@vercel/oidc 3.0.5 → 3.2.0

package/dist/get-vercel-oidc-token.test.js

@@ -0,0 +1,363 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_crypto = require("crypto");
+var import_vitest = require("vitest");
+var os = __toESM(require("os"));
+var path = __toESM(require("path"));
+var fs = __toESM(require("fs"));
+var import_token_io = require("./token-io");
+var import_get_vercel_oidc_token = require("./get-vercel-oidc-token");
+var tokenUtil = __toESM(require("./token-util"));
+import_vitest.vi.mock("./token-io");
+import_vitest.vi.mock("./get-context", () => ({
+  getContext: () => ({ headers: {} })
+}));
+(0, import_vitest.describe)("getVercelOidcToken - Error Scenarios", () => {
+  let rootDir;
+  let userDataDir;
+  let cliDataDir;
+  let tokenDataDir;
+  const projectId = "prj_test123";
+  const teamId = "team_test456";
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.clearAllMocks();
+    import_vitest.vi.restoreAllMocks();
+    process.env.VERCEL_OIDC_TOKEN = void 0;
+    const random = `test-${(0, import_crypto.randomUUID)()}`;
+    rootDir = path.join(os.tmpdir(), random);
+    userDataDir = path.join(rootDir, "data");
+    cliDataDir = path.join(userDataDir, "com.vercel.cli");
+    tokenDataDir = path.join(userDataDir, "com.vercel.token");
+    fs.mkdirSync(cliDataDir, { recursive: true });
+    fs.mkdirSync(tokenDataDir, { recursive: true });
+    fs.mkdirSync(path.join(rootDir, ".vercel"), {
+      recursive: true
+    });
+    import_vitest.vi.spyOn(process, "cwd").mockReturnValue(rootDir);
+    import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(rootDir);
+    import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(userDataDir);
+  });
+  (0, import_vitest.afterEach)(() => {
+    if (fs.existsSync(rootDir)) {
+      fs.rmSync(rootDir, { recursive: true, force: true });
+    }
+  });
+  (0, import_vitest.test)("should throw AccessTokenMissingError when CLI auth file is missing", async () => {
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: teamId })
+    );
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /No authentication found/
+    );
+  });
+  (0, import_vitest.test)("should throw helpful error when project.json is missing", async () => {
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /project\.json not found, have you linked your project with `vc link\?`/
+    );
+  });
+  (0, import_vitest.test)("should throw helpful error when root directory cannot be found", async () => {
+    import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(null);
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /Unable to find project root directory\. Have you linked your project with `vc link\?`/
+    );
+  });
+  (0, import_vitest.test)("should throw helpful error when user data directory cannot be found", async () => {
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: teamId })
+    );
+    import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(null);
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /Unable to find user data directory\. Please reach out to Vercel support\./
+    );
+  });
+  (0, import_vitest.test)("should throw helpful error when API returns non-200", async () => {
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: teamId })
+    );
+    import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockRejectedValue(
+      new Error("Failed to refresh OIDC token: Unauthorized")
+    );
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /Failed to refresh OIDC token: Unauthorized/
+    );
+  });
+  (0, import_vitest.test)("should throw helpful error when token response is malformed", async () => {
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: teamId })
+    );
+    import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockRejectedValue(
+      new TypeError(
+        "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+      )
+    );
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /Vercel OIDC token is malformed\. Expected a string-valued token property\. Please run `vc env pull` and try again/
+    );
+  });
+  (0, import_vitest.test)("should throw helpful error when token has invalid format", async () => {
+    process.env.VERCEL_OIDC_TOKEN = "not-a-valid-jwt-token";
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockImplementation(() => {
+      throw new Error("Invalid token. Please run `vc env pull` and try again");
+    });
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /Invalid token\. Please run `vc env pull` and try again/
+    );
+  });
+  (0, import_vitest.test)("should throw error when token expiry check fails", async () => {
+    process.env.VERCEL_OIDC_TOKEN = "not-a-jwt-token";
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(
+      /Invalid token\. Please run `vc env pull` and try again/
+    );
+  });
+  (0, import_vitest.test)("should fail when no token exists and no CLI credentials available", async () => {
+    process.env.VERCEL_OIDC_TOKEN = void 0;
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(/Invalid token/);
+  });
+  (0, import_vitest.test)("should propagate filesystem errors when saving token fails", async () => {
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: teamId })
+    );
+    import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: "new-valid-token"
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 - 1e3
+    });
+    import_vitest.vi.spyOn(tokenUtil, "saveToken").mockImplementation(() => {
+      throw new Error("EACCES: permission denied");
+    });
