@vercel/cli-auth 0.1.0-canary.20260211174907.cdd2da6 → 0.1.1

package/credentials-store.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod/mini';
+declare const Credentials: z.ZodMiniObject<{
+    /** An `access_token` obtained using the OAuth Device Authorization flow. */
+    token: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
+    refreshToken: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    /**
+     * The absolute time (seconds) when the {@link Credentials.token} expires.
+     * Used to optimistically check if the token is still valid.
+     */
+    expiresAt: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+    /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
+    skipWrite: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+    '// Note': z.ZodMiniOptional<z.ZodMiniString<string>>;
+    '// Docs': z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+export type Credentials = z.infer<typeof Credentials>;
+/**
+ * Returns in which directory the config should be present
+ * @internal Should only be used in {@link CredentialsStore} or tests.
+ */
+export declare function getGlobalPathConfig(dir: string): string;
+export declare function CredentialsStore(dir: string): {
+    configPath: string;
+    get(): Credentials;
+    /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
+    update(config: Partial<Credentials>): void;
+};
+export {};

package/credentials-store.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGlobalPathConfig = getGlobalPathConfig;
+exports.CredentialsStore = CredentialsStore;
+const node_path_1 = __importDefault(require("node:path"));
+const fs = __importStar(require("node:fs"));
+const node_os_1 = require("node:os");
+// NOTE: We are pinned on v5 because newer versions behave differently
+// when there are dots in the application name, eg. `com.vercel.cli` becomes `com.vercel`
+const xdg_app_paths_1 = __importDefault(require("xdg-app-paths"));
+const mini_1 = require("zod/mini");
+const Credentials = mini_1.z.object({
+    /** An `access_token` obtained using the OAuth Device Authorization flow. */
+    token: mini_1.z.optional(mini_1.z.string()),
+    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
+    refreshToken: mini_1.z.optional(mini_1.z.string()),
+    /**
+     * The absolute time (seconds) when the {@link Credentials.token} expires.
+     * Used to optimistically check if the token is still valid.
+     */
+    expiresAt: mini_1.z.optional(mini_1.z.number()),
+    /** Whether to skip writing the credentials to disk during {@link CredentialsStore.update} */
+    skipWrite: mini_1.z.optional(mini_1.z.boolean()),
+    '// Note': mini_1.z.optional(mini_1.z.string()),
+    '// Docs': mini_1.z.optional(mini_1.z.string()),
+});
+/** Returns whether a directory exists */
+function isDirectory(path) {
+    try {
+        return fs.lstatSync(path).isDirectory();
+    }
+    catch (_) {
+        // We don't care which kind of error occured, it isn't a directory anyway.
+        return false;
+    }
+}
+/**
+ * Returns in which directory the config should be present
+ * @internal Should only be used in {@link CredentialsStore} or tests.
+ */
+function getGlobalPathConfig(dir) {
+    const vercelDirectories = (0, xdg_app_paths_1.default)(dir).dataDirs();
+    const possibleConfigPaths = [
+        ...vercelDirectories, // latest vercel directory
+        node_path_1.default.join((0, node_os_1.homedir)(), '.now'), // legacy config in user's home directory
+        ...(0, xdg_app_paths_1.default)('now').dataDirs(), // legacy XDG directory
+    ];
+    // The customPath flag is the preferred location,
+    // followed by the vercel directory,
+    // followed by the now directory.
+    // If none of those exist, use the vercel directory.
+    return (possibleConfigPaths.find(configPath => isDirectory(configPath)) ||
+        vercelDirectories[0]);
+}
+function CredentialsStore(dir) {
+    const configPath = node_path_1.default.join(getGlobalPathConfig(dir), 'auth.json');
+    return {
+        configPath,
+        get() {
+            return Credentials.parse(JSON.parse(fs.readFileSync(configPath, 'utf8')));
+        },
+        /** Update the credentials store. If `skipWrite` is set, the update will be skipped. */
+        update(config) {
+            if (config.skipWrite)
+                return;
+            const parsedConfig = Credentials.parse(config);
+            fs.mkdirSync(node_path_1.default.dirname(configPath), { recursive: true });
+            fs.writeFileSync(configPath, JSON.stringify(parsedConfig, null, 2) + '\n', { mode: 0o600 });
+        },
+    };
+}
+//# sourceMappingURL=credentials-store.js.map

