@vercel/cli-auth 0.1.0-canary.20260211174907.cdd2da6 → 0.1.0

package/oauth.d.ts

@@ -0,0 +1,207 @@
+import * as z from 'zod/mini';
+declare const AuthorizationServerMetadata: z.ZodMiniObject<{
+    issuer: z.ZodMiniURL;
+    device_authorization_endpoint: z.ZodMiniURL;
+    token_endpoint: z.ZodMiniURL;
+    revocation_endpoint: z.ZodMiniURL;
+    jwks_uri: z.ZodMiniURL;
+    introspection_endpoint: z.ZodMiniURL;
+}, z.core.$strip>;
+export type AuthorizationServerMetadata = z.infer<typeof AuthorizationServerMetadata>;
+declare const IntrospectionResponse: z.ZodMiniObject<{
+    active: z.ZodMiniBoolean<boolean>;
+    client_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    session_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+export declare function OAuth(config: {
+    issuer: URL;
+    clientId: string;
+    userAgent: string;
+}): {
+    init(): Promise<{
+        as: {
+            issuer: string;
+            device_authorization_endpoint: string;
+            token_endpoint: string;
+            revocation_endpoint: string;
+            jwks_uri: string;
+            introspection_endpoint: string;
+        };
+        init(): Promise</*elided*/ any>;
+        /**
+         * Returns the Authorization Server Metadata
+         *
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+         */
+        authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
+        /**
+         * Perform the Device Authorization Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+         */
+        deviceAuthorizationRequest(): Promise<{
+            /** The device verification code. */
+            device_code: string;
+            /** The end-user verification code. */
+            user_code: string;
+            /**
+             * The minimum amount of time in seconds that the client
+             * SHOULD wait between polling requests to the token endpoint.
+             */
+            interval: number;
+            /** The end-user verification URI on the authorization server. */
+            verification_uri: string;
+            /**
+             * The end-user verification URI on the authorization server,
+             * including the `user_code`, without redirection.
+             */
+            verification_uri_complete: string;
+            /**
+             * The absolute lifetime of the `device_code` and `user_code`.
+             * Calculated from `expires_in`.
+             */
+            expiresAt: number;
+        }>;
+        /**
+         * Perform the Device Access Token Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+         */
+        deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
+        /**
+         * Process the Token request Response
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+         */
+        processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
+        /**
+         * Perform a Token Revocation Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+         */
+        revokeToken(token: string): Promise<OAuthError | undefined>;
+        /**
+         * Perform Refresh Token Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+         */
+        refreshToken(token: string): Promise<TokenSet>;
+        /**
+         * Perform Token Introspection Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+         */
+        introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
+    }>;
+    /**
+     * Returns the Authorization Server Metadata
+     *
+     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+     */
+    authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
+    /**
+     * Perform the Device Authorization Request
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+     */
+    deviceAuthorizationRequest(): Promise<{
+        /** The device verification code. */
+        device_code: string;
+        /** The end-user verification code. */
+        user_code: string;
+        /**
+         * The minimum amount of time in seconds that the client
+         * SHOULD wait between polling requests to the token endpoint.
+         */
+        interval: number;
+        /** The end-user verification URI on the authorization server. */
+        verification_uri: string;
+        /**
+         * The end-user verification URI on the authorization server,
+         * including the `user_code`, without redirection.
+         */
+        verification_uri_complete: string;
+        /**
+         * The absolute lifetime of the `device_code` and `user_code`.
+         * Calculated from `expires_in`.
+         */
+        expiresAt: number;
+    }>;
+    /**
+     * Perform the Device Access Token Request
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+     */
+    deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
+    /**
+     * Process the Token request Response
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+     */
+    processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
+    /**
+     * Perform a Token Revocation Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+     */
+    revokeToken(token: string): Promise<OAuthError | undefined>;
+    /**
+     * Perform Refresh Token Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+     */
+    refreshToken(token: string): Promise<TokenSet>;
+    /**
+     * Perform Token Introspection Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+     */
+    introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
+};
+export type OAuth = ReturnType<typeof OAuth>;
+declare const TokenSet: z.ZodMiniObject<{
+    /** The access token issued by the authorization server. */
+    access_token: z.ZodMiniString<string>;
+    /** The type of the token issued */
+    token_type: z.ZodMiniLiteral<"Bearer">;
+    /** The lifetime in seconds of the access token. */
+    expires_in: z.ZodMiniNumber<number>;
+    /** The refresh token, which can be used to obtain new access tokens. */
+    refresh_token: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    /** The scope of the access token. */
+    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+type TokenSet = z.infer<typeof TokenSet>;
+declare const OAuthErrorResponse: z.ZodMiniObject<{
+    error: z.ZodMiniEnum<{
+        invalid_request: "invalid_request";
+        invalid_client: "invalid_client";
+        invalid_grant: "invalid_grant";
+        unauthorized_client: "unauthorized_client";
+        unsupported_grant_type: "unsupported_grant_type";
+        invalid_scope: "invalid_scope";
+        server_error: "server_error";
+        authorization_pending: "authorization_pending";
+        slow_down: "slow_down";
+        access_denied: "access_denied";
+        expired_token: "expired_token";
+        unsupported_token_type: "unsupported_token_type";
+    }>;
+    error_description: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    error_uri: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+type OAuthErrorResponse = z.infer<typeof OAuthErrorResponse>;
+declare class OAuthError extends Error {
+    name: string;
+    code: OAuthErrorResponse['error'];
+    cause: Error;
+    constructor(message: string, response: unknown);
+}
+export declare function isOAuthError(error: unknown): error is OAuthError;
+export {};

