@vercel/oidc 3.0.5 → 3.2.0

package/dist/token-util.js

@@ -31,9 +31,9 @@ __export(token_util_exports, {
   assertVercelOidcTokenResponse: () => assertVercelOidcTokenResponse,
   findProjectInfo: () => findProjectInfo,
   getTokenPayload: () => getTokenPayload,
-  getVercelCliToken: () => getVercelCliToken,
   getVercelDataDir: () => getVercelDataDir,
   getVercelOidcToken: () => getVercelOidcToken,
+  getVercelToken: () => getVercelToken,
   isExpired: () => isExpired,
   loadToken: () => loadToken,
   saveToken: () => saveToken
@@ -43,6 +43,9 @@ var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
 var import_token_error = require("./token-error");
 var import_token_io = require("./token-io");
+var import_auth_config = require("./auth-config");
+var import_oauth = require("./oauth");
+var import_auth_errors = require("./auth-errors");
 function getVercelDataDir() {
   const vercelFolder = "com.vercel.cli";
   const dataDir = (0, import_token_io.getUserDataDir)();
@@ -51,106 +54,129 @@ function getVercelDataDir() {
   }
   return path.join(dataDir, vercelFolder);
 }
-function getVercelCliToken() {
-  const dataDir = getVercelDataDir();
-  if (!dataDir) {
-    return null;
+async function getVercelToken(options) {
+  const authConfig = (0, import_auth_config.readAuthConfig)();
+  if (!authConfig?.token) {
+    throw new import_auth_errors.AccessTokenMissingError();
   }
-  const tokenPath = path.join(dataDir, "auth.json");
-  if (!fs.existsSync(tokenPath)) {
-    return null;
+  if ((0, import_auth_config.isValidAccessToken)(authConfig, options?.expirationBufferMs)) {
+    return authConfig.token;
   }
-  const token = fs.readFileSync(tokenPath, "utf8");
-  if (!token) {
-    return null;
+  if (!authConfig.refreshToken) {
+    (0, import_auth_config.writeAuthConfig)({});
+    throw new import_auth_errors.RefreshAccessTokenFailedError("No refresh token available");
   }
-  return JSON.parse(token).token;
-}
-async function getVercelOidcToken(authToken, projectId, teamId) {
   try {
-    const url = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${authToken}`
-      }
+    const tokenResponse = await (0, import_oauth.refreshTokenRequest)({
+      refresh_token: authConfig.refreshToken
     });
-    if (!res.ok) {
-      throw new import_token_error.VercelOidcTokenError(
-        `Failed to refresh OIDC token: ${res.statusText}`
-      );
+    const [tokensError, tokens] = await (0, import_oauth.processTokenResponse)(tokenResponse);
+    if (tokensError || !tokens) {
+      (0, import_auth_config.writeAuthConfig)({});
+      throw new import_auth_errors.RefreshAccessTokenFailedError(tokensError);
     }
-    const tokenRes = await res.json();
-    assertVercelOidcTokenResponse(tokenRes);
-    return tokenRes;
-  } catch (e) {
-    throw new import_token_error.VercelOidcTokenError(`Failed to refresh OIDC token`, e);
+    const updatedConfig = {
+      token: tokens.access_token,
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    if (tokens.refresh_token) {
+      updatedConfig.refreshToken = tokens.refresh_token;
+    }
+    (0, import_auth_config.writeAuthConfig)(updatedConfig);
+    return updatedConfig.token;
+  } catch (error) {
+    (0, import_auth_config.writeAuthConfig)({});
+    if (error instanceof import_auth_errors.AccessTokenMissingError || error instanceof import_auth_errors.RefreshAccessTokenFailedError) {
+      throw error;
+    }
+    throw new import_auth_errors.RefreshAccessTokenFailedError(error);
   }
 }
+async function getVercelOidcToken(authToken, projectId, teamId) {
+  const url = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${authToken}`
+    }
+  });
+  if (!res.ok) {
+    throw new import_token_error.VercelOidcTokenError(
+      `Failed to refresh OIDC token: ${res.statusText}`
+    );
+  }
+  const tokenRes = await res.json();
+  assertVercelOidcTokenResponse(tokenRes);
+  return tokenRes;
+}
 function assertVercelOidcTokenResponse(res) {
   if (!res || typeof res !== "object") {
-    throw new TypeError("Expected an object");
+    throw new TypeError(
+      "Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again"
+    );
   }
   if (!("token" in res) || typeof res.token !== "string") {
-    throw new TypeError("Expected a string-valued token property");
+    throw new TypeError(
+      "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+    );
   }
 }
 function findProjectInfo() {