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token.getVercelOidcToken)()).rejects.toThrow(/EACCES|permission/i);
+  });
+  (0, import_vitest.test)("should succeed when valid token exists in env", async () => {
+    const validToken = createValidToken();
+    process.env.VERCEL_OIDC_TOKEN = validToken;
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 + 43200
+    });
+    const token = await (0, import_get_vercel_oidc_token.getVercelOidcToken)();
+    (0, import_vitest.expect)(token).toBe(validToken);
+  });
+  (0, import_vitest.test)("should refresh when token is expired but all configs are valid", async () => {
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: teamId })
+    );
+    const newToken = createValidToken("new-token");
+    import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: newToken
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValueOnce({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 - 1e3
+    }).mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 + 43200
+    });
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    const token = await (0, import_get_vercel_oidc_token.getVercelOidcToken)();
+    (0, import_vitest.expect)(token).toBe(newToken);
+  });
+  (0, import_vitest.test)("should use provided team and project for refresh instead of reading project.json", async () => {
+    const customProjectId = "prj_custom123";
+    const customTeamId = "team_custom456";
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    const newToken = createValidToken("custom-token");
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: newToken
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValueOnce({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 - 1e3
+    }).mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 + 43200
+    });
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    const token = await (0, import_get_vercel_oidc_token.getVercelOidcToken)({
+      team: customTeamId,
+      project: customProjectId
+    });
+    (0, import_vitest.expect)(token).toBe(newToken);
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test-auth-token",
+      customProjectId,
+      customTeamId
+    );
+  });
+  (0, import_vitest.test)("should use provided project and read team from project.json", async () => {
+    const customProjectId = "prj_custom234";
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId: "original-project-id", orgId: teamId })
+    );
+    const newToken = createValidToken("partial-custom-token");
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: newToken
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValueOnce({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 - 1e3
+    }).mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 + 43200
+    });
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    const token = await (0, import_get_vercel_oidc_token.getVercelOidcToken)({
+      project: customProjectId
+    });
+    (0, import_vitest.expect)(token).toBe(newToken);
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test-auth-token",
+      customProjectId,
+      teamId
+    );
+  });
+  (0, import_vitest.test)("should use provided team and read project from project.json", async () => {
+    const customTeamId = "team_custom789";
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test-auth-token" })
+    );
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: "original-team-id" })
+    );
+    const newToken = createValidToken("partial-custom-token-2");
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: newToken
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValueOnce({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 - 1e3
+    }).mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 + 43200
+    });
+    process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
+    const token = await (0, import_get_vercel_oidc_token.getVercelOidcToken)({
+      team: customTeamId
+    });
+    (0, import_vitest.expect)(token).toBe(newToken);
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test-auth-token",
+      projectId,
+      customTeamId
+    );
+  });
+  (0, import_vitest.test)("should not refresh when token is valid even with options provided", async () => {
+    const validToken = createValidToken();
+    process.env.VERCEL_OIDC_TOKEN = validToken;
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: "should-not-be-called"
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() / 1e3 + 43200
+    });
+    const token = await (0, import_get_vercel_oidc_token.getVercelOidcToken)({
+      team: "custom-team",
+      project: "custom-project"
+    });
+    (0, import_vitest.expect)(token).toBe(validToken);
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).not.toHaveBeenCalled();
+  });
+});
+function createExpiredToken() {
+  const header = Buffer.from(
+    JSON.stringify({ alg: "RS256", typ: "JWT" })
+  ).toString("base64url");
+  const payload = Buffer.from(
+    JSON.stringify({
+      sub: "test-sub",
+      exp: 1,
+      iat: 1
+    })
+  ).toString("base64url");
+  return `${header}.${payload}.fake_signature`;
+}
+function createValidToken(value = "valid-token") {
+  const header = Buffer.from(
+    JSON.stringify({ alg: "RS256", typ: "JWT" })
+  ).toString("base64url");
+  const payload = Buffer.from(
+    JSON.stringify({
+      sub: "test-sub",
+      exp: Math.floor(Date.now() / 1e3) + 43200,
+      iat: Math.floor(Date.now() / 1e3)
+    })
+  ).toString("base64url");
+  return `${header}.${payload}.fake_signature_${value}`;
+}

