1457ed5536c02fdd2f001129fae67bcbca54a1"><code>7c1457e</code></a> 2.0.10</li> <li><a href="https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1"><code>3a21938</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/node-server/commit/98420217e53a17a238ef1aa1a6bef0b2b70136c5"><code>9842021</code></a> 2.0.9</li> <li><a href="https://github.com/honojs/node-server/commit/51f3bf56f56d9691ec0f7e1562a96f0b485a7dd9"><code>51f3bf5</code></a> fix: recover complete request bodies after client disconnect (<a href="https://redirect.github.com/honojs/node-server/issues/375">#375</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/fdb87badbe313cfbfe6bb2355e9893dc0698d2bd"><code>fdb87ba</code></a> fix(serve-static): correct Range header parsing edge cases (<a href="https://redirect.github.com/honojs/node-server/issues/372">#372</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/912e3fd80c4311756f724bd566de1433c8d772d9"><code>912e3fd</code></a> fix(websocket): polyfill missing ErrorEvent global (<a href="https://redirect.github.com/honojs/node-server/issues/371">#371</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/114c15efb38dabaf81af774ddb764409e3d156d8"><code>114c15e</code></a> 2.0.8</li> <li><a href="https://github.com/honojs/node-server/commit/5db2d5df662cd69ff5c4cc23b8ecb3a6f63e4e38"><code>5db2d5d</code></a> ci(release): add <code>--no-git-checks</code> option for <code>pnpm stage publish</code> (<a href="https://redirect.github.com/honojs/node-server/issues/369">#369</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/a528a77ed2c28dc12775c849abc6b6df6d4cb44c"><code>a528a77</code></a> 2.0.7</li> <li><a href="https://github.com/honojs/node-server/commit/b2d610c1e37a96639fbb2eae662e858800aa8906"><code>b2d610c</code></a> chore: bump <code>supertest</code> (<a href="https://redirect.github.com/honojs/node-server/issues/368">#368</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/node-server/compare/v2.0.2...v2.0.10">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@hono/node-server</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ben Sabic
|
4cb7e5d58e |
feat(chat): durable human-in-the-loop approvals via chat/workflow (#728)
Adds a `chat/workflow` subpath export with `requestApproval()`. This is the DX from #284, rebuilt on Workflow SDK so the approval survives deploys, restarts, and arbitrarily long waits. No in-memory promises, no approvals registry, no restart-recovery machinery: the workflow suspends on a webhook and resumes when a button is clicked. `requestApproval()` posts a card with Approve/Deny buttons whose `callbackUrl` targets a `createWebhook()` URL, suspends the workflow until a decision (or optional durable-sleep timeout), validates approvers, finalizes the card in place with the outcome (removing the buttons, leaving an audit trail), and returns the decision. ```typescript import { requestApproval } from "chat/workflow"; import type { Thread } from "chat"; export async function deployApproval(opts: { thread: Thread; version: string }) { "use workflow"; const { approved, user, timedOut } = await requestApproval(opts.thread, { title: `Deploy ${opts.version}?`, fields: { Version: opts.version }, timeout: "24h", approvers: ["U_ALICE", "U_BOB"], }); if (approved) { await deploy(opts.version); } } ``` Starting it from a handler is one line. `Thread` instances serialize across the workflow boundary automatically via the existing `@workflow/serde` hooks on `ThreadImpl` (requires `chat.registerSingleton()`): ```typescript import { start } from "workflow/api"; bot.onNewMention(async (thread, message) => { await start(deployApproval, [{ thread, version: parseVersion(message.text) }]); }); ``` **Details** - `workflow` is a new **optional** peer dependency (same pattern as `ai`); the subpath is the only code that imports it - Unauthorized clicks (when `approvers` is set) and unrecognizable payloads post a notice / are ignored, and the workflow keeps waiting - On timeout the card is finalized as timed out and the result has `timedOut: true` - Card builders (`buildApprovalCard`, `buildResolvedCard`) are exported for custom flows - Verified the published `dist` preserves the `"use step"` directives and down-levels `using` correctly, so the app-side Workflow SDK compiler handles the library code - Docs page under Interactivity; changeset (`chat` minor); 8 unit tests mocking the `workflow` primitives **Deliberate deviation from #284:** no `thread.requestApproval()` method. The function must suspend at workflow level, so hanging it off `ThreadImpl` would make `workflow` a hard dependency of core (or require prototype patching). The standalone `requestApproval(thread, options)` keeps the dependency optional. --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Rich Haines
|
d616072f45 |
chore(docs): update @vercel/geistdocs to 1.13.0 (#727)
## Summary - update the Chat SDK docs app to `@vercel/geistdocs` 1.13.0 - use the package-owned Tailwind sources introduced since 1.10.0 - align docs content spacing and breadcrumb visibility with the new container-responsive sidebar https://chat-git-chore-update-geistdocs.vercel.sh/docs ## Testing - `pnpm install --force --frozen-lockfile` - `pnpm --filter docs exec tsc --noEmit` - `pnpm --filter docs build` - `pnpm exec turbo typecheck --filter='!example-nuxt-chat'` - `pnpm exec turbo test --filter='!example-nextjs-chat' --filter='!docs' --filter='!example-nuxt-chat'` - production route smoke tests for HTML, `.md`, `Accept: text/markdown`, agent requests, `llms.txt`, `sitemap.md`, `agents.md`, and `/api/search` - desktop and mobile browser checks with no runtime errors or horizontal overflow `pnpm validate` is locally blocked by the unrelated `example-nuxt-chat` `oxc-parser` native resolution failure; all remaining workspace typechecks and tests pass. Upstream release: https://github.com/vercel/geistdocs/pull/160 Signed-off-by: molebox <rich@vercel.com> |
||
|
C. T. Lin
|
6714efc3a1 |
feat: support AI SDK v7 (ai@7) as a peer dependency (#691)
Closes #690 ## What Widens the AI SDK peer dependency ranges so the Chat SDK installs cleanly next to `ai@7`: - `chat`: `ai@^6.0.182 || ^7.0.0` - `@chat-adapter/web`: `ai@^6 || ^7`, `@ai-sdk/react@^3 || ^4`, `@ai-sdk/svelte@^4 || ^5`, `@ai-sdk/vue@^3 || ^4` This also unbreaks `create-chat-sdk` scaffolds, which install `ai@latest` (now v7) next to `chat` and currently hit a peer conflict out of the box. ## The one real v6 → v7 break In v7, `tool()` with an `execute` function returns `ExecutableTool<Tool<...>>` — an internal type from `@ai-sdk/provider-utils` that `ai` does not re-export. The `chat/ai` tool factories relied on inference, so declaration emit failed with TS2742 (17 errors). The factories now declare explicit `Tool<Input, Output>` return types, which is exactly the shape the previously published `.d.ts` already had — the public type surface is unchanged, and the emitted declarations only reference types from `ai` (portable for consumers on either major). Everything else checked out compatible: - v7 stream parts keep `text-delta` / `finish-step` shapes, so `fromFullStream` duck-typing works unchanged; `fullStream` remains as a deprecated alias - tool-level `needsApproval` is deprecated in v7 but still typed and honored - `createUIMessageStream`, `createUIMessageStreamResponse`, `isTextUIPart`, `UIMessage`, `UIMessageStreamWriter`, `ChatInit`, `DefaultChatTransport` all still exported — `@chat-adapter/web` needed zero source changes ## Other changes - devDependencies move to v7 so the workspace develops/tests against the latest major - `examples/nextjs-chat` and `examples/nuxt-chat` move to `ai@^7` (required — mixing majors across the workspace fails typecheck, since `chat`'s d.ts resolves `ai` types from its own devDependency) - Test-only: the `ToolExecutionOptions` stub type is now derived from `Tool["execute"]` because v7 made the generic parameter required - Changeset included (minor for `chat` and `@chat-adapter/web`) ## Verification The same source was verified against **both majors** (`ai@6.0.182` and `ai@7.0.17`): `tsc --noEmit` and the full test suites (`chat`: 1035 tests, `@chat-adapter/web`: 21 tests) pass on each. `pnpm validate` (knip + check + typecheck + test + build, including both examples) is green on v7. Note for adopters: `ai@7` itself requires Node.js ≥ 22 and is ESM-only; `chat` keeps `engines.node >= 20` since `ai` is an optional peer. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: chentsulin <chentsulin@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: dancer <josh@afterima.ge> |
||
|
damianborowy-nexos
|
1721fa01e7 |
feat(slack): add Slack Agent messaging experience (agent_view) support (#684)
## Summary
Add support for Slack's Agent messaging experience (`agent_view`), the
2026 replacement for `assistant_view`.
## Core (`chat`)
- New `onAppContextChanged` event carrying the active-view context as a
normalized `AppContextEntity[]` (`channel` / `canvas` / `list` /
`message` / `unknown`) describing what the user is currently viewing.
- `AppHomeOpenedEvent` now carries:
- the same folded active-view context as optional `entities`
- the opened `tab` (`"home"` / `"messages"`), so handlers can
distinguish a Home-tab open from the DM-open signal under `agent_view`
## Slack adapter (`@chat-adapter/slack`)
- **`agentView` config flag.** Under `agent_view`:
- `app_home_opened` is the DM-open signal and fires regardless of tab
(branch on `event.tab` if you also publish a Home view)
- DM messages are threaded per Slack's new model — each user message is
a thread root (`thread_ts ?? ts`)
- conversation-scoped threads returned by `openDM()` keep working: when
that thread is subscribed, incoming top-level DM messages route to it,
so `onSubscribedMessage` and per-thread state behave the same as in
legacy mode
- **`app_context_changed` routing** with normalized entities. Malformed
payloads degrade gracefully: a missing `context` yields `entities: []`,
and entities with a null/malformed `value` normalize to `kind:
"unknown"` — never a webhook 500.
- **`getAppContext(message)`** helper to read the folded active-view
context off a DM message.
- **`setSuggestedPrompts`** accepts an optional thread reference
(`agent_view` lets prompts sit at the top of the agent conversation).
- **Env auth fallback now keys off auth fields**: `SLACK_BOT_TOKEN` /
`SLACK_CLIENT_ID` / `SLACK_CLIENT_SECRET` fallback is disabled only when
an auth-related field (`botToken`, `clientId`, `clientSecret`,
`installationProvider`) is passed explicitly, rather than by the
presence of any config object. This lets non-auth options compose with
env auth — e.g. `createSlackAdapter({ agentView: true })` picks up env
credentials — and matches the semantics documented in the adapter's
AGENTS.md. *(Behavior change for callers passing non-auth-only configs
while relying on env vars being ignored.)*
- Bumped `@slack/web-api` to `^7.18.0` (adds the optional `thread_ts`
typing for `setSuggestedPrompts`).
## Docs
- New "Agent messaging experience" section on the Slack adapter page
(config, manifest snippet, threading model, openDM bridge).
- "Handling active-view context" section in handling-events, plus
`tab`/`entities` rows on the app-home event table.
