@vercel/sandbox 2.0.0-beta.2 → 2.0.0-beta.20

package/dist/auth/poll-for-token.d.ts

@@ -1,20 +1,28 @@
-import { DeviceAuthorizationRequest, OAuth } from "./oauth";
-export type PollTokenItem = {
-    _tag: "Timeout";
-    newInterval: number;
+import { DeviceAuthorizationRequest, OAuth } from "./oauth.js";
+
+//#region src/auth/poll-for-token.d.ts
+type PollTokenItem = {
+  _tag: "Timeout";
+  newInterval: number;
 } | {
-    _tag: "SlowDