@vercel/oidc 3.5.0 → 3.6.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @vercel/oidc
 
+## 3.6.0
+
+### Minor Changes
+
+- fddeb55: Add configurable credentials storage handling across the CLI auth stack. Storage of credentials can be configured by the new `credStorage` key in global `config.json` or the new `VERCEL_TOKEN_STORAGE` environment variable. The environment variable takes precedence over the configuration key. Accepted values are `file` (store credentials in `auth.json`), `keyring` (store credentials in system keyring, e.g macOS Keychain or Secrets Service on Linux), and `auto` (try storing in keyring if available, fall back to `file` if keyring is not available).
+
+  `@vercel/oidc` supports keyring-stored authentication credentials by delegating the OIDC minting to the CLI executable via `@vercel/cli-exec`.
+
+### Patch Changes
+
+- Updated dependencies [fddeb55]
+  - @vercel/cli-config@0.2.0
+
 ## 3.5.0
 
 ### Minor Changes

package/dist/auth-errors.js

@@ -32,8 +32,11 @@ class AccessTokenMissingError extends Error {
 }
 class RefreshAccessTokenFailedError extends Error {
   constructor(cause) {
-    super("Failed to refresh authentication token.", { cause });
+    super("Failed to refresh authentication token.");
     this.name = "RefreshAccessTokenFailedError";
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
   }
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/get-vercel-oidc-token-with-refresh.test.js

@@ -27,8 +27,19 @@ var os = __toESM(require("os"));
 var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
 var import_token_io = require("./token-io");
+var import_cli_config = require("@vercel/cli-config");
 var import_get_vercel_oidc_token_with_refresh = require("./get-vercel-oidc-token-with-refresh");
 var tokenUtil = __toESM(require("./token-util"));
+import_vitest.vi.mock("@vercel/cli-config", async (importOriginal) => ({
+  ...await importOriginal(),
+  getGlobalPathConfig: import_vitest.vi.fn(),
+  getLikelyEffectiveCredStorage: import_vitest.vi.fn(() => "file")
+}));
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+  }
+}));
 import_vitest.vi.mock("./token-io");
 import_vitest.vi.mock("./get-context", () => ({
   getContext: () => ({ headers: {} })
@@ -57,6 +68,7 @@ import_vitest.vi.mock("./get-context", () => ({
     import_vitest.vi.spyOn(process, "cwd").mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(userDataDir);
+    import_vitest.vi.mocked(import_cli_config.getGlobalPathConfig).mockReturnValue(cliDataDir);
   });
   (0, import_vitest.afterEach)(() => {
     if (fs.existsSync(rootDir)) {
@@ -129,28 +141,24 @@ import_vitest.vi.mock("./get-context", () => ({
     );
     import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockRejectedValue(
       new TypeError(
-        "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+        "Vercel OIDC token is malformed. Expected a string-valued token property."
       )
     );
     process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
     await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(
-      /Vercel OIDC token is malformed\. Expected a string-valued token property\. Please run `vc env pull` and try again/
+      /Vercel OIDC token is malformed\. Expected a string-valued token property\./
     );
   });
   (0, import_vitest.test)("should throw helpful error when token has invalid format", async () => {
     process.env.VERCEL_OIDC_TOKEN = "not-a-valid-jwt-token";
     import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockImplementation(() => {
-      throw new Error("Invalid token. Please run `vc env pull` and try again");
+      throw new Error("Invalid token.");
     });
-    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(
-      /Invalid token\. Please run `vc env pull` and try again/
-    );
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(/Invalid token\./);
   });
   (0, import_vitest.test)("should throw error when token expiry check fails", async () => {
     process.env.VERCEL_OIDC_TOKEN = "not-a-jwt-token";
-    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(
-      /Invalid token\. Please run `vc env pull` and try again/
-    );
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(/Invalid token\./);
   });
   (0, import_vitest.test)("should fail when no token exists and no CLI credentials available", async () => {
     process.env.VERCEL_OIDC_TOKEN = void 0;

package/dist/index-browser.test.js

@@ -24,6 +24,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_vitest = require("vitest");
 var DefaultImports = __toESM(require("./index"));
 var BrowserImports = __toESM(require("./index-browser"));
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+  }
+}));
 (0, import_vitest.describe)("browser export", () => {
   (0, import_vitest.test)("should match the default export", async () => {
     (0, import_vitest.expect)(Object.keys(BrowserImports).sort()).toStrictEqual(

