This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @chat-adapter/gchat@4.37.0 ### Minor Changes -c3b5a08: Bind Pub/Sub push verification to a specific identity with the new pubsubServiceAccountEmail option, alongside the existing audience check. Pushes are rejected unless the token email matches it. Direct webhooks are unaffected. -7a19223: Bind Workspace Add-on webhook verification to a specific identity with the new `workspaceAddOnServiceAccountEmail` option, replacing a pattern match on the add-on service account email. Workspace Add-on Chat apps must set it; standalone Chat apps are unaffected. ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/instagram@4.37.0 ### Minor Changes -2a2b2c5: Add a native Instagram Direct Messages adapter with signed webhooks, media, quick replies, story context, reactions, and typed Meta API errors. ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/notion@4.37.0 ### Minor Changes -0ec6a73: Add `@chat-adapter/notion` for Notion page and block comment discussions: webhook HMAC verification, Post+Edit streaming, conversation history, `message.subject` page metadata, plain-text `@userName`/`@botUserId` mention detection, and File Uploads (up to 3 native attachments). Registers the adapter in the `chat/adapters` catalog and `create-chat-sdk` CLI scaffold, and adds Notion emoji platform support. ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/slack@4.37.0 ### Minor Changes -4ac0455: Add message update and delete lifecycle callbacks, with Slack message_changed and message_deleted dispatch support. ### Patch Changes -6f0d2f0: Resolve outgoing @name mentions on the Slack native streaming path so streamed responses mention users consistently with the post-and-edit fallback. Committed renderer text is resolved incrementally, keeping fenced code literal and preserving the existing ambiguity semantics. -4cc3445: Bound the length of bracketed URLs parsed from message text in the link-unfurl fallback, avoiding a quadratic scan on adversarial input. Valid links are unaffected. -c311827: Preserve the Slack channel ID when converting labeled channel tokens (`<#C123|general>` now becomes `#general (C123)`) so agents can pass the ID to channel tools, and normalize the commonly hallucinated `<label|url>` link order before Markdown conversion - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/whatsapp@4.37.0 ### Minor Changes -6abf480: Add native WhatsApp LinkButton support - A card whose only interactive element is a single `LinkButton` with a non-empty label and an `http://` or `https://` URL is now sent as a native `cta_url` interactive message, as long as the card has no header image or image, table, chart, or inline link children and the post carries no files or attachments. - Link button URLs are now appended as `Label: url` lines to interactive button message bodies and to media captions, instead of being dropped. - Everything else is unchanged: non-matching cards keep the formatted text fallback, and card + media posts keep the single captioned media send. -16879fd: Fix the `WhatsAppInboundMessage.context` type to model all documented webhook variants. The type previously declared `context?: { from: string; id: string }`, but Meta's Cloud API sends mutually exclusive context shapes: quoted replies carry `from`/`id`, forwarded messages carry only `forwarded` or `frequently_forwarded` (no `id`), and catalog product inquiries add `referred_product`. Code narrowed by the old type could dereference `context.id` and crash at runtime on forwarded messages. All context fields are now optional and the forwarded/product-inquiry fields are included. Consumers that dereference `context.from` or `context.id` without a guard will now see a type error, surfacing what was already a latent crash on forwarded messages. ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## chat@4.37.0 ### Minor Changes -2a2b2c5: Add a native Instagram Direct Messages adapter with signed webhooks, media, quick replies, story context, reactions, and typed Meta API errors. -4ac0455: Add message update and delete lifecycle callbacks, with Slack message_changed and message_deleted dispatch support. -0ec6a73: Add `@chat-adapter/notion` for Notion page and block comment discussions: webhook HMAC verification, Post+Edit streaming, conversation history, `message.subject` page metadata, plain-text `@userName`/`@botUserId` mention detection, and File Uploads (up to 3 native attachments). Registers the adapter in the `chat/adapters` catalog and `create-chat-sdk` CLI scaffold, and adds Notion emoji platform support. -85e3d22: Close residual gaps in agent