package/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["credentials-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,kDAiBC;AAED,4CAmBC;AA9ED,0DAA6B;AAC7B,4CAA8B;AAC9B,qCAAkC;AAClC,sEAAsE;AACtE,yFAAyF;AACzF,kEAAwC;AACxC,mCAA6B;AAE7B,MAAM,WAAW,GAAG,QAAC,CAAC,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,KAAK,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,YAAY,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACjC,6FAA6F;IAC7F,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,OAAO,EAAE,CAAC;IAClC,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,QAAC,CAAC,QAAQ,CAAC,QAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,yCAAyC;AACzC,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,iBAAiB,GAAG,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEtD,MAAM,mBAAmB,GAAG;QAC1B,GAAG,iBAAiB,EAAE,0BAA0B;QAChD,mBAAI,CAAC,IAAI,CAAC,IAAA,iBAAO,GAAE,EAAE,MAAM,CAAC,EAAE,yCAAyC;QACvE,GAAG,IAAA,uBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;KAC1D,CAAC;IAEF,iDAAiD;IACjD,oCAAoC;IACpC,iCAAiC;IACjC,oDAAoD;IACpD,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/D,iBAAiB,CAAC,CAAC,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO;QACL,UAAU;QACV,GAAG;YACD,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,MAA4B;YACjC,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO;YAC7B,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,EAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,aAAa,CACd,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC5C,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/oauth.d.ts

