@vercel/sandbox 1.1.4 → 1.1.5

package/dist/utils/dev-credentials.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cachedGenerateCredentials = void 0;
+exports.shouldPromptForCredentials = shouldPromptForCredentials;
+exports.generateCredentials = generateCredentials;
+exports.signInAndGetToken = signInAndGetToken;
+const picocolors_1 = __importDefault(require("picocolors"));
+const ms_1 = __importDefault(require("ms"));
+const Log = __importStar(require("./log"));
+async function importAuth() {
+    const auth = await Promise.resolve().then(() => __importStar(require("../auth/index")));
+    return auth;
+}
+function shouldPromptForCredentials() {
+    return (process.env.NODE_ENV !== "production" &&
+        !["1", "true"].includes(process.env.CI || "") &&
+        process.stdout.isTTY &&
+        process.stdin.isTTY);
+}
+/**
+ * Returns cached credentials for the given team/project combination.
+ *
+ * @remarks
+ * The cache is keyed by `teamId` and `projectId`. A new credential generation
+ * is triggered only when these values change or when a previous attempt failed.
+ *
+ * **Important:** Successfully resolved credentials are cached indefinitely and
+ * will not be refreshed even if the token expires. Cache invalidation only occurs
+ * on rejection (error). This is intentional for development use cases where
+ * short-lived sessions don't require proactive token refresh.
+ */
+exports.cachedGenerateCredentials = (() => {
+    let cache = null;
+    return async (opts) => {
+        if (!cache ||
+            cache[0].teamId !== opts.teamId ||
+            cache[0].projectId !== opts.projectId) {
+            const promise = generateCredentials(opts).catch((err) => {
+                cache = null;
+                throw err;
+            });
+            cache = [opts, promise];
+        }
+        const v = await cache[1];
+        Log.write("warn", `using inferred credentials team=${v.teamId} project=${v.projectId}`);
+        return v;
+    };
+})();
+/**
+ * Generates credentials by authenticating and inferring scope.
+ *
+ * @internal This is exported for testing purposes. Consider using
+ * {@link cachedGenerateCredentials} instead, which caches the result
+ * to avoid redundant authentication flows.
+ */
+async function generateCredentials(opts) {
+    const { OAuth, pollForToken, getAuth, updateAuthConfig, inferScope } = await importAuth();
+    let auth = getAuth();
+    if (!auth?.token) {
+        const timeout = process.env.VERCEL_URL
+            ? /* when deployed to vercel we don't want to have a long timeout */ "1 minute"
+            : "5 minutes";
+        auth = await signInAndGetToken({ OAuth, pollForToken, getAuth }, timeout);
+    }
+    if (auth?.refreshToken &&
+        auth.expiresAt &&
+        auth.expiresAt.getTime() <= Date.now()) {
+        const oauth = await OAuth();
+        const newToken = await oauth.refreshToken(auth.refreshToken);
+        auth = {
+            expiresAt: new Date(Date.now() + newToken.expires_in * 1000),
+            token: newToken.access_token,
+            refreshToken: newToken.refresh_token || auth.refreshToken,
+        };
+        updateAuthConfig(auth);
+    }
+    if (!auth?.token) {
+        throw new Error("Failed to retrieve authentication token.");
+    }
+    if (opts.teamId && opts.projectId) {
+        return {
+            token: auth.token,
+            teamId: opts.teamId,
+            projectId: opts.projectId,
+        };
+    }
+    const scope = await inferScope({ teamId: opts.teamId, token: auth.token });
+    if (scope.created) {
+        Log.write("info", `Created default project "${scope.projectId}" in team "${scope.teamId}".`);
+    }
+    return {
+        token: auth.token,
+        teamId: opts.teamId || scope.teamId,
+        projectId: opts.projectId || scope.projectId,
+    };
+}
+async function signInAndGetToken(auth, timeout) {
+    Log.write("warn", [
+        `No VERCEL_OIDC_TOKEN environment variable found, initiating device authorization flow...`,
+        `│  ${picocolors_1.default.bold("help:")} this flow only happens on development environment.`,
+        `│  In production, make sure to set up a proper token, or set up Vercel OIDC [https://vercel.com/docs/oidc].`,
+    ]);
+    const oauth = await auth.OAuth();
+    const request = await oauth.deviceAuthorizationRequest();
+    Log.write("info", [
+        `╰▶ To authenticate, visit: ${request.verification_uri_complete}`,
+        `   or visit ${picocolors_1.default.italic(request.verification_uri)} and type ${picocolors_1.default.bold(request.user_code)}`,
+        `   Press ${picocolors_1.default.bold("<return>")} to open in your browser`,
+    ]);
+    let error;
+    const generator = auth.pollForToken({ request, oauth });
+    let done = false;
+    let spawnedTimeout = setTimeout(() => {
+        if (done)
+            return;
+        const message = [
+            `Authentication flow timed out after ${timeout}.`,
+            `│  Make sure to provide a token to avoid prompting an interactive flow.`,
+            `╰▶ ${picocolors_1.default.bold("help:")} Link your project with ${Log.code("npx vercel link")} to refresh OIDC token automatically.`,
+        ].join("\n");
+        error = new Error(message);
+        // Note: generator.return() initiates cooperative cancellation. The generator's
+        // finally block will abort pending setTimeout calls, but any in-flight HTTP
+        // request will complete before the generator terminates. This is acceptable
+        // for this dev-only timeout scenario.
+        generator.return();
+    }, (0, ms_1.default)(timeout));
+    try {
+        for await (const event of generator) {
+            switch (event._tag) {
+                case "SlowDown":
+                case "Timeout":
+                case "Response":
+                    break;
+                case "Error":
+                    error = event.error;
+                    break;
+                default:
+                    throw new Error(`Unknown event type: ${JSON.stringify(event)}`);
+            }
+        }
+    }
+    finally {
+        done = true;
+        clearTimeout(spawnedTimeout);
+    }
+    if (error) {
+        Log.write("error", `${picocolors_1.default.bold("error:")} Authentication failed: ${error.message}`);
+        throw error;
+    }
+    Log.write("success", `${picocolors_1.default.bold("done!")} Authenticated successfully!`);
+    const stored = auth.getAuth();
+    return stored;
+}
+//# sourceMappingURL=dev-credentials.js.map