read-tool scoping. `createChatTools`'s read guard now wraps modal, assistant-thread, assistant-context, app-home, app-context, and member-joined dispatch so tools built in those handlers inherit the active conversation, and it logs a warning (instead of failing open silently) when a read runs with no resolvable scope. Scoping stays channel-level by default, so a thread scope still permits sibling threads in its channel. Pass the new `strictScope: true` to confine a thread scope to that thread alone, rejecting both sibling threads and the parent channel, which matters on platforms where a channel is the widest read available (a GitHub channel is an entire repo). Note that reads inside those newly wrapped handlers were previously unscoped. An agent built in an `onModalSubmit`, `onAppHomeOpened`, or `onMemberJoinedChannel` handler that reads another channel will now be rejected. Pass an explicit `scope`, or `scope: false` for intentionally workspace-wide reads. ## create-chat-sdk@0.3.0 ### Minor Changes -2a2b2c5: Add a native Instagram Direct Messages adapter with signed webhooks, media, quick replies, story context, reactions, and typed Meta API errors. -0ec6a73: Add `@chat-adapter/notion` for Notion page and block comment discussions: webhook HMAC verification, Post+Edit streaming, conversation history, `message.subject` page metadata, plain-text `@userName`/`@botUserId` mention detection, and File Uploads (up to 3 native attachments). Registers the adapter in the `chat/adapters` catalog and `create-chat-sdk` CLI scaffold, and adds Notion emoji platform support. ## @chat-adapter/discord@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/github@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/linear@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/messenger@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/shared@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 ## @chat-adapter/teams@4.37.0 ### Patch Changes -4cc3445: Harden Teams HTML-to-text conversion to strip tags until the output is stable, so nested or malformed markup can't leave a partial tag behind. `stripHtmlTags` is now shared across the format and Graph message converters. - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/telegram@4.37.0 ### Patch Changes -629e655: Combine incoming Telegram media groups into one message with ordered attachments and the shared caption. - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/twilio@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/web@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/x@4.37.0 ### Patch Changes -b674923: Restrict the X CRC challenge to the opaque token shape X sends before signing it. The endpoint previously returned an HMAC over any `crc_token`, which let a caller have an arbitrary webhook body signed and replay that as `x-twitter-webhooks-signature` on a forged POST. A webhook body is JSON and can no longer pass the token check, so a CRC response can't double as a POST event signature. - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 - @chat-adapter/shared@4.37.0 ## @chat-adapter/state-ioredis@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 ## @chat-adapter/state-memory@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 ## @chat-adapter/state-pg@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 ## @chat-adapter/state-redis@4.37.0 ### Patch Changes - Updated dependencies [2a2b2c5] - Updated dependencies [4ac0455] - Updated dependencies [0ec6a73] - Updated dependencies [85e3d22] - chat@4.37.0 ## @chat-adapter/tests@4.37.0 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@chat-adapter/web
npm package:
@chat-adapter/web
Web adapter for Chat SDK. Lets a chat-sdk bot serve a browser chat UI alongside Slack, Teams, Discord, etc. — the same bot.onDirectMessage(...) handler fires for every platform.
The adapter speaks the AI SDK UI message stream protocol, so React, Vue, and Svelte AI SDK clients work against the same server endpoint.
Documentation: chat-sdk.dev/adapters/official/web · Guides: vercel.com/kb/chat-sdk
Installation
pnpm add @chat-adapter/web ai
Then install the framework package that matches your UI:
| Framework | Package | Import from |
|---|---|---|
| React / Next.js | @ai-sdk/react |
@chat-adapter/web/react |
| Vue / Nuxt | @ai-sdk/vue |
@chat-adapter/web/vue |
| Svelte / SvelteKit | @ai-sdk/svelte |
@chat-adapter/web/svelte |
Scaffold with the CLI
To scaffold a new browser chat bot with the Web adapter preselected:
npx create-chat-sdk@latest my-bot --adapter web memory
Visit the adapters directory to see other available official and vendor-official adapters.