@@ -0,0 +1,207 @@
+import * as z from 'zod/mini';
+declare const AuthorizationServerMetadata: z.ZodMiniObject<{
+    issuer: z.ZodMiniURL;
+    device_authorization_endpoint: z.ZodMiniURL;
+    token_endpoint: z.ZodMiniURL;
+    revocation_endpoint: z.ZodMiniURL;
+    jwks_uri: z.ZodMiniURL;
+    introspection_endpoint: z.ZodMiniURL;
+}, z.core.$strip>;
+export type AuthorizationServerMetadata = z.infer<typeof AuthorizationServerMetadata>;
+declare const IntrospectionResponse: z.ZodMiniObject<{
+    active: z.ZodMiniBoolean<boolean>;
+    client_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    session_id: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+export declare function OAuth(config: {
+    issuer: URL;
+    clientId: string;
+    userAgent: string;
+}): {
+    init(): Promise<{
+        as: {
+            issuer: string;
+            device_authorization_endpoint: string;
+            token_endpoint: string;
+            revocation_endpoint: string;
+            jwks_uri: string;
+            introspection_endpoint: string;
+        };
+        init(): Promise</*elided*/ any>;
+        /**
+         * Returns the Authorization Server Metadata
+         *
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+         */
+        authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
+        /**
+         * Perform the Device Authorization Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+         */
+        deviceAuthorizationRequest(): Promise<{
+            /** The device verification code. */
+            device_code: string;
+            /** The end-user verification code. */
+            user_code: string;
+            /**
+             * The minimum amount of time in seconds that the client
+             * SHOULD wait between polling requests to the token endpoint.
+             */
+            interval: number;
+            /** The end-user verification URI on the authorization server. */
+            verification_uri: string;
+            /**
+             * The end-user verification URI on the authorization server,
+             * including the `user_code`, without redirection.
+             */
+            verification_uri_complete: string;
+            /**
+             * The absolute lifetime of the `device_code` and `user_code`.
+             * Calculated from `expires_in`.
+             */
+            expiresAt: number;
+        }>;
+        /**
+         * Perform the Device Access Token Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+         */
+        deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
+        /**
+         * Process the Token request Response
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+         */
+        processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
+        /**
+         * Perform a Token Revocation Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+         */
+        revokeToken(token: string): Promise<OAuthError | undefined>;
+        /**
+         * Perform Refresh Token Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+         */
+        refreshToken(token: string): Promise<TokenSet>;
+        /**
+         * Perform Token Introspection Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+         */
+        introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
+    }>;
+    /**
+     * Returns the Authorization Server Metadata
+     *
+     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+     * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+     */
+    authorizationServerMetadata(): Promise<AuthorizationServerMetadata>;
+    /**
+     * Perform the Device Authorization Request
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+     */
+    deviceAuthorizationRequest(): Promise<{
+        /** The device verification code. */
+        device_code: string;
+        /** The end-user verification code. */
+        user_code: string;
+        /**
+         * The minimum amount of time in seconds that the client
+         * SHOULD wait between polling requests to the token endpoint.
+         */
+        interval: number;
+        /** The end-user verification URI on the authorization server. */
+        verification_uri: string;
+        /**
+         * The end-user verification URI on the authorization server,
+         * including the `user_code`, without redirection.
+         */
+        verification_uri_complete: string;
+        /**
+         * The absolute lifetime of the `device_code` and `user_code`.
+         * Calculated from `expires_in`.
+         */
+        expiresAt: number;
+    }>;
+    /**
+     * Perform the Device Access Token Request
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+     */
+    deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
+    /**
+     * Process the Token request Response
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+     */
+    processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
+    /**
+     * Perform a Token Revocation Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+     */
+    revokeToken(token: string): Promise<OAuthError | undefined>;
+    /**
+     * Perform Refresh Token Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+     */
+    refreshToken(token: string): Promise<TokenSet>;
+    /**
+     * Perform Token Introspection Request.
+     *
+     * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+     */
+    introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
+};
+export type OAuth = ReturnType<typeof OAuth>;
+declare const TokenSet: z.ZodMiniObject<{
+    /** The access token issued by the authorization server. */
+    access_token: z.ZodMiniString<string>;
+    /** The type of the token issued */
+    token_type: z.ZodMiniLiteral<"Bearer">;
+    /** The lifetime in seconds of the access token. */
+    expires_in: z.ZodMiniNumber<number>;
+    /** The refresh token, which can be used to obtain new access tokens. */
+    refresh_token: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    /** The scope of the access token. */
+    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+type TokenSet = z.infer<typeof TokenSet>;
+declare const OAuthErrorResponse: z.ZodMiniObject<{
+    error: z.ZodMiniEnum<{
+        invalid_request: "invalid_request";
+        invalid_client: "invalid_client";
+        invalid_grant: "invalid_grant";
+        unauthorized_client: "unauthorized_client";
+        unsupported_grant_type: "unsupported_grant_type";
+        invalid_scope: "invalid_scope";
+        server_error: "server_error";
+        authorization_pending: "authorization_pending";
+        slow_down: "slow_down";
+        access_denied: "access_denied";
+        expired_token: "expired_token";
+        unsupported_token_type: "unsupported_token_type";
+    }>;
+    error_description: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    error_uri: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+type OAuthErrorResponse = z.infer<typeof OAuthErrorResponse>;
+declare class OAuthError extends Error {
+    name: string;
+    code: OAuthErrorResponse['error'];
+    cause: Error;
+    constructor(message: string, response: unknown);
+}
+export declare function isOAuthError(error: unknown): error is OAuthError;
+export {};