package/dist/utils/dev-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-credentials.js","sourceRoot":"","sources":["../../src/utils/dev-credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,gEAOC;AA8CD,kDAsDC;AAED,8CAqEC;AA5LD,4DAA8B;AAE9B,4CAAoB;AACpB,2CAA6B;AAE7B,KAAK,UAAU,UAAU;IACvB,MAAM,IAAI,GAAG,wDAAa,eAAe,GAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,0BAA0B;IACxC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK;QACpB,OAAO,CAAC,KAAK,CAAC,KAAK,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,yBAAyB,GAAG,CAAC,GAAG,EAAE;IAC7C,IAAI,KAAK,GAEE,IAAI,CAAC;IAChB,OAAO,KAAK,EAAE,IAA6C,EAAE,EAAE;QAC7D,IACE,CAAC,KAAK;YACN,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAC/B,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EACrC,CAAC;YACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtD,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,KAAK,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,GAAG,CAAC,KAAK,CACP,MAAM,EACN,mCAAmC,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CACrE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;GAMG;AACI,KAAK,UAAU,mBAAmB,CAAC,IAGzC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAClE,MAAM,UAAU,EAAE,CAAC;IACrB,IAAI,IAAI,GAAG,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,OAAO,GAAmB,OAAO,CAAC,GAAG,CAAC,UAAU;YACpD,CAAC,CAAC,kEAAkE,CAAC,UAAU;YAC/E,CAAC,CAAC,WAAW,CAAC;QAChB,IAAI,GAAG,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,IAAI,EAAE,YAAY;QAClB,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EACtC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,GAAG;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;YAC5D,KAAK,EAAE,QAAQ,CAAC,YAAY;YAC5B,YAAY,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY;SAC1D,CAAC;QACF,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAE3E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,MAAM,EACN,4BAA4B,KAAK,CAAC,SAAS,cAAc,KAAK,CAAC,MAAM,IAAI,CAC1E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;KAC7C,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,IAGC,EACD,OAAuB;IAEvB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;QAChB,0FAA0F;QAC1F,MAAM,oBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,qDAAqD;QAC7E,6GAA6G;KAC9G,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,EAAE,CAAC;IACzD,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;QAChB,8BAA8B,OAAO,CAAC,yBAAyB,EAAE;QACjE,eAAe,oBAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,oBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;QAC/F,YAAY,oBAAI,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B;KAC5D,CAAC,CAAC;IAEH,IAAI,KAAwB,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;QACnC,IAAI,IAAI;YAAE,OAAO;QACjB,MAAM,OAAO,GAAG;YACd,uCAAuC,OAAO,GAAG;YACjD,yEAAyE;YACzE,MAAM,oBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,uCAAuC;SACtH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,+EAA+E;QAC/E,4EAA4E;QAC5E,4EAA4E;QAC5E,sCAAsC;QACtC,SAAS,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YACpC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,UAAU,CAAC;gBAChB,KAAK,SAAS,CAAC;gBACf,KAAK,UAAU;oBACb,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;oBACpB,MAAM;gBACR;oBACE,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAqB,CAAC,EAAE,CAC/D,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,GAAG,IAAI,CAAC;QACZ,YAAY,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CACP,OAAO,EACP,GAAG,oBAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CACjE,CAAC;QACF,MAAM,KAAK,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,oBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/get-credentials.d.ts