   const dir = (0, import_token_io.findRootDir)();
   if (!dir) {
-    throw new import_token_error.VercelOidcTokenError("Unable to find root directory");
+    throw new import_token_error.VercelOidcTokenError(
+      "Unable to find project root directory. Have you linked your project with `vc link?`"
+    );
   }
-  try {
-    const prjPath = path.join(dir, ".vercel", "project.json");
-    if (!fs.existsSync(prjPath)) {
-      throw new import_token_error.VercelOidcTokenError("project.json not found");
-    }
-    const prj = JSON.parse(fs.readFileSync(prjPath, "utf8"));
-    if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
-      throw new TypeError("Expected a string-valued projectId property");
-    }
-    return { projectId: prj.projectId, teamId: prj.orgId };
-  } catch (e) {
-    throw new import_token_error.VercelOidcTokenError(`Unable to find project ID`, e);
+  const prjPath = path.join(dir, ".vercel", "project.json");
+  if (!fs.existsSync(prjPath)) {
+    throw new import_token_error.VercelOidcTokenError(
+      "project.json not found, have you linked your project with `vc link?`"
+    );
   }
+  const prj = JSON.parse(fs.readFileSync(prjPath, "utf8"));
+  if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
+    throw new TypeError(
+      "Expected a string-valued projectId property. Try running `vc link` to re-link your project."
+    );
+  }
+  return { projectId: prj.projectId, teamId: prj.orgId };
 }
 function saveToken(token, projectId) {
-  try {
-    const dir = (0, import_token_io.getUserDataDir)();
-    if (!dir) {
-      throw new import_token_error.VercelOidcTokenError("Unable to find user data directory");
-    }
-    const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
-    const tokenJson = JSON.stringify(token);
-    fs.mkdirSync(path.dirname(tokenPath), { mode: 504, recursive: true });
-    fs.writeFileSync(tokenPath, tokenJson);
-    fs.chmodSync(tokenPath, 432);
-    return;
-  } catch (e) {
-    throw new import_token_error.VercelOidcTokenError(`Failed to save token`, e);
+  const dir = (0, import_token_io.getUserDataDir)();
+  if (!dir) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Unable to find user data directory. Please reach out to Vercel support."
+    );
   }
+  const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
+  const tokenJson = JSON.stringify(token);
+  fs.mkdirSync(path.dirname(tokenPath), { mode: 504, recursive: true });
+  fs.writeFileSync(tokenPath, tokenJson);
+  fs.chmodSync(tokenPath, 432);
+  return;
 }
 function loadToken(projectId) {
-  try {
-    const dir = (0, import_token_io.getUserDataDir)();
-    if (!dir) {
-      return null;
-    }
-    const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
-    if (!fs.existsSync(tokenPath)) {
-      return null;
-    }
-    const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
-    assertVercelOidcTokenResponse(token);
-    return token;
-  } catch (e) {
-    throw new import_token_error.VercelOidcTokenError(`Failed to load token`, e);
+  const dir = (0, import_token_io.getUserDataDir)();
+  if (!dir) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Unable to find user data directory. Please reach out to Vercel support."
+    );
+  }
+  const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
+  if (!fs.existsSync(tokenPath)) {
+    return null;
   }
+  const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
+  assertVercelOidcTokenResponse(token);
+  return token;
 }
 function getTokenPayload(token) {
   const tokenParts = token.split(".");
   if (tokenParts.length !== 3) {
-    throw new import_token_error.VercelOidcTokenError("Invalid token");
+    throw new import_token_error.VercelOidcTokenError(
+      "Invalid token. Please run `vc env pull` and try again"
+    );
   }
   const base64 = tokenParts[1].replace(/-/g, "+").replace(/_/g, "/");
   const padded = base64.padEnd(
@@ -159,17 +185,17 @@ function getTokenPayload(token) {
   );
   return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
 }
-function isExpired(token) {
-  return token.exp * 1e3 < Date.now();
+function isExpired(token, bufferMs = 0) {
+  return token.exp * 1e3 < Date.now() + bufferMs;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   assertVercelOidcTokenResponse,
   findProjectInfo,
   getTokenPayload,
-  getVercelCliToken,
   getVercelDataDir,
   getVercelOidcToken,
+  getVercelToken,
   isExpired,
   loadToken,
   saveToken