Quick start
Server
// lib/bot.ts
import { Chat } from "chat";
import { createWebAdapter } from "@chat-adapter/web";
import { createMemoryState } from "@chat-adapter/state-memory";
export const bot = new Chat({
userName: "mybot",
adapters: {
web: createWebAdapter({
userName: "mybot",
getUser: (req) => ({ id: getUserIdFromCookie(req) }),
}),
},
state: createMemoryState(),
});
bot.onDirectMessage(async (thread, message) => {
await thread.post(`You said: ${message.text}`);
});
// app/api/chat/route.ts
import { after } from "next/server";
import { bot } from "@/lib/bot";
export async function POST(request: Request): Promise<Response> {
return bot.webhooks.web(request, {
waitUntil: (task) => after(() => task),
});
}
Client
React
// app/chat/page.tsx
"use client";
import { useChat } from "@chat-adapter/web/react";
export default function ChatPage() {
const { messages, sendMessage, status, stop } = useChat();
// Render with `ai-elements` (<Conversation>, <Message>, <PromptInput>)
// or your own components — `messages`, `sendMessage`, `status` are the
// standard `@ai-sdk/react` API.
}
Vue
<!-- components/Chat.vue -->
<script setup lang="ts">
import { useChat } from "@chat-adapter/web/vue";
const chat = useChat({ api: "/api/chat" });
</script>
<template>
<div v-for="msg in chat.messages" :key="msg.id">
<template
v-for="(part, index) in msg.parts"
:key="`${msg.id}-${part.type}-${index}`"
>
<p v-if="part.type === 'text'">{{ part.text }}</p>
</template>
</div>
</template>
Svelte
<!-- Chat.svelte -->
<script lang="ts">
import { useChat } from "@chat-adapter/web/svelte";
const chat = useChat({ api: "/api/chat" });
</script>
{#each chat.messages as msg (msg.id)}
{#each msg.parts as part, index (`${msg.id}-${part.type}-${index}`)}
{#if part.type === "text"}<p>{part.text}</p>{/if}
{/each}
{/each}
Authentication
getUser is the security boundary for the Web adapter. Unlike Slack/Teams where the platform signs every webhook, web requests come straight from a browser — you must identify the caller yourself. Returning null causes the adapter to respond with HTTP 401 and no handler runs.
Plug in whatever your app already uses:
// NextAuth
createWebAdapter({
userName: "mybot",
getUser: async (req) => {
const session = await getServerSession(authOptions);
if (!session?.user) return null;
return { id: session.user.id, name: session.user.name };
},
});
// Clerk
createWebAdapter({
userName: "mybot",
getUser: async (req) => {
const { userId, sessionClaims } = await auth();
if (!userId) return null;
return { id: userId, name: sessionClaims?.name as string | undefined };
},
});
// Custom session cookie
createWebAdapter({
userName: "mybot",
getUser: async (req) => {
const sessionId = req.headers.get("cookie")?.match(/session=([^;]+)/)?.[1];
if (!sessionId) return null;
const user = await db.users.findBySession(sessionId);
return user ? { id: user.id, name: user.name } : null;
},
});
If getUser throws, the adapter returns 401 and logs the error. Don't include sensitive data in the error message — it's not surfaced to the client, but it is logged.
The resolved
user.idis embedded in the chat-sdk thread id (see Threading below). User ids containing:are rejected with HTTP 400 because they would corrupt the round-trip throughdecodeThreadId. If your auth provider emits ids with colons (e.g.provider:subclaims), normalize them insidegetUser— for example by base64-encoding.
