@vercel/functions 2.2.8 → 2.2.12

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @vercel/functions
 
+## 2.2.12
+
+### Patch Changes
+
+- Fix package versions for oidc-aws-credentials-provider, vercel/functions, and publish the next version of vercel/oidc ([#13765](https://github.com/vercel/vercel/pull/13765))
+
+- Updated dependencies [[`2f5244647dc7d2c81bb688035952d4d45b6d707e`](https://github.com/vercel/vercel/commit/2f5244647dc7d2c81bb688035952d4d45b6d707e)]:
+  - @vercel/oidc@2.0.1
+
+## 2.2.11
+
+### Patch Changes
+
+- Fix dependency ([#13726](https://github.com/vercel/vercel/pull/13726))
+
+## 2.2.10
+
+### Patch Changes
+
+- Update dependency ([#13722](https://github.com/vercel/vercel/pull/13722))
+
+## 2.2.9
+
+### Patch Changes
+
+- Extract AWS dynamic import to async loader with error handling ([#13660](https://github.com/vercel/vercel/pull/13660))
+
+- Updated dependencies [[`a133e534e7dfd785beeeb0dcafed8d2c991e9f11`](https://github.com/vercel/vercel/commit/a133e534e7dfd785beeeb0dcafed8d2c991e9f11)]:
+  - @vercel/oidc@2.1.0
+
 ## 2.2.8
 
 ### Patch Changes

package/docs/modules/oidc.md

@@ -18,46 +18,19 @@
 
 ▸ **awsCredentialsProvider**(`init`): `AwsCredentialIdentityProvider`
 
-Obtains the Vercel OIDC token and creates an AWS credential provider function
-that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
-
-**`Example`**
-
-```js
-import * as s3 from '@aws-sdk/client-s3';
-import { awsCredentialsProvider } from '@vercel/functions/oidc';
-
-const s3Client = new s3.S3Client({
-  credentials: awsCredentialsProvider({
-    roleArn: 'arn:aws:iam::1234567890:role/RoleA',
-    clientConfig: { region: 'us-west-2' },
-    clientPlugins: [addFooHeadersPlugin],
-    roleAssumerWithWebIdentity: customRoleAssumer,
-    roleSessionName: 'session_123',
-    providerId: 'graph.facebook.com',
-    policyArns: [{ arn: 'arn:aws:iam::1234567890:policy/SomePolicy' }],
-    policy:
-      '{"Statement": [{"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "*"}]}',
-    durationSeconds: 7200,
-  }),
-});
-```
-
 #### Parameters
 
-| Name   | Type                                                                             | Description                |
-| :----- | :------------------------------------------------------------------------------- | :------------------------- |
-| `init` | [`AwsCredentialsProviderInit`](../interfaces/oidc.AwsCredentialsProviderInit.md) | The initialization object. |
+| Name   | Type                                                                             |
+| :----- | :------------------------------------------------------------------------------- |
+| `init` | [`AwsCredentialsProviderInit`](../interfaces/oidc.AwsCredentialsProviderInit.md) |
 
 #### Returns
 
 `AwsCredentialIdentityProvider`
 
-A function that provides AWS credentials.
-
 #### Defined in
 
-[packages/functions/src/oidc/aws-credentials-provider.ts:60](https://github.com/vercel/vercel/blob/main/packages/functions/src/oidc/aws-credentials-provider.ts#L60)
+[packages/functions/src/oidc/aws-credentials-provider.ts:70](https://github.com/vercel/vercel/blob/main/packages/functions/src/oidc/aws-credentials-provider.ts#L70)
 
 ---
 
@@ -72,9 +45,13 @@ Do not cache this value, as it is subject to change in production!
 This function is used to retrieve the OIDC token from the request context or the environment variable.
 It checks for the `x-vercel-oidc-token` header in the request context and falls back to the `VERCEL_OIDC_TOKEN` environment variable if the header is not present.
 
+Unlike the `getVercelOidcTokenSync` function, this function will refresh the token if it is expired in a development environment.
+
 **`Throws`**
 
-If the `x-vercel-oidc-token` header is missing from the request context and the environment variable `VERCEL_OIDC_TOKEN` is not set.
+If the `x-vercel-oidc-token` header is missing from the request context and the environment variable `VERCEL_OIDC_TOKEN` is not set. If the token
+is expired in a development environment, will also throw an error if the token cannot be refreshed: no CLI credentials are available, CLI credentials are expired, no project configuration is available
+or the token refresh request fails.
 
 **`Example`**
 
@@ -97,7 +74,7 @@ A promise that resolves to the OIDC token.
 