@@ -14,6 +14,22 @@ export interface Credentials {
      */
     teamId: string;
 }
+/**
+ * Error thrown when OIDC context is not available in local development,
+ * therefore we should guide how to ensure it is set up by linking a project
+ */
+export declare class LocalOidcContextError extends Error {
+    name: string;
+    constructor(cause: unknown);
+}
+/**
+ * Error thrown when OIDC context is not available in Vercel environment,
+ * therefore we should guide how to set it up.
+ */
+export declare class VercelOidcContextError extends Error {
+    name: string;
+    constructor(cause: unknown);
+}
 /**
  * Allow to get credentials to access the Vercel API. Credentials can be
  * provided in two different ways:

package/dist/utils/get-credentials.js

@@ -1,10 +1,60 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.schema = void 0;
+exports.schema = exports.VercelOidcContextError = exports.LocalOidcContextError = void 0;
 exports.getCredentials = getCredentials;
 const oidc_1 = require("@vercel/oidc");
 const decode_base64_url_1 = require("./decode-base64-url");
 const zod_1 = require("zod");
+const dev_credentials_1 = require("./dev-credentials");
+/**
+ * Error thrown when OIDC context is not available in local development,
+ * therefore we should guide how to ensure it is set up by linking a project
+ */
+class LocalOidcContextError extends Error {
+    constructor(cause) {
+        const message = [
+            "Could not get credentials from OIDC context.",
+            "Please link your Vercel project using `npx vercel link`.",
+            "Then, pull an initial OIDC token with `npx vercel env pull`",
+            "and retry.",
+        ].join("\n");
+        super(message, { cause });
+        this.name = "LocalOidcContextError";
+    }
+}
+exports.LocalOidcContextError = LocalOidcContextError;
+/**
+ * Error thrown when OIDC context is not available in Vercel environment,
+ * therefore we should guide how to set it up.
+ */
+class VercelOidcContextError extends Error {
+    constructor(cause) {
+        const message = [
+            "Could not get credentials from OIDC context.",
+            "Please make sure OIDC is set up for your project",
+            "Read more at https://vercel.com/docs/oidc",
+        ].join("\n");
+        super(message, { cause });
+        this.name = "VercelOidcContextError";
+    }
+}
+exports.VercelOidcContextError = VercelOidcContextError;
+async function getVercelToken(opts) {
+    try {
+        return getCredentialsFromOIDCToken(await (0, oidc_1.getVercelOidcToken)());
+    }
+    catch (error) {
+        if (!(0, dev_credentials_1.shouldPromptForCredentials)()) {
+            if (process.env.VERCEL_URL) {
+                throw new VercelOidcContextError(error);
+            }
+            else {
+                throw new LocalOidcContextError(error);
+            }
+        }
+        return await (0, dev_credentials_1.cachedGenerateCredentials)(opts);
+    }
+}
 /**
  * Allow to get credentials to access the Vercel API. Credentials can be
  * provided in two different ways:
@@ -20,12 +70,21 @@ async function getCredentials(params) {
     if (credentials) {
         return credentials;
     }
-    const oidcToken = await (0, oidc_1.getVercelOidcToken)();
-    if (oidcToken) {
-        return getCredentialsFromOIDCToken(oidcToken);
-    }
-    throw new Error("You must provide credentials to access the Vercel API \n" +
-        "either through parameters or using OpenID Connect [https://vercel.com/docs/oidc]");
+    const oidcToken = await getVercelToken({
+        teamId: params &&
+            typeof params === "object" &&
+            "teamId" in params &&
+            typeof params.teamId === "string"
+            ? params.teamId
+            : undefined,
+        projectId: params &&
+            typeof params === "object" &&
+            "projectId" in params &&