package/oauth.js

@@ -0,0 +1,311 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth = OAuth;
+exports.isOAuthError = isOAuthError;
+const z = __importStar(require("zod/mini"));
+const AuthorizationServerMetadata = z.object({
+    issuer: z.url(),
+    device_authorization_endpoint: z.url(),
+    token_endpoint: z.url(),
+    revocation_endpoint: z.url(),
+    jwks_uri: z.url(),
+    introspection_endpoint: z.url(),
+});
+const DeviceAuthorization = z.object({
+    device_code: z.string(),
+    user_code: z.string(),
+    verification_uri: z.url(),
+    verification_uri_complete: z.url(),
+    expires_in: z.number(),
+    interval: z.number(),
+});
+const IntrospectionResponse = z.object({
+    active: z.boolean(),
+    client_id: z.optional(z.string()),
+    session_id: z.optional(z.string()),
+});
+function OAuth(config) {
+    const { issuer, clientId, userAgent } = config;
+    let as;
+    function assertAs(as) {
+        if (as)
+            return;
+        throw new Error('Authorization Server Metadata not initialized. Call init() first.');
+    }
+    return {
+        async init() {
+            as ??= await this.authorizationServerMetadata();
+            return { ...this, as };
+        },
+        /**
+         * Returns the Authorization Server Metadata
+         *
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+         */
+        async authorizationServerMetadata() {
+            const response = await fetch(new URL('.well-known/openid-configuration', issuer), {
+                headers: {
+                    'Content-Type': 'application/json',
+                    'user-agent': userAgent,
+                },
+            });
+            const json = await response.json();
+            as = AuthorizationServerMetadata.parse(json);
+            if (as.issuer !== issuer.origin) {
+                throw new OAuthError(`Issuer mismatch: expected ${issuer}, got ${as.issuer}`, json);
+            }
+            return as;
+        },
+        /**
+         * Perform the Device Authorization Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+         */
+        async deviceAuthorizationRequest() {
+            assertAs(as);
+            const response = await fetch(as.device_authorization_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({
+                    client_id: clientId,
+                    scope: 'openid offline_access',
+                }),
+            });
+            const json = await response.json();
+            const parsed = DeviceAuthorization.safeParse(json);
+            if (!parsed.success) {
+                throw new OAuthError(`Failed to parse device authorization response: ${parsed.error.message}`, json);
+            }
+            return {
+                device_code: parsed.data.device_code,
+                user_code: parsed.data.user_code,
+                verification_uri: parsed.data.verification_uri,
+                verification_uri_complete: parsed.data.verification_uri_complete,
+                expiresAt: Date.now() + parsed.data.expires_in * 1000,
+                interval: parsed.data.interval,
+            };
+        },
+        /**
+         * Perform the Device Access Token Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+         */
+        async deviceAccessTokenRequest(device_code) {
+            assertAs(as);
+            try {
+                return [
+                    null,
+                    await fetch(as.token_endpoint, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'user-agent': userAgent,
+                        },
+                        body: new URLSearchParams({
+                            client_id: clientId,
+                            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                            device_code,
+                        }),
+                        signal: AbortSignal.timeout(10 * 1000),
+                    }),
+                ];
+            }
+            catch (error) {
+                if (error instanceof Error)
+                    return [error];
+                return [
+                    new Error('An unknown error occurred. See the logs for details.', {
+                        cause: error,
+                    }),
+                ];
+            }
+        },
+        /**
+         * Process the Token request Response
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+         */
+        async processTokenResponse(response) {
+            const json = await response.json();