package/dist/index-browser.d.ts

@@ -1,3 +1,5 @@
 export { getContext } from './get-context';
+export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
 export declare function getVercelOidcToken(): Promise<string>;
 export declare function getVercelOidcTokenSync(): string;
+export declare function getVercelToken(): Promise<string>;

package/dist/index-browser.js

@@ -18,21 +18,31 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var index_browser_exports = {};
 __export(index_browser_exports, {
+  AccessTokenMissingError: () => import_auth_errors.AccessTokenMissingError,
+  RefreshAccessTokenFailedError: () => import_auth_errors.RefreshAccessTokenFailedError,
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => getVercelOidcToken,
-  getVercelOidcTokenSync: () => getVercelOidcTokenSync
+  getVercelOidcTokenSync: () => getVercelOidcTokenSync,
+  getVercelToken: () => getVercelToken
 });
 module.exports = __toCommonJS(index_browser_exports);
 var import_get_context = require("./get-context");
+var import_auth_errors = require("./auth-errors");
 async function getVercelOidcToken() {
   return "";
 }
 function getVercelOidcTokenSync() {
   return "";
 }
+async function getVercelToken() {
+  throw new Error("getVercelToken is not supported in browser environments");
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AccessTokenMissingError,
+  RefreshAccessTokenFailedError,
   getContext,
   getVercelOidcToken,
-  getVercelOidcTokenSync
+  getVercelOidcTokenSync,
+  getVercelToken
 });

package/dist/index.d.ts

@@ -1,2 +1,4 @@
 export { getVercelOidcToken, getVercelOidcTokenSync, } from './get-vercel-oidc-token';
 export { getContext } from './get-context';
+export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
+export { getVercelToken } from './token-util';

package/dist/index.js

@@ -18,16 +18,24 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var src_exports = {};
 __export(src_exports, {
+  AccessTokenMissingError: () => import_auth_errors.AccessTokenMissingError,
+  RefreshAccessTokenFailedError: () => import_auth_errors.RefreshAccessTokenFailedError,
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => import_get_vercel_oidc_token.getVercelOidcToken,
-  getVercelOidcTokenSync: () => import_get_vercel_oidc_token.getVercelOidcTokenSync
+  getVercelOidcTokenSync: () => import_get_vercel_oidc_token.getVercelOidcTokenSync,
+  getVercelToken: () => import_token_util.getVercelToken
 });
 module.exports = __toCommonJS(src_exports);
 var import_get_vercel_oidc_token = require("./get-vercel-oidc-token");
 var import_get_context = require("./get-context");
+var import_auth_errors = require("./auth-errors");
+var import_token_util = require("./token-util");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AccessTokenMissingError,
+  RefreshAccessTokenFailedError,
   getContext,
   getVercelOidcToken,
-  getVercelOidcTokenSync
+  getVercelOidcTokenSync,
+  getVercelToken
 });

package/dist/oauth.d.ts

@@ -0,0 +1,17 @@
+export interface TokenSet {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+}
+/**
+ * Refresh an OAuth access token using a refresh token
+ */
+export declare function refreshTokenRequest(options: {
+    refresh_token: string;
+}): Promise<Response>;
+/**
+ * Process the token response and extract the token set
+ */
+export declare function processTokenResponse(response: Response): Promise<[Error] | [null, TokenSet]>;