+            typeof params.projectId === "string"
+            ? params.projectId
+            : undefined,
+    });
+    return oidcToken;
 }
 /**
  * Attempt to extract credentials from the provided parameters. Either all

package/dist/utils/get-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-credentials.js","sourceRoot":"","sources":["../../src/utils/get-credentials.ts"],"names":[],"mappings":";;;AA8BA,wCAeC;AA7CD,uCAAkD;AAClD,2DAAsD;AACtD,6BAAwB;AAkBxB;;;;;;;;;GASG;AACI,KAAK,UAAU,cAAc,CAAC,MAAgB;IACnD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAA,yBAAkB,GAAE,CAAC;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,0DAA0D;QACxD,kFAAkF,CACrF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAe;IAC/C,uCAAuC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACtE,QAAQ,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;QACzE,WAAW,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC3D,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,WAAW;KAChB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAG,MAAc,CAAC,KAAK;YAC5B,SAAS,EAAG,MAAc,CAAC,SAAS;YACpC,MAAM,EAAG,MAAc,CAAC,MAAM;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO;aAChE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aACjC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACU,QAAA,MAAM,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC7E,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAC1D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,cAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,MAAM,EAAE,OAAO,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"get-credentials.js","sourceRoot":"","sources":["../../src/utils/get-credentials.ts"],"names":[],"mappings":";;;AAqFA,wCAwBC;AA7GD,uCAAkD;AAClD,2DAAsD;AACtD,6BAAwB;AACxB,uDAG2B;AAkB3B;;;GAGG;AACH,MAAa,qBAAsB,SAAQ,KAAK;IAE9C,YAAY,KAAc;QACxB,MAAM,OAAO,GAAG;YACd,8CAA8C;YAC9C,0DAA0D;YAC1D,6DAA6D;YAC7D,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAR5B,SAAI,GAAG,uBAAuB,CAAC;IAS/B,CAAC;CACF;AAXD,sDAWC;AAED;;;GAGG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IAE/C,YAAY,KAAc;QACxB,MAAM,OAAO,GAAG;YACd,8CAA8C;YAC9C,kDAAkD;YAClD,2CAA2C;SAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAP5B,SAAI,GAAG,wBAAwB,CAAC;IAQhC,CAAC;CACF;AAVD,wDAUC;AAED,KAAK,UAAU,cAAc,CAAC,IAG7B;IACC,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,IAAA,yBAAkB,GAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,IAAA,4CAA0B,GAAE,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,IAAA,2CAAyB,EAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,cAAc,CAAC,MAAgB;IACnD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;QACrC,MAAM,EACJ,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,QAAQ,IAAI,MAAM;YAClB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAC/B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,SAAS;QACf,SAAS,EACP,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,WAAW,IAAI,MAAM;YACrB,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAClC,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,MAAe;IAC/C,uCAAuC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACtE,QAAQ,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;QACzE,WAAW,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC3D,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,WAAW;KAChB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAG,MAAc,CAAC,KAAK;YAC5B,SAAS,EAAG,MAAc,CAAC,SAAS;YACpC,MAAM,EAAG,MAAc,CAAC,MAAM;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO;aAChE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;aACjC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACU,QAAA,MAAM,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC7E,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAC1D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,cAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,MAAM,EAAE,OAAO,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/utils/log.d.ts

