fix(cards): align LinkButton stable-id param to id (not id_), matching Button/Select

The Wave-A Slack PR's rebase onto #153 surfaced an API inconsistency: #153 landed
LinkButton's optional stable-id param as `id_`, but Button/Select/RadioSelect all
use `id`. Align LinkButton to the `id` convention — it's keyword-only with no
real builtin-shadow issue (Button already does this; ruff's lint config does not
select flake8-builtins), and 0.4.31 is unreleased so nothing depends on `id_` yet.
Also drops this branch's duplicate jsx-runtime non-parity row (keeps #153's
canonical one) and its redundant core LinkButton tests (keeps #153's
TestLinkButtonId).

Author: patrick-chinchill

docs/UPSTREAM_SYNC.md

@@ -646,14 +646,12 @@ stay explicit instead of being rediscovered in code review.
 | `@chat-adapter/tests` adapter test kit (vercel/chat#470) | Not ported | New TS package with test utilities for adapter authors | Python already ships `chat_sdk.testing` (`MockAdapter`, `MockStateAdapter`, `create_test_message()`) covering the same surface for this repo's adapter tests; mirroring the TS kit verbatim would duplicate it. Revisit if upstream's kit grows capabilities ours lacks (e.g. recorded replay fixtures for third-party adapter authors). |
 | Teams modal-submit webhook options (vercel/chat#454 adapter-teams slice) | Not ported — the Python Teams adapter has no task-module/modal-submit flow (`handleTaskSubmit`/`processModalSubmit` are absent), so upstream's change passing `bridgeAdapter.getWebhookOptions(activity.id)` into `processModalSubmit` has no landing site | `TeamsAdapter.handleTaskSubmit` forwards webhook options so modal callbackUrl POSTs are registered with `waitUntil` | Pre-existing gap: Teams modals are unported. The Slack adapter already forwards options to `process_modal_submit`, so the new waitUntil plumbing is exercised there. Add the Teams call when Teams modal support lands. |
 | jsx-runtime `callbackUrl` props (vercel/chat#454 slice) | Not ported | `ButtonProps`/`ModalProps` gain `callbackUrl`; `resolveJSXElement` forwards it | Covered by the existing "JSX Card/Modal elements" row — Python has no JSX runtime; `Button()`/`Modal()` builders accept `callback_url` directly. |
-| jsx-runtime `id` prop for link buttons (stable-id-for-link-buttons, chat@4.31.0 commit `171657a`) | Not ported | `LinkButtonProps` gains `id?`; `resolveJSXElement` forwards `id: props.id` | Covered by the existing "JSX Card/Modal elements" row — Python has no JSX runtime. The core half of the same commit (`LinkButton()` factory + `LinkButtonElement` `id`) **is** ported: the `LinkButton(id_=…)` builder accepts the optional stable identifier directly. |
+| jsx-runtime `id` prop for link buttons (stable-id-for-link-buttons, chat@4.31.0 commit `171657a`) | Not ported | `LinkButtonProps` gains `id?`; `resolveJSXElement` forwards `id: props.id` | Covered by the existing "JSX Card/Modal elements" row — Python has no JSX runtime. The core half of the same commit (`LinkButton()` factory + `LinkButtonElement` `id`) **is** ported: the `LinkButton(id=…)` builder accepts the optional stable identifier directly (matching the `Button`/`Select` `id` convention). |
 | Transcripts API Python adaptations (vercel/chat#448) | `transcripts.delete()` returns a `DeleteResult` dataclass; misconfiguration raises `ValueError` (constructor/`AppendInput` guards, invalid duration) or `ChatError` (`chat.transcripts` accessor); guard messages name the Python kwarg (`options.user_key`); `DurationString` is a `str` alias validated at runtime by `_parse_duration` | Inline `{ deleted: number }`; generic `Error` for all of the above; template-literal `` `${number}${"s"\|"m"\|"h"\|"d"}` `` type | Port rules: typed dataclasses over raw dicts; repo error-type conventions (constructor misconfig → `ValueError`, runtime API misuse → `ChatError`) with upstream-matching message wording; Python has no template-literal types. Same shapes and values throughout. |
 | Slack legacy mrkdwn renderer (response_url surface only, post-#440) | `_node_to_mrkdwn` renders headings as `*bold*` and images as `{alt} ({url})` / bare URL | TS `nodeToMrkdwn` has no heading/image branches — both fall through to `defaultNodeToText`, dropping heading emphasis and image URLs | Pre-existing Python improvement; after vercel/chat#440 it affects only `to_response_url_text` (ephemeral edits via response_url). Preserves visual hierarchy and image URLs Slack would otherwise lose. |