package/dist/token-util.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/token-util.test.js

@@ -0,0 +1,232 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var import_token_util = require("./token-util");
+var authConfig = __toESM(require("./auth-config"));
+var oauth = __toESM(require("./oauth"));
+var import_auth_errors = require("./auth-errors");
+import_vitest.vi.mock("fs");
+import_vitest.vi.mock("./token-io", () => ({
+  getUserDataDir: import_vitest.vi.fn(() => "/mock/user/data"),
+  findRootDir: import_vitest.vi.fn(() => "/mock/root")
+}));
+(0, import_vitest.describe)("getVercelToken", () => {
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.clearAllMocks();
+  });
+  (0, import_vitest.afterEach)(() => {
+    import_vitest.vi.restoreAllMocks();
+  });
+  (0, import_vitest.it)("should return token if valid and not expired", async () => {
+    const validToken = {
+      token: "valid-access-token",
+      refreshToken: "refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) + 3600
+      // expires in 1 hour
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(validToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    const token = await (0, import_token_util.getVercelToken)();
+    (0, import_vitest.expect)(token).toBe("valid-access-token");
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.it)("should throw AccessTokenMissingError if auth config does not exist", async () => {
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(null);
+    await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(import_auth_errors.AccessTokenMissingError);
+  });
+  (0, import_vitest.it)("should refresh token if expired and refresh token exists", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "valid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+      // expired 1 hour ago
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600,
+        refresh_token: "new-refresh-token"
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    const token = await (0, import_token_util.getVercelToken)();
+    (0, import_vitest.expect)(token).toBe("new-access-token");
+    (0, import_vitest.expect)(oauth.refreshTokenRequest).toHaveBeenCalledWith({
+      refresh_token: "valid-refresh-token"
+    });
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.objectContaining({
+        token: "new-access-token",
+        refreshToken: "new-refresh-token",
+        expiresAt: import_vitest.expect.any(Number)
+      })
+    );
+  });
+  (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if token expired and no refresh token", async () => {
+    const expiredTokenNoRefresh = {
+      token: "expired-access-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(
+      expiredTokenNoRefresh
+    );
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
+      import_auth_errors.RefreshAccessTokenFailedError
+    );
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+  });
+  (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if refresh fails with OAuth error", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "invalid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockErrorResponse = {
+      ok: false,
+      json: async () => ({
+        error: "invalid_grant",
+        error_description: "Refresh token expired"
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockErrorResponse);
+    await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
+      import_auth_errors.RefreshAccessTokenFailedError
+    );
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+  });
+  (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if refresh fails with network error", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "valid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockRejectedValue(
+      new Error("Network error")
+    );
+    await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
+      import_auth_errors.RefreshAccessTokenFailedError
+    );
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+  });
+  (0, import_vitest.it)("should treat token as valid if expiresAt is missing (--token case)", async () => {
+    const tokenWithoutExpiry = {
+      token: "cli-provided-token"
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(tokenWithoutExpiry);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    const token = await (0, import_token_util.getVercelToken)();
+    (0, import_vitest.expect)(token).toBe("cli-provided-token");
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.it)("should preserve new refresh token if provided in response", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "old-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600,
+        refresh_token: "new-refresh-token"
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    await (0, import_token_util.getVercelToken)();
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.objectContaining({
+        refreshToken: "new-refresh-token"
+      })
+    );
+  });
+  (0, import_vitest.it)("should not overwrite refresh token if not provided in response", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "existing-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600
+        // No refresh_token in response
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    await (0, import_token_util.getVercelToken)();
+    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
+    (0, import_vitest.expect)(writeCall).not.toHaveProperty("refreshToken");
+  });
+  (0, import_vitest.it)("should calculate expiresAt correctly from expires_in", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "valid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 7200
+        // 2 hours
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    const beforeCall = Math.floor(Date.now() / 1e3);
+    await (0, import_token_util.getVercelToken)();
+    const afterCall = Math.floor(Date.now() / 1e3);
+    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
+    (0, import_vitest.expect)(writeCall.expiresAt).toBeGreaterThanOrEqual(beforeCall + 7200);
+    (0, import_vitest.expect)(writeCall.expiresAt).toBeLessThanOrEqual(afterCall + 7200);
+  });
+});