package/dist/token-util.d.ts

@@ -1,4 +1,3 @@
-export declare function getVercelDataDir(): string | null;
 export interface GetVercelTokenOptions {
     /**
      * Optional time buffer in milliseconds before token expiry to consider it expired.
@@ -11,6 +10,7 @@ export declare function getVercelToken(options?: GetVercelTokenOptions): Promise
 interface VercelTokenResponse {
     token: string;
 }
+export declare function getVercelOidcTokenFromCli(projectId: string, teamId?: string): Promise<VercelTokenResponse>;
 export declare function getVercelOidcToken(authToken: string, projectId: string, teamId?: string): Promise<VercelTokenResponse | null>;
 export declare function assertVercelOidcTokenResponse(res: unknown): asserts res is VercelTokenResponse;
 export declare function findProjectInfo(): {

package/dist/token-util.js

@@ -31,8 +31,8 @@ __export(token_util_exports, {
   assertVercelOidcTokenResponse: () => assertVercelOidcTokenResponse,
   findProjectInfo: () => findProjectInfo,
   getTokenPayload: () => getTokenPayload,
-  getVercelDataDir: () => getVercelDataDir,
   getVercelOidcToken: () => getVercelOidcToken,
+  getVercelOidcTokenFromCli: () => getVercelOidcTokenFromCli,
   getVercelToken: () => getVercelToken,
   isExpired: () => isExpired,
   loadToken: () => loadToken,
@@ -41,29 +41,23 @@ __export(token_util_exports, {
 module.exports = __toCommonJS(token_util_exports);
 var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
+var import_cli_exec = require("@vercel/cli-exec");
+var import_cli_config = require("@vercel/cli-config");
 var import_token_error = require("./token-error");
 var import_token_io = require("./token-io");
-var import_auth_config = require("./auth-config");
 var import_oauth = require("./oauth");
 var import_auth_errors = require("./auth-errors");
-function getVercelDataDir() {
-  const vercelFolder = "com.vercel.cli";
-  const dataDir = (0, import_token_io.getUserDataDir)();
-  if (!dataDir) {
-    return null;
-  }
-  return path.join(dataDir, vercelFolder);
-}
 async function getVercelToken(options) {
-  const authConfig = (0, import_auth_config.readAuthConfig)();
-  if (!authConfig?.token) {
+  const configDir = (0, import_cli_config.getGlobalPathConfig)();
+  const authConfig = (0, import_cli_config.tryReadAuthConfig)(configDir);
+  if (!authConfig || !authConfig.token && !authConfig.refreshToken) {
     throw new import_auth_errors.AccessTokenMissingError();
   }
-  if ((0, import_auth_config.isValidAccessToken)(authConfig, options?.expirationBufferMs)) {
+  if (isValidAccessToken(authConfig, options?.expirationBufferMs)) {
     return authConfig.token;
   }
   if (!authConfig.refreshToken) {
-    (0, import_auth_config.writeAuthConfig)({});
+    (0, import_cli_config.writeAuthConfig)(configDir, {});
     throw new import_auth_errors.RefreshAccessTokenFailedError("No refresh token available");
   }
   try {
@@ -72,26 +66,70 @@ async function getVercelToken(options) {
     });
     const [tokensError, tokens] = await (0, import_oauth.processTokenResponse)(tokenResponse);
     if (tokensError || !tokens) {
-      (0, import_auth_config.writeAuthConfig)({});
+      (0, import_cli_config.writeAuthConfig)(configDir, {});
       throw new import_auth_errors.RefreshAccessTokenFailedError(tokensError);
     }
     const updatedConfig = {
       token: tokens.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in,
+      refreshToken: tokens.refresh_token
     };
-    if (tokens.refresh_token) {
-      updatedConfig.refreshToken = tokens.refresh_token;
-    }
-    (0, import_auth_config.writeAuthConfig)(updatedConfig);
+    (0, import_cli_config.writeAuthConfig)(configDir, updatedConfig);
