@vercel/oidc 3.6.1 → 3.7.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @vercel/oidc
 
+## 3.7.0
+
+### Minor Changes
+
+- 415fde0: Add optional `audience` and `jti` parameters to exchange Vercel OIDC tokens for use with AWS STS and other providers.
+
+## 3.6.2
+
+### Patch Changes
+
+- Updated dependencies [3f21605]
+  - @vercel/cli-exec@1.0.0
+
 ## 3.6.1
 
 ### Patch Changes

package/dist/exchange-vercel-oidc-token.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The options for the `exchangeVercelOidcToken` function.
+ *
+ * @typedef {Object} ExchangeVercelOidcTokenOptions
+ * @property {string} token - The token to exchange.
+ * @property {string} audience - Optional audience to set on the exchanged token.
+ * @property {string} jti - Optional JTI to set on the exchanged token.
+ */
+export interface ExchangeVercelOidcTokenOptions {
+    /**
+     * The token to exchange.
+     */
+    token: string;
+    /**
+     * Optional audience to set on the exchanged token.
+     * @default undefined
+     */
+    audience?: string;
+    /**
+     * Optional JTI to set on the exchanged token.
+     * @default undefined
+     */
+    jti?: string;
+}
+/**
+ * Exchanges a Vercel OIDC token for a Vercel token with a custom audience.
+ *
+ * @param {ExchangeVercelOidcTokenOptions} options - The options for the exchange.
+ * @param {string} options.token - The token to exchange.
+ * @param {string} options.audience - Optional audience to set on the exchanged token.
+ * @param {string} options.jti - Optional JTI to set on the exchanged token.
+ * @throws {Error} If the token exchange fails.
+ * @returns {Promise<string>} A promise that resolves to the exchanged token.
+ */
+export declare function exchangeVercelOidcToken(options: ExchangeVercelOidcTokenOptions): Promise<string>;

package/dist/exchange-vercel-oidc-token.js

@@ -0,0 +1,70 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var exchange_vercel_oidc_token_exports = {};
+__export(exchange_vercel_oidc_token_exports, {
+  exchangeVercelOidcToken: () => exchangeVercelOidcToken
+});
+module.exports = __toCommonJS(exchange_vercel_oidc_token_exports);
+var import_version = require("./version");
+async function exchangeVercelOidcToken(options) {
+  const response = await fetch("https://oidc.vercel.com/~token", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": `@vercel/oidc@${import_version.version}`
+    },
+    body: JSON.stringify({
+      token: options.token,
+      aud: options.audience,
+      ...options.jti ? { jti: options.jti } : void 0
+    })
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Failed to exchange token: ${await readErrorMessage(response)}`
+    );
+  }
+  let data;
+  try {
+    data = await response.json();
+  } catch (_error) {
+    throw new Error("Failed to exchange token: response was not valid JSON");
+  }
+  if (!data || typeof data !== "object" || !("token" in data) || typeof data.token !== "string") {
+    throw new Error(
+      "Failed to exchange token: response did not contain a token"
+    );
+  }
+  return data.token;
+}
+async function readErrorMessage(response) {
+  try {
+    const data = await response.json();
+    if (data && typeof data === "object" && "error" in data && typeof data.error === "string") {
+      return data.error;
+    }
+  } catch (_error) {
+  }
+  return response.statusText || `HTTP ${response.status}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  exchangeVercelOidcToken
+});

package/dist/get-vercel-oidc-token-with-refresh.d.ts

@@ -1,7 +1,8 @@
+import { type ExchangeVercelOidcTokenOptions } from './exchange-vercel-oidc-token';
 /**
  * Options for getting the Vercel OIDC token.
  */
-export interface GetVercelOidcTokenOptions {
+export interface GetVercelOidcTokenOptions extends Omit<ExchangeVercelOidcTokenOptions, 'token'> {
     /**
      * Optional team ID (team_*) or slug to use for token refresh.
      * When provided, this team will be used instead of reading from `.vercel/project.json`.