package/dist/token.d.ts

@@ -1 +1,19 @@
-export declare function refreshToken(): Promise<void>;
+export interface RefreshTokenOptions {
+    /**
+     * Team ID (team_*) or slug to use for token refresh.
+     * When provided, this team will be used instead of reading from `.vercel/project.json`.
+     */
+    team?: string;
+    /**
+     * Project ID (prj_*) or slug to use for token refresh.
+     * When provided, this project will be used instead of reading from `.vercel/project.json`.
+     */
+    project?: string;
+    /**
+     * Optional time buffer in milliseconds before token expiry to consider it expired.
+     * When provided, the token will be refreshed if it expires within this buffer time.
+     * @default 0
+     */
+    expirationBufferMs?: number;
+}
+export declare function refreshToken(options?: RefreshTokenOptions): Promise<void>;

package/dist/token.js

@@ -23,21 +23,28 @@ __export(token_exports, {
 module.exports = __toCommonJS(token_exports);
 var import_token_error = require("./token-error");
 var import_token_util = require("./token-util");
-async function refreshToken() {
-  const { projectId, teamId } = (0, import_token_util.findProjectInfo)();
+async function refreshToken(options) {
+  let projectId = options?.project;
+  let teamId = options?.team;
+  if (!projectId && !teamId) {
+    const projectInfo = (0, import_token_util.findProjectInfo)();
+    projectId = projectInfo.projectId;
+    teamId = projectInfo.teamId;
+  } else if (!projectId || !teamId) {
+    const projectInfo = (0, import_token_util.findProjectInfo)();
+    projectId = projectId ?? projectInfo.projectId;
+    teamId = teamId ?? projectInfo.teamId;
+  }
+  if (!projectId) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`"
+    );
+  }
   let maybeToken = (0, import_token_util.loadToken)(projectId);
-  if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token))) {
-    const authToken = (0, import_token_util.getVercelCliToken)();
-    if (!authToken) {
-      throw new import_token_error.VercelOidcTokenError(
-        "Failed to refresh OIDC token: login to vercel cli"
-      );
-    }
-    if (!projectId) {
-      throw new import_token_error.VercelOidcTokenError(
-        "Failed to refresh OIDC token: project id not found"
-      );
-    }
+  if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token), options?.expirationBufferMs)) {
+    const authToken = await (0, import_token_util.getVercelToken)({
+      expirationBufferMs: options?.expirationBufferMs
+    });
     maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
     if (!maybeToken) {
       throw new import_token_error.VercelOidcTokenError("Failed to refresh OIDC token");