@@ -0,0 +1,2 @@
+export declare function write(level: "warn" | "error" | "info" | "success", text: string | string[]): void;
+export declare function code(text: string): string;

package/dist/utils/log.js

@@ -0,0 +1,24 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.write = write;
+exports.code = code;
+const picocolors_1 = __importDefault(require("picocolors"));
+const colors = {
+    warn: picocolors_1.default.yellow,
+    error: picocolors_1.default.red,
+    success: picocolors_1.default.green,
+    info: picocolors_1.default.blue,
+};
+const logPrefix = picocolors_1.default.dim("[vercel/sandbox]");
+function write(level, text) {
+    text = Array.isArray(text) ? text.join("\n") : text;
+    const prefixed = text.replace(/^/gm, `${logPrefix} `);
+    console.error(colors[level](prefixed));
+}
+function code(text) {
+    return picocolors_1.default.italic(picocolors_1.default.dim("`") + text + picocolors_1.default.dim("`"));
+}
+//# sourceMappingURL=log.js.map

package/dist/utils/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/utils/log.ts"],"names":[],"mappings":";;;;;AAQA,sBAOC;AAED,oBAEC;AAnBD,4DAA8B;AAC9B,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,oBAAI,CAAC,MAAM;IACjB,KAAK,EAAE,oBAAI,CAAC,GAAG;IACf,OAAO,EAAE,oBAAI,CAAC,KAAK;IACnB,IAAI,EAAE,oBAAI,CAAC,IAAI;CAChB,CAAC;AACF,MAAM,SAAS,GAAG,oBAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC/C,SAAgB,KAAK,CACnB,KAA4C,EAC5C,IAAuB;IAEvB,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,GAAG,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,IAAI,CAAC,IAAY;IAC/B,OAAO,oBAAI,CAAC,MAAM,CAAC,oBAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.1.4";
+export declare const VERSION = "1.1.5";

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 // Autogenerated by inject-version.ts
-exports.VERSION = "1.1.4";
+exports.VERSION = "1.1.5";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/sandbox",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,8 +13,10 @@
     "async-retry": "1.3.3",
     "jsonlines": "0.1.1",
     "ms": "2.1.3",
+    "picocolors": "^1.1.1",
     "tar-stream": "3.1.7",
     "undici": "^7.16.0",
+    "xdg-app-paths": "5.1.0",
     "zod": "3.24.4"
   },
   "devDependencies": {
@@ -24,6 +26,7 @@
     "@types/node": "22.15.12",
     "@types/tar-stream": "3.1.4",
     "dotenv": "16.5.0",
+    "factoree": "^0.1.2",
     "typedoc": "0.28.5",
     "typescript": "5.8.3",
     "vitest": "3.2.1"