 | Slack `api` primitives `send_slack_response_url` URL gate (vercel/chat#548) | `send_slack_response_url` (`slack/api/__init__.py`) calls `_assert_slack_response_url(url)` before POSTing — requires an `https://*.slack.com` URL (where Slack-issued `response_url`s always live) and raises `ValueError` for anything else | Upstream `api/client.ts` `sendResponseUrl` POSTs to whatever `response_url` it is handed, with no scheme/host validation | SSRF guard. The `response_url` reaching this primitive can originate from a parsed-but-unverified interaction payload; without a gate a crafted value could redirect the POST (which carries no bearer token but does echo SDK-controlled message content and trigger an arbitrary outbound request) to an attacker host. Enforces `CLAUDE.md`'s "Validate external URLs before requests (SSRF)" rule, mirroring the high-level adapter's `rehydrate_attachment` allowlist row above. Allowlist: scheme `https`, host `slack.com` or `*.slack.com`. |
 | Slack `api` primitives `fetch_slack_file` host allowlist (vercel/chat#548) | `fetch_slack_file` (`slack/api/__init__.py`) gates `url` through `is_trusted_slack_file_url` before forwarding the bot token, raising `ValueError` for untrusted hosts | Upstream `api/client.ts` `fetchFile` GETs the supplied URL with `Authorization: Bearer <token>` unconditionally | Token-leak guard. `fetch_slack_file` attaches the workspace bot token; a crafted `url_private` from a parsed file object could otherwise exfiltrate that token to an arbitrary host. `is_trusted_slack_file_url` requires scheme `https` and host in `{files.slack.com, slack.com, *.slack.com, *.slack-edge.com}` — the same allowlist the high-level adapter's `rehydrate_attachment` row uses for Slack. Enforces `CLAUDE.md`'s SSRF/URL-validation rule. |
 | Slack `web_client_options` → slack_sdk `WebClient` kwargs (vercel/chat#8336a3e, chat@4.31) | `SlackAdapterConfig.web_client_options: dict[str, Any] \| None` is spread (gated on `is not None`, so an explicit `{}` still spreads as a no-op) into **both** WebClient construction sites — the default `AsyncWebClient` (`_get_client`) and the per-token sync `WebClient` (`_get_web_client_for_token`). The keys are **slack_sdk** `WebClient` constructor kwargs: `timeout` (int seconds), `retry_handlers` (a list of `slack_sdk.http_retry.RetryHandler`), `headers`, etc. Any nested `headers` dict is **deep-copied per client** (`_web_client_kwargs`) so cached per-token clients never share a mutable dict and the caller's input is never mutated. | Upstream `webClientOptions?: Omit<WebClientOptions, "slackApiUrl">` forwards to `@slack/web-api`'s axios-backed `WebClient`; its headline keys are `retryConfig` (a `retryPolicies.*` policy), `rejectRateLimitedCalls`, and `timeout` (ms). | No 1:1 mapping: `slack_sdk` has no `retryConfig`/`rejectRateLimitedCalls` (retry behavior is configured via `retry_handlers`) and its `timeout` is seconds, not ms. So the option bag maps to slack_sdk `WebClient` kwargs rather than axios options. Same intent (tune the underlying HTTP client the adapter doesn't otherwise expose) and same per-client header isolation. Documented inline in `slack/types.py` (`web_client_options` docstring) and `slack/adapter.py` (`_web_client_kwargs`). Regression coverage: `tests/test_adapter_api_url_config.py::TestSlackWebClientOptions`. |
-| jsx-runtime `LinkButtonProps.id` prop (vercel/chat#171657a slice, chat@4.31) | Not ported | `LinkButtonProps` gains `id?: string`; `resolveJSXElement` forwards it to `LinkButton({ id })` | Covered by the existing "JSX Card/Modal elements" row — Python has no JSX runtime. The underlying capability ports cleanly: the `LinkButton()` builder accepts `id=` directly, the core `LinkButtonElement` carries `id`, and the Slack adapter consumes it as the link-button `action_id` (with `??` fallback to `link-{url}`). |
-
 ### Platform-specific gaps
 
 | Area | Python | TS | Rationale |

src/chat_sdk/cards.py

@@ -290,22 +290,23 @@ def LinkButton(
     url: str,
     label: str,
     style: ButtonStyle | None = None,
-    id_: str | None = None,
+    id: str | None = None,
 ) -> LinkButtonElement:
     """Create a LinkButton element that opens a URL when clicked.
 