package/dist/token.test.js

@@ -35,7 +35,7 @@ import_vitest.vi.mock("./token-io");
   let userDataDir;
   let cliDataDir;
   let tokenDataDir;
-  const projectId = "test-project-id";
+  const projectId = "prj_test123";
   (0, import_vitest.beforeEach)(() => {
     import_vitest.vi.clearAllMocks();
     process.env.VERCEL_OIDC_TOKEN = void 0;
@@ -57,7 +57,7 @@ import_vitest.vi.mock("./token-io");
     import_vitest.vi.spyOn(process, "cwd").mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(userDataDir);
-    import_vitest.vi.spyOn(tokenUtil, "getVercelCliToken").mockReturnValue("test");
+    import_vitest.vi.spyOn(tokenUtil, "getVercelToken").mockResolvedValue("test");
     import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
       token: "test-token"
     });
@@ -81,4 +81,110 @@ import_vitest.vi.mock("./token-io");
     const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
     (0, import_vitest.expect)(token).toEqual({ token: "test-token" });
   });
+  (0, import_vitest.test)("should use provided team and project instead of reading project.json", async () => {
+    const customProjectId = "prj_custom123";
+    const customTeamId = "team_custom456";
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken");
+    const findRootDirSpy = import_vitest.vi.mocked(import_token_io.findRootDir);
+    await (0, import_token.refreshToken)({ team: customTeamId, project: customProjectId });
+    (0, import_vitest.expect)(findRootDirSpy).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test",
+      customProjectId,
+      customTeamId
+    );
+    const tokenPath = path.join(tokenDataDir, `${customProjectId}.json`);
+    (0, import_vitest.expect)(fs.existsSync(tokenPath)).toBe(true);
+    const savedToken = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
+    (0, import_vitest.expect)(savedToken).toEqual({ token: "test-token" });
+  });
+  (0, import_vitest.test)("should merge provided project with team from project.json", async () => {
+    const customProjectId = "prj_custom234";
+    const projectTeamId = "team_fromproject567";
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId, orgId: projectTeamId })
+    );
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken");
+    await (0, import_token.refreshToken)({ project: customProjectId });
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test",
+      customProjectId,
+      projectTeamId
+    );
+  });
+  (0, import_vitest.test)("should merge provided team with project from project.json", async () => {
+    const customTeamId = "team_custom789";
+    const projectProjectId = "prj_fromjson123";
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId: projectProjectId, orgId: "original-team" })
+    );
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken");
+    await (0, import_token.refreshToken)({ team: customTeamId });
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test",
+      projectProjectId,
+      customTeamId
+    );
+  });
+  (0, import_vitest.test)("should use cached token when valid with custom project", async () => {
+    const customProjectId = "prj_customcached123";
+    const customTeamId = "team_customcached456";
+    const cachedToken = { token: "cached-valid-token" };
+    const tokenPath = path.join(tokenDataDir, `${customProjectId}.json`);
+    fs.writeFileSync(tokenPath, JSON.stringify(cachedToken));
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken");
+    await (0, import_token.refreshToken)({ team: customTeamId, project: customProjectId });
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("cached-valid-token");
+  });
+  (0, import_vitest.test)("should refresh token when cached token expires within buffer", async () => {
+    const customProjectId = "prj_buffertest123";
+    const customTeamId = "team_buffertest456";
+    const cachedToken = { token: "expiring-soon-token" };
+    const tokenPath = path.join(tokenDataDir, `${customProjectId}.json`);
+    fs.writeFileSync(tokenPath, JSON.stringify(cachedToken));
+    const expiresIn3Minutes = Math.floor((Date.now() + 18e4) / 1e3);
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: expiresIn3Minutes
+    });
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({ token: "fresh-token" });
+    await (0, import_token.refreshToken)({
+      team: customTeamId,
+      project: customProjectId,
+      expirationBufferMs: 3e5
+    });
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).toHaveBeenCalledWith(
+      "test",
+      customProjectId,
+      customTeamId
+    );
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("fresh-token");
+    const savedToken = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
+    (0, import_vitest.expect)(savedToken).toEqual({ token: "fresh-token" });
+  });
+  (0, import_vitest.test)("should use cached token when it does not expire within buffer", async () => {
+    const customProjectId = "prj_buffervalid123";
+    const customTeamId = "team_buffervalid456";
+    const cachedToken = { token: "valid-cached-token" };
+    const tokenPath = path.join(tokenDataDir, `${customProjectId}.json`);
+    fs.writeFileSync(tokenPath, JSON.stringify(cachedToken));
+    const expiresIn10Minutes = Math.floor((Date.now() + 6e5) / 1e3);
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: expiresIn10Minutes
+    });
+    const getVercelOidcTokenSpy = import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken");
+    await (0, import_token.refreshToken)({
+      team: customTeamId,
+      project: customProjectId,
+      expirationBufferMs: 3e5
+    });
+    (0, import_vitest.expect)(getVercelOidcTokenSpy).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("valid-cached-token");
+  });
 });