@vercel/oidc 3.5.0 → 3.6.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @vercel/oidc
 
+## 3.6.1
+
+### Patch Changes
+
+- 01cf6c2: Add `verifyVercelOidcToken` for verifying Vercel OIDC tokens against Vercel's remote JWKS.
+
+## 3.6.0
+
+### Minor Changes
+
+- fddeb55: Add configurable credentials storage handling across the CLI auth stack. Storage of credentials can be configured by the new `credStorage` key in global `config.json` or the new `VERCEL_TOKEN_STORAGE` environment variable. The environment variable takes precedence over the configuration key. Accepted values are `file` (store credentials in `auth.json`), `keyring` (store credentials in system keyring, e.g macOS Keychain or Secrets Service on Linux), and `auto` (try storing in keyring if available, fall back to `file` if keyring is not available).
+
+  `@vercel/oidc` supports keyring-stored authentication credentials by delegating the OIDC minting to the CLI executable via `@vercel/cli-exec`.
+
+### Patch Changes
+
+- Updated dependencies [fddeb55]
+  - @vercel/cli-config@0.2.0
+
 ## 3.5.0
 
 ### Minor Changes

package/dist/auth-errors.js

@@ -32,8 +32,11 @@ class AccessTokenMissingError extends Error {
 }
 class RefreshAccessTokenFailedError extends Error {
   constructor(cause) {
-    super("Failed to refresh authentication token.", { cause });
+    super("Failed to refresh authentication token.");
     this.name = "RefreshAccessTokenFailedError";
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
   }
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/get-vercel-oidc-token-with-refresh.test.js

@@ -27,8 +27,19 @@ var os = __toESM(require("os"));
 var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
 var import_token_io = require("./token-io");
+var import_cli_config = require("@vercel/cli-config");
 var import_get_vercel_oidc_token_with_refresh = require("./get-vercel-oidc-token-with-refresh");
 var tokenUtil = __toESM(require("./token-util"));
+import_vitest.vi.mock("@vercel/cli-config", async (importOriginal) => ({
+  ...await importOriginal(),
+  getGlobalPathConfig: import_vitest.vi.fn(),
+  getLikelyEffectiveCredStorage: import_vitest.vi.fn(() => "file")
+}));
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+  }
+}));
 import_vitest.vi.mock("./token-io");
 import_vitest.vi.mock("./get-context", () => ({
   getContext: () => ({ headers: {} })
@@ -57,6 +68,7 @@ import_vitest.vi.mock("./get-context", () => ({
     import_vitest.vi.spyOn(process, "cwd").mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(rootDir);
     import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(userDataDir);
+    import_vitest.vi.mocked(import_cli_config.getGlobalPathConfig).mockReturnValue(cliDataDir);
   });
   (0, import_vitest.afterEach)(() => {
     if (fs.existsSync(rootDir)) {
@@ -129,28 +141,24 @@ import_vitest.vi.mock("./get-context", () => ({
     );
     import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockRejectedValue(
       new TypeError(
-        "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+        "Vercel OIDC token is malformed. Expected a string-valued token property."
       )
     );
     process.env.VERCEL_OIDC_TOKEN = createExpiredToken();
     await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(
-      /Vercel OIDC token is malformed\. Expected a string-valued token property\. Please run `vc env pull` and try again/
+      /Vercel OIDC token is malformed\. Expected a string-valued token property\./
     );
   });
   (0, import_vitest.test)("should throw helpful error when token has invalid format", async () => {
     process.env.VERCEL_OIDC_TOKEN = "not-a-valid-jwt-token";
     import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockImplementation(() => {
-      throw new Error("Invalid token. Please run `vc env pull` and try again");
+      throw new Error("Invalid token.");
     });
-    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(
-      /Invalid token\. Please run `vc env pull` and try again/
-    );
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(/Invalid token\./);
   });
   (0, import_vitest.test)("should throw error when token expiry check fails", async () => {
     process.env.VERCEL_OIDC_TOKEN = "not-a-jwt-token";
-    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(
-      /Invalid token\. Please run `vc env pull` and try again/
-    );
+    await (0, import_vitest.expect)((0, import_get_vercel_oidc_token_with_refresh.getVercelOidcToken)()).rejects.toThrow(/Invalid token\./);
   });
   (0, import_vitest.test)("should fail when no token exists and no CLI credentials available", async () => {
     process.env.VERCEL_OIDC_TOKEN = void 0;