     return updatedConfig.token;
   } catch (error) {
-    (0, import_auth_config.writeAuthConfig)({});
+    (0, import_cli_config.writeAuthConfig)(configDir, {});
     if (error instanceof import_auth_errors.AccessTokenMissingError || error instanceof import_auth_errors.RefreshAccessTokenFailedError) {
       throw error;
     }
     throw new import_auth_errors.RefreshAccessTokenFailedError(error);
   }
 }
+function isValidAccessToken(authConfig, expirationBufferMs = 0) {
+  if (!authConfig.token)
+    return false;
+  if (typeof authConfig.expiresAt !== "number")
+    return true;
+  const nowInSeconds = Math.floor(Date.now() / 1e3);
+  const bufferInSeconds = expirationBufferMs / 1e3;
+  return authConfig.expiresAt >= nowInSeconds + bufferInSeconds;
+}
+async function getVercelOidcTokenFromCli(projectId, teamId) {
+  const args = ["project", "token", projectId, "--format=json"];
+  if (teamId) {
+    args.push("--scope", teamId);
+  }
+  try {
+    const { stdout } = await (0, import_cli_exec.execVercelCli)(args);
+    let parsedOutput;
+    if (typeof stdout !== "string") {
+      throw new import_token_error.VercelOidcTokenError(
+        "Failed to refresh OIDC token: `vercel project token` did not return stdout"
+      );
+    }
+    try {
+      parsedOutput = JSON.parse(stdout);
+    } catch {
+      throw new import_token_error.VercelOidcTokenError(
+        "Failed to refresh OIDC token: `vercel project token` returned invalid JSON: " + stdout
+      );
+    }
+    assertVercelOidcTokenResponse(parsedOutput);
+    return parsedOutput;
+  } catch (error) {
+    if (error instanceof import_token_error.VercelOidcTokenError) {
+      throw error;
+    }
+    let message = error instanceof Error ? error.message : "";
+    const stderr = error instanceof import_cli_exec.VercelCliError ? error.stderr?.trim() : void 0;
+    if (stderr && !message.includes(stderr)) {
+      message = `${message}
+${stderr}`.trim();
+    }
+    throw new import_token_error.VercelOidcTokenError(
+      message ? `Failed to refresh OIDC token with the Vercel CLI: ${message}` : "Failed to refresh OIDC token with the Vercel CLI"
+    );
+  }
+}
 async function getVercelOidcToken(authToken, projectId, teamId) {
   const url = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
   const res = await fetch(url, {
@@ -111,13 +149,11 @@ async function getVercelOidcToken(authToken, projectId, teamId) {
 }
 function assertVercelOidcTokenResponse(res) {
   if (!res || typeof res !== "object") {
-    throw new TypeError(
-      "Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again"
-    );
+    throw new TypeError("Vercel OIDC token is malformed. Expected an object.");
   }
   if (!("token" in res) || typeof res.token !== "string") {
     throw new TypeError(
-      "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+      "Vercel OIDC token is malformed. Expected a string-valued token property."
     );
   }
 }
@@ -174,9 +210,7 @@ function loadToken(projectId) {
 function getTokenPayload(token) {
   const tokenParts = token.split(".");
   if (tokenParts.length !== 3) {
-    throw new import_token_error.VercelOidcTokenError(
-      "Invalid token. Please run `vc env pull` and try again"
-    );
+    throw new import_token_error.VercelOidcTokenError("Invalid token.");
   }
   const base64 = tokenParts[1].replace(/-/g, "+").replace(/_/g, "/");
   const padded = base64.padEnd(
@@ -193,8 +227,8 @@ function isExpired(token, bufferMs = 0) {
   assertVercelOidcTokenResponse,
   findProjectInfo,
   getTokenPayload,
-  getVercelDataDir,
   getVercelOidcToken,
+  getVercelOidcTokenFromCli,
   getVercelToken,
   isExpired,
   loadToken,