package/dist/get-vercel-oidc-token-with-refresh.js

@@ -31,6 +31,7 @@ __export(get_vercel_oidc_token_with_refresh_exports, {
   getVercelOidcToken: () => getVercelOidcToken
 });
 module.exports = __toCommonJS(get_vercel_oidc_token_with_refresh_exports);
+var import_exchange_vercel_oidc_token = require("./exchange-vercel-oidc-token");
 var import_get_vercel_oidc_token_sync = require("./get-vercel-oidc-token-sync");
 var import_token_error = require("./token-error");
 async function getVercelOidcToken(options) {
@@ -61,6 +62,13 @@ ${error.message}`;
     }
     throw error;
   }
+  if (options?.audience) {
+    token = await (0, import_exchange_vercel_oidc_token.exchangeVercelOidcToken)({
+      token,
+      audience: options.audience,
+      jti: options.jti
+    });
+  }
   return token;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/index-edge-light.d.ts

@@ -1,12 +1,14 @@
+import { ExchangeVercelOidcTokenOptions } from './exchange-vercel-oidc-token';
 export { getContext } from './get-context';
 export { verifyVercelOidcToken, type VercelOidcPayload, } from './verify-vercel-oidc-token';
 export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
 export { getVercelOidcTokenSync } from './get-vercel-oidc-token-sync';
+export { exchangeVercelOidcToken, type ExchangeVercelOidcTokenOptions, } from './exchange-vercel-oidc-token';
 /**
  * Gets the current OIDC token in Edge Runtime.
  *
  * Edge Runtime does not support automatic token refresh, so this returns the
  * request-scoped token without checking expiration.
  */
-export declare function getVercelOidcToken(): Promise<string>;
+export declare function getVercelOidcToken(options?: ExchangeVercelOidcTokenOptions): Promise<string>;
 export declare function getVercelToken(): Promise<string>;

package/dist/index-edge-light.js

@@ -20,6 +20,7 @@ var index_edge_light_exports = {};
 __export(index_edge_light_exports, {
   AccessTokenMissingError: () => import_auth_errors.AccessTokenMissingError,
   RefreshAccessTokenFailedError: () => import_auth_errors.RefreshAccessTokenFailedError,
+  exchangeVercelOidcToken: () => import_exchange_vercel_oidc_token2.exchangeVercelOidcToken,
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => getVercelOidcToken,
   getVercelOidcTokenSync: () => import_get_vercel_oidc_token_sync2.getVercelOidcTokenSync,
@@ -27,13 +28,23 @@ __export(index_edge_light_exports, {
   verifyVercelOidcToken: () => import_verify_vercel_oidc_token.verifyVercelOidcToken
 });
 module.exports = __toCommonJS(index_edge_light_exports);
+var import_exchange_vercel_oidc_token = require("./exchange-vercel-oidc-token");
 var import_get_vercel_oidc_token_sync = require("./get-vercel-oidc-token-sync");
 var import_get_context = require("./get-context");
 var import_verify_vercel_oidc_token = require("./verify-vercel-oidc-token");
 var import_auth_errors = require("./auth-errors");
 var import_get_vercel_oidc_token_sync2 = require("./get-vercel-oidc-token-sync");
-async function getVercelOidcToken() {
-  return (0, import_get_vercel_oidc_token_sync.getVercelOidcTokenSync)();
+var import_exchange_vercel_oidc_token2 = require("./exchange-vercel-oidc-token");
+async function getVercelOidcToken(options) {
+  let token = (0, import_get_vercel_oidc_token_sync.getVercelOidcTokenSync)();
+  if (options?.audience) {
+    token = await (0, import_exchange_vercel_oidc_token.exchangeVercelOidcToken)({
+      token,
+      audience: options.audience,
+      jti: options.jti
+    });
+  }
+  return token;
 }
 async function getVercelToken() {
   throw new Error("getVercelToken is not supported in Edge Runtime");
@@ -42,6 +53,7 @@ async function getVercelToken() {
 0 && (module.exports = {
   AccessTokenMissingError,
   RefreshAccessTokenFailedError,
+  exchangeVercelOidcToken,
   getContext,
   getVercelOidcToken,
   getVercelOidcTokenSync,