package/dist/oauth.js

@@ -0,0 +1,88 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var oauth_exports = {};
+__export(oauth_exports, {
+  processTokenResponse: () => processTokenResponse,
+  refreshTokenRequest: () => refreshTokenRequest
+});
+module.exports = __toCommonJS(oauth_exports);
+var import_os = require("os");
+const VERCEL_ISSUER = "https://vercel.com";
+const VERCEL_CLI_CLIENT_ID = "cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp";
+const userAgent = `@vercel/oidc node-${process.version} ${(0, import_os.platform)()} (${(0, import_os.arch)()}) ${(0, import_os.hostname)()}`;
+let _tokenEndpoint = null;
+async function getTokenEndpoint() {
+  if (_tokenEndpoint) {
+    return _tokenEndpoint;
+  }
+  const discoveryUrl = `${VERCEL_ISSUER}/.well-known/openid-configuration`;
+  const response = await fetch(discoveryUrl, {
+    headers: { "user-agent": userAgent }
+  });
+  if (!response.ok) {
+    throw new Error("Failed to discover OAuth endpoints");
+  }
+  const metadata = await response.json();
+  if (!metadata || typeof metadata.token_endpoint !== "string") {
+    throw new Error("Invalid OAuth discovery response");
+  }
+  const endpoint = metadata.token_endpoint;
+  _tokenEndpoint = endpoint;
+  return endpoint;
+}
+async function refreshTokenRequest(options) {
+  const tokenEndpoint = await getTokenEndpoint();
+  return await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "user-agent": userAgent
+    },
+    body: new URLSearchParams({
+      client_id: VERCEL_CLI_CLIENT_ID,
+      grant_type: "refresh_token",
+      ...options
+    })
+  });
+}
+async function processTokenResponse(response) {
+  const json = await response.json();
+  if (!response.ok) {
+    const errorMsg = typeof json === "object" && json && "error" in json ? String(json.error) : "Token refresh failed";
+    return [new Error(errorMsg)];
+  }
+  if (typeof json !== "object" || json === null) {
+    return [new Error("Invalid token response")];
+  }
+  if (typeof json.access_token !== "string") {
+    return [new Error("Missing access_token in response")];
+  }
+  if (json.token_type !== "Bearer") {
+    return [new Error("Invalid token_type in response")];
+  }
+  if (typeof json.expires_in !== "number") {
+    return [new Error("Missing expires_in in response")];
+  }
+  return [null, json];
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  processTokenResponse,
+  refreshTokenRequest
+});

package/dist/token-io.d.ts

@@ -1,2 +1,2 @@
-export declare function findRootDir(): string;
+export declare function findRootDir(): string | null;
 export declare function getUserDataDir(): string | null;

package/dist/token-io.js

@@ -51,7 +51,7 @@ function findRootDir() {
       "Token refresh only supported in node server environments"
     );
   }
-  throw new import_token_error.VercelOidcTokenError("Unable to find root directory");
+  return null;
 }
 function getUserDataDir() {
   if (process.env.XDG_DATA_HOME) {

package/dist/token-util.d.ts

@@ -1,5 +1,13 @@
 export declare function getVercelDataDir(): string | null;
-export declare function getVercelCliToken(): string | null;
+export interface GetVercelTokenOptions {
+    /**
+     * Optional time buffer in milliseconds before token expiry to consider it expired.
+     * When provided, the token will be refreshed if it expires within this buffer time.
+     * @default 0
+     */
+    expirationBufferMs?: number;
+}
+export declare function getVercelToken(options?: GetVercelTokenOptions): Promise<string>;
 interface VercelTokenResponse {
     token: string;
 }
@@ -17,5 +25,5 @@ interface TokenPayload {
     exp: number;
 }
 export declare function getTokenPayload(token: string): TokenPayload;
-export declare function isExpired(token: TokenPayload): boolean;
+export declare function isExpired(token: TokenPayload, bufferMs?: number): boolean;
 export {};