package/dist/index-browser.d.ts

@@ -1,4 +1,5 @@
 export { getContext } from './get-context';
+export { verifyVercelOidcToken, type VercelOidcPayload, } from './verify-vercel-oidc-token';
 export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
 export declare function getVercelOidcToken(): Promise<string>;
 export declare function getVercelOidcTokenSync(): string;

package/dist/index-browser.js

@@ -23,10 +23,12 @@ __export(index_browser_exports, {
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => getVercelOidcToken,
   getVercelOidcTokenSync: () => getVercelOidcTokenSync,
-  getVercelToken: () => getVercelToken
+  getVercelToken: () => getVercelToken,
+  verifyVercelOidcToken: () => import_verify_vercel_oidc_token.verifyVercelOidcToken
 });
 module.exports = __toCommonJS(index_browser_exports);
 var import_get_context = require("./get-context");
+var import_verify_vercel_oidc_token = require("./verify-vercel-oidc-token");
 var import_auth_errors = require("./auth-errors");
 async function getVercelOidcToken() {
   return "";
@@ -44,5 +46,6 @@ async function getVercelToken() {
   getContext,
   getVercelOidcToken,
   getVercelOidcTokenSync,
-  getVercelToken
+  getVercelToken,
+  verifyVercelOidcToken
 });

package/dist/index-browser.test.js

@@ -24,6 +24,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var import_vitest = require("vitest");
 var DefaultImports = __toESM(require("./index"));
 var BrowserImports = __toESM(require("./index-browser"));
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+  }
+}));
 (0, import_vitest.describe)("browser export", () => {
   (0, import_vitest.test)("should match the default export", async () => {
     (0, import_vitest.expect)(Object.keys(BrowserImports).sort()).toStrictEqual(

package/dist/index-edge-light.d.ts

@@ -1,4 +1,5 @@
 export { getContext } from './get-context';
+export { verifyVercelOidcToken, type VercelOidcPayload, } from './verify-vercel-oidc-token';
 export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
 export { getVercelOidcTokenSync } from './get-vercel-oidc-token-sync';
 /**

package/dist/index-edge-light.js

@@ -23,11 +23,13 @@ __export(index_edge_light_exports, {
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => getVercelOidcToken,
   getVercelOidcTokenSync: () => import_get_vercel_oidc_token_sync2.getVercelOidcTokenSync,
-  getVercelToken: () => getVercelToken
+  getVercelToken: () => getVercelToken,
+  verifyVercelOidcToken: () => import_verify_vercel_oidc_token.verifyVercelOidcToken
 });
 module.exports = __toCommonJS(index_edge_light_exports);
 var import_get_vercel_oidc_token_sync = require("./get-vercel-oidc-token-sync");
 var import_get_context = require("./get-context");
+var import_verify_vercel_oidc_token = require("./verify-vercel-oidc-token");
 var import_auth_errors = require("./auth-errors");
 var import_get_vercel_oidc_token_sync2 = require("./get-vercel-oidc-token-sync");
 async function getVercelOidcToken() {
@@ -43,5 +45,6 @@ async function getVercelToken() {
   getContext,
   getVercelOidcToken,
   getVercelOidcTokenSync,
-  getVercelToken
+  getVercelToken,
+  verifyVercelOidcToken
 });

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { getVercelOidcToken } from './get-vercel-oidc-token-with-refresh';
 export { getVercelOidcTokenSync } from './get-vercel-oidc-token-sync';
 export { getContext } from './get-context';
+export { verifyVercelOidcToken, type VercelOidcPayload, } from './verify-vercel-oidc-token';
 export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
 export { getVercelToken } from './token-util';