- Callout: under `agent_view`, bot replies are threaded per user
message, so `conversations.history` only returns the user's side of a DM
— build AI conversation history from transcripts instead of channel
history.
## Example app (`examples/nextjs-chat`)
- Plain `SLACK_BOT_TOKEN` adapter branch (previously Slack was only
wired via Vercel Connect).
- DM AI history built from transcripts instead of channel history (see
docs callout above); assistant turns persisted.
- The `dm me` trigger regex now matches mention text, which carries the
`@bot` prefix on Slack.
## Test plan
- `pnpm validate` and `pnpm konsistent` pass.
- Unit tests cover the new events, entity normalization (including
malformed payloads), `agent_view` DM threading, the openDM subscription
bridge, `tab` passthrough, `setSuggestedPrompts` thread handling, and
env-fallback behavior; an integration replay test exercises the full
webhook flow.
- Verified manually against a live `agent_view` workspace:
`onAppContextChanged` entities, folded context on `app_home_opened` and
DM messages, `tab` values for both tabs, per-message DM threading, the
openDM subscription bridge, and signed malformed-payload replays (all
return 200).
- Legacy regression pass with `agentView` off: conversation-scoped DM
threading, Home-tab-only `app_home_opened`, mention flow unchanged.
### Slack references
- Agent messaging experience:
https://docs.slack.dev/changelog/2026/06/30/agent-messages-tab/
- Active-view context:
https://docs.slack.dev/changelog/2026/07/02/app-context/
## Checklist
- [x] All commits are signed and verified
- [x] All commits are signed off for the DCO (`git commit -s`)
- [x] `pnpm validate` passes
- [x] Changeset added
- [x] Documentation updated
---------
Signed-off-by: Damian Borowy <301205838+damianborowy-nexos@users.noreply.github.com>
Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
|
||
|
Rich Haines
|
1dff4515e2 |
refactor(docs): migrate chat-sdk.dev to @vercel/geistdocs (#686)
## Summary Migrates `apps/docs` from locally-copied geistdocs runtime code to the published [`@vercel/geistdocs`](https://www.npmjs.com/package/@vercel/geistdocs) package (1.8.2), following the official [migration guide](https://preview.geistdocs.com/docs/migration). Net **−8,400 lines**. ### Package-backed now - Docs page + layouts: `createDocsPage`, `GeistdocsDocsLayout`, `GeistdocsHomeLayout` (JSON-LD + sr-only markdown hints preserved via `renderTop`) - Navbar (OSS product switcher via `navbarOssProducts`), footer, provider, search dialog, page actions (edit source, feedback, copy page, Ask AI, open-in-chat, scroll top) - `/api/search` → `createSearchRoute`, `/api/chat` → `createChatRoute` (AI SDK v6; AI Gateway default, optional `GEISTDOCS_CHAT_PROXY_URL`) - `llms.mdx` → `createDocsMarkdownRoute`, `sitemap.md` → `createSitemapMarkdownRoute` (now includes an **Adapters** section) - **New**: `/agents.md` via `createAgentsRoute`, backed by a new `agent` readiness config - `proxy.ts` → `createProxy` with explicit `markdownRoutes` for `/docs` → `llms.mdx` and `/adapters` → `adapters.mdx` (adds AI-agent UA rewrites) - CSS: `@vercel/geistdocs/styles.css` + slim local overrides (shadcn tokens for remaining `components/ui`, body tint, prose inline code, `#nd-*` tweaks); code blocks now use the geist Shiki theme - Icons/logos from `@vercel/geistdocs/assets/*`; feedback via the package action (same geistdocs.com endpoint + `siteId`) ### Kept local by design - Curated `/llms.txt` index + `/llms-full.txt` corpus — the published `AGENTS.md`/SKILL.md artifacts and integration tests reference this exact contract - The adapters section (README fetching, OG images, JSON-LD, feature matrices, `adapters.mdx` markdown route) — now rendered inside the package docs layout - RSS and OG image routes (app-owned per the migration guide) - Skipped `/.well-known/mcp.json`: no MCP servers configured, and the proxy matcher must keep excluding `.well-known` for the served agent-skills files ### Cleanup - Deleted local copies: `components/geistdocs/*` chrome, `components/ai-elements/*`, chat hooks/persistence, feedback server actions, unused shadcn primitives, geistcn logo/icon fallbacks covered by package assets - Removed 13 now-unused deps (`ai@5`, `@ai-sdk/react@2`, `dexie`, `jotai`, `cmdk`, `vaul`, `mermaid`, `nanoid`, `react-player`, `use-stick-to-bottom`, `@orama/tokenizers`, `dexie-react-hooks`, `next-themes`) - Updated `docs-llms.test.ts` proxy assertions to the `createProxy` markdown-route shape ### Behavior changes to be aware of - Code blocks use the geist Shiki theme instead of GitHub light/dark - Ask AI history is no longer persisted in IndexedDB (package owns the panel) - Adapters sidebar uses the standard geistdocs tree rendering instead of the bespoke grouped sidebar - Per-page markdown output appends the standard geistdocs footer links (`/sitemap.md`, `/llms.txt`, `/agents.md`) ## Test plan - `pnpm validate` green (knip + check + typecheck + test + build) - Smoke-tested against `next build && next start`: `/`, `/docs`, `/adapters`, `/agents.md`, `/llms.txt`, `/llms-full.txt`, `/sitemap.md`, page-level `.md` URLs for both docs and adapters, `Accept: text/markdown` negotiation, search API, JSON-LD, sr-only markdown hints, edit-source URLs (`apps/docs/content/docs/{path}`), OSS navbar, page actions - Verified compiled CSS chunks contain the home grid, Shiki palette, and geist utilities (note: stale turbopack dev caches from before this change can serve incomplete CSS — `rm -rf apps/docs/.next` fixes it) ## Checklist - [x] All commits are signed and verified - [x] All commits are signed off for the DCO (`git commit -s`) - [x] `pnpm validate` passes - [x] Changeset added (or N/A — docs app + tests only, no package behavior change) - [x] Documentation updated (or N/A) --------- Signed-off-by: molebox <rich@vercel.com> |
||
|
josh
|
ef2542c5fd |
feat(x): add X (Twitter) adapter (#682)
## summary
new `@chat-adapter/x` adapter for X (Twitter), built on the X API v2 and
the X Activity API. write bot logic once and reply to mentions, hold DM
conversations, post from the account, and like posts, like the other
Chat SDK adapters
what it supports:
- reply to public mentions (`post.mention.create`) and top-level posts
via `channel.post`
- send and receive direct messages (`dm.received` / `dm.sent`)
- edit and delete owned posts, delete own DM events
- likes as the only reaction (`emoji.heart` or `"like"`)
- buffered streaming: accumulates an LLM stream and posts once instead
of post+edit churn on a public timeline
- OAuth 2.0 user context with managed token refresh (rotating refresh
token persisted in the state adapter, optional AES-256-GCM encryption)
- webhook CRC and `x-twitter-webhooks-signature` verification
key design decisions:
- DMs are threaded by the other participant's user id (`x:dm:{userId}`)
because X DM webhooks carry no conversation id, only participants
- OAuth 2.0 only at runtime: DM send and read are verified to work on
OAuth 2.0 user tokens, so no OAuth 1.0a in the adapter (subscription and
webhook setup is one-time and handled in the X developer console)
- parsers were written against real captured payloads: mentions use the
v2 shape (author hydrated in `includes.users`), DMs use the legacy
Account Activity shape (`direct_message_events`,
`message_create.message_data`, a `users` map, and no conversation id)
also includes the `chat/adapters` catalog entry, docs page, CLI scaffold
spec, and `sample-messages.md` with real captured payloads
<details><summary>usage</summary>
```typescript
import { Chat } from "chat";
import { createXAdapter } from "@chat-adapter/x";
const bot = new Chat({
userName: "mybot",
adapters: { x: createXAdapter() },
});
bot.onNewMention(async (thread, message) => {
await thread.post(`hi @${message.author.userName}!`);
});
bot.onDirectMessage(async (thread) => {
await thread.post("hello from X");
});
```
</details>
## test plan
- adapter unit tests pass against the real captured payload shapes, with
regression tests for author-from-`includes` (mentions) and the legacy
`direct_message_events` shape (DMs)
- real captured `post.mention.create` and `dm.received` payloads
verified end-to-end through `handleWebhook`: signature verification,
routing, author resolution, and participant threading, plus
bad-signature rejection returns 401
- every write and read path fired live against the X API through the
adapter: top-level post, reply to a mention, like and unlike, edit,
delete, DM send, DM read, DM delete
- OAuth 2.0 managed token refresh exercised live (access and refresh
token rotation)
---------
Signed-off-by: dancer <josh@afterima.ge>
|
||
|
dependabot[bot]
|
5267669563 |
build(deps): bump nuxt from 4.3.1 to 4.4.7 (#680)