Threading
By default, each useChat conversation maps to one chat-sdk thread:
web:{user.id}:{conversationId}
conversationId is the id field useChat sends in its request body. If your client supplies one (useChat({ id: "support-chat" })), it's reused across reloads; otherwise a fresh id is generated per request.
channel.messages and thread.messages are equivalent on web — the channel id is the thread id. This avoids cross-conversation bleed when persistMessageHistory is enabled and the same user has multiple useChat conversations open.
To override (for example, one thread per user regardless of conversation):
createWebAdapter({
userName: "mybot",
getUser: (req) => /* ... */,
threadIdFor: ({ user }) => `web:${user.id}:default`,
});
The encode/decode helpers are exposed on the adapter:
adapter.encodeThreadId({ userId: "u1", conversationId: "abc" });
// → "web:u1:abc"
adapter.decodeThreadId("web:u1:abc");
// → { userId: "u1", conversationId: "abc" }
Streaming
thread.post accepts an AsyncIterable<string | StreamChunk> and pumps deltas straight onto the SSE response body — no edit loop, no rate limiting. Plays nicely with the AI SDK's streamText:
import { streamText } from "ai";
// Bring your own model from any AI SDK provider
// (@ai-sdk/openai, @ai-sdk/anthropic, @ai-sdk/google, ...).
bot.onDirectMessage(async (thread, message) => {
const result = streamText({
model: myModel,
prompt: message.text,
});
await thread.post(result.textStream);
});
The adapter honors request.signal, so calling stop() from useChat short-circuits the iterator on the server. task_update and plan_update StreamChunks have no native v1 representation in the UI message stream and are dropped silently.
Message persistence
persistMessageHistory defaults to true. Web has no platform-side history API, so the only way for chat-sdk handlers to see prior turns via thread.messages / channel.messages is through the configured state adapter's message history cache. Set it to false only if your handler re-derives history from the request body's messages[] itself:
createWebAdapter({
userName: "mybot",
getUser: (req) => /* ... */,
persistMessageHistory: false,
});
The AI SDK client retains the conversation in its UI state and resends it on every request, so opting out is a valid choice for stateless handlers — but anything that calls await thread.messages won't see prior turns.
Framework helpers
@chat-adapter/web/react exports a thin wrapper around @ai-sdk/react's useChat preconfigured with DefaultChatTransport:
import { useChat } from "@chat-adapter/web/react";
const { messages, sendMessage, status, stop, regenerate } = useChat({
api: "/api/chat", // default
threadId: "support-1", // becomes useChat's `id` and the request body's `id`
});
| Option | Description |
|---|---|
api |
API endpoint for the Web adapter route. Defaults to /api/chat. |
threadId |
chat-sdk thread id — surfaces in the request body's id so the server can derive the chat-sdk thread id. Strongly recommended. Falls back to id from ChatInit. |
experimental_throttle |
Throttle wait in ms for chat messages and data updates. |
resume |
Whether to resume an ongoing chat generation stream. |
| ...rest | All other options pass through to @ai-sdk/react's useChat. |
For advanced configuration (custom transport, response interceptors, etc.) use @ai-sdk/react's useChat directly — there's nothing magical in the wrapper.
@chat-adapter/web/vue exports a useChat factory that returns a Vue-reactive Chat instance from @ai-sdk/vue:
<script setup lang="ts">
import { useChat } from "@chat-adapter/web/vue";
const chat = useChat({ api: "/api/chat", threadId: "support-1" });
</script>
<template>
<div v-for="msg in chat.messages" :key="msg.id">
<template
v-for="(part, index) in msg.parts"
:key="`${msg.id}-${part.type}-${index}`"
>
<p v-if="part.type === 'text'">{{ part.text }}</p>
</template>
</div>
</template>
@chat-adapter/web/svelte exports a useChat factory that returns a Svelte-reactive Chat instance from @ai-sdk/svelte:
<script lang="ts">
import { useChat } from "@chat-adapter/web/svelte";
const chat = useChat({ api: "/api/chat", threadId: "support-1" });
</script>
{#each chat.messages as msg (msg.id)}
{#each msg.parts as part, index (`${msg.id}-${part.type}-${index}`)}
{#if part.type === "text"}<p>{part.text}</p>{/if}
{/each}
{/each}
Unlike the React helper, Vue and Svelte return the Chat instance directly. Access chat.messages, chat.sendMessage(), chat.status, and chat.stop() on that object instead of destructuring.