package/dist/index.d.ts

@@ -3,4 +3,5 @@ export { getVercelOidcTokenSync } from './get-vercel-oidc-token-sync';
 export { getContext } from './get-context';
 export { verifyVercelOidcToken, type VercelOidcPayload, } from './verify-vercel-oidc-token';
 export { AccessTokenMissingError, RefreshAccessTokenFailedError, } from './auth-errors';
-export { getVercelToken } from './token-util';
+export { exchangeVercelOidcToken, type ExchangeVercelOidcTokenOptions, } from './exchange-vercel-oidc-token';
+export { getVercelToken, type GetVercelTokenOptions, } from './token-util';

package/dist/index.js

@@ -20,6 +20,7 @@ var src_exports = {};
 __export(src_exports, {
   AccessTokenMissingError: () => import_auth_errors.AccessTokenMissingError,
   RefreshAccessTokenFailedError: () => import_auth_errors.RefreshAccessTokenFailedError,
+  exchangeVercelOidcToken: () => import_exchange_vercel_oidc_token.exchangeVercelOidcToken,
   getContext: () => import_get_context.getContext,
   getVercelOidcToken: () => import_get_vercel_oidc_token_with_refresh.getVercelOidcToken,
   getVercelOidcTokenSync: () => import_get_vercel_oidc_token_sync.getVercelOidcTokenSync,
@@ -32,11 +33,13 @@ var import_get_vercel_oidc_token_sync = require("./get-vercel-oidc-token-sync");
 var import_get_context = require("./get-context");
 var import_verify_vercel_oidc_token = require("./verify-vercel-oidc-token");
 var import_auth_errors = require("./auth-errors");
+var import_exchange_vercel_oidc_token = require("./exchange-vercel-oidc-token");
 var import_token_util = require("./token-util");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AccessTokenMissingError,
   RefreshAccessTokenFailedError,
+  exchangeVercelOidcToken,
   getContext,
   getVercelOidcToken,
   getVercelOidcTokenSync,

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const version = "3.7.0";

package/dist/version.js

@@ -0,0 +1,28 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var version_exports = {};
+__export(version_exports, {
+  version: () => version
+});
+module.exports = __toCommonJS(version_exports);
+const version = "3.7.0";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  version
+});

package/docs/README.md

@@ -9,12 +9,18 @@
 - [AccessTokenMissingError](classes/AccessTokenMissingError.md)
 - [RefreshAccessTokenFailedError](classes/RefreshAccessTokenFailedError.md)
 
+## Interfaces
+
+- [ExchangeVercelOidcTokenOptions](interfaces/ExchangeVercelOidcTokenOptions.md)
+- [GetVercelTokenOptions](interfaces/GetVercelTokenOptions.md)
+
 ## Type Aliases
 
 - [VercelOidcPayload](type-aliases/VercelOidcPayload.md)
 
 ## Functions
 
+- [exchangeVercelOidcToken](functions/exchangeVercelOidcToken.md)
 - [getContext](functions/getContext.md)
 - [getVercelOidcToken](functions/getVercelOidcToken.md)
 - [getVercelOidcTokenSync](functions/getVercelOidcTokenSync.md)

package/docs/functions/exchangeVercelOidcToken.md

@@ -0,0 +1,29 @@
+[**@vercel/oidc**](../README.md)
+
+---
+
+# Function: exchangeVercelOidcToken()
+
+> **exchangeVercelOidcToken**(`options`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
+
+Defined in: [packages/oidc/src/exchange-vercel-oidc-token.ts:38](https://github.com/vercel/vercel/blob/main/packages/oidc/src/exchange-vercel-oidc-token.ts#L38)
+
+Exchanges a Vercel OIDC token for a Vercel token with a custom audience.
+
+## Parameters
+
+### options
+
+[`ExchangeVercelOidcTokenOptions`](../interfaces/ExchangeVercelOidcTokenOptions.md)
+
+The options for the exchange.
+
+## Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
+
+A promise that resolves to the exchanged token.
+
+## Throws
+
+If the token exchange fails.

package/docs/functions/getVercelOidcToken.md

@@ -6,7 +6,7 @@
 
 > **getVercelOidcToken**(`options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`string`\>
 