package/oauth.js

@@ -0,0 +1,311 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth = OAuth;
+exports.isOAuthError = isOAuthError;
+const z = __importStar(require("zod/mini"));
+const AuthorizationServerMetadata = z.object({
+    issuer: z.url(),
+    device_authorization_endpoint: z.url(),
+    token_endpoint: z.url(),
+    revocation_endpoint: z.url(),
+    jwks_uri: z.url(),
+    introspection_endpoint: z.url(),
+});
+const DeviceAuthorization = z.object({
+    device_code: z.string(),
+    user_code: z.string(),
+    verification_uri: z.url(),
+    verification_uri_complete: z.url(),
+    expires_in: z.number(),
+    interval: z.number(),
+});
+const IntrospectionResponse = z.object({
+    active: z.boolean(),
+    client_id: z.optional(z.string()),
+    session_id: z.optional(z.string()),
+});
+function OAuth(config) {
+    const { issuer, clientId, userAgent } = config;
+    let as;
+    function assertAs(as) {
+        if (as)
+            return;
+        throw new Error('Authorization Server Metadata not initialized. Call init() first.');
+    }
+    return {
+        async init() {
+            as ??= await this.authorizationServerMetadata();
+            return { ...this, as };
+        },
+        /**
+         * Returns the Authorization Server Metadata
+         *
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
+         * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
+         */
+        async authorizationServerMetadata() {
+            const response = await fetch(new URL('.well-known/openid-configuration', issuer), {
+                headers: {
+                    'Content-Type': 'application/json',
+                    'user-agent': userAgent,
+                },
+            });
+            const json = await response.json();
+            as = AuthorizationServerMetadata.parse(json);
+            if (as.issuer !== issuer.origin) {
+                throw new OAuthError(`Issuer mismatch: expected ${issuer}, got ${as.issuer}`, json);
+            }
+            return as;
+        },
+        /**
+         * Perform the Device Authorization Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+         */
+        async deviceAuthorizationRequest() {
+            assertAs(as);
+            const response = await fetch(as.device_authorization_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({
+                    client_id: clientId,
+                    scope: 'openid offline_access',
+                }),
+            });
+            const json = await response.json();
+            const parsed = DeviceAuthorization.safeParse(json);
+            if (!parsed.success) {
+                throw new OAuthError(`Failed to parse device authorization response: ${parsed.error.message}`, json);
+            }
+            return {
+                device_code: parsed.data.device_code,
+                user_code: parsed.data.user_code,
+                verification_uri: parsed.data.verification_uri,
+                verification_uri_complete: parsed.data.verification_uri_complete,
+                expiresAt: Date.now() + parsed.data.expires_in * 1000,
+                interval: parsed.data.interval,
+            };
+        },
+        /**
+         * Perform the Device Access Token Request
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+         */
+        async deviceAccessTokenRequest(device_code) {
+            assertAs(as);
+            try {
+                return [
+                    null,
+                    await fetch(as.token_endpoint, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'user-agent': userAgent,
+                        },
+                        body: new URLSearchParams({
+                            client_id: clientId,
+                            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                            device_code,
+                        }),
+                        signal: AbortSignal.timeout(10 * 1000),
+                    }),
+                ];
+            }
+            catch (error) {
+                if (error instanceof Error)
+                    return [error];
+                return [
+                    new Error('An unknown error occurred. See the logs for details.', {
+                        cause: error,
+                    }),
+                ];
+            }
+        },
+        /**
+         * Process the Token request Response
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+         */
+        async processTokenResponse(response) {
+            const json = await response.json();
+            const processed = TokenSet.safeParse(json);
+            if (!processed.success) {
+                return [
+                    new OAuthError(`Failed to parse token response: ${processed.error.message}`, json),
+                ];
+            }
+            return [null, processed.data];
+        },
+        /**
+         * Perform a Token Revocation Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+         * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+         */
+        async revokeToken(token) {
+            assertAs(as);
+            const response = await fetch(as.revocation_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({ token, client_id: clientId }),
+            });
+            if (response.ok)
+                return;
+            const json = await response.json();
+            return new OAuthError('Revocation request failed', json);
+        },
+        /**
+         * Perform Refresh Token Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+         */
+        async refreshToken(token) {
+            assertAs(as);
+            const response = await fetch(as.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({
+                    client_id: clientId,
+                    grant_type: 'refresh_token',
+                    refresh_token: token,
+                }),
+            });
+            const [tokensError, tokenSet] = await this.processTokenResponse(response);
+            if (tokensError)
+                throw tokensError;
+            return tokenSet;
+        },
+        /**
+         * Perform Token Introspection Request.
+         *
+         * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+         */
+        async introspectToken(token) {
+            assertAs(as);
+            const response = await fetch(as.introspection_endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'user-agent': userAgent,
+                },
+                body: new URLSearchParams({ token }),
+            });
+            const json = await response.json();
+            const processed = IntrospectionResponse.safeParse(json);
+            if (!processed.success) {
+                throw new OAuthError(`Failed to parse introspection response: ${processed.error.message}`, json);
+            }
+            return processed.data;
+        },
+    };
+}
+const TokenSet = z.object({
+    /** The access token issued by the authorization server. */
+    access_token: z.string(),
+    /** The type of the token issued */
+    token_type: z.literal('Bearer'),
+    /** The lifetime in seconds of the access token. */
+    expires_in: z.number(),
+    /** The refresh token, which can be used to obtain new access tokens. */
+    refresh_token: z.optional(z.string()),
+    /** The scope of the access token. */
+    scope: z.optional(z.string()),
+});
+const OAuthErrorResponse = z.object({
+    error: z.enum([
+        'invalid_request',
+        'invalid_client',
+        'invalid_grant',
+        'unauthorized_client',
+        'unsupported_grant_type',
+        'invalid_scope',
+        'server_error',
+        // Device Authorization Response Errors
+        'authorization_pending',
+        'slow_down',
+        'access_denied',
+        'expired_token',
+        // Revocation Response Errors
+        'unsupported_token_type',
+    ]),
+    error_description: z.optional(z.string()),
+    error_uri: z.optional(z.string()),
+});
+function processOAuthErrorResponse(json) {
+    try {
+        return OAuthErrorResponse.parse(json);
+    }
+    catch (error) {
+        if (error instanceof z.core.$ZodError) {
+            return new TypeError(`Invalid OAuth error response: ${error.message}`);
+        }
+        return new TypeError('Failed to parse OAuth error response');
+    }
+}
+class OAuthError extends Error {
+    constructor(message, response) {
+        super(message);
+        this.name = 'OAuthError';
+        const error = processOAuthErrorResponse(response);
+        if (error instanceof TypeError) {
+            const message = `Unexpected server response: ${JSON.stringify(response)}`;
+            this.cause = new Error(message, { cause: error });
+            this.code = 'server_error';
+            return;
+        }
+        let cause = error.error;
+        if (error.error_description)
+            cause += `: ${error.error_description}`;
+        if (error.error_uri)
+            cause += ` (${error.error_uri})`;
+        this.cause = new Error(cause.toString());
+        this.code = error.error;
+    }
+}
+function isOAuthError(error) {
+    return error instanceof OAuthError;
+}
+//# sourceMappingURL=oauth.js.map