Bumps [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) from 4.3.1 to 4.4.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nuxt/nuxt/releases">nuxt's releases</a>.</em></p> <blockquote> <h2>v4.4.7</h2> <blockquote> <p>4.4.7 is a security hotfix release.</p> </blockquote> <p>👉 make sure to check <a href="https://github.com/nuxt/nuxt/security/advisories">https://github.com/nuxt/nuxt/security/advisories</a> to view open advisories resolved by this release.</p> <h2>👉 Changelog</h2> <p><a href="https://github.com/nuxt/nuxt/compare/v4.4.6...v4.4.7">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li><strong>nitro:</strong> Assign <code>noSSR</code> before deciding payload extraction (<a href="https://redirect.github.com/nuxt/nuxt/pull/35108">#35108</a>)</li> <li><strong>vite:</strong> Avoid filtering out dirs with shared prefix from <code>allowDirs</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/35112">#35112</a>)</li> <li><strong>nuxt:</strong> Use resolve from <code>pathe</code> for buildCache path boundary check (<a href="https://redirect.github.com/nuxt/nuxt/pull/35111">#35111</a>)</li> <li><strong>nuxt:</strong> Prevent sibling-directory traversal in test component wrapper (<a href="https://redirect.github.com/nuxt/nuxt/pull/35110">#35110</a>)</li> <li><strong>nitro:</strong> Pass event data to <code>isValid</code> in dev clipboard-copy listener (<a href="https://redirect.github.com/nuxt/nuxt/pull/35109">#35109</a>)</li> <li><strong>nuxt:</strong> Validate protocols in <code>reloadNuxtApp</code> path before reload (<a href="https://redirect.github.com/nuxt/nuxt/pull/35115">#35115</a>)</li> <li><strong>vite:</strong> Prefix public asset virtuals with null byte (<a href="https://github.com/nuxt/nuxt/commit/9e303b438">9e303b438</a>)</li> <li><strong>nuxt:</strong> Re-run <code>getCachedData</code> after initial fetch (<a href="https://redirect.github.com/nuxt/nuxt/pull/35122">#35122</a>)</li> <li><strong>nuxt:</strong> Propagate <code>useFetch</code>/<code>useAsyncData</code> factory types (<a href="https://redirect.github.com/nuxt/nuxt/pull/35133">#35133</a>)</li> <li><strong>vite:</strong> Close vite dev server on nuxt close (<a href="https://github.com/nuxt/nuxt/commit/a10a68abc">a10a68abc</a>)</li> <li><strong>kit,nuxt:</strong> Handle cancelling prompts to install packages (<a href="https://github.com/nuxt/nuxt/commit/e84813229">e84813229</a>)</li> <li><strong>kit:</strong> Avoid excluding node-context files in legacy tsconfig (<a href="https://redirect.github.com/nuxt/nuxt/pull/35152">#35152</a>)</li> <li><strong>nuxt:</strong> Handle missing payload in chunkError listener (<a href="https://redirect.github.com/nuxt/nuxt/pull/35155">#35155</a>)</li> <li><strong>nuxt:</strong> Await in-lifght template generation when closing nuxt (<a href="https://redirect.github.com/nuxt/nuxt/pull/35181">#35181</a>)</li> <li><strong>nuxt:</strong> Clarify page and layout usage warnings (<a href="https://redirect.github.com/nuxt/nuxt/pull/35184">#35184</a>)</li> <li><strong>webpack:</strong> Surface compilation errors when stats.toString is empty (<a href="https://github.com/nuxt/nuxt/commit/073b07851">073b07851</a>)</li> <li><strong>nuxt:</strong> Reject prototype-chain keys in the island registry (<a href="https://redirect.github.com/nuxt/nuxt/pull/35205">#35205</a>)</li> <li><strong>nuxt:</strong> Apply <code>isScriptProtocol</code> guard to <code>navigateTo</code> open option (<a href="https://redirect.github.com/nuxt/nuxt/pull/35206">#35206</a>)</li> <li><strong>nuxt:</strong> Prevent server-only page island from recursing via <code><NuxtPage></code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/35198">#35198</a>)</li> <li><strong>rspack,webpack:</strong> Require loopback host when missing same-origin signals (<a href="https://redirect.github.com/nuxt/nuxt/pull/35200">#35200</a>)</li> <li><strong>nitro:</strong> Gate chrome devtools workspace endpoint to local requests (<a href="https://redirect.github.com/nuxt/nuxt/pull/35201">#35201</a>)</li> <li><strong>nuxt:</strong> Escape props in <code><NuxtClientFallback></code> ssr output (<a href="https://redirect.github.com/nuxt/nuxt/pull/35199">#35199</a>)</li> <li><strong>kit:</strong> Improve TS extension stripping/substitutions (<a href="https://redirect.github.com/nuxt/nuxt/pull/35233">#35233</a>)</li> <li><strong>nuxt:</strong> Preserve <code>.d.mts</code>/<code>.d.cts</code> in <code>resolveTypePaths</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/35235">#35235</a>)</li> <li><strong>nuxt:</strong> Escape <code><NoScript></code> slot content (<a href="https://github.com/nuxt/nuxt/commit/4b054e9d9">4b054e9d9</a>)</li> <li><strong>nuxt:</strong> Match route rules case-insensitively to mirror <code>vue-router</code> (<a href="https://github.com/nuxt/nuxt/commit/07e39cd6f">07e39cd6f</a>)</li> <li><strong>nuxt:</strong> Reject script-capable protocols in <code><NuxtLink></code> href (<a href="https://github.com/nuxt/nuxt/commit/0103ce06f">0103ce06f</a>)</li> <li><strong>nuxt:</strong> Block path-normalization open redirect in <code>navigateTo</code> (<a href="https://github.com/nuxt/nuxt/commit/2cce6fb02">2cce6fb02</a>)</li> <li><strong>nuxt:</strong> Reject cross-origin paths in <code>reloadNuxtApp</code> (<a href="https://github.com/nuxt/nuxt/commit/e447a793c">e447a793c</a>)</li> <li><strong>vite:</strong> Bind vite-node IPC to a permissioned filesystem socket (<a href="https://github.com/nuxt/nuxt/commit/1f9f4767a">1f9f4767a</a>)</li> </ul> <h3>💅 Refactors</h3> <ul> <li><strong>kit,nuxt,vite:</strong> Use <code>es2023</code> array methods (<a href="https://redirect.github.com/nuxt/nuxt/pull/34980">#34980</a>)</li> <li><strong>nuxt:</strong> Replace <code>runInNewContext</code> with AST walker (<a href="https://github.com/nuxt/nuxt/commit/d72a89ef4">d72a89ef4</a>)</li> </ul> <h3>📖 Documentation</h3> <ul> <li>Document vite client and server options (<a href="https://redirect.github.com/nuxt/nuxt/pull/35090">#35090</a>)</li> <li>Add dedicated module dependencies page (<a href="https://redirect.github.com/nuxt/nuxt/pull/35171">#35171</a>)</li> <li>Add nodeTsConfig and sharedTsConfig options (<a href="https://redirect.github.com/nuxt/nuxt/pull/35231">#35231</a>)</li> <li>Edit for clarity and grammar (<a href="https://redirect.github.com/nuxt/nuxt/pull/35214">#35214</a>)</li> </ul> <h3>🏡 Chore</h3> <ul> <li>Use <code>execFileSync</code> for safety in release scripts (<a href="https://github.com/nuxt/nuxt/commit/1d7baaf01">1d7baaf01</a>)</li> <li>Assert there is always a tag (<a href="https://github.com/nuxt/nuxt/commit/e98c47c3c">e98c47c3c</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nuxt/nuxt/commit/b7d57903b947e788fadfcfdf88be7951943731bf"><code>b7d5790</code></a> v4.4.7</li> <li><a href="https://github.com/nuxt/nuxt/commit/dbc58965ca7ffa21d7cc4207a4c40a62e0762f4a"><code>dbc5896</code></a> chore: lint</li> <li><a href="https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1"><code>e447a79</code></a> fix(nuxt): reject cross-origin paths in <code>reloadNuxtApp</code></li> <li><a href="https://github.com/nuxt/nuxt/commit/d72a89ef451965a8a1abb58d3bd6eab4865631a0"><code>d72a89e</code></a> refactor(nuxt): replace <code>runInNewContext</code> with AST walker</li> <li><a href="https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d"><code>2cce6fb</code></a> fix(nuxt): block path-normalization open redirect in <code>navigateTo</code></li> <li><a href="https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3"><code>0103ce0</code></a> fix(nuxt): reject script-capable protocols in <code>\<NuxtLink></code> href</li> <li><a href="https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb"><code>07e39cd</code></a> fix(nuxt): match route rules case-insensitively to mirror <code>vue-router</code></li> <li><a href="https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e"><code>4b054e9</code></a> fix(nuxt): escape <code>\<NoScript></code> slot content</li> <li><a href="https://github.com/nuxt/nuxt/commit/03d83bfab531b27fbc1dac7cdea9227b3707476e"><code>03d83bf</code></a> fix(nuxt): preserve <code>.d.mts</code>/<code>.d.cts</code> in <code>resolveTypePaths</code> (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35235">#35235</a>)</li> <li><a href="https://github.com/nuxt/nuxt/commit/46960b2b18e79d64f212b2b77d879b3f88ab72cb"><code>46960b2</code></a> fix(nuxt): escape props in <code>\<NuxtClientFallback></code> ssr output (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/35199">#35199</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nuxt/nuxt/commits/v4.4.7/packages/nuxt">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ben Sabic
|
ac5a54ee1d |
test(adapters): adopt shared @chat-adapter/tests factories and matchers (#674)
Wires `@chat-adapter/tests` as a devDependency and registers its matchers via `setupFiles: ["@chat-adapter/tests/setup"]` across all 11 platform adapters, then replaces bespoke local `mockLogger`/`createMockState`/`createMockChatInstance` with the shared factories and adopts `toHaveDispatched`/`not.toHaveDispatched` where clean. - 10 adapters migrated (gchat, messenger, teams, whatsapp, telegram, discord, twilio, linear, github, slack). Positional `createMockChatInstance(...)` call sites converted to the options API (slack 100, linear 35). - `web` left as-is — its suite uses the real `Chat`/`createMemoryState` for e2e, so the shared factories don't apply. - Platform SDK mocks (Octokit, WebClient, socket-mode, `@linear/sdk`, `fetch`) and the Phase 1 `connectWebhookContract` descriptors are left intact. Net ~−540 lines of duplicated test scaffolding. Stacked on #673. Tests-only, no changeset. --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
840c0d16e9 |
test(adapters): migrate Vercel Connect webhook tests to connectWebhookContract (#673)
Adopts the shared `connectWebhookContract` from `@chat-adapter/tests` in the Slack, GitHub, and Linear suites, replacing the bespoke `webhookVerifier` blocks (verifier pass → 200, throw/falsy → 401, invoked with request + raw body, precedence over a native secret). Adapter-specific Connect tests are kept (token resolvers, GitHub bot-id capture, type-level mutual exclusivity, 400-on-invalid-JSON, Linear identity/`withInstallation`). Each descriptor keeps `initialize()` network-free (GitHub `botUserId`, Slack `_botUserId` to skip `auth.test`, Linear stubs `resolveConnectIdentity`). Twilio is intentionally not included — it has a single generic `webhookVerifier` usage with no 200/401 gating suite to migrate. First of three stacked test-generalization PRs. Tests-only, no changeset. Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
03d274283f |
feat(examples): add nuxt-chat example app (#609)
Adds `examples/nuxt-chat`, a Nuxt 4 reference app for Chat SDK scoped to
the Slack and web adapters.
The Nitro server exposes `/api/webhooks/{platform}` for Slack events and
`/api/chat` for the browser UI, with H3-to-Fetch conversion that
preserves the raw request body for signature verification. Bot handlers
are ported from `nextjs-chat` — interactive cards, modals, slash
commands, transcripts, reactions, and AI streaming — without the
workflow demos.
The `/chat` page is a client-only Vue UI using `@chat-adapter/web/vue`
and the AI SDK. A Slack app manifest ships with the scopes and events
needed for pins, reactions, channel joins, and interactivity.
