[enderdev01]

Linked issue

Closes #17

What and why

Two loose ends from 0.3.4, both in the Worker (no app build changes, so no new app release is needed):

• A connection page instead of plain text. The callback now answers with a small dark page in the app's style: what happened, whether it worked, and "you can close this tab". Failures say what to do next (expired session, redirect mismatch, unexpected Vercel response). It still ships no scripts: the CSP is default-src 'none'; style-src 'unsafe-inline'.
• Disconnect revokes the token (finding F1). POST /disconnect deletes the local session, then calls the documented POST https://api.vercel.com/login/oauth/token/revoke with Basic client credentials and the token. It is deliberately best effort: the log records revoke <status>, and a failure never keeps the local session alive.

Changes

File	Change
integrations/vercel-worker/index.mjs	Rendered callback pages; revocation on disconnect
integrations/vercel-worker/index.test.mjs	Page content and headers, revocation request, revocation failure
docs/vercel-security-review.md	F1 moves from open to fixed, with its caveat
integrations/vercel-worker/README.md	Verification step now checks revoke 200
docs/vercel-deployment-monitoring.md	Status updated

How I tested it

• node --test integrations/vercel-worker/index.test.mjs passes (13 tests)
• python3 scripts/check-strings.py passes (89 strings, 3 languages)
• No secrets, personal paths or network calls added beyond the documented revocation request

Notes

• Needs a Worker redeploy to take effect; the 0.3.4 app keeps working against it unchanged.
• The revoke endpoint is documented for Sign in with Vercel tokens; this is its first use with an integration token. The next real disconnect should show revoke 200 in wrangler tail. If Vercel answers 400/401, the token is not revoked and the integration still has to be removed manually in Vercel — the docs and the dialog say so.
• The page interpolates only static strings, so there is nothing to escape and no user input reaches the HTML.