package/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["oauth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,sBAmPC;AA6ED,oCAEC;AAhWD,4CAA8B;AAE9B,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,6BAA6B,EAAE,CAAC,CAAC,GAAG,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE;CAChC,CAAC,CAAC;AAMH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,yBAAyB,EAAE,CAAC,CAAC,GAAG,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,SAAgB,KAAK,CAAC,MAIrB;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,IAAI,EAA2C,CAAC;IAEhD,SAAS,QAAQ,CAAC,EAAW;QAC3B,IAAI,EAAE;YAAE,OAAO;QACf,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,EAAE,KAAK,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,2BAA2B;YAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,EACnD;gBACE,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,SAAS;iBACxB;aACF,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE7C,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,IAAI,UAAU,CAClB,6BAA6B,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,EACvD,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,0BAA0B;YAuB9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,6BAA6B,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,UAAU,CAClB,kDAAkD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACxE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;gBAC9C,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB;gBAChE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B,CAAC;QACJ,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,wBAAwB,CAC5B,WAAmB;YAEnB,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO;oBACL,IAAI;oBACJ,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;wBAC7B,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,mCAAmC;4BACnD,YAAY,EAAE,SAAS;yBACxB;wBACD,IAAI,EAAE,IAAI,eAAe,CAAC;4BACxB,SAAS,EAAE,QAAQ;4BACnB,UAAU,EAAE,8CAA8C;4BAC1D,WAAW;yBACZ,CAAC;wBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;qBACvC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3C,OAAO;oBACL,IAAI,KAAK,CAAC,sDAAsD,EAAE;wBAChE,KAAK,EAAE,KAAK;qBACb,CAAC;iBACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,oBAAoB,CACxB,QAAkB;YAElB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,UAAU,CACZ,mCAAmC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAC5D,IAAI,CACL;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD;;;;;WAKG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,mBAAmB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO;YACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,OAAO,IAAI,UAAU,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa;YAC9B,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,SAAS,EAAE,QAAQ;oBACnB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,KAAK;iBACrB,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC1E,IAAI,WAAW;gBAAE,MAAM,WAAW,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,eAAe,CACnB,KAAa;YAEb,QAAQ,CAAC,EAAE,CAAC,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,sBAAsB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;aACrC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,UAAU,CAClB,2CAA2C,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,2DAA2D;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,mDAAmD;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,wEAAwE;IACxE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,qCAAqC;IACrC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAIH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,qBAAqB;QACrB,wBAAwB;QACxB,eAAe;QACf,cAAc;QACd,uCAAuC;QACvC,uBAAuB;QACvB,WAAW;QACX,eAAe;QACf,eAAe;QACf,6BAA6B;QAC7B,wBAAwB;KACzB,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAIH,SAAS,yBAAyB,CAChC,IAAa;IAEb,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,SAAS,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;IAI5B,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAJjB,SAAI,GAAG,YAAY,CAAC;QAKlB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,CAAC,iBAAiB;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACrE,IAAI,KAAK,CAAC,SAAS;YAAE,KAAK,IAAI,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC;QAEtD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,UAAU,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vercel/cli-auth",
   "description": "Used by Vercel's CLIs to handle authentication",
-  "version": "0.1.0-canary.20260211174907.cdd2da6",
+  "version": "0.1.1",
   "publishConfig": {
     "access": "public"
   },

package/sso.d.ts

@@ -0,0 +1,24 @@
+import * as z from 'zod/mini';
+import type { OAuth } from './oauth';
+import type { Credentials } from './credentials-store';
+/**
+ * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
+ * the SSO flow. Use when the user's SSO session has expired or missing.
+ *
+ */
+export declare function reauthorizeTeam(params: {
+    /** The team's slug that requires re-authorization */
+    team: string;
+    /** The current access token that needs to be re-authorized */
+    token: Credentials['token'];
+    oauth: OAuth;
+}): Promise<void>;
+declare const SSOError: z.ZodMiniObject<{
+    code: z.ZodMiniString<string>;
+    message: z.ZodMiniString<string>;
+    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    enforced: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strip>;
+/** Parse an error-like object to determine if SSO re-authorization is required. */
+export declare function parseSSOError(error: unknown): z.infer<typeof SSOError> | undefined;
+export {};

package/sso.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reauthorizeTeam = reauthorizeTeam;
+exports.parseSSOError = parseSSOError;
+const node_http_1 = __importDefault(require("node:http"));
+const async_listen_1 = require("async-listen");
+const open_1 = __importDefault(require("open"));
+const z = __importStar(require("zod/mini"));
+/**
+ * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
+ * the SSO flow. Use when the user's SSO session has expired or missing.
+ *
+ */
+async function reauthorizeTeam(params) {
+    const { team, token, oauth } = params;
+    if (!token) {
+        throw new TypeError('Token is missing, cannot initiate SSO re-authorization. Please log in again.');
+    }
+    const introspection = await oauth.introspectToken(token);
+    const { active, session_id, client_id } = introspection;
+    if (!active || !session_id || !client_id) {
+        throw new Error('Introspection failed. Token is either expired or otherwise invalid. Please log in again.');
+    }
+    const verificationToken = await waitForVerification({
+        team,
+        session_id,
+        client_id,
+    });
+    await fetch(`https://api.vercel.com/registration/verify?${new URLSearchParams({ token: verificationToken })}`);
+}
+/**
+ * Get a verification token by spawning a localhost HTTP server
+ * that gets redirected to as the OAuth callback URL.
+ *
+ * The token returned can be sent back to the Vercel API to complete
+ * the SSO re-authorization.
+ */
+async function waitForVerification(params) {
+    const { team, session_id, client_id } = params;
+    const server = node_http_1.default.createServer();
+    const { port } = await (0, async_listen_1.listen)(server, 0, '127.0.0.1');
+    const initSSOUrl = new URL(`/sso/${team}?${new URLSearchParams({
+        session_id,
+        client_id,
+        next: `http://localhost:${port}`,
+    })}`, `https://vercel.com`);
+    try {
+        const [query] = await Promise.all([
+            new Promise((resolve, reject) => {
+                server.once('request', (req, res) => {
+                    // Close the HTTP connection to prevent `server.close()` from hanging
+                    res.setHeader('connection', 'close');
+                    const { searchParams } = new URL(req.url || '/', 'http://localhost');
+                    resolve(searchParams);
+                    // Redirect the user back to the Vercel login notification page
+                    res.statusCode = 302;
+                    res.setHeader('location', getNotificationUrl(searchParams)).end();
+                });
+                server.once('error', reject);
+            }),
+            (0, open_1.default)(initSSOUrl.href),
+        ]);
+        const loginError = query.get('loginError');
+        if (loginError) {
+            const error = new Error('Login failed.');
+            error.cause = JSON.parse(loginError);
+            throw error;
+        }
+        const token = query.get('token');
+        if (!token) {
+            throw new TypeError('Could not get verification token. Please contact support.');
+        }
+        return token;
+    }
+    finally {
+        server.close();
+    }
+}
+function getNotificationUrl(params) {
+    const loginState = params.has('loginError')
+        ? 'failed'
+        : params.has('ssoEmail')
+            ? 'incomplete'
+            : 'success';
+    return `https://vercel.com/notifications/cli-login-${loginState}?${params}`;
+}
+const SSOError = z.object({
+    code: z.string(),
+    message: z.string(),
+    scope: z.optional(z.string()),
+    enforced: z.optional(z.boolean()),
+});
+/** Parse an error-like object to determine if SSO re-authorization is required. */
+function parseSSOError(error) {
+    const { data } = SSOError.safeParse(error);
+    if (!data?.enforced)
+        return;
+    return data;
+}
+//# sourceMappingURL=sso.js.map