Monorepo plumbing covers changeset ignore, CI build exclusion,
`AGENTS.md`, knip entry paths for the Nuxt 4 `app/` directory, and biome
globals for Nitro auto-imports.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
|
||
|
Ben Sabic
|
ba687cb13c |
docs(slack): document Vercel Connect support (#648)
Documents authenticating the Slack adapter with Vercel Connect via `connectSlackAdapter()` from `@vercel/connect/chat`. The Slack adapter already supports a `botToken` resolver and a `webhookVerifier`, so this is a documentation-only change (no changeset). Stacked on #647 (base `vercel-connect/base`). ## Companion `@vercel/connect/chat` subpath: vercel/vercel#16826. <img width="824" height="527" alt="CleanShot 2026-06-30 at 12 03 26" src="https://github.com/user-attachments/assets/cbced069-8913-4848-9cf1-df0e5f614353" /> --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
dependabot[bot]
|
df825b3a56 |
build(deps-dev): bump postcss from 8.5.15 to 8.5.16 (#658)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/92ccc93ff15bd193491d67fad9763e62d489dfad"><code>92ccc93</code></a> Release 8.5.16 version</li> <li><a href="https://github.com/postcss/postcss/commit/818bdd6043359af773ccc3ca8663053d61a707c8"><code>818bdd6</code></a> Update formatting</li> <li><a href="https://github.com/postcss/postcss/commit/46e451068ee6160b837865b715cf6972f28fabd5"><code>46e4510</code></a> Fix <code>Input#origin()</code> returning incorrect position (<a href="https://redirect.github.com/postcss/postcss/issues/2036">#2036</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/34942ce76c0b0c9ee65b1421017ac71855e722c4"><code>34942ce</code></a> Fix tests</li> <li><a href="https://github.com/postcss/postcss/commit/d4feed645314ee421edf80ee9ebe453cc75c997f"><code>d4feed6</code></a> Don't clone root-less child nodes in container constructor (<a href="https://redirect.github.com/postcss/postcss/issues/2097">#2097</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/da323fc8d327a38199a21987dcbf7e27e3bc34f3"><code>da323fc</code></a> Revert version update to fix old Node.js on CI</li> <li><a href="https://github.com/postcss/postcss/commit/886336919497516df8f140d0fb327bd125e35053"><code>8863369</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/3828982213fec6bc13d0791b1adf40393be0935e"><code>3828982</code></a> Preserve node raws when rehydrating a JSON AST (<a href="https://redirect.github.com/postcss/postcss/issues/2100">#2100</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/d1e80b830386b08dcd5b962fd466d1c51f28e82d"><code>d1e80b8</code></a> Fix Node#rangeBy() ignoring index 0 (<a href="https://redirect.github.com/postcss/postcss/issues/2091">#2091</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/b91e4a63907325d98b75d11fda546bdd91acc608"><code>b91e4a6</code></a> Fix Node.js 26 tests</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.15...8.5.16">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for postcss since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
bb6e52f058 |
build(deps): bump piscina from 4.9.2 to 4.9.3 (#627)
Bumps [piscina](https://github.com/piscinajs/piscina) from 4.9.2 to 4.9.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/piscinajs/piscina/blob/v4.9.3/CHANGELOG.md">piscina's changelog</a>.</em></p> <blockquote> <h3><a href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">4.9.3</a> (2026-06-12)</h3> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/piscinajs/piscina/commit/4440ae15037b2462549943ba9ab66da0b87f906d"><code>4440ae1</code></a> chore(release): 4.9.3</li> <li><a href="https://github.com/piscinajs/piscina/commit/8703d3e353936c05dd3386508955e0e30c2ffc57"><code>8703d3e</code></a> Merge</li> <li><a href="https://github.com/piscinajs/piscina/commit/63532c5a7595dba7647f4c521d9aed39475a6d0f"><code>63532c5</code></a> docs: Update Fastify listen() calls to use { port: 3000 } in docs and example...</li> <li><a href="https://github.com/piscinajs/piscina/commit/67591a20a78c894de9170f782a038365784874bc"><code>67591a2</code></a> chores: gh actions least privilege (<a href="https://redirect.github.com/piscinajs/piscina/issues/1013">#1013</a>) (<a href="https://redirect.github.com/piscinajs/piscina/issues/1014">#1014</a>)</li> <li><a href="https://github.com/piscinajs/piscina/commit/7c4220706fa45ff1ea629891854ef45ed0ecdc30"><code>7c42207</code></a> chore: enhance contributing guidelines (<a href="https://redirect.github.com/piscinajs/piscina/issues/972">#972</a>)</li> <li><a href="https://github.com/piscinajs/piscina/commit/04c2c52b7c7bdfd7471668d2c052848fd91d9347"><code>04c2c52</code></a> chore: pin actions (<a href="https://redirect.github.com/piscinajs/piscina/issues/848">#848</a>) (<a href="https://redirect.github.com/piscinajs/piscina/issues/850">#850</a>)</li> <li><a href="https://github.com/piscinajs/piscina/commit/d157099670fbb55a5a6f8d730d44bff131d04387"><code>d157099</code></a> [Backport v4] chore: edit ignore files (<a href="https://redirect.github.com/piscinajs/piscina/issues/826">#826</a>)</li> <li>See full diff in <a href="https://github.com/piscinajs/piscina/compare/v4.9.2...v4.9.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ben Sabic
|
e0a155e718 |
fix(examples): add @vercel/oidc to fix nextjs-chat Vercel build (#645)
- The `nextjs-chat` example's generated workflow step route (`/.well-known/workflow/v1/step`) bundles `@workflow/world-vercel → @vercel/queue`, and `@vercel/queue` has an unconditional `import "@vercel/oidc"`. - `@vercel/oidc` is only a deep transitive dependency, so it isn't hoisted into the example app. Vercel's isolated build can't resolve it and fails with `Module not found: Can't resolve '@vercel/oidc'`. (It resolves locally only because pnpm symlinks it, which is why the GitHub Actions build — which excludes the example — stays green.) - Declaring `@vercel/oidc` as a direct dependency of the example fixes resolution for the bundler. No changeset needed — `example-*` packages are private and excluded from versioning. --------- Signed-off-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
64b66864b1 |
chore(changesets): ignore all example-* packages and enforce the convention (#626)
Replace the explicit per-example entries in the changesets `ignore` list with an `example-*` name glob (matched by micromatch). All example apps are private and never published, so listing them individually only adds version and changelog churn to release PRs, and each new example required editing this CODEOWNERS-gated file. Add an integration test that resolves the changesets config against the workspace and asserts every examples/* package is in the resolved ignore list and follows the `example-*` naming convention, so an off-convention example app fails CI instead of silently leaking into releases. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Shujan Islam
|
f3de12823c |
Added Express.js chat-sdk example project (#551)
## Summary Added a new example project demonstrating how to use `chat-sdk` with Express.js. Previously, there was no example showing how to integrate `chat-sdk` in a simple Express.js setup. This PR adds a minimal Express.js project with a Discord bot integration to demonstrate how `chat-sdk` can be used in a practical server-side workflow. Closes #519 ## Test plan - Ran the example project locally - Verified the Express.js server starts successfully - Verified the Discord bot connects and responds as expected - Confirmed the example demonstrates basic `chat-sdk` usage with Express.js ## Checklist - [x] All commits are signed and verified - [x] `pnpm validate` passes - [ ] Changeset added (or N/A — see [CONTRIBUTING.md](./CONTRIBUTING.md)) - [x] Documentation updated (or N/A) --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
8f3af76565 |
feat: add create-chat-sdk CLI (#603)
Adds `create-chat-sdk`, a CLI that scaffolds a Next.js Chat SDK bot project: ```bash npm create chat-sdk@latest my-bot # non-interactive npm create chat-sdk@latest -- my-bot --adapter slack redis -y ``` The user picks platform and state adapters interactively or via `--adapter`, and the CLI generates a webhook-only project with `src/lib/bot.ts`, `.env.example`, `next.config.ts`, `package.json`, and a README, then optionally runs `git init` and installs dependencies. There are no pages or client UI in the template. Adapter choices come straight from the `chat/adapters` catalog, so the CLI has no adapter registry of its own. When a coding agent such as Cursor or Claude Code runs the CLI, it uses non-interactive defaults and requires an explicit platform adapter. `--interactive` forces prompts. ## also in this pr - `google-chat` is renamed to `gchat` everywhere, including docs pages, the OG image, and adapter catalog. Old URLs redirect permanently, including language-prefixed and `/og` paths - a new docs page is available at `chat-sdk.dev/docs/create-chat-sdk`, and the CLI is promoted on the homepage, package READMEs, and agent skill - `create-chat-sdk` releases independently with a minor changeset for its initial `0.1.0` release --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: dancer <josh@afterima.ge> |
||
|
OSS Polar Bear
|
b14114a714 |
test(slack): expand emulator coverage for emulate.dev 0.6.0 APIs (#591)
Upgrade @emulators/* to 0.6.0 and add integration tests for DMs, reactions, fetch history, modals, scheduled messages, file uploads, member joins, and bookmarks against the in-process Slack emulator. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
9b8d8c4518 |
Discoverability lift: link KB guides, broaden npm keywords, mirror to AGENTS.md (#560)
Broad SEO/AEO pass across the docs site, adapter READMEs and AGENTS.md files, and npm package metadata so Chat SDK content shows up better in search engines, in LLM-driven package recommendations, and in IDE/coding-agent context. **Docs site** - Adds a `## Resources` section to the Getting Started and AI overview pages and to the Slack, Discord, GitHub, Liveblocks, and Sendblue adapter pages, each linking to applicable guides/templates with descriptions sourced from `resources-edge-config.json` and a cross-link back to the central `/resources` hub. **Adapter packages** - Mirrors the same Resources sections into the Slack, Discord, and GitHub READMEs (so they surface on npm) and into their AGENTS.md files (so coding agents see them alongside the API notes). - Expands `keywords` on every published adapter and state package — adds `chat-sdk`, `chatbot`, `ai-agent`, `ai-sdk`, `vercel`, plus platform-specific terms like `slack-bot`, `block-kit`, `slash-commands`, `github-app`, `whatsapp-business`, `state-adapter`. **Resources registry** - Registers four new entries in `resources-edge-config.json` (Human-in-the-Loop guide, Liveblocks AI agent guide, Slack + Vercel Blob guide, Durable iMessage Agent template) and runs `pnpm sync-resources` so the bundled `chat` package guides, `templates.json`, and `skills/chat/SKILL.md` all pick them up. - Fixes the synced Slack AI agent guide to import `toAiMessages` from `chat/ai` instead of the deprecated `chat` re-export path (the upstream KB source has also been updated, so future syncs will preserve this). **Drive-by fixes** - Resend adapter doc quick start: corrects `MemoryStateAdapter` class import to the `createMemoryState()` factory (matching every other adapter doc). - Zalo adapter doc: drops the "community adapter" callout that duplicated frontmatter. **Tooling / CI** - Adds `tsx` as a root devDependency so `pnpm sync-resources` works out of the box (it previously relied on `npx tsx`, which hung when not pre-cached). - Loosens the CI changeset gate to also skip `packages/chat/resources/` (generated data), matching the existing `*.md` carve-out. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
josh
|
25ebc3b925 |
feat(twilio): add sms, mms, and voice helpers (#558)
## summary adds a first-class Twilio adapter for SMS and MMS bots, plus low-level voice helpers for custom Twilio voice routes this includes webhook parsing and signature verification, outbound Messages API helpers, phone-number and Messaging Service sending, inbound MMS attachments with authenticated `fetchData`, plain text card fallback rendering, markdown conversion, and runtime-light `api`, `webhook`, `voice`, and `format` subpaths the adapter intentionally avoids the `twilio` npm runtime dependency so apps can use the low-level helpers without pulling in the full SDK |
||
|
dependabot[bot]
|
c3091eb9f9 |
build(deps): bump rollup from 4.54.0 to 4.60.4 (#525)