Configuration
| Option | Required | Description |
|---|---|---|
userName |
Yes | Bot username. Required by chat-sdk for mention detection (@username) and seeds the bot identity for assistant messages. |
getUser |
Yes | (request: Request) => WebUser | null | Promise<WebUser | null>. Resolves the user from the inbound HTTP request. Returning null produces HTTP 401. |
persistMessageHistory |
No | Persist incoming message history in the configured state adapter. Default: true. |
threadIdFor |
No | Derive a chat-sdk thread id from the resolved user and the useChat conversation id. Default: web:{user.id}:{conversationId}. |
logger |
No | Logger instance (defaults to ConsoleLogger("info")). |
Features
Messaging
| Feature | Supported |
|---|---|
| Post message | Yes |
| Edit message | No (every assistant turn is a fresh streamed response) |
| Delete message | No |
| File uploads | No (deferred to v2) |
| Streaming | Native (SSE / UI message stream) |
| Scheduled messages | No |
Rich content
| Feature | Supported |
|---|---|
| Card format | Markdown only in v1 (cards/JSX deferred to v2) |
| Buttons | No |
| Tables | Yes (GFM markdown) |
| Modals | No |
Conversations
| Feature | Supported |
|---|---|
| Mentions | N/A (every web message routes as a DM) |
| Add reactions | No |
| Remove reactions | No |
| Typing indicator | N/A (useChat derives a status from the SSE response itself) |
| DMs | Yes — isDM: true for every thread |
Message history
| Feature | Supported |
|---|---|
| Fetch messages | Via state adapter cache (no platform API) |
| Fetch single message | No |
| Fetch thread info | Yes (synthesized) |
| Fetch channel messages | Via state adapter cache |
| List threads | No |
| Post channel message | No |
v1 scope
In: text + markdown, native streaming, DM-style routing, persisted message history, abort propagation via request.signal.
Out (deferred to v2): cards/JSX rendering, reactions, modals, file uploads, edit/delete, multi-tab proactive push.
Troubleshooting
Every request returns 401
getUseris returningnullor throwing. Add a log inside it to confirm the request actually carries the session you expect.- Cookies aren't being forwarded — check that
useChatis mounted on the same origin as/api/chat(or that your transport passes credentials).
Every request returns 400 "Invalid user id"
- The id returned by
getUsercontains a:character, which would corrupt the thread-id round-trip. Normalize the id insidegetUser(for example,id.replace(/:/g, "_")or base64-encode it).
useChat recreates state on every render
- Don't pass
id: undefinedtouseChat. The wrapper guards against this internally — but if you're calling@ai-sdk/react'suseChatdirectly, omitidrather than passingundefined.
thread.messages is empty
persistMessageHistoryisfalseand there is no platform-side history to fall back on. Either set it totrue(the default) or read history from the request body'smessages[]directly inside your handler.
AI Coding Agents
If you use an AI coding agent such as OpenAI Codex, Claude Code, or Cursor, install the Chat SDK skill so it knows the SDK APIs, adapter patterns, and project conventions before writing code.
npx skills add vercel/chat
The skill references bundled documentation in node_modules/chat/docs, plus adapter guides and starter templates in the published package.
You can also install the Vercel Plugin for a broader agent toolkit — it includes the Chat SDK skill alongside specialist agents, agent slash commands, and more:
npx plugins add vercel/vercel-plugin
The plugin is optional; the skill alone is enough to build with Chat SDK.
For agent-readable documentation, see chat-sdk.dev/llms.txt (page index) or chat-sdk.dev/llms-full.txt (full text).
License
MIT