-Defined in: [packages/oidc/src/get-vercel-oidc-token-with-refresh.ts:64](https://github.com/vercel/vercel/blob/main/packages/oidc/src/get-vercel-oidc-token-with-refresh.ts#L64)
+Defined in: [packages/oidc/src/get-vercel-oidc-token-with-refresh.ts:69](https://github.com/vercel/vercel/blob/main/packages/oidc/src/get-vercel-oidc-token-with-refresh.ts#L69)
 
 Gets the current OIDC token from the request context or the environment variable.
 

package/docs/functions/getVercelToken.md

@@ -12,7 +12,7 @@ Defined in: [packages/oidc/src/token-util.ts:27](https://github.com/vercel/verce
 
 ### options?
 
-`GetVercelTokenOptions`
+[`GetVercelTokenOptions`](../interfaces/GetVercelTokenOptions.md)
 
 ## Returns
 

package/docs/interfaces/ExchangeVercelOidcTokenOptions.md

@@ -0,0 +1,39 @@
+[**@vercel/oidc**](../README.md)
+
+---
+
+# Interface: ExchangeVercelOidcTokenOptions
+
+Defined in: [packages/oidc/src/exchange-vercel-oidc-token.ts:11](https://github.com/vercel/vercel/blob/main/packages/oidc/src/exchange-vercel-oidc-token.ts#L11)
+
+The options for the `exchangeVercelOidcToken` function.
+
+## Properties
+
+### audience?
+
+> `optional` **audience?**: `string`
+
+Defined in: [packages/oidc/src/exchange-vercel-oidc-token.ts:20](https://github.com/vercel/vercel/blob/main/packages/oidc/src/exchange-vercel-oidc-token.ts#L20)
+
+Optional audience to set on the exchanged token.
+
+---
+
+### jti?
+
+> `optional` **jti?**: `string`
+
+Defined in: [packages/oidc/src/exchange-vercel-oidc-token.ts:25](https://github.com/vercel/vercel/blob/main/packages/oidc/src/exchange-vercel-oidc-token.ts#L25)
+
+Optional JTI to set on the exchanged token.
+
+---
+
+### token
+
+> **token**: `string`
+
+Defined in: [packages/oidc/src/exchange-vercel-oidc-token.ts:15](https://github.com/vercel/vercel/blob/main/packages/oidc/src/exchange-vercel-oidc-token.ts#L15)
+
+The token to exchange.

package/docs/interfaces/GetVercelTokenOptions.md

@@ -0,0 +1,24 @@
+[**@vercel/oidc**](../README.md)
+
+---
+
+# Interface: GetVercelTokenOptions
+
+Defined in: [packages/oidc/src/token-util.ts:18](https://github.com/vercel/vercel/blob/main/packages/oidc/src/token-util.ts#L18)
+
+## Properties
+
+### expirationBufferMs?
+
+> `optional` **expirationBufferMs?**: `number`
+
+Defined in: [packages/oidc/src/token-util.ts:24](https://github.com/vercel/vercel/blob/main/packages/oidc/src/token-util.ts#L24)
+
+Optional time buffer in milliseconds before token expiry to consider it expired.
+When provided, the token will be refreshed if it expires within this buffer time.
+
+#### Default
+
+```ts
+0;
+```

package/package.json

@@ -18,7 +18,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "3.6.1",
+  "version": "3.7.0",
   "repository": {
     "directory": "packages/oidc",
     "type": "git",
@@ -30,7 +30,7 @@
   "dependencies": {
     "jose": "^5.9.6",
     "@vercel/cli-config": "0.2.0",
-    "@vercel/cli-exec": "0.1.1"
+    "@vercel/cli-exec": "1.0.0"
   },
   "devDependencies": {
     "prettier": "3.8.3",
@@ -52,7 +52,7 @@
     "pretest": "pnpm run build:code",
     "test": "vitest",
     "build": "pnpm run build:code && pnpm run build:docs",
-    "build:code": "node ../../utils/build.mjs",
+    "build:code": "node build.mjs",
     "build:docs": "typedoc && prettier --write docs/**/*.md docs/*.md"
   }
 }