Bumps [rollup](https://github.com/rollup/rollup) from 4.54.0 to 4.60.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.60.4</h2> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor"><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu"><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi"><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.60.2</h2> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6346">#6346</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6347">#6347</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6348">#6348</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6349">#6349</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6350">#6350</a>: fix: reset variable render names between outputs in the same generate (<a href="https://github.com/barry3406"><code>@barry3406</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6351">#6351</a>: chore(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6352">#6352</a>: chore(deps): update cross-platform-actions/action action to v1 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6353">#6353</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6354">#6354</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6355">#6355</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6356">#6356</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6358">#6358</a>: chore: remove cross-env from devDeps (<a href="https://github.com/K-tecchan"><code>@K-tecchan</code></a>)</li> </ul> <h2>v4.60.1</h2> <h2>4.60.1</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.60.4</h2> <p><em>2026-05-14</em></p> <h3>Bug Fixes</h3> <ul> <li>Improve stability of chunk hashes (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6362">#6362</a>: fix: stabilize chunk assignment across parallel file reads (<a href="https://github.com/sonukapoor"><code>@sonukapoor</code></a>, <a href="https://github.com/Sonu"><code>@Sonu</code></a> Kapoor, <a href="https://github.com/TrickyPi"><code>@TrickyPi</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6370">#6370</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6371">#6371</a>: chore(deps): update dependency lru-cache to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6372">#6372</a>: chore(deps): update react monorepo to v19 (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6373">#6373</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6375">#6375</a>: Resolve vulnerabilities (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.60.3</h2> <p><em>2026-05-04</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure nested "exports" variables are not renamed (<a href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6360">#6360</a>: fix: do not rename nested "exports" bindings that do not conflict (<a href="https://github.com/tariqrafique"><code>@tariqrafique</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6364">#6364</a>: chore(deps): update msys2/setup-msys2 digest to e989830 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6365">#6365</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6366">#6366</a>: fix(deps): update swc monorepo (major) (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6367">#6367</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6368">#6368</a>: docs: add missing backticks in <code>plugin-development</code> (<a href="https://github.com/lumirlumir"><code>@lumirlumir</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.60.2</h2> <p><em>2026-04-18</em></p> <h3>Bug Fixes</h3> <ul> <li>Resolve a variable rendering bug when generating different formats from the same build (<a href="https://redirect.github.com/rollup/rollup/issues/6350">#6350</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/6327">#6327</a>: docs: fix various typos in source and documentation (<a href="https://github.com/Abhi3975"><code>@Abhi3975</code></a>, <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6331">#6331</a>: fix(deps): update minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6332">#6332</a>: chore(deps): update codecov/codecov-action action to v6 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6333">#6333</a>: chore(deps): update dependency eslint-plugin-unicorn to v64 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6334">#6334</a>: fix(deps): update rust crate swc_compiler_base to v51 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/6335">#6335</a>: chore(deps): lock file maintenance (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/d311a84b0bb4d4a6f50d19ffd2c29cca28660c88"><code>d311a84</code></a> 4.60.4</li> <li><a href="https://github.com/rollup/rollup/commit/6aa324854482e273b711972955d2d1b3bb445bcc"><code>6aa3248</code></a> fix: stabilize chunk assignment across parallel file reads (<a href="https://redirect.github.com/rollup/rollup/issues/6362">#6362</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/82a0fe76b1372a2cf509fc4067d69f25569b83f5"><code>82a0fe7</code></a> Resolve vulnerabilities (<a href="https://redirect.github.com/rollup/rollup/issues/6375">#6375</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/71f5ebc893d7ff76b5571d63b04ea2ed4a4ddd9d"><code>71f5ebc</code></a> chore(deps): update dependency lru-cache to v11 (<a href="https://redirect.github.com/rollup/rollup/issues/6371">#6371</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/af91d778cdf564dd1ae1bfd6e92604ec031824a7"><code>af91d77</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/rollup/rollup/issues/6373">#6373</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/65e7b94ddda9f02334fa8f12ff6bf699c1f07833"><code>65e7b94</code></a> chore(deps): update react monorepo to v19 (major) (<a href="https://redirect.github.com/rollup/rollup/issues/6372">#6372</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/642587f3d9c5b4aa482a5027672f0fa8ea76da12"><code>642587f</code></a> fix(deps): update minor/patch updates (<a href="https://redirect.github.com/rollup/rollup/issues/6370">#6370</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/b47bdabeccbb7aa1b1d4117f2f4a781a9f6de297"><code>b47bdab</code></a> 4.60.3</li> <li><a href="https://github.com/rollup/rollup/commit/15c5f33083c8c6b1b2cbae548124fffbba2553bb"><code>15c5f33</code></a> Add again some unneeded dev dependencies, to make some builds succeed</li> <li><a href="https://github.com/rollup/rollup/commit/12195dcebbd21f0f2d91e26720cd053526edbfe3"><code>12195dc</code></a> fix: do not rename nested "exports" bindings that do not conflict (<a href="https://redirect.github.com/rollup/rollup/issues/6360">#6360</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v4.54.0...v4.60.4">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
db61173386 |
build(deps-dev): bump postcss from 8.5.14 to 8.5.15 (#541)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.14 to 8.5.15. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/eae46db765d752cf8f40c4fa2b0b85030079c43d"><code>eae46db</code></a> Release 8.5.15 version</li> <li><a href="https://github.com/postcss/postcss/commit/79508ffa59e42c02056aca61b88bc393c8b516c4"><code>79508ff</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b128e2131288a411c6e28071d0929542c49e74eb"><code>b128e21</code></a> Speed up declaration parsing by avoiding creating new array on each token</li> <li><a href="https://github.com/postcss/postcss/commit/9825dca02c33cf610e2a842be767468b67fbecf9"><code>9825dca</code></a> Fix code format</li> <li><a href="https://github.com/postcss/postcss/commit/55789c865281e2be194fa5b4e41dd046be3a2307"><code>55789c8</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/84fbbe9009cb3cc3bbb4cc3a9b65d468f4844d95"><code>84fbbe9</code></a> Install older pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/9f860bd78ec1dbc4f0ae72d693f03f956baa38cb"><code>9f860bd</code></a> Revert pnpm action for old Node.js</li> <li><a href="https://github.com/postcss/postcss/commit/08771986d47359545f502e009763e223b66bfcf6"><code>0877198</code></a> Update CI actions</li> <li><a href="https://github.com/postcss/postcss/commit/b2d1a335cea818f8b27e5cfb90147648afe3e582"><code>b2d1a33</code></a> Fix linter warnings</li> <li><a href="https://github.com/postcss/postcss/commit/0700dac92283bc259977dff2743ca74a00f58267"><code>0700dac</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/2088">#2088</a> from rootvector2/add-oss-fuzz-harness</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.14...8.5.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/vercel/chat/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b4f3a00821 |
build(deps): bump ws from 8.18.3 to 8.20.1 (#539)
Bumps [ws](https://github.com/websockets/ws) from 8.18.3 to 8.20.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.20.1</h2> <h1>Bug fixes</h1> <ul> <li>Fixed an uninitialized memory disclosure issue in <code>websocket.close()</code> (c0327ec1).</li> </ul> <p>Providing a <code>TypedArray</code> (e.g. <code>Float32Array</code>) as the <code>reason</code> argument for <code>websocket.close()</code>, rather than the supported string or <code>Buffer</code> types, caused uninitialized memory to be disclosed to the remote peer.</p> <pre lang="js"><code>import { deepStrictEqual } from 'node:assert'; import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer( { port: 0, skipUTF8Validation: true }, function () { const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>, { skipUTF8Validation: true });</p> <pre><code>ws.on('close', function (code, reason) { deepStrictEqual(reason, Buffer.alloc(80)); }); </code></pre> <p>} );</p> <p>wss.on('connection', function (ws) { ws.close(1000, new Float32Array(20)); }); </code></pre></p> <p>The issue was privately reported by <a href="https://github.com/ChALkeR">Nikita Skovoroda</a>.</p> <h2>8.20.0</h2> <h1>Features</h1> <ul> <li>Added exports for the <code>PerMessageDeflate</code> class and utilities for the <code>Sec-WebSocket-Extensions</code> and <code>Sec-WebSocket-Protocol</code> headers (d3503c1f).</li> </ul> <h2>8.19.0</h2> <h1>Features</h1> <ul> <li>Added the <code>closeTimeout</code> option (<a href="https://redirect.github.com/websockets/ws/issues/2308">#2308</a>).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Handled a forthcoming breaking change in Node.js core (19984854).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li><a href="https://github.com/websockets/ws/commit/843925544e2f4cffe445e0179947f56d6c5b608f"><code>8439255</code></a> [dist] 8.20.0</li> <li><a href="https://github.com/websockets/ws/commit/d3503c1fd36a310985108f62b343bae18346ab67"><code>d3503c1</code></a> [minor] Export the <code>PerMessageDeflate</code> class and header utils</li> <li><a href="https://github.com/websockets/ws/commit/3ee5349a0b1580f6e1f347b59ec3371011bd8481"><code>3ee5349</code></a> [api] Convert the <code>isServer</code> and <code>maxPayload</code> parameters to options</li> <li><a href="https://github.com/websockets/ws/commit/91707b470ebd803aaa3fd1e896217740f39267d4"><code>91707b4</code></a> [doc] Add missing space</li> <li><a href="https://github.com/websockets/ws/commit/8b553192268810a83253e2a4a39ac16768e75bb3"><code>8b55319</code></a> [pkg] Update eslint to version 10.0.1</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
63cd869f20 | build(deps-dev): bump turbo from 2.8.12 to 2.9.14 | ||
|
dependabot[bot]
|
39130a8898 | build(deps): bump vite from 7.3.1 to 7.3.3 | ||
|
dependabot[bot]
|
10c58c2721 | build(deps): bump path-to-regexp from 0.1.13 to 8.4.2 | ||
|
dependabot[bot]
|
b18e99625e | build(deps): bump lodash from 4.17.21 to 4.18.1 | ||
|
dependabot[bot]
|
ceb1fdfa4b | build(deps): bump minimatch from 5.1.9 to 10.2.5 | ||
|
dependabot[bot]
|
4139283a17 | build(deps): bump picomatch from 2.3.1 to 4.0.4 | ||
|
dependabot[bot]
|
e4bd4a6ce8 | build(deps): bump axios from 1.13.6 to 1.16.1 | ||
|
dependabot[bot]
|
b93ffa78a1 |
build(deps-dev): bump svelte from 5.55.5 to 5.55.7 (#511)