package/dist/index.js

@@ -23,12 +23,14 @@ __export(src_exports, {
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => import_get_vercel_oidc_token_with_refresh.getVercelOidcToken,
   getVercelOidcTokenSync: () => import_get_vercel_oidc_token_sync.getVercelOidcTokenSync,
-  getVercelToken: () => import_token_util.getVercelToken
+  getVercelToken: () => import_token_util.getVercelToken,
+  verifyVercelOidcToken: () => import_verify_vercel_oidc_token.verifyVercelOidcToken
 });
 module.exports = __toCommonJS(src_exports);
 var import_get_vercel_oidc_token_with_refresh = require("./get-vercel-oidc-token-with-refresh");
 var import_get_vercel_oidc_token_sync = require("./get-vercel-oidc-token-sync");
 var import_get_context = require("./get-context");
+var import_verify_vercel_oidc_token = require("./verify-vercel-oidc-token");
 var import_auth_errors = require("./auth-errors");
 var import_token_util = require("./token-util");
 // Annotate the CommonJS export names for ESM import in node:
@@ -38,5 +40,6 @@ var import_token_util = require("./token-util");
   getContext,
   getVercelOidcToken,
   getVercelOidcTokenSync,
-  getVercelToken
+  getVercelToken,
+  verifyVercelOidcToken
 });

package/dist/token-util.d.ts

@@ -1,4 +1,3 @@
-export declare function getVercelDataDir(): string | null;
 export interface GetVercelTokenOptions {
     /**
      * Optional time buffer in milliseconds before token expiry to consider it expired.
@@ -11,6 +10,7 @@ export declare function getVercelToken(options?: GetVercelTokenOptions): Promise
 interface VercelTokenResponse {
     token: string;
 }
+export declare function getVercelOidcTokenFromCli(projectId: string, teamId?: string): Promise<VercelTokenResponse>;
 export declare function getVercelOidcToken(authToken: string, projectId: string, teamId?: string): Promise<VercelTokenResponse | null>;
 export declare function assertVercelOidcTokenResponse(res: unknown): asserts res is VercelTokenResponse;
 export declare function findProjectInfo(): {