 #### Defined in
 
-packages/oidc/dist/get-vercel-oidc-token.d.ts:23
+packages/oidc/dist/get-vercel-oidc-token.d.ts:27
 
 ---
 
@@ -112,6 +89,8 @@ Do not cache this value, as it is subject to change in production!
 This function is used to retrieve the OIDC token from the request context or the environment variable.
 It checks for the `x-vercel-oidc-token` header in the request context and falls back to the `VERCEL_OIDC_TOKEN` environment variable if the header is not present.
 
+This function will not refresh the token if it is expired. For refreshing the token, use the @{link getVercelOidcToken} function.
+
 **`Throws`**
 
 If the `x-vercel-oidc-token` header is missing from the request context and the environment variable `VERCEL_OIDC_TOKEN` is not set.
@@ -132,4 +111,4 @@ The OIDC token.
 
 #### Defined in
 
-packages/oidc/dist/get-vercel-oidc-token.d.ts:43
+packages/oidc/dist/get-vercel-oidc-token.d.ts:49

package/oidc/aws-credentials-provider.d.ts

@@ -17,41 +17,4 @@ import type { FromWebTokenInit } from '@aws-sdk/credential-provider-web-identity
 export interface AwsCredentialsProviderInit// eslint-disable-line @typescript-eslint/no-empty-interface
  extends Omit<FromWebTokenInit, 'webIdentityToken'> {
 }
-/**
- * Obtains the Vercel OIDC token and creates an AWS credential provider function
- * that gets AWS credentials by calling STS AssumeRoleWithWebIdentity API.
- *
- * @param {AwsCredentialsProviderInit} init - The initialization object.
- * @param {string} init.roleArn - ARN of the role that the caller is assuming.
- * @param {Object} [init.clientConfig] - Custom STS client configurations overriding the default ones.
- * @param {Array} [init.clientPlugins] - Custom STS client middleware plugin to modify the client default behavior.
- * @param {Function} [init.roleAssumerWithWebIdentity] - A function that assumes a role with web identity and returns a promise fulfilled with credentials for the assumed role.
- * @param {string} [init.roleSessionName] - An identifier for the assumed role session.
- * @param {string} [init.providerId] - The fully qualified host component of the domain name of the identity provider.
- * @param {Array} [init.policyArns] - ARNs of the IAM managed policies that you want to use as managed session policies.
- * @param {string} [init.policy] - An IAM policy in JSON format that you want to use as an inline session policy.
- * @param {number} [init.durationSeconds=3600] - The duration, in seconds, of the role session. Defaults to 3600 seconds.
- *
- * @returns {AwsCredentialIdentityProvider} A function that provides AWS credentials.
- *
- * @example
- * ```js
- * import * as s3 from '@aws-sdk/client-s3';
- * import { awsCredentialsProvider } from '@vercel/functions/oidc';
- *
- * const s3Client = new s3.S3Client({
- *   credentials: awsCredentialsProvider({
- *     roleArn: "arn:aws:iam::1234567890:role/RoleA",
- *     clientConfig: { region: "us-west-2" },
- *     clientPlugins: [addFooHeadersPlugin],
- *     roleAssumerWithWebIdentity: customRoleAssumer,
- *     roleSessionName: "session_123",
- *     providerId: "graph.facebook.com",
- *     policyArns: [{ arn: "arn:aws:iam::1234567890:policy/SomePolicy" }],
- *     policy: "{\"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"s3:ListBucket\", \"Resource\": \"*\"}]}",
- *     durationSeconds: 7200
- *   }),
- * });
- * ```
- */
 export declare function awsCredentialsProvider(init: AwsCredentialsProviderInit): AwsCredentialIdentityProvider;

package/oidc/aws-credentials-provider.js

@@ -32,9 +32,18 @@ __export(aws_credentials_provider_exports, {
 });
 module.exports = __toCommonJS(aws_credentials_provider_exports);
 var import_oidc = require("@vercel/oidc");
+async function loadAwsCredentialProviderWebIdentity() {
+  try {
+    return await import("@aws-sdk/credential-provider-web-identity");
+  } catch (err) {
+    throw new Error(
+      "package '@aws-sdk/credential-provider-web-identity' not found"
+    );
+  }
+}
 function awsCredentialsProvider(init) {
   return async () => {
-    const { fromWebToken } = await import("@aws-sdk/credential-provider-web-identity");
+    const { fromWebToken } = await loadAwsCredentialProviderWebIdentity();
     return fromWebToken({
       ...init,
       webIdentityToken: (0, import_oidc.getVercelOidcTokenSync)()

package/package.json

@@ -30,7 +30,7 @@
       "require": "./middleware.js"
     }
   },
-  "version": "2.2.8",
+  "version": "2.2.12",
   "repository": {
     "directory": "packages/functions",
     "type": "git",
@@ -72,7 +72,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@vercel/oidc": "2.0.0"
+    "@vercel/oidc": "2.0.1"
   },
   "scripts": {
     "pretest": "pnpm run build:code",