package/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["sso.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,0CAiCC;AAmFD,sCAMC;AAtID,0DAA6B;AAC7B,+CAAsC;AACtC,gDAAwB;AACxB,4CAA8B;AAI9B;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,MAMrC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CACjB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IAExD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,IAAI;QACJ,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,KAAK,CACT,8CAA8C,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAClG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAIlC;IACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,mBAAI,CAAC,YAAY,EAAE,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,qBAAM,EAAC,MAAM,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,QAAQ,IAAI,IAAI,IAAI,eAAe,CAAC;QAClC,UAAU;QACV,SAAS;QACT,IAAI,EAAE,oBAAoB,IAAI,EAAE;KACjC,CAAC,EAAE,EACJ,oBAAoB,CACrB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChC,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAClC,qEAAqE;oBACrE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBAErC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;oBACrE,OAAO,CAAC,YAAY,CAAC,CAAC;oBAEtB,+DAA+D;oBAC/D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACpE,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC,CAAC;YACF,IAAA,cAAI,EAAC,UAAU,CAAC,IAAI,CAAC;SACtB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,8CAA8C,UAAU,IAAI,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,mFAAmF;AACnF,SAAgB,aAAa,CAC3B,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/user-agent.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Get the user agent string for the current environment.
+ *
+ * @exapmle
+ * ```
+ * getUserAgent({ name: 'my-cli', version: '1.0.0' });
+ * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
+ * ```
+ */
+export declare function getUserAgent(pkg: {
+    name: string;
+    version: string;
+}): string;

package/user-agent.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUserAgent = getUserAgent;
+const node_os_1 = __importDefault(require("node:os"));
+/**
+ * Get the user agent string for the current environment.
+ *
+ * @exapmle
+ * ```
+ * getUserAgent({ name: 'my-cli', version: '1.0.0' });
+ * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
+ * ```
+ */
+function getUserAgent(pkg) {
+    return `${node_os_1.default.hostname()} @ ${pkg.name} ${pkg.version} node-${process.version} ${node_os_1.default.platform()} (${node_os_1.default.arch()})`;
+}
+//# sourceMappingURL=user-agent.js.map

package/user-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.js","sourceRoot":"","sources":["user-agent.ts"],"names":[],"mappings":";;;;;AAWA,oCAIC;AAfD,sDAAyB;AAEzB;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,GAAsC;IACjE,OAAO,GAAG,iBAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,SAClD,OAAO,CAAC,OACV,IAAI,iBAAE,CAAC,QAAQ,EAAE,KAAK,iBAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AACrC,CAAC"}