package/src/api-client/api-client.test.ts

@@ -0,0 +1,128 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { APIClient } from "./api-client";
+import { APIError, StreamError } from "./api-error";
+import { createNdjsonStream } from "../../test-utils/mock-response";
+
+describe("APIClient", () => {
+  describe("getLogs", () => {
+    let client: APIClient;
+    let mockFetch: ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+      mockFetch = vi.fn();
+      client = new APIClient({
+        teamId: "team_123",
+        token: "1234",
+        fetch: mockFetch,
+      });
+    });
+
+    it("yields stdout log lines", async () => {
+      const logLines = [
+        { stream: "stdout", data: "hello" },
+        { stream: "stdout", data: "world" },
+      ];
+
+      mockFetch.mockResolvedValue(
+        new Response(createNdjsonStream(logLines), {
+          headers: { "content-type": "application/x-ndjson" },
+        }),
+      );
+
+      const logs = client.getLogs({ sandboxId: "sbx_123", cmdId: "cmd_456" });
+      const results: Array<{ stream: string; data: string }> = [];
+
+      for await (const log of logs) {
+        results.push(log);
+      }
+
+      expect(results).toHaveLength(2);
+      expect(results[0]).toEqual({ stream: "stdout", data: "hello" });
+      expect(results[1]).toEqual({ stream: "stdout", data: "world" });
+    });
+
+    it("yields stderr log lines", async () => {
+      const logLines = [{ stream: "stderr", data: "Error" }];
+
+      mockFetch.mockResolvedValue(
+        new Response(createNdjsonStream(logLines), {
+          headers: { "content-type": "application/x-ndjson" },
+        }),
+      );
+
+      const logs = client.getLogs({ sandboxId: "sbx_123", cmdId: "cmd_456" });
+      const results: Array<{ stream: string; data: string }> = [];
+
+      for await (const log of logs) {
+        results.push(log);
+      }
+
+      expect(results).toHaveLength(1);
+      expect(results[0]).toEqual({
+        stream: "stderr",
+        data: "Error",
+      });
+    });
+
+    it("throws APIError when content-type is not application/x-ndjson", async () => {
+      mockFetch.mockResolvedValue(
+        new Response(null, {
+          headers: { "content-type": "application/json" },
+        }),
+      );
+
+      const logs = client.getLogs({ sandboxId: "sbx_123", cmdId: "cmd_456" });
+
+      await expect(async () => {
+        for await (const _ of logs) {
+        }
+      }).rejects.toThrow(APIError);
+    });
+
+    it("throws APIError when response body is null", async () => {
+      mockFetch.mockResolvedValue(
+        new Response(null, {
+          headers: { "content-type": "application/x-ndjson" },
+        }),
+      );
+
+      const logs = client.getLogs({ sandboxId: "sbx_123", cmdId: "cmd_456" });
+
+      await expect(async () => {
+        for await (const _ of logs) {
+        }
+      }).rejects.toThrow(APIError);
+    });
+
+    it("throws StreamError when error log line is received", async () => {
+      const logLines = [
+        { stream: "stdout", data: "some logs" },
+        {
+          stream: "error",
+          data: {
+            code: "sandbox_stream_closed",
+            message: "Sandbox stream was closed and is not accepting commands.",
+          },
+        },
+      ];
+
+      mockFetch.mockResolvedValue(
+        new Response(createNdjsonStream(logLines), {
+          headers: { "content-type": "application/x-ndjson" },
+        }),
+      );
+
+      const logs = client.getLogs({ sandboxId: "sbx_123", cmdId: "cmd_456" });
+      const results: Array<{ stream: string; data: string }> = [];
+
+      await expect(async () => {
+        for await (const log of logs) {
+          results.push(log);
+        }
+      }).rejects.toThrow(StreamError);
+
+      expect(results).toHaveLength(1);
+      expect(results[0]).toEqual({ stream: "stdout", data: "some logs" });
+    });
+  });
+});

package/src/api-client/with-retry.ts

@@ -1,6 +1,6 @@
 import type { Options as RetryOptions } from "async-retry";
 import { APIError } from "./api-error";
-import { setTimeout } from "timers/promises";
+import { setTimeout } from "node:timers/promises";
 import retry from "async-retry";
 