package/dist/token-util.test.js

@@ -23,9 +23,19 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var import_vitest = require("vitest");
 var import_token_util = require("./token-util");
-var authConfig = __toESM(require("./auth-config"));
+var cliConfig = __toESM(require("@vercel/cli-config"));
 var oauth = __toESM(require("./oauth"));
 var import_auth_errors = require("./auth-errors");
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+  }
+}));
+import_vitest.vi.mock("@vercel/cli-config", () => ({
+  getGlobalPathConfig: import_vitest.vi.fn(() => "/mock/user/data/com.vercel.cli"),
+  tryReadAuthConfig: import_vitest.vi.fn(),
+  writeAuthConfig: import_vitest.vi.fn()
+}));
 import_vitest.vi.mock("fs");
 import_vitest.vi.mock("./token-io", () => ({
   getUserDataDir: import_vitest.vi.fn(() => "/mock/user/data"),
@@ -45,15 +55,13 @@ import_vitest.vi.mock("./token-io", () => ({
       expiresAt: Math.floor(Date.now() / 1e3) + 3600
       // expires in 1 hour
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(validToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(validToken);
     const token = await (0, import_token_util.getVercelToken)();
     (0, import_vitest.expect)(token).toBe("valid-access-token");
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).not.toHaveBeenCalled();
   });
   (0, import_vitest.it)("should throw AccessTokenMissingError if auth config does not exist", async () => {
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(null);
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(null);
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(import_auth_errors.AccessTokenMissingError);
   });
   (0, import_vitest.it)("should refresh token if expired and refresh token exists", async () => {
@@ -72,16 +80,15 @@ import_vitest.vi.mock("./token-io", () => ({
         refresh_token: "new-refresh-token"
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     const token = await (0, import_token_util.getVercelToken)();
     (0, import_vitest.expect)(token).toBe("new-access-token");
     (0, import_vitest.expect)(oauth.refreshTokenRequest).toHaveBeenCalledWith({
       refresh_token: "valid-refresh-token"
     });
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
       import_vitest.expect.objectContaining({
         token: "new-access-token",
         refreshToken: "new-refresh-token",
@@ -89,20 +96,41 @@ import_vitest.vi.mock("./token-io", () => ({
       })
     );
   });
+  (0, import_vitest.it)("should refresh token when only refreshToken is present", async () => {
+    const refreshOnlyToken = {
+      refreshToken: "valid-refresh-token"
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600
+      })
+    };
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(refreshOnlyToken);
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    const token = await (0, import_token_util.getVercelToken)();
+    (0, import_vitest.expect)(token).toBe("new-access-token");
+    (0, import_vitest.expect)(oauth.refreshTokenRequest).toHaveBeenCalledWith({
+      refresh_token: "valid-refresh-token"
+    });
+  });
   (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if token expired and no refresh token", async () => {
     const expiredTokenNoRefresh = {
       token: "expired-access-token",
       expiresAt: Math.floor(Date.now() / 1e3) - 3600
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(
       expiredTokenNoRefresh
     );
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
       import_auth_errors.RefreshAccessTokenFailedError
     );
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      {}
+    );
   });
   (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if refresh fails with OAuth error", async () => {
     const expiredToken = {
@@ -117,14 +145,15 @@ import_vitest.vi.mock("./token-io", () => ({
         error_description: "Refresh token expired"
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockErrorResponse);
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
       import_auth_errors.RefreshAccessTokenFailedError
     );
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      {}
+    );
   });
   (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if refresh fails with network error", async () => {
     const expiredToken = {
@@ -132,27 +161,26 @@ import_vitest.vi.mock("./token-io", () => ({
       refreshToken: "valid-refresh-token",
       expiresAt: Math.floor(Date.now() / 1e3) - 3600
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockRejectedValue(
       new Error("Network error")
     );
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
       import_auth_errors.RefreshAccessTokenFailedError
     );
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      {}
+    );
   });
   (0, import_vitest.it)("should treat token as valid if expiresAt is missing (--token case)", async () => {
     const tokenWithoutExpiry = {
       token: "cli-provided-token"
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(tokenWithoutExpiry);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(tokenWithoutExpiry);
     const token = await (0, import_token_util.getVercelToken)();
     (0, import_vitest.expect)(token).toBe("cli-provided-token");
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).not.toHaveBeenCalled();
   });
   (0, import_vitest.it)("should preserve new refresh token if provided in response", async () => {
     const expiredToken = {
@@ -169,18 +197,17 @@ import_vitest.vi.mock("./token-io", () => ({
         refresh_token: "new-refresh-token"
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     await (0, import_token_util.getVercelToken)();
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
       import_vitest.expect.objectContaining({
         refreshToken: "new-refresh-token"
       })
     );
   });
-  (0, import_vitest.it)("should not overwrite refresh token if not provided in response", async () => {
+  (0, import_vitest.it)("should preserve refresh token if not provided in response", async () => {
     const expiredToken = {
       token: "expired-access-token",
       refreshToken: "existing-refresh-token",
@@ -195,13 +222,11 @@ import_vitest.vi.mock("./token-io", () => ({
         // No refresh_token in response
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     await (0, import_token_util.getVercelToken)();
-    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
-    (0, import_vitest.expect)(writeCall).not.toHaveProperty("refreshToken");
+    const writeCall = import_vitest.vi.mocked(cliConfig.writeAuthConfig).mock.calls[0][1];
+    (0, import_vitest.expect)(writeCall).toHaveProperty("refreshToken", "existing-refresh-token");
   });
   (0, import_vitest.it)("should calculate expiresAt correctly from expires_in", async () => {
     const expiredToken = {
@@ -218,14 +243,12 @@ import_vitest.vi.mock("./token-io", () => ({
         // 2 hours
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     const beforeCall = Math.floor(Date.now() / 1e3);
     await (0, import_token_util.getVercelToken)();
     const afterCall = Math.floor(Date.now() / 1e3);
-    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
+    const writeCall = import_vitest.vi.mocked(cliConfig.writeAuthConfig).mock.calls[0][1];
     (0, import_vitest.expect)(writeCall.expiresAt).toBeGreaterThanOrEqual(beforeCall + 7200);
     (0, import_vitest.expect)(writeCall.expiresAt).toBeLessThanOrEqual(afterCall + 7200);
   });