Bumps [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) from 5.55.5 to 5.55.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/releases">svelte's releases</a>.</em></p> <blockquote> <h2>svelte@5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>svelte@5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> <li> <p>fix: abort running obsolete async branches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18118">#18118</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md">svelte's changelog</a>.</em></p> <blockquote> <h2>5.55.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: prevent XSS on <code>hydratable</code> from user contents (<a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc67bbcf8f708360195687e1b2719463e1a4</code></a>)</p> </li> <li> <p>chore: bump devalue (<a href="https://redirect.github.com/sveltejs/svelte/pull/18219">#18219</a>)</p> </li> <li> <p>fix: disallow empty attribute names during SSR (<a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e2406a2147ad7fb5ffeba95b01bd9642da</code></a>)</p> </li> <li> <p>fix: harden regex (<a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2ebcab5c88feb5652f1a9d621b8f06b259</code></a>)</p> </li> <li> <p>fix: move Svelte runtime properties to symbols (<a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd96441e82c9eb8a23a2903c0d06d3cda991</code></a>)</p> </li> </ul> <h2>5.55.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: leave stale promises to wait for a later resolution, instead of rejecting (<a href="https://redirect.github.com/sveltejs/svelte/pull/18180">#18180</a>)</p> </li> <li> <p>fix: keep dependencies of <code>$state.eager/pending</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18218">#18218</a>)</p> </li> <li> <p>fix: reapply context after transforming error during SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18099">#18099</a>)</p> </li> <li> <p>fix: don't rebase just-created batches (<a href="https://redirect.github.com/sveltejs/svelte/pull/18117">#18117</a>)</p> </li> <li> <p>chore: allow <code>null</code> for <code>pending</code> in typings (<a href="https://redirect.github.com/sveltejs/svelte/pull/18201">#18201</a>)</p> </li> <li> <p>fix: flush eager effects in production (<a href="https://redirect.github.com/sveltejs/svelte/pull/18107">#18107</a>)</p> </li> <li> <p>fix: rethrow error of failed iterable after calling <code>return()</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18169">#18169</a>)</p> </li> <li> <p>fix: account for proxified instance when updating <code>bind:this</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18147">#18147</a>)</p> </li> <li> <p>fix: ensure scheduled batch is flushed if not obsolete (<a href="https://redirect.github.com/sveltejs/svelte/pull/18131">#18131</a>)</p> </li> <li> <p>fix: resolve stale deriveds with latest value (<a href="https://redirect.github.com/sveltejs/svelte/pull/18167">#18167</a>)</p> </li> <li> <p>chore: remove unnecessary <code>increment_pending</code> calls (<a href="https://redirect.github.com/sveltejs/svelte/pull/18183">#18183</a>)</p> </li> <li> <p>fix: correctly compile component member expressions for SSR (<a href="https://redirect.github.com/sveltejs/svelte/pull/18192">#18192</a>)</p> </li> <li> <p>fix: reset <code>source.updated</code> stack traces after <code>flush</code> (<a href="https://redirect.github.com/sveltejs/svelte/pull/18196">#18196</a>)</p> </li> <li> <p>fix: replacing async 'blocking' strategy with 'merging' (<a href="https://redirect.github.com/sveltejs/svelte/pull/18205">#18205</a>)</p> </li> <li> <p>fix: allow <code>@debug</code> tags to reference awaited variables (<a href="https://redirect.github.com/sveltejs/svelte/pull/18138">#18138</a>)</p> </li> <li> <p>fix: re-run fallback props if dependencies update (<a href="https://redirect.github.com/sveltejs/svelte/pull/18146">#18146</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sveltejs/svelte/commit/4d8f99a2709e3c02e48d8bc6c77458f4ba49d0e3"><code>4d8f99a</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18220">#18220</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/05523088173e10af0753877af6936088de924833"><code>0552308</code></a> chore: bump devalue (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18219">#18219</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991"><code>e1cbbd9</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"><code>a16ebc6</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259"><code>d2375e2</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da"><code>547853e</code></a> Merge commit from fork</li> <li><a href="https://github.com/sveltejs/svelte/commit/55f9c85c09d625c3dd80c71ce7542f57386fafb4"><code>55f9c85</code></a> Version Packages (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18158">#18158</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/a10e8e47a5946623a60a1e36b9023c23926eae87"><code>a10e8e4</code></a> fix: keep dependencies of <code>$state.eager</code>/<code>pending</code> (alternative approach) (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/1">#1</a>...</li> <li><a href="https://github.com/sveltejs/svelte/commit/ef4b97dfabfd7a23b27933e18f7393587c343d66"><code>ef4b97d</code></a> fix: duplicated "of" in events.js comment (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18217">#18217</a>)</li> <li><a href="https://github.com/sveltejs/svelte/commit/5122936edb3c14e9a602e579727479b49cbd3239"><code>5122936</code></a> fix: treat batches as a linked list (<a href="https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte/issues/18205">#18205</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sveltejs/svelte/commits/svelte@5.55.7/packages/svelte">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c9559c89ee |
build(deps): bump next from 16.2.3 to 16.2.6 (#488)
Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li> <li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ben Sabic
|
ac8a20779c |
feat(chat): add chat/ai subpath for AI SDK utilities (#492)
## Summary
Introduces a dedicated `chat/ai` subpath as the home for every Vercel AI
SDK helper that ships with Chat SDK. Importing from this subpath keeps
the optional `ai` and `zod` peer dependencies out of bundles that don't
use them.
### What's new
- **`createChatTools`** — exposes Chat SDK operations as ready-to-use AI
SDK tools so an agent can read, post, react, edit, delete, and manage
thread subscriptions across every adapter the supplied `Chat` instance
has registered.
- Write operations require user approval by default (`requireApproval:
true`); toggle globally or per-tool.
- Three presets — `reader`, `messenger`, `moderator` — scope the
toolset.
- Individual tools can also be cherry-picked (`import { postMessage,
addReaction } from "chat/ai"`).
- **`toAiMessages`** (and the `Ai*` / `ToAiMessagesOptions` types) now
live alongside the tools at `chat/ai`. The previous `chat` re-exports
continue to work, but are flagged `@deprecated` with an editor hint
pointing to the new home — migration is a one-line import change.
- **Docs** — new `/docs/ai` section between Usage and Adapters in the
sidebar:
- `/docs/ai` — Overview
- `/docs/ai/ai-sdk-tools` — `createChatTools` guide
- `/docs/ai/to-ai-messages` — `toAiMessages` reference
- `/docs/ai/types` — Reference for every type exported from `chat/ai`
- **Example app** — `examples/nextjs-chat` now demos the new surface via
a "Run Agent Demo" button on the welcome card and a free-form `/agent
<prompt>` slash command (streaming, with a placeholder so users get
immediate feedback in channel contexts where Slack's typing-status API
is a no-op).
### Future plans
`createChatTools` currently exposes the cross-adapter Chat SDK surface
only. A natural follow-up is to also support **platform-specific tools**
— e.g. expose Slack-only `pin`/`unpin`, Discord-only thread archiving,
GitHub-only issue commenting, etc., so users can further extend what
their agent can do without dropping back to raw adapter calls. The shape
would likely be additional opt-in factories under `chat/ai` (or
per-adapter subpaths like `@chat-adapter/slack/ai`) that return tools
layered on top of the platform-specific adapter clients, while keeping
the cross-platform `createChatTools` API as the lowest common
denominator.
### Coverage
- `createChatTools` orchestrator: 100% statements / 94.7% branches.
- Every tool factory's `execute()` is exercised end-to-end (29 tests in
`index.test.ts`).
- `toAiMessages` keeps its existing 35-test suite covering role mapping,
attachment handling, links, transforms, and unsupported-attachment
fallbacks.
- Tools folder overall: 99.0% statements / 86.1% branches / 97.4%
functions / 98.9% lines.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
|
||
|
Hugo
|
716e934aa2 |
feat(web-adapter): first class support for Vue and Svelte (#498)
## Summary <!-- What does this PR do? --> ## Test plan <!-- How did you verify the changes? --> ## Checklist - [ ] All commits are signed and verified - [ ] `pnpm validate` passes - [ ] Changeset added (or N/A — see [CONTRIBUTING.md](./CONTRIBUTING.md)) - [ ] Documentation updated (or N/A) --------- Co-authored-by: dancer <josh@afterima.ge> |
||
|
Ben Sabic
|
cd7b6af1c8 |
test(integration-tests): add Emulate.dev-backed tests for the GitHub adapter (#479)
## Summary Add an Emulate.dev-backed integration-test suite for the GitHub adapter, mirroring the structure of the Slack work in #477. Tests drive the adapter against an in-process [`@emulators/github`](https://emulate.dev/docs/github) server and assert on its stateful store (comments, reviews) rather than `mock.calls`, catching wire-format and contract issues that pure Octokit mocks miss. - New private devDeps in `packages/integration-tests`: `@emulators/github`, `@emulators/core`, `@hono/node-server`, plus a workspace dep on `@chat-adapter/github`. (`@emulators/core` and `@hono/node-server` are also declared by #477; this PR is independent of merge order.) - New harness `packages/integration-tests/src/github-emulator-utils.ts` boots the emulator on an ephemeral `127.0.0.1` port, seeds a deterministic user / repo / issue / PR / starter review comment, and exposes a near-passthrough HTTP forwarder. **No re-signing needed** here. `@emulators/core`'s `WebhookDispatcher` already signs deliveries with `X-Hub-Signature-256: sha256=<hex>` exactly as the GitHub adapter expects. The harness also adds a small URL rewriter for Octokit's `pulls.createReplyForReviewComment` shortcut endpoint, translating it into the canonical review-comment POST that the emulator implements. - Four new test files (12 tests), wired to the adapter via its existing `apiUrl` + `webhookSecret` config **zero source changes** to `packages/adapter-github`: - `emulator-github-auth.test.ts` (2) `GET /user` populates `botUserId` during `initialize()`. - `emulator-github-comments.test.ts` (4) `thread.post` / `edit` / `delete` on issue and PR-conversation threads. - `emulator-github-reviews.test.ts` (3) review-comment replies routed through `pulls.createReplyForReviewComment` with the right \`in_reply_to_id\`, plus edit / delete. - `emulator-github-events.test.ts` (3) full inbound `issue_comment` / `pull_request_review_comment` round-trip, including bot self-message filtering. ```mermaid flowchart LR subgraph Test["Vitest test process"] SDK[GitHubAdapter + Chat] Forwarder["HTTP forwarder<br/>passthrough"] Emu["@emulators/github<br/>(in-process Hono)"] end SDK -->|"issues.createComment / pulls.* / GET /user<br/>(apiUrl override)"| Emu Emu -->|"X-Hub-Signature-256 + x-github-event"| Forwarder Forwarder -->|"chat.webhooks.github(request)"| SDK ``` ### Out of scope (deliberate) - **Reactions** `@emulators/github` does not implement the `/reactions` endpoints used by the adapter. Reaction logic is still covered by the existing mock-based tests in `packages/adapter-github/src/index.test.ts`. - **GitHub App auth** (JWT \u2192 installation token via `POST /app/installations/:id/access_tokens`) the adapter and emulator both support it, but PAT-mode was the agreed scope here. - **Multi-tenant install flows** via `installation` webhook events. - Branches/refs, releases, search, actions, checks not used by the adapter. ## Test plan - [x] `pnpm --filter @chat-adapter/integration-tests test` 407 tests pass across 34 files (including the 12 new emulator-github tests, ~480 ms total). - [x] `pnpm check` and `pnpm knip` clean. - [x] CI safety verified: ephemeral ports (`port: 0`), loopback-only binds (`127.0.0.1`), deterministic teardown via `httpServer.close()`, no env vars, no external network egress. ## Checklist - [x] All commits are signed and verified - [x] \`pnpm validate\` passes - [x] Changeset added (or N/A see [CONTRIBUTING.md](./CONTRIBUTING.md)) N/A: \`@chat-adapter/integration-tests\` is \`private: true\` and the change is test-only. - [x] Documentation updated (or N/A) \`packages/integration-tests/README.md\` describes the new emulator-github test category. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
14b1434998 |
test(integration-tests): add Emulate.dev-backed tests for the Slack adapter (#477)
* chore(integration-tests): add Emulate.dev Slack emulator devDeps
Add @emulators/slack, @emulators/core, and @hono/node-server as
devDependencies of the private integration-tests package. These power
the upcoming in-process Slack emulator harness used to drive the Slack
adapter against a stateful, Slack-shaped HTTP server instead of mocks.