package/dist/token-util.js

@@ -31,8 +31,8 @@ __export(token_util_exports, {
   assertVercelOidcTokenResponse: () => assertVercelOidcTokenResponse,
   findProjectInfo: () => findProjectInfo,
   getTokenPayload: () => getTokenPayload,
-  getVercelDataDir: () => getVercelDataDir,
   getVercelOidcToken: () => getVercelOidcToken,
+  getVercelOidcTokenFromCli: () => getVercelOidcTokenFromCli,
   getVercelToken: () => getVercelToken,
   isExpired: () => isExpired,
   loadToken: () => loadToken,
@@ -41,29 +41,23 @@ __export(token_util_exports, {
 module.exports = __toCommonJS(token_util_exports);
 var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
+var import_cli_exec = require("@vercel/cli-exec");
+var import_cli_config = require("@vercel/cli-config");
 var import_token_error = require("./token-error");
 var import_token_io = require("./token-io");
-var import_auth_config = require("./auth-config");
 var import_oauth = require("./oauth");
 var import_auth_errors = require("./auth-errors");
-function getVercelDataDir() {
-  const vercelFolder = "com.vercel.cli";
-  const dataDir = (0, import_token_io.getUserDataDir)();
-  if (!dataDir) {
-    return null;
-  }
-  return path.join(dataDir, vercelFolder);
-}
 async function getVercelToken(options) {
-  const authConfig = (0, import_auth_config.readAuthConfig)();
-  if (!authConfig?.token) {
+  const configDir = (0, import_cli_config.getGlobalPathConfig)();
+  const authConfig = (0, import_cli_config.tryReadAuthConfig)(configDir);
+  if (!authConfig || !authConfig.token && !authConfig.refreshToken) {
     throw new import_auth_errors.AccessTokenMissingError();
   }
-  if ((0, import_auth_config.isValidAccessToken)(authConfig, options?.expirationBufferMs)) {
+  if (isValidAccessToken(authConfig, options?.expirationBufferMs)) {
     return authConfig.token;
   }
   if (!authConfig.refreshToken) {
-    (0, import_auth_config.writeAuthConfig)({});
+    (0, import_cli_config.writeAuthConfig)(configDir, {});
     throw new import_auth_errors.RefreshAccessTokenFailedError("No refresh token available");
   }
   try {
@@ -72,26 +66,70 @@ async function getVercelToken(options) {
     });
     const [tokensError, tokens] = await (0, import_oauth.processTokenResponse)(tokenResponse);
     if (tokensError || !tokens) {
-      (0, import_auth_config.writeAuthConfig)({});
+      (0, import_cli_config.writeAuthConfig)(configDir, {});
       throw new import_auth_errors.RefreshAccessTokenFailedError(tokensError);
     }
     const updatedConfig = {
       token: tokens.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in,
+      refreshToken: tokens.refresh_token
     };
-    if (tokens.refresh_token) {
-      updatedConfig.refreshToken = tokens.refresh_token;
-    }
-    (0, import_auth_config.writeAuthConfig)(updatedConfig);
+    (0, import_cli_config.writeAuthConfig)(configDir, updatedConfig);
     return updatedConfig.token;
   } catch (error) {
-    (0, import_auth_config.writeAuthConfig)({});
+    (0, import_cli_config.writeAuthConfig)(configDir, {});
     if (error instanceof import_auth_errors.AccessTokenMissingError || error instanceof import_auth_errors.RefreshAccessTokenFailedError) {
       throw error;
     }
     throw new import_auth_errors.RefreshAccessTokenFailedError(error);
   }
 }
+function isValidAccessToken(authConfig, expirationBufferMs = 0) {
+  if (!authConfig.token)
+    return false;
+  if (typeof authConfig.expiresAt !== "number")
+    return true;
+  const nowInSeconds = Math.floor(Date.now() / 1e3);
+  const bufferInSeconds = expirationBufferMs / 1e3;
+  return authConfig.expiresAt >= nowInSeconds + bufferInSeconds;
+}
+async function getVercelOidcTokenFromCli(projectId, teamId) {
+  const args = ["project", "token", projectId, "--format=json"];
+  if (teamId) {
+    args.push("--scope", teamId);
+  }
+  try {
+    const { stdout } = await (0, import_cli_exec.execVercelCli)(args);
+    let parsedOutput;
+    if (typeof stdout !== "string") {
+      throw new import_token_error.VercelOidcTokenError(
+        "Failed to refresh OIDC token: `vercel project token` did not return stdout"
+      );
+    }
+    try {
+      parsedOutput = JSON.parse(stdout);
+    } catch {
+      throw new import_token_error.VercelOidcTokenError(
+        "Failed to refresh OIDC token: `vercel project token` returned invalid JSON: " + stdout
+      );
+    }
+    assertVercelOidcTokenResponse(parsedOutput);
+    return parsedOutput;
+  } catch (error) {
+    if (error instanceof import_token_error.VercelOidcTokenError) {
+      throw error;
+    }
+    let message = error instanceof Error ? error.message : "";
+    const stderr = error instanceof import_cli_exec.VercelCliError ? error.stderr?.trim() : void 0;
+    if (stderr && !message.includes(stderr)) {
+      message = `${message}
+${stderr}`.trim();
+    }
+    throw new import_token_error.VercelOidcTokenError(
+      message ? `Failed to refresh OIDC token with the Vercel CLI: ${message}` : "Failed to refresh OIDC token with the Vercel CLI"
+    );
+  }
+}
 async function getVercelOidcToken(authToken, projectId, teamId) {
   const url = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
   const res = await fetch(url, {
@@ -111,13 +149,11 @@ async function getVercelOidcToken(authToken, projectId, teamId) {
 }
 function assertVercelOidcTokenResponse(res) {
   if (!res || typeof res !== "object") {
-    throw new TypeError(
-      "Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again"
-    );
+    throw new TypeError("Vercel OIDC token is malformed. Expected an object.");
   }
   if (!("token" in res) || typeof res.token !== "string") {
     throw new TypeError(
-      "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+      "Vercel OIDC token is malformed. Expected a string-valued token property."
     );
   }
 }
@@ -174,9 +210,7 @@ function loadToken(projectId) {
 function getTokenPayload(token) {
   const tokenParts = token.split(".");
   if (tokenParts.length !== 3) {
-    throw new import_token_error.VercelOidcTokenError(
-      "Invalid token. Please run `vc env pull` and try again"
-    );
+    throw new import_token_error.VercelOidcTokenError("Invalid token.");
   }
   const base64 = tokenParts[1].replace(/-/g, "+").replace(/_/g, "/");
   const padded = base64.padEnd(
@@ -193,8 +227,8 @@ function isExpired(token, bufferMs = 0) {
   assertVercelOidcTokenResponse,
   findProjectInfo,
   getTokenPayload,
-  getVercelDataDir,
   getVercelOidcToken,
+  getVercelOidcTokenFromCli,
   getVercelToken,
   isExpired,
   loadToken,

package/dist/token-util.test.js

@@ -23,9 +23,19 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var import_vitest = require("vitest");
 var import_token_util = require("./token-util");
-var authConfig = __toESM(require("./auth-config"));
+var cliConfig = __toESM(require("@vercel/cli-config"));
 var oauth = __toESM(require("./oauth"));
 var import_auth_errors = require("./auth-errors");
+import_vitest.vi.mock("@vercel/cli-exec", () => ({
+  execVercelCli: import_vitest.vi.fn(),
+  VercelCliError: class VercelCliError extends Error {
+  }
+}));
+import_vitest.vi.mock("@vercel/cli-config", () => ({
+  getGlobalPathConfig: import_vitest.vi.fn(() => "/mock/user/data/com.vercel.cli"),
+  tryReadAuthConfig: import_vitest.vi.fn(),
+  writeAuthConfig: import_vitest.vi.fn()
+}));
 import_vitest.vi.mock("fs");
 import_vitest.vi.mock("./token-io", () => ({
   getUserDataDir: import_vitest.vi.fn(() => "/mock/user/data"),
@@ -45,15 +55,13 @@ import_vitest.vi.mock("./token-io", () => ({
       expiresAt: Math.floor(Date.now() / 1e3) + 3600
       // expires in 1 hour
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(validToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(validToken);
     const token = await (0, import_token_util.getVercelToken)();
     (0, import_vitest.expect)(token).toBe("valid-access-token");
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).not.toHaveBeenCalled();
   });
   (0, import_vitest.it)("should throw AccessTokenMissingError if auth config does not exist", async () => {
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(null);
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(null);
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(import_auth_errors.AccessTokenMissingError);
   });
   (0, import_vitest.it)("should refresh token if expired and refresh token exists", async () => {
@@ -72,16 +80,15 @@ import_vitest.vi.mock("./token-io", () => ({
         refresh_token: "new-refresh-token"
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     const token = await (0, import_token_util.getVercelToken)();
     (0, import_vitest.expect)(token).toBe("new-access-token");
     (0, import_vitest.expect)(oauth.refreshTokenRequest).toHaveBeenCalledWith({
       refresh_token: "valid-refresh-token"
     });
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
       import_vitest.expect.objectContaining({
         token: "new-access-token",
         refreshToken: "new-refresh-token",
@@ -89,20 +96,41 @@ import_vitest.vi.mock("./token-io", () => ({
       })
     );
   });
+  (0, import_vitest.it)("should refresh token when only refreshToken is present", async () => {
+    const refreshOnlyToken = {
+      refreshToken: "valid-refresh-token"
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600
+      })
+    };
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(refreshOnlyToken);
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    const token = await (0, import_token_util.getVercelToken)();
+    (0, import_vitest.expect)(token).toBe("new-access-token");
+    (0, import_vitest.expect)(oauth.refreshTokenRequest).toHaveBeenCalledWith({
+      refresh_token: "valid-refresh-token"
+    });
+  });
   (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if token expired and no refresh token", async () => {
     const expiredTokenNoRefresh = {
       token: "expired-access-token",
       expiresAt: Math.floor(Date.now() / 1e3) - 3600
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(
       expiredTokenNoRefresh
     );
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
       import_auth_errors.RefreshAccessTokenFailedError
     );
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      {}
+    );
   });
   (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if refresh fails with OAuth error", async () => {
     const expiredToken = {
@@ -117,14 +145,15 @@ import_vitest.vi.mock("./token-io", () => ({
         error_description: "Refresh token expired"
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockErrorResponse);
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
       import_auth_errors.RefreshAccessTokenFailedError
     );
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      {}
+    );
   });
   (0, import_vitest.it)("should clear auth and throw RefreshAccessTokenFailedError if refresh fails with network error", async () => {
     const expiredToken = {
@@ -132,27 +161,26 @@ import_vitest.vi.mock("./token-io", () => ({
       refreshToken: "valid-refresh-token",
       expiresAt: Math.floor(Date.now() / 1e3) - 3600
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockRejectedValue(
       new Error("Network error")
     );
     await (0, import_vitest.expect)((0, import_token_util.getVercelToken)()).rejects.toThrow(
       import_auth_errors.RefreshAccessTokenFailedError
     );
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      {}
+    );
   });
   (0, import_vitest.it)("should treat token as valid if expiresAt is missing (--token case)", async () => {
     const tokenWithoutExpiry = {
       token: "cli-provided-token"
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(tokenWithoutExpiry);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(tokenWithoutExpiry);
     const token = await (0, import_token_util.getVercelToken)();
     (0, import_vitest.expect)(token).toBe("cli-provided-token");
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).not.toHaveBeenCalled();
   });
   (0, import_vitest.it)("should preserve new refresh token if provided in response", async () => {
     const expiredToken = {
@@ -169,18 +197,17 @@ import_vitest.vi.mock("./token-io", () => ({
         refresh_token: "new-refresh-token"
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     await (0, import_token_util.getVercelToken)();
-    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+    (0, import_vitest.expect)(cliConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
       import_vitest.expect.objectContaining({
         refreshToken: "new-refresh-token"
       })
     );
   });
-  (0, import_vitest.it)("should not overwrite refresh token if not provided in response", async () => {
+  (0, import_vitest.it)("should preserve refresh token if not provided in response", async () => {
     const expiredToken = {
       token: "expired-access-token",
       refreshToken: "existing-refresh-token",
@@ -195,13 +222,11 @@ import_vitest.vi.mock("./token-io", () => ({
         // No refresh_token in response
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     await (0, import_token_util.getVercelToken)();
-    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
-    (0, import_vitest.expect)(writeCall).not.toHaveProperty("refreshToken");
+    const writeCall = import_vitest.vi.mocked(cliConfig.writeAuthConfig).mock.calls[0][1];
+    (0, import_vitest.expect)(writeCall).toHaveProperty("refreshToken", "existing-refresh-token");
   });
   (0, import_vitest.it)("should calculate expiresAt correctly from expires_in", async () => {
     const expiredToken = {
@@ -218,14 +243,12 @@ import_vitest.vi.mock("./token-io", () => ({
         // 2 hours
       })
     };
-    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
-    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
-    });
+    import_vitest.vi.mocked(cliConfig.tryReadAuthConfig).mockReturnValue(expiredToken);
     import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
     const beforeCall = Math.floor(Date.now() / 1e3);
     await (0, import_token_util.getVercelToken)();
     const afterCall = Math.floor(Date.now() / 1e3);
-    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
+    const writeCall = import_vitest.vi.mocked(cliConfig.writeAuthConfig).mock.calls[0][1];
     (0, import_vitest.expect)(writeCall.expiresAt).toBeGreaterThanOrEqual(beforeCall + 7200);
     (0, import_vitest.expect)(writeCall.expiresAt).toBeLessThanOrEqual(afterCall + 7200);
   });