package/dist/token.js

@@ -21,6 +21,7 @@ __export(token_exports, {
   refreshToken: () => refreshToken
 });
 module.exports = __toCommonJS(token_exports);
+var import_cli_config = require("@vercel/cli-config");
 var import_token_error = require("./token-error");
 var import_token_util = require("./token-util");
 async function refreshToken(options) {
@@ -42,10 +43,15 @@ async function refreshToken(options) {
   }
   let maybeToken = (0, import_token_util.loadToken)(projectId);
   if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token), options?.expirationBufferMs)) {
-    const authToken = await (0, import_token_util.getVercelToken)({
-      expirationBufferMs: options?.expirationBufferMs
-    });
-    maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
+    const configDir = (0, import_cli_config.getGlobalPathConfig)();
+    if ((0, import_cli_config.getLikelyEffectiveCredStorage)(configDir) === "keyring") {
+      maybeToken = await (0, import_token_util.getVercelOidcTokenFromCli)(projectId, teamId);
+    } else {
+      const authToken = await (0, import_token_util.getVercelToken)({
+        expirationBufferMs: options?.expirationBufferMs
+      });
+      maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
+    }
     if (!maybeToken) {
       throw new import_token_error.VercelOidcTokenError("Failed to refresh OIDC token");
     }