* test(integration-tests): add Slack emulator test harness
Introduce slack-emulator-utils.ts, a test-only helper that boots the
@emulators/slack Hono app on an ephemeral 127.0.0.1 port via
@hono/node-server and pre-seeds a deterministic team / channel / bot /
human user / OAuth app. The Slack adapter is wired to it via its
existing apiUrl config; no source changes required.
Also exposes startSlackWebhookForwarder, a tiny in-process Node http
forwarder that re-signs the emulator's outbound event_callback
deliveries with x-slack-signature / x-slack-request-timestamp before
handing them to chat.webhooks.slack(...). The emulator's core
WebhookDispatcher only emits GitHub-style X-Hub-Signature-256 headers,
so this bridge is what makes inbound flows exercise the SDK's real
HMAC verification path.
The handle returns direct access to the emulator's Store and
WebhookDispatcher so tests can assert on persisted state instead of
mock call records.
* test(integration-tests): cover Slack auth, postMessage, and reactions via emulator
Add three test files that drive the SlackAdapter's outbound WebClient
calls through the in-process emulator and assert on its stateful store
rather than on mock call records:
- emulator-slack-auth.test.ts (3 tests): auth.test populates botUserId
during initialize(); explicit botUserId is respected; multi-workspace
mode skips the call entirely.
- emulator-slack-post-message.test.ts (5 tests): plain text and threaded
thread.post round-trip into the messages collection and are visible
via conversations.replies; editMessage updates via chat.update;
deleteMessage removes via chat.delete; markdown posts succeed.
- emulator-slack-reactions.test.ts (3 tests): addReaction /
removeReaction round-trip via reactions.add / reactions.remove and
show up via reactions.get; multi-user reactions accumulate correctly.
These exercise the full HTTP path against a Slack-shaped server,
catching wire-format and contract issues that pure mocks miss.
* test(integration-tests): cover Slack inbound events and OAuth v2 install via emulator
Add two test files that drive end-to-end flows previously only
verifiable against real Slack:
- emulator-slack-events.test.ts (4 tests): a human posts to the
emulator, which dispatches an event_callback to the local forwarder,
which signs the body and hands it to chat.webhooks.slack(...). The
SDK's onNewMention and onNewMessage handlers run with a live Thread
and the bot's reply lands back in the emulator. Bot self-messages
are correctly filtered. This is the only Slack adapter test in the
repo that covers the full inbound-then-outbound round-trip without
hand-crafted webhook payloads.
- emulator-slack-oauth.test.ts (4 tests): handleOAuthCallback
exchanges a real authorization code via oauth.v2.access against the
emulator's authorize/callback flow; the resulting installation is
persisted in the state adapter; invalid codes and mismatched
client_secrets are rejected; the freshly issued bot token works for
subsequent chat.postMessage calls via withBotToken.
* docs(integration-tests): document emulator-* test category
Add an "Emulator tests" entry to the package README so newcomers can
distinguish the new emulator-backed suite from the existing unit and
replay tests, and find the harness in slack-emulator-utils.ts.
* fix(integration-tests): keep full token scopes after emulator.reset()
`applyTokenSeed` (used during `reset()`) was granting only
["chat:write", "channels:read"] to seeded tokens, while the initial
`createCoreServer({ tokens })` call granted the full bot/human scope
sets. After the first `reset()` the bot token silently lost
`channels:history`, `users:read`, `reactions:read`, and
`reactions:write`, which would surface as flaky behaviour for any test
that relied on those scopes after a reset.
Unify both call sites on a single `buildTokenSeedEntries` helper so
fresh-boot and post-reset state always grant the same scopes. Add a
regression test in emulator-slack-auth.test.ts that triggers a manual
`emulator.reset()` and re-asserts that the bot token still resolves
via auth.test.
* refactor(integration-tests): reorganize Slack emulator tests under emulator/slack/
Address review feedback (visyat) by moving the flat
`emulator-slack-*.test.ts` files into a per-adapter directory:
packages/integration-tests/src/emulator/slack/
utils.ts
auth.test.ts
events.test.ts
oauth.test.ts
post-message.test.ts
reactions.test.ts
This scales cleanly as more adapter emulator suites land (e.g.
`emulator/github/`), instead of cluttering the top-level src tree with
adapter-prefixed file names.
Also hoist the duplicated `silentLogger` definition from each test
file into the shared `utils.ts`, removing five identical copies.
No behavior changes. All 20 emulator tests still pass.
* test(integration-tests): cover Slack multi-workspace token resolution via emulator
Add `emulator/slack/multi-workspace.test.ts` exercising the path that
was previously only covered by replay/mock-based tests: the adapter
runs without a hardcoded `botToken`, multiple workspaces are persisted
in the state adapter via `adapter.setInstallation(teamId, ...)`, and
inbound `event_callback`s for either team are routed to the correct
per-tenant bot token end-to-end against the shared emulator.
To make this work, the helper grew two small additions:
- `addEmulatorWorkspace(emulator, seed)` — register an additional
team + bot + channel + token on an already-booted emulator, so two
tenants live side-by-side without needing two emulator instances.
- The inbound forwarder's `augmentEventEnvelope` now accepts an
optional `resolveTeamId(envelope)` callback, defaulting to a constant
teamId for the existing single-workspace tests. The multi-workspace
test passes a resolver that looks up the dispatched event's channel
in the emulator store and returns the owning team's id, so the SDK's
per-team token resolver sees the right `team_id` on the envelope.
Three new tests: team-A routing, team-B routing, and `getInstallation`
returning null for unknown team ids. Follow-up from review feedback on
PR #477.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
|
||
|
dependabot[bot]
|
41139a42ff |
build(deps): bump mermaid from 11.12.2 to 11.15.0 (#486)
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.12.2 to 11.15.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.2...mermaid@11.15.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Felix Arntz
|
06fb8e59ef |
chore: set up konsistent with basic initial config for package, adapter, and state adapter conventions (#466)
* set up konsistent with basic initial config * add konsistent to CI * fix konsistent.json formatting * fix(gchat): move GoogleChatAdapterConfig to ./types for konsistent * fix(slack): move SlackAdapterConfig to ./types and drop Partial wrapper from createSlackAdapter * fix(messenger): name createMessengerAdapter parameter MessengerAdapterConfig * fix(web): rename WebAdapterOptions to WebAdapterConfig and import Adapter type in index.ts * fix(whatsapp): align WhatsAppAdapterConfig and creator with konsistent + map kebab to PascalCase * fix(state-memory): add MemoryStateAdapterOptions type for konsistent * fix(state-ioredis): unify URL and client options under IoRedisStateAdapterOptions * fix(state-redis): unify URL and client options under RedisStateAdapterOptions * fix(state-pg): unify URL and client options under PostgresStateAdapterOptions * chore: changeset for konsistent convention alignment * chore: drop CHANGELOG.md from konsistent's required files list CHANGELOG.md is generated automatically by changesets on each release — it's never hand-authored and doesn't exist for a package until its first release lands. Requiring it as a convention check makes CI fail indefinitely for any newly added package, with no honest fix available (an empty placeholder is just noise that gets overwritten on first release). * docs: document konsistent and package shape conventions * fix(web): use WebAdapterConfig in WebAdapter field types after main merge The merge of main into konsistent brought in PR #475's `protected` field modifiers on top of the WebAdapterOptions → WebAdapterConfig rename, leaving two stale references to the (un-imported) old name. Switch them to WebAdapterConfig and update a stale JSDoc reference in als.ts to match. --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> |
||
|
Ben Sabic
|
0adf3adef6 |
feat(tests): add @chat-adapter/tests test kit (#470)
* feat(tests): add @chat-adapter/tests test kit
New package providing Vitest factories, custom matchers, and a setup file for
people building Chat SDK adapters and bots.
Factories: createMockAdapter, createMockChatInstance, createMockState (with
working in-memory subscriptions/locks/KV/queues), createTestMessage,
mockLogger / createMockLogger.
Matchers: toHavePosted(threadId, textPattern?), toHaveDispatched(handler),
toBeSubscribedTo(threadId). Auto-register via the
'@chat-adapter/tests/setup' subpath in vitest setupFiles.
chat and vitest are peer dependencies. Adapter-specific helpers (e.g. signed
Slack webhook builders) belong in each adapter's own /testing subpath, not
in this kit.
* test(integration-tests): allow @chat-adapter/tests imports in README check
* docs: add Testing page covering @chat-adapter/tests
New content/docs/testing.mdx walks bot authors and custom-adapter authors
through the kit's factories, custom matchers, and setup file. Added under
the Usage section in the sidebar, after error-handling.
Cross-link from contributing/testing.mdx clarifying that the hand-rolled
patterns there are for repo contributors building first-party adapters,
while consumers of Chat SDK should use @chat-adapter/tests.
* test(integration-tests): allow @chat-adapter/tests imports in docs check
* fix(tests): match real Adapter.postMessage signature in toHavePosted
Adapter.postMessage is (threadId: string, message: AdapterPostableMessage)
— previously the matcher read args[0] as { id: string } and args[1] as
{ text: string }, neither of which match the actual SDK shape. The matcher's
own tests fed the same wrong shape into the mock so they passed locally
while the matcher silently failed against any real bot or adapter.
Now compares args[0] as a string threadId, and extracts a comparable string
from AdapterPostableMessage's union — strings directly, PostableMarkdown
.markdown, PostableRaw.raw, and PostableCard.fallbackText. PostableAst and
fallback-less cards aren't text-matchable; documented in the JSDoc.
Tests updated to call postMessage with the real signature and to cover
each comparable AdapterPostableMessage shape.
