This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @chat-adapter/gchat@4.40.0 ### Minor Changes -f485255: Harden webhook tenant isolation, require explicit Google Chat bot identity for reliable mention handling, use native Google Chat pagination, isolate Slack caches, and bound recording storage. ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/slack@4.40.0 ### Minor Changes -51322dd: Decode the bot's own mention in incoming Slack messages. The adapter now resolves `<@U_BOT>` to the bot's display name (`@<DisplayName>`) the same way it resolves every other user mention, instead of leaving the raw user-ID markup in place, and sets `isMention` on the parsed message by detecting the bot's ID in the raw event text. This keeps `message.text` self-describing for downstream consumers (LLM prompts, classifiers) while preserving mention detection, which previously depended on the raw ID markup surviving in the text. -d4a1f03: Rotate long-running native Slack streams before Slack expires them. Once a stream segment passes `streamSegmentMaxAgeMs` (default four minutes) the adapter finalizes it at the next paragraph break and continues the reply in a new message, closing and reopening code fences, repeating table headers, replaying open task cards and the plan title, and keeping the agent session in `processing`. A segment Slack already expired during an idle gap is recovered the same way instead of failing the reply. -2cc8cc3: Surface custom status text in the Agent messaging experience. `startTyping` and `setAssistantStatus` with a custom status now call the legacy `assistant.threads.setStatus` endpoint, whose compatibility bridge renders the text in the agent-session loading UX — instead of silently dropping the text and showing the generic "Working…" indicator. Clearing (empty status) still transitions the session to `active` via the Agent Sessions lifecycle. ### Patch Changes -78021c0: pass workspace context to suggested prompt resolvers in Agent view -8b6d7f3: Reactivate Slack Agent Sessions when `startTyping` receives an empty status. -c2b6bff: Use the Slack bot user ID for bot-authored messages when a bot profile is available. -f485255: Harden webhook tenant isolation, require explicit Google Chat bot identity for reliable mention handling, use native Google Chat pagination, isolate Slack caches, and bound recording storage. -8fdaf4a: Stream post-and-edit fallback updates through Slack's `markdown_text` field instead of `text`, so live-updating messages render markdown while the stream is in progress (and get the 12,000-character ceiling rather than 4,000) -7609d8f: Validate external request targets before sending credentials, message content, or attachment requests. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/teams@4.40.0 ### Minor Changes -aaeede7: emit Teams bot-join events and expose the bot user ID -4a0b5c0: Add `tooltip` to `Button` and `LinkButton`, and a `width` hint to `Card`. The Teams adapter and the `@chat-adapter/teams/cards` subpath render them as the Adaptive Card action `tooltip` and the `msteams` full-width card property; other adapters ignore them. Emitted Adaptive Cards now declare schema version 1.5, which is the version that introduced action tooltips. Buttons with a `callbackUrl` keep their `tooltip` and other fields when the URL is swapped for a callback token. ### Patch Changes -a8de95b: Fall back to Teams activity group metadata when the explicit conversation type is missing. -f485255: Harden webhook tenant isolation, require explicit Google Chat bot identity for reliable mention handling, use native Google Chat pagination, isolate Slack caches, and bound recording storage. -7062c39: preserve outgoing @names as plain text instead of generating mention markup without matching entities -7609d8f: Validate external request targets before sending credentials, message content, or attachment requests. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/telegram@4.40.0 ### Minor Changes -043386b: Add Telegram Business mode support. Opt in via `businessMode: true`. The adapter handles `business_connection`, `business_message`, and `edited_business_message` updates, encodes business threads as `telegram:biz:{connectionId}:{chatId}`, and passes `business_connection_id` on outbound sends, edits, typing, file uploads, and inline-keyboard callbacks. Business threads are their own channel, slash commands route through `onSlashCommand`, deletes use `deleteBusinessMessages`, and connection state is cached in the state adapter so a revoked connection is honoured by every instance. Reactions on business threads throw a `NotImplementedError`, since the Bot API has no business variant of `setMessageReaction`. ### Patch Changes -43dba3d: Skip unused plain-text conversion for rich and Markdown native draft updates. Plain-text fallback and final delivery keep their existing behavior. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/whatsapp@4.40.0 ### Minor Changes -31bce0a: export `WhatsAppApiError` for non-2xx Graph API responses. It carries Meta's numeric `errorCode`, `providerMessage`, `type`, `details`, `subcode`, `traceId`, the HTTP `status`, and the `raw` envelope, and maps `code` onto the shared `AdapterError` taxonomy (`RATE_LIMITED`, `AUTH_FAILED`, `PERMISSION_DENIED`, `NOT_FOUND`). Transport failures and unparseable response bodies now throw `NetworkError` instead of leaking raw fetch errors, and error messages carry Meta's message or a bounded excerpt instead of the full response body. ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## chat@4.40.0 ### Minor Changes -4a0b5c0: Add `tooltip` to `Button` and `LinkButton`, and a `width` hint to `Card`. The Teams adapter and the `@chat-adapter/teams/cards` subpath render them as the Adaptive Card action `tooltip` and the `msteams` full-width card property; other adapters ignore them. Emitted Adaptive Cards now declare schema version 1.5, which is the version that introduced action tooltips. Buttons with a `callbackUrl` keep their `tooltip` and other fields when the URL is swapped for a callback token. ### Patch Changes -f485255: Harden webhook tenant isolation, require explicit Google Chat bot identity for reliable mention handling, use native Google Chat pagination, isolate Slack caches, and bound recording storage. -b7c9316: Tighten AI tool and queued-message scoping, isolate direct-message conversations, preserve ephemeral follow-ups, consume callback tokens once, and mark external link metadata as untrusted. ## @chat-adapter/discord@4.40.0 ### Patch Changes -b7c9316: Tighten AI tool and queued-message scoping, isolate direct-message conversations, preserve ephemeral follow-ups, consume callback tokens once, and mark external link metadata as untrusted. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/github@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/instagram@4.40.0 ### Patch Changes -7609d8f: Validate external request targets before sending credentials, message content, or attachment requests. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/linear@4.40.0 ### Patch Changes -3d2cb22: Keep Linear agent-session events on one stable thread and handle sessions created by automation or without a root comment. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/messenger@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/notion@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/shared@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 ## @chat-adapter/twilio@4.40.0 ### Patch Changes -b7c9316: Tighten AI tool and queued-message scoping, isolate direct-message conversations, preserve ephemeral follow-ups, consume callback tokens once, and mark external link metadata as untrusted. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/web@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/x@4.40.0 ### Patch Changes -7609d8f: Validate external request targets before sending credentials, message content, or attachment requests. - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 - @chat-adapter/shared@4.40.0 ## @chat-adapter/state-ioredis@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 ## @chat-adapter/state-memory@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 ## @chat-adapter/state-pg@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 ## @chat-adapter/state-redis@4.40.0 ### Patch Changes - Updated dependencies [f485255] - Updated dependencies [b7c9316] - Updated dependencies [4a0b5c0] - chat@4.40.0 ## @chat-adapter/tests@4.40.0 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@chat-adapter/messenger
npm package:
@chat-adapter/messenger
Facebook Messenger adapter for Chat SDK, using the Messenger Platform API.
Documentation: chat-sdk.dev/adapters/official/messenger · Guides: vercel.com/kb/chat-sdk
Building for Instagram Direct Messages? Use
@chat-adapter/instagraminstead. It connects through Instagram API with Instagram Login and does not require a Facebook Page.
Installation
pnpm add @chat-adapter/messenger
Scaffold with the CLI
To scaffold a new Messenger bot with this adapter preselected:
npx create-chat-sdk@latest my-bot --adapter messenger memory
Visit the adapters directory to see other available official and vendor-official adapters.
Usage
import { Chat } from "chat";
import { createMessengerAdapter } from "@chat-adapter/messenger";
const bot = new Chat({
userName: "mybot",
adapters: {
messenger: createMessengerAdapter(),
},
});
bot.onDirectMessage(async (thread, message) => {
await thread.post("Hello from Messenger!");
});
When using createMessengerAdapter() without arguments, credentials are auto-detected from environment variables.