+            const processed = TokenSet.safeParse(json);
+            if (!processed.success) {
+                return [
+                    new OAuthError(`Failed to parse token response: ${processed.error.message}`, json),
+                ];
+            }
+            return [null, processed.data];
+        },
+        /**
+         * Perform a Token Revocation Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+         */
+        async revokeToken(token) {
+            assertAs(as);
+            const response = await fetch(as.revocation_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({ token, client_id: clientId }),
+            });
+            if (response.ok)
+                return;
+            const json = await response.json();
+            return new OAuthError('Revocation request failed', json);
+        },
+        /**
+         * Perform Refresh Token Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+         */
+        async refreshToken(token) {
+            assertAs(as);
+            const response = await fetch(as.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({
+                    client_id: clientId,
+                    grant_type: 'refresh_token',
+                    refresh_token: token,
+                }),
+            });
+            const [tokensError, tokenSet] = await this.processTokenResponse(response);
+            if (tokensError)
+                throw tokensError;
+            return tokenSet;
+        },
+        /**
+         * Perform Token Introspection Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+         */
+        async introspectToken(token) {
+            assertAs(as);
+            const response = await fetch(as.introspection_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({ token }),
+            });
+            const json = await response.json();
+            const processed = IntrospectionResponse.safeParse(json);
+            if (!processed.success) {
+                throw new OAuthError(`Failed to parse introspection response: ${processed.error.message}`, json);
+            }
+            return processed.data;
+        },
+    };
+}
+const TokenSet = z.object({
+    /** The access token issued by the authorization server. */
+    access_token: z.string(),
+    /** The type of the token issued */
+    token_type: z.literal('Bearer'),
+    /** The lifetime in seconds of the access token. */
+    expires_in: z.number(),
+    /** The refresh token, which can be used to obtain new access tokens. */
+    refresh_token: z.optional(z.string()),
+    /** The scope of the access token. */
+    scope: z.optional(z.string()),
+});
+const OAuthErrorResponse = z.object({
+    error: z.enum([
+        'invalid_request',
+        'invalid_client',
+        'invalid_grant',
+        'unauthorized_client',
+        'unsupported_grant_type',
+        'invalid_scope',
+        'server_error',
+        // Device Authorization Response Errors
+        'authorization_pending',
+        'slow_down',
+        'access_denied',
+        'expired_token',
+        // Revocation Response Errors
+        'unsupported_token_type',
+    ]),
+    error_description: z.optional(z.string()),
+    error_uri: z.optional(z.string()),
+});
+function processOAuthErrorResponse(json) {
+    try {
+        return OAuthErrorResponse.parse(json);
+    }
+    catch (error) {
+        if (error instanceof z.core.$ZodError) {
+            return new TypeError(`Invalid OAuth error response: ${error.message}`);
+        }
+        return new TypeError('Failed to parse OAuth error response');
+    }
+}
+class OAuthError extends Error {
+    constructor(message, response) {
+        super(message);
+        this.name = 'OAuthError';
+        const error = processOAuthErrorResponse(response);
+        if (error instanceof TypeError) {
+            const message = `Unexpected server response: ${JSON.stringify(response)}`;
+            this.cause = new Error(message, { cause: error });
+            this.code = 'server_error';
+            return;
+        }
+        let cause = error.error;
+        if (error.error_description)
+            cause += `: ${error.error_description}`;
+        if (error.error_uri)
+            cause += ` (${error.error_uri})`;
+        this.cause = new Error(cause.toString());
+        this.code = error.error;
+    }
+}
+function isOAuthError(error) {
+    return error instanceof OAuthError;
+}
+//# sourceMappingURL=oauth.js.map

package/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["oauth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,sBAmPC;AA6ED,oCAEC;AAhWD,4CAA8B;AAE9B,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,6BAA6B,EAAE,CAAC,CAAC,GAAG,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE;CAChC,CAAC,CAAC;AAMH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,yBAAyB,EAAE,CAAC,CAAC,GAAG,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,SAAgB,KAAK,CAAC,MAIrB;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,IAAI,EAA2C,CAAC;IAEhD,SAAS,QAAQ,CAAC,EAAW;QAC3B,IAAI,EAAE;YAAE,OAAO;QACf,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,EAAE,KAAK,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,2BAA2B;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,EACnD;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,SAAS;iBACxB;aACF,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,IAAI,UAAU,CAClB,6BAA6B,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,EACvD,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,0BAA0B;YAuB9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,6BAA6B,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,UAAU,CAClB,kDAAkD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACxE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;gBAC9C,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB;gBAChE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B,CAAC;QACJ,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,wBAAwB,CAC5B,WAAmB;YAEnB,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO;oBACL,IAAI;oBACJ,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;wBAC7B,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,mCAAmC;4BACnD,YAAY,EAAE,SAAS;yBACxB;wBACD,IAAI,EAAE,IAAI,eAAe,CAAC;4BACxB,SAAS,EAAE,QAAQ;4BACnB,UAAU,EAAE,8CAA8C;4BAC1D,WAAW;yBACZ,CAAC;wBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;qBACvC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3C,OAAO;oBACL,IAAI,KAAK,CAAC,sDAAsD,EAAE;wBAChE,KAAK,EAAE,KAAK;qBACb,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,oBAAoB,CACxB,QAAkB;YAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,UAAU,CACZ,mCAAmC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAC5D,IAAI,CACL;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,mBAAmB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO;YACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,OAAO,IAAI,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa;YAC9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,KAAK;iBACrB,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC1E,IAAI,WAAW;gBAAE,MAAM,WAAW,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,eAAe,CACnB,KAAa;YAEb,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,sBAAsB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;aACrC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,UAAU,CAClB,2CAA2C,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,mDAAmD;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,qCAAqC;IACrC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAIH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,qBAAqB;QACrB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,uCAAuC;QACvC,uBAAuB;QACvB,WAAW;QACX,eAAe;QACf,eAAe;QACf,6BAA6B;QAC7B,wBAAwB;KACzB,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,SAAS,yBAAyB,CAChC,IAAa;IAEb,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,SAAS,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;IAI5B,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAJjB,SAAI,GAAG,YAAY,CAAC;QAKlB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACrE,IAAI,KAAK,CAAC,SAAS;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;QAEtD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,UAAU,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vercel/cli-auth",
   "description": "Used by Vercel's CLIs to handle authentication",
-  "version": "0.1.0-canary.20260211174907.cdd2da6",
+  "version": "0.1.0",
   "publishConfig": {
     "access": "public"
   },
@@ -19,6 +19,7 @@
     "!**/*.test.ts"
   ],
   "dependencies": {
+    "@napi-rs/keyring": "1.2.0",
     "async-listen": "3.0.0",
     "open": "8.4.0",
     "xdg-app-paths": "5",

package/sso.d.ts

@@ -0,0 +1,24 @@
+import * as z from 'zod/mini';
+import type { OAuth } from './oauth';
+import type { Credentials } from './credentials-store';
+/**
+ * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
+ * the SSO flow. Use when the user's SSO session has expired or missing.
+ *
+ */
+export declare function reauthorizeTeam(params: {
+    /** The team's slug that requires re-authorization */
+    team: string;
+    /** The current access token that needs to be re-authorized */
+    token: Credentials['token'];
+    oauth: OAuth;
+}): Promise<void>;
+declare const SSOError: z.ZodMiniObject<{
+    code: z.ZodMiniString<string>;
+    message: z.ZodMiniString<string>;
+    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    enforced: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strip>;
+/** Parse an error-like object to determine if SSO re-authorization is required. */
+export declare function parseSSOError(error: unknown): z.infer<typeof SSOError> | undefined;
+export {};