package/dist/token.test.js

@@ -26,9 +26,25 @@ var import_vitest = require("vitest");
 var os = __toESM(require("os"));
 var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
+var import_cli_config = require("@vercel/cli-config");
+var import_cli_exec = require("@vercel/cli-exec");
 var import_token_io = require("./token-io");
 var tokenUtil = __toESM(require("./token-util"));
 var import_token = require("./token");
+import_vitest.vi.mock("@vercel/cli-config", () => ({
+  getGlobalPathConfig: import_vitest.vi.fn(),
+  getLikelyEffectiveCredStorage: import_vitest.vi.fn(() => "file")
+}));
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+    constructor(options) {
+      super(options.message);
+      this.name = "VercelCliError";
+      this.stderr = options.stderr;
+    }
+  }
+}));
 import_vitest.vi.mock("./token-io");
 (0, import_vitest.describe)("refreshToken", () => {
   let rootDir;
@@ -38,6 +54,7 @@ import_vitest.vi.mock("./token-io");
   const projectId = "prj_test123";
   (0, import_vitest.beforeEach)(() => {
     import_vitest.vi.clearAllMocks();
+    import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("file");
     process.env.VERCEL_OIDC_TOKEN = void 0;
     const random = `test-${(0, import_crypto.randomUUID)()}`;
     rootDir = path.join(os.tmpdir(), random);
@@ -49,7 +66,10 @@ import_vitest.vi.mock("./token-io");
     fs.mkdirSync(path.join(rootDir, ".vercel"), {
       recursive: true
     });
-    fs.writeFileSync(path.join(cliDataDir, "auth.json"), '{token: "test"}');
+    fs.writeFileSync(
+      path.join(cliDataDir, "auth.json"),
+      JSON.stringify({ token: "test" })
+    );
     fs.writeFileSync(
       path.join(rootDir, ".vercel", "project.json"),
       JSON.stringify({ projectId })
@@ -57,6 +77,7 @@ import_vitest.vi.mock("./token-io");
     import_vitest.vi.spyOn(process, "cwd").mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(userDataDir);
+    import_vitest.vi.mocked(import_cli_config.getGlobalPathConfig).mockReturnValue(cliDataDir);
     import_vitest.vi.spyOn(tokenUtil, "getVercelToken").mockResolvedValue("test");
     import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
       token: "test-token"
@@ -66,6 +87,15 @@ import_vitest.vi.mock("./token-io");
       name: "test-name",
       exp: Date.now() + 1e5
     });
+    import_vitest.vi.mocked(import_cli_exec.execVercelCli).mockResolvedValue({
+      stdout: JSON.stringify({ token: "cli-token" }),
+      stderr: "",
+      invocation: {
+        command: "vercel",
+        commandArgs: [],
+        source: "path"
+      }
+    });
   });
   (0, import_vitest.test)("should correctly load saved token from file", async () => {
     const token = { token: "test-saved" };
@@ -81,6 +111,66 @@ import_vitest.vi.mock("./token-io");
     const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
     (0, import_vitest.expect)(token).toEqual({ token: "test-token" });
   });
+  (0, import_vitest.test)("should use cli-exec when keyring-backed credentials are likely", async () => {
+    import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("keyring");
+    await (0, import_token.refreshToken)();
+    (0, import_vitest.expect)(import_cli_exec.execVercelCli).toHaveBeenCalledWith([
+      "project",
+      "token",
+      projectId,
+      "--format=json"
+    ]);
+    (0, import_vitest.expect)(tokenUtil.getVercelToken).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(tokenUtil.getVercelOidcToken).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("cli-token");
+  });
+  (0, import_vitest.test)("should pass scope to cli-exec when team is known", async () => {
+    const customTeamId = "team_customscope123";
+    import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("keyring");
+    await (0, import_token.refreshToken)({ team: customTeamId, project: projectId });
+    (0, import_vitest.expect)(import_cli_exec.execVercelCli).toHaveBeenCalledWith([
+      "project",
+      "token",
+      projectId,
+      "--format=json",
+      "--scope",
+      customTeamId
+    ]);
+  });
+  (0, import_vitest.test)("should fail with a cli-specific error for malformed cli json output", async () => {
+    import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("keyring");
+    import_vitest.vi.mocked(import_cli_exec.execVercelCli).mockResolvedValue({
+      stdout: JSON.stringify({ nope: "missing-token" }),
+      stderr: "",
+      invocation: {
+        command: "vercel",
+        commandArgs: [],
+        source: "path"
+      }
+    });
+    await (0, import_vitest.expect)((0, import_token.refreshToken)()).rejects.toThrow(
+      "Failed to refresh OIDC token with the Vercel CLI: Vercel OIDC token is malformed. Expected a string-valued token property."
+    );
+  });
+  (0, import_vitest.test)("should include cli stderr when cli-exec fails", async () => {
+    import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("keyring");
+    import_vitest.vi.mocked(import_cli_exec.execVercelCli).mockRejectedValue(
+      new import_cli_exec.VercelCliError({
+        code: "VERCEL_CLI_ERRORED",
+        message: "Command failed with exit code 1",
+        stderr: "Project not found for this scope",
+        exitCode: 1,
+        invocation: {
+          command: "vercel",
+          commandArgs: [],
+          source: "path"
+        }
+      })
+    );
+    await (0, import_vitest.expect)((0, import_token.refreshToken)()).rejects.toThrow(
+      "Failed to refresh OIDC token with the Vercel CLI: Command failed with exit code 1\nProject not found for this scope"
+    );
+  });
   (0, import_vitest.test)("should use provided team and project instead of reading project.json", async () => {
     const customProjectId = "prj_custom123";
     const customTeamId = "team_custom456";

package/docs/functions/getVercelToken.md

@@ -6,7 +6,7 @@
 
 > **getVercelToken**(`options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
 