* test(tests): add smoke tests driving matchers against a real Chat
Construct a real `Chat` with a `createMockAdapter` + `createMockState` and
exercise `Chat.thread().post()` and `.subscribe()` end-to-end. The matchers
(toHavePosted, toBeSubscribedTo) then assert against the actual call shape
the SDK uses, so a future signature drift breaks here instead of silently
agreeing with whatever wrong shape lives in the unit tests.
This is the regression guard for the postMessage-shape bug fixed in the
prior commit: each new matcher in subsequent PRs should be paired with a
smoke case here.
* feat(tests): round out adapter mutation matchers
Adds toHaveEdited, toHaveDeleted, toHaveReactedWith, toHaveStartedTyping,
and toHavePostedToChannel — covering the common Adapter mutation surface
that bot authors assert on. Each matcher's signature was checked against
packages/chat/src/types.ts, and each is paired with a smoke case that
drives a real Chat through the corresponding Thread/Channel API so
signature drift breaks the smoke test instead of silently agreeing with
the unit tests.
Emoji matching accepts both plain strings and EmojiValue ({ name }).
Text matching reuses the same extraction rules as toHavePosted —
strings, PostableMarkdown.markdown, PostableRaw.raw, and
PostableCard.fallbackText. Documented in matcher JSDoc, README, and
the Testing docs page.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
|
||
|
Ben Sabic
|
2de905cb0c |
fix: regenerate pnpm-lock.yaml after merge conflict (#462)
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
josh
|
c1cd9b5da1 |
feat(chat): add callbackUrl to buttons and modals (#454)
* 1 * wfw * 4224 * dfe * wip * f * 22 * tsts * more * ch * dc * t * tm * docs * ex * k * cs * lock * test(chat): expand callbackUrl coverage * docs: document callbackUrl handling for adapter authors * docs: expand changeset for callbackUrl feature * docs(skill): mention callbackUrl on Button and Modal * feat(example): add modal callbackUrl workflow demo * test(integration): add replay tests for callbackUrl flows --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |
||
|
Vishal Yathish
|
68025ca965 |
[messenger] add messenger (meta) platform adapter to chat sdk (#461)
* [messenger] add messenger (meta) platform adapter to chat sdk - Webhook handling with HMAC-SHA256 signature verification - Generic and Button template support for cards - Postback, reaction, delivery/read confirmation handling - Message caching for fetchMessages (Messenger has no history API) - Replay tests and ~98% code coverage Co-authored-by: Dimitar K. Nikolov <mitkodkn@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * Fix: The `@chat-adapter/messenger` package version is `4.15.0` while all other packages in the Changesets fixed version group are at `4.27.0`, breaking the fixed versioning contract. This commit fixes the issue reported at packages/adapter-messenger/package.json:3 **Bug explanation:** The repository uses Changesets with a `"fixed"` configuration: `[["chat", "@chat-adapter/*"]]`. This means all packages matching these patterns must always share the same version number. Every package in the group (`chat`, `@chat-adapter/discord`, `@chat-adapter/gchat`, `@chat-adapter/github`, `@chat-adapter/linear`, `@chat-adapter/shared`, `@chat-adapter/slack`, `@chat-adapter/teams`, `@chat-adapter/telegram`, `@chat-adapter/web`, `@chat-adapter/whatsapp`, and the state packages) is at version `4.27.0`, except `@chat-adapter/messenger` which is at `4.15.0`. This is likely because the messenger adapter was newly added to the monorepo (copied from a template or created fresh) and its version was never aligned with the rest of the fixed group. This mismatch will cause problems with the Changesets release workflow — when Changesets tries to bump versions for the fixed group, it may produce inconsistent or errored releases because one package is 12 minor versions behind the others. **Fix explanation:** Changed `"version": "4.15.0"` to `"version": "4.27.0"` in `packages/adapter-messenger/package.json` to align it with all other packages in the fixed version group. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> * Fix: Messenger adapter env var guard only checks `FACEBOOK_APP_SECRET` but `createMessengerAdapter` requires all three env vars, causing a `ValidationError` crash at Next.js build time when only `FACEBOOK_APP_SECRET` is set. This commit fixes the issue reported at examples/nextjs-chat/src/lib/adapters.ts:154 **Bug Analysis:** The build failure is confirmed in the Vercel build log with: ``` Error [ValidationError]: pageAccessToken is required. Set FACEBOOK_PAGE_ACCESS_TOKEN or provide it in config. ``` The root cause is in `examples/nextjs-chat/src/lib/adapters.ts` at line ~154. The messenger adapter guard only checks for `FACEBOOK_APP_SECRET`: ```typescript if (process.env.FACEBOOK_APP_SECRET) { ``` However, `createMessengerAdapter` (in `packages/adapter-messenger/src/index.ts`) validates and throws `ValidationError` for each of three required env vars: `FACEBOOK_APP_SECRET`, `FACEBOOK_PAGE_ACCESS_TOKEN`, and `FACEBOOK_VERIFY_TOKEN`. When only `FACEBOOK_APP_SECRET` is set in the Vercel project environment, the guard passes, `createMessengerAdapter` is called, and it throws a `ValidationError` for the missing `FACEBOOK_PAGE_ACCESS_TOKEN`. Since this code runs at module evaluation time during the Next.js build's "Collecting page data" phase, the uncaught error crashes the entire build. This is inconsistent with other adapters in the same file. For example, the WhatsApp adapter checks both `WHATSAPP_ACCESS_TOKEN` and `WHATSAPP_PHONE_NUMBER_ID`, and the gchat/github/linear/whatsapp adapters all wrap creation in try-catch blocks. **Fix:** 1. Updated the env var guard to check all three required environment variables (`FACEBOOK_APP_SECRET`, `FACEBOOK_PAGE_ACCESS_TOKEN`, and `FACEBOOK_VERIFY_TOKEN`) before attempting to create the adapter. 2. Wrapped the `createMessengerAdapter` call in a try-catch block (matching the pattern used by gchat, github, linear, and whatsapp adapters) so that any unexpected validation errors are caught and logged as warnings instead of crashing the build. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: visyat <vishal.yathish@gmail.com> --------- Co-authored-by: Dimitar K. Nikolov <mitkodkn@users.noreply.github.com> Co-authored-by: Ben Sabic <27636870+bensabic@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
3e4764db4d |
build(deps-dev): bump postcss from 8.5.10 to 8.5.11 (#451)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.11. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.10...8.5.11) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.11 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Ben Sabic
|
3490a8c84c |
feat: add @chat-adapter/web — browser chat UI for chat-sdk bots (#444)
* feat(chat): expose awaitable Promise from processMessage
Return the inner task as Promise<void> instead of void so streaming
adapters can await full handler completion and surface user-handler
rejections at the wire level. waitUntil semantics for existing webhook
adapters are unchanged — the SDK still tracks the work with errors
swallowed (and logged) so platforms don't retry on handler bugs.
Required by @chat-adapter/web, whose response body is the user
handler's stream.
* feat(adapter-web): add @chat-adapter/web package
A new platform adapter that lets a chat-sdk bot serve a browser chat
UI alongside Slack/Teams/Discord/etc. without writing any client-side
glue. Speaks the AI SDK UI message stream protocol, so @ai-sdk/react's
useChat and the ai-elements component library work out of the box.
- `@chat-adapter/web` — server: createWebAdapter({ userName, getUser })
- `@chat-adapter/web/react` — client: useChat() preconfigured with
DefaultChatTransport against /api/chat (override via `api`)
Defaults that matter for v1:
- `isDM: true` — every web message routes through onDirectMessage
- `persistMessageHistory: true` — chat-sdk caches each turn in the
configured state adapter so handlers can read prior context via
thread.messages / channel.messages (no platform history API exists)
- channelId === threadId — web has no separate channel concept; this
prevents cross-conversation bleed when a single user has multiple
useChat sessions
- Native `adapter.stream` implementation pumps text-deltas straight
onto the SSE response — no post+edit fallback
Out of scope for v1: cards/JSX rendering, reactions, modals, file
uploads, edit/delete, multi-tab proactive push.
* feat(example-nextjs-chat): wire up web adapter and add /chat page
- Register the web adapter in lib/adapters.ts with a demo getUser
(single shared identity — replace with NextAuth/Clerk/cookie auth
in production)
- Expose POST /api/chat backed by bot.webhooks.web (using next/after
for waitUntil)
- Add a minimal /chat page using @chat-adapter/web/react's useChat —
same bot.onDirectMessage handler that powers Slack now powers the
browser too
Bumps `ai` to ^6.0.174 to align with @ai-sdk/react@^3 (avoids dual
provider-utils versions in the workspace).
* docs: list @chat-adapter/web in registry
- Add an entry to adapters.json so the package shows up on /adapters
- Add a globe SVG to lib/logos.tsx and wire it into the icon map
- Mention the new adapter in docs/adapters.mdx
* feat(adapter-web): tighten request handling and message construction
- Reject user ids containing ':' with HTTP 400 — the character would
corrupt the thread-id round-trip through decodeThreadId
- Skip emitting text-start/text-end in postMessage when the resolved
text is empty so useChat doesn't render blank assistant bubbles
- Derive the parseMessage author from raw.role so rehydrated assistant
messages report the bot identity instead of "unknown"
- Drop the duplicate handler-error log; chat.processMessage already
logs at ERROR level
- Document the actual persistMessageHistory default (true) and the
state-cache rationale; promote the fetchMessages no-op rationale
into its JSDoc
* test(adapter-web): add direct coverage for stream()
- Aborting request.signal mid-stream short-circuits the iterator and
still writes text-end via the finally block
- Non-text StreamChunks (task_update, plan_update) are dropped without
emitting any delta
- The SentMessage returned from thread.post matches the id used in
text-start / text-end events
* docs(adapter-web): expand README into the full adapter docs page
The docs site renders each adapter's README, so flesh out
@chat-adapter/web to match the depth of @chat-adapter/slack:
authentication boundary, threading semantics, streaming,
persistence, React hook reference, configuration table,
feature matrix, and troubleshooting.
* docs(adapter-web): drop unsupported provider import from streaming example
* fix(adapter-web): validate conversationId for reserved colon character
* fix(example): show error state in web chat demo
* fix(example): add thinking indicator to web chat demo
* feat(example): redesign web chat demo with tailwind
* chore: remove redundant changeset
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Co-authored-by: dancer <josh@afterima.ge>
|
||
|
dependabot[bot]
|
de55c1e217 |
build(deps-dev): bump postcss from 8.5.6 to 8.5.10 (#424)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.10. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.10) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Aamir Jawaid
|
885a4717c9 |
Bump Teams SDK to 2.0.8, use User-Agent header (#415)
* Bump Teams SDK to 2.0.8 and switch to User-Agent header Co-Authored-By: Claude <noreply@anthropic.com> * fix(teams): remove unused ts-expect-error after SDK 2.0.8 upgrade --------- Co-authored-by: dancer <josh@afterima.ge> |
||
|
Ben Sabic
|
e8c4b1a6c4 |
docs: update adapter docs (#412)
* docs: update adapter docs * docs: update adapter docs * docs: update adapter docs --------- Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com> |