     Example::
 
         LinkButton(url="https://example.com", label="View Docs")
 
-    ``id_`` is an optional action identifier emitted by platforms that report
-    link clicks. Upstream sets ``id`` unconditionally and relies on
-    ``JSON.stringify`` dropping ``undefined``; in Python we only write the
-    key when it is provided so an unset id never serializes as ``null``.
+    ``id`` is an optional action identifier emitted by platforms that report
+    link clicks (matching the ``Button``/``Select`` ``id`` convention). Upstream
+    sets ``id`` unconditionally and relies on ``JSON.stringify`` dropping
+    ``undefined``; in Python we only write the key when it is provided so an
+    unset id never serializes as ``null``.
     """
     element: LinkButtonElement = {"type": "link-button", "url": url, "label": label}
-    if id_ is not None:
-        element["id"] = id_
+    if id is not None:
+        element["id"] = id
     if style is not None:
         element["style"] = style
     return element

tests/test_cards.py

@@ -14,35 +14,6 @@
 from chat_sdk.shared.card_utils import escape_table_cell, render_gfm_table
 
 
-class TestLinkButtonFactory:
-    """``LinkButton`` factory — including the optional ``id`` (chat@4.31)."""
-
-    def test_minimal(self):
-        assert LinkButton(url="https://example.com", label="Open") == {
-            "type": "link-button",
-            "url": "https://example.com",
-            "label": "Open",
-        }
-
-    def test_includes_id_when_provided(self):
-        # chat@4.31: ``id`` is an optional action identifier emitted by
-        # platforms that report link clicks.
-        assert LinkButton(url="https://example.com", label="Open", id="open-btn") == {
-            "type": "link-button",
-            "url": "https://example.com",
-            "label": "Open",
-            "id": "open-btn",
-        }
-
-    def test_omits_id_key_when_none(self):
-        # Absent id must NOT add an ``id`` key (so adapter ``??`` fallbacks fire).
-        assert "id" not in LinkButton(url="https://example.com", label="Open")
-
-    def test_empty_string_id_is_kept(self):
-        # An explicit empty-string id is kept (locks ``is not None``, not truthy).
-        assert LinkButton(url="https://example.com", label="Open", id="")["id"] == ""
-
-
 class TestIsCardElement:
     """Tests for is_card_element."""
 
@@ -253,7 +224,7 @@ class TestLinkButtonId:
     """
 
     def test_id_written_when_provided(self):
-        btn = LinkButton(url="https://example.com/docs", label="Docs", id_="open-docs")
+        btn = LinkButton(url="https://example.com/docs", label="Docs", id="open-docs")
         assert btn["id"] == "open-docs"
 
     def test_no_id_key_when_omitted(self):
@@ -264,13 +235,13 @@ def test_no_id_key_when_omitted(self):
 
     def test_empty_string_id_is_emitted(self):
         # Explicit empty string is distinct from unset and must survive
-        # (this is exactly why we use ``is not None`` and not ``id_ or ...``).
-        btn = LinkButton(url="https://example.com/docs", label="Docs", id_="")
+        # (this is exactly why we use ``is not None`` and not ``id or ...``).
+        btn = LinkButton(url="https://example.com/docs", label="Docs", id="")
         assert "id" in btn
         assert btn["id"] == ""
 
     def test_id_survives_wire_serialization(self):
-        btn = LinkButton(url="https://example.com/docs", label="Docs", id_="open-docs")
+        btn = LinkButton(url="https://example.com/docs", label="Docs", id="open-docs")
         round_tripped = json.loads(json.dumps(btn))
         assert round_tripped["id"] == "open-docs"
         assert round_tripped["type"] == "link-button"