-Defined in: [packages/oidc/src/token-util.ts:35](https://github.com/vercel/vercel/blob/main/packages/oidc/src/token-util.ts#L35)
+Defined in: [packages/oidc/src/token-util.ts:27](https://github.com/vercel/vercel/blob/main/packages/oidc/src/token-util.ts#L27)
 
 ## Parameters
 

package/package.json

@@ -18,7 +18,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "3.5.0",
+  "version": "3.6.0",
   "repository": {
     "directory": "packages/oidc",
     "type": "git",
@@ -27,6 +27,10 @@
   "bugs": {
     "url": "https://github.com/vercel/vercel/issues"
   },
+  "dependencies": {
+    "@vercel/cli-config": "0.2.0",
+    "@vercel/cli-exec": "0.1.1"
+  },
   "devDependencies": {
     "prettier": "3.8.3",
     "tinyspawn": "1.3.1",

package/dist/auth-config.d.ts

@@ -1,30 +0,0 @@
-/**
- * Auth configuration stored in ~/.../com.vercel.cli/auth.json
- */
-export interface AuthConfig {
-    /** An `access_token` obtained using the OAuth Device Authorization flow. */
-    token?: string;
-    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-    refreshToken?: string;
-    /**
-     * The absolute time (seconds) when the token expires.
-     * Used to optimistically check if the token is still valid.
-     */
-    expiresAt?: number;
-    /** Whether to skip writing this config to disk. */
-    skipWrite?: boolean;
-}
-/**
- * Read the auth config from disk
- * Returns null if the file doesn't exist or cannot be read
- */
-export declare function readAuthConfig(): AuthConfig | null;
-/**
- * Write the auth config to disk with proper permissions
- */
-export declare function writeAuthConfig(config: AuthConfig): void;
-/**
- * Check if an access token is valid (not expired)
- * Copied from packages/cli/src/util/client.ts:72-81
- */
-export declare function isValidAccessToken(authConfig: AuthConfig, expirationBufferMs?: number): boolean;

package/dist/auth-config.js

@@ -1,85 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var auth_config_exports = {};
-__export(auth_config_exports, {
-  isValidAccessToken: () => isValidAccessToken,
-  readAuthConfig: () => readAuthConfig,
-  writeAuthConfig: () => writeAuthConfig
-});
-module.exports = __toCommonJS(auth_config_exports);
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var import_token_util = require("./token-util");
-function getAuthConfigPath() {
-  const dataDir = (0, import_token_util.getVercelDataDir)();
-  if (!dataDir) {
-    throw new Error(
-      `Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`
-    );
-  }
-  return path.join(dataDir, "auth.json");
-}
-function readAuthConfig() {
-  try {
-    const authPath = getAuthConfigPath();
-    if (!fs.existsSync(authPath)) {
-      return null;
-    }
-    const content = fs.readFileSync(authPath, "utf8");
-    if (!content) {
-      return null;
-    }
-    return JSON.parse(content);
-  } catch (_error) {
-    return null;
-  }
-}
-function writeAuthConfig(config) {
-  const authPath = getAuthConfigPath();
-  const authDir = path.dirname(authPath);
-  if (!fs.existsSync(authDir)) {
-    fs.mkdirSync(authDir, { mode: 504, recursive: true });
-  }
-  fs.writeFileSync(authPath, JSON.stringify(config, null, 2), { mode: 384 });
-}
-function isValidAccessToken(authConfig, expirationBufferMs = 0) {
-  if (!authConfig.token)
-    return false;
-  if (typeof authConfig.expiresAt !== "number")
-    return true;
-  const nowInSeconds = Math.floor(Date.now() / 1e3);
-  const bufferInSeconds = expirationBufferMs / 1e3;
-  return authConfig.expiresAt >= nowInSeconds + bufferInSeconds;
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  isValidAccessToken,
-  readAuthConfig,
-  writeAuthConfig
-});