 export interface RequestOptions {

package/src/auth/api.ts

@@ -0,0 +1,31 @@
+import { NotOk } from "./error";
+
+export async function fetchApi(opts: {
+  token: string;
+  endpoint: string;
+  method?: string;
+  body?: string;
+}): Promise<unknown> {
+  const x = await fetch(`https://api.vercel.com${opts.endpoint}`, {
+    method: opts.method,
+    body: opts.body,
+    headers: {
+      Authorization: `Bearer ${opts.token}`,
+      "Content-Type": "application/json",
+    },
+  });
+  if (!x.ok) {
+    let message = await x.text();
+
+    try {
+      const { error } = JSON.parse(message);
+      message = `${error.code.toUpperCase()}: ${error.message}`;
+    } catch {}
+
+    throw new NotOk({
+      responseText: message,
+      statusCode: x.status,
+    });
+  }
+  return (await x.json()) as unknown;
+}

package/src/auth/error.ts

@@ -0,0 +1,8 @@
+export class NotOk extends Error {
+  name = "NotOk";
+  response: { statusCode: number; responseText: string };
+  constructor(response: { statusCode: number; responseText: string }) {
+    super(`HTTP ${response.statusCode}: ${response.responseText}`);
+    this.response = response;
+  }
+}

package/src/auth/file.ts

@@ -0,0 +1,69 @@
+import path from "node:path";
+import fs from "node:fs";
+import { homedir } from "node:os";
+import XDGAppPaths from "xdg-app-paths";
+import { z } from "zod";
+import { json } from "./zod";
+
+const ZodDate = z.number().transform((seconds) => new Date(seconds * 1000));
+
+const AuthFile = z.object({
+  token: z.string().min(1).optional(),
+  refreshToken: z.string().min(1).optional(),
+  expiresAt: ZodDate.optional(),
+});
+
+const StoredAuthFile = json.pipe(AuthFile);
+
+type AuthFile = z.infer<typeof AuthFile>;
+
+// Returns whether a directory exists
+const isDirectory = (path: string): boolean => {
+  try {
+    return fs.lstatSync(path).isDirectory();
+  } catch (_) {
+    // We don't care which kind of error occured, it isn't a directory anyway.
+    return false;
+  }
+};
+
+// Returns in which directory the config should be present
+const getGlobalPathConfig = (): string => {
+  const vercelDirectories = XDGAppPaths("com.vercel.cli").dataDirs();
+
+  const possibleConfigPaths = [
+    ...vercelDirectories, // latest vercel directory
+    path.join(homedir(), ".now"), // legacy config in user's home directory
+    ...XDGAppPaths("now").dataDirs(), // legacy XDG directory
+  ];
+
+  // The customPath flag is the preferred location,
+  // followed by the vercel directory,
+  // followed by the now directory.
+  // If none of those exist, use the vercel directory.
+  return (
+    possibleConfigPaths.find((configPath) => isDirectory(configPath)) ||
+    vercelDirectories[0]
+  );
+};
+
+export const getAuth = () => {
+  try {
+    const pathname = path.join(getGlobalPathConfig(), "auth.json");
+    return StoredAuthFile.parse(fs.readFileSync(pathname, "utf8"));
+  } catch {
+    return null;
+  }
+};
+
+export function updateAuthConfig(config: AuthFile): void {
+  const pathname = path.join(getGlobalPathConfig(), "auth.json");
+  fs.mkdirSync(path.dirname(pathname), { recursive: true });
+  const content = {
+    token: config.token,
+    expiresAt:
+      config.expiresAt && Math.round(config.expiresAt.getTime() / 1000),
+    refreshToken: config.refreshToken,
+  } satisfies z.input<typeof AuthFile>;
+  fs.writeFileSync(pathname, JSON.stringify(content) + "\n");
+}

package/src/auth/index.ts

@@ -0,0 +1,9 @@
+// This file can also be imported as `@vercel/sandbox/dist/auth`, which is completely fine.
+// The only valid importer of this would be the CLI as we share the same codebase.
+
+export * from "./file";
+export type * from "./file";
+export * from "./oauth";
+export type * from "./oauth";
+export { pollForToken } from "./poll-for-token";
+export { inferScope, selectTeam } from "./project";