package/dist/token.js

@@ -21,6 +21,7 @@ __export(token_exports, {
   refreshToken: () => refreshToken
 });
 module.exports = __toCommonJS(token_exports);
+var import_cli_config = require("@vercel/cli-config");
 var import_token_error = require("./token-error");
 var import_token_util = require("./token-util");
 async function refreshToken(options) {
@@ -42,10 +43,15 @@ async function refreshToken(options) {
   }
   let maybeToken = (0, import_token_util.loadToken)(projectId);
   if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token), options?.expirationBufferMs)) {
-    const authToken = await (0, import_token_util.getVercelToken)({
-      expirationBufferMs: options?.expirationBufferMs
-    });
-    maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
+    const configDir = (0, import_cli_config.getGlobalPathConfig)();
+    if ((0, import_cli_config.getLikelyEffectiveCredStorage)(configDir) === "keyring") {
+      maybeToken = await (0, import_token_util.getVercelOidcTokenFromCli)(projectId, teamId);
+    } else {
+      const authToken = await (0, import_token_util.getVercelToken)({
+        expirationBufferMs: options?.expirationBufferMs
+      });
+      maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
+    }
     if (!maybeToken) {
       throw new import_token_error.VercelOidcTokenError("Failed to refresh OIDC token");
     }