Facebook Messenger setup
1. Create a Meta app
- Go to developers.facebook.com/apps
- Click Create App
- Select the use case "Engage with customers on Messenger from Meta"
- Enter your app name and contact email, then create the app
- Go to App > App Settings > Basic and copy your App Secret — this becomes
FACEBOOK_APP_SECRET
2. Create a Facebook Page
Your Messenger bot needs a Facebook Page to send and receive messages. If you don't have one:
- The easiest approach is to create a Facebook Business profile first
- Then create a Page under that business profile
- Note the Page name — users will message this Page to interact with your bot
3. Configure Messenger API
- In your Meta app dashboard, go to Use Cases
- Find "Engage with customers on Messenger from Meta" and click Customize
- Then open Messenger API Settings
Configure webhooks
- Under Configure webhooks, click Add Callback URL
- Enter your webhook URL:
https://your-domain.com/api/webhooks/messenger - Enter a Verify Token — this is a secret string you create (this becomes
FACEBOOK_VERIFY_TOKEN) - Click Verify and Save
- After verification, click Add Subscriptions and enable:
messagesmessaging_postbacksmessaging_reactionsmessage_deliveriesmessage_reads
Generate a Page Access Token
- Under Generate access tokens, click Add or remove Pages
- Your Pages should populate — select the Page you created
- Assign the standard permissions when prompted
- Click Generate Token
- Copy the token — this becomes
FACEBOOK_PAGE_ACCESS_TOKEN
Environment variables
FACEBOOK_APP_SECRET=... # App secret from App Settings > Basic
FACEBOOK_PAGE_ACCESS_TOKEN=... # Generated Page access token
FACEBOOK_VERIFY_TOKEN=... # User-defined webhook verification secret
FACEBOOK_BOT_USERNAME=... # Optional, defaults to "messenger-bot"
FACEBOOK_API_URL=... # Optional, override the Meta Graph API base URL
Webhook setup
Messenger uses two webhook mechanisms:
- Verification handshake (GET) — Meta sends a
hub.verify_tokenchallenge that must match yourFACEBOOK_VERIFY_TOKEN. - Event delivery (POST) — incoming messages, reactions, and postbacks, verified via
X-Hub-Signature-256.
// Next.js App Router example
import { bot } from "@/lib/bot";
export async function GET(request: Request) {
return bot.webhooks.messenger(request);
}
export async function POST(request: Request) {
return bot.webhooks.messenger(request);
}
Features
Messaging
| Feature | Supported |
|---|---|
| Post message | Yes |
| Edit message | No (Messenger limitation) |
| Delete message | No (Messenger limitation) |
| Streaming | Buffered (accumulates then sends) |
| Typing indicator | Yes |
| Mark as read | Yes |
Rich content
| Feature | Supported |
|---|---|
| Card format | Generic/Button Templates |
| Buttons | Yes (max 3 per message) |
| Link buttons | Yes (web_url) |
| Select menus | No |
| Tables | Text fallback |
| Fields | Text fallback |
| Images in cards | Yes (Generic Template) |
| Modals | No |
Conversations
| Feature | Supported |
|---|---|
| Reactions | Receive only |
| Typing indicator | Yes |
| DMs | Yes (DM-only platform) |
| Postbacks | Yes |
Inbound attachments
Inbound attachment URLs remain available as attachment.url. The adapter's
fetchData function downloads media only from Meta's fbsbx.com and
fbcdn.net hosts, refuses private and internal addresses (including after
redirects), limits responses to 25 MB, and times out after 30 seconds.
External fallback and link-share URLs are preserved but rejected before any
network request.
Read receipts
Use thread.markAsRead() in a message handler to send Messenger's mark_seen sender action:
await thread.markAsRead();
Messenger applies this action to the conversation's seen state rather than a single message, even when you pass a message or message ID.
Message history
| Feature | Supported |
|---|---|
| Fetch messages | Cached sent messages only |
| Fetch thread info | Yes |
Interactive messages
Card elements are automatically converted to Messenger templates:
- Generic Template — Used when the card has a
titleorimageUrl. Supports up to 3 buttons. - Button Template — Used when the card has text content and buttons but no title/image. Max 640 characters.
- Text Fallback — Used when the card contains unsupported elements (tables, select menus) or exceeds constraints.
Template constraints:
- Maximum 3 buttons per template
- Button titles limited to 20 characters (truncated with ellipsis)
- Subtitles limited to 80 characters
- Button Template text limited to 640 characters
Thread ID format
messenger:{recipientId}
Example: messenger:27161130920158013
AI Coding Agents
If you use an AI coding agent such as OpenAI Codex, Claude Code, or Cursor, install the Chat SDK skill so it knows the SDK APIs, adapter patterns, and project conventions before writing code.
npx skills add vercel/chat
The skill references bundled documentation in node_modules/chat/docs, plus adapter guides and starter templates in the published package.
You can also install the Vercel Plugin for a broader agent toolkit — it includes the Chat SDK skill alongside specialist agents, agent slash commands, and more:
npx plugins add vercel/vercel-plugin
The plugin is optional; the skill alone is enough to build with Chat SDK.
For agent-readable documentation, see chat-sdk.dev/llms.txt (page index) or chat-sdk.dev/llms-full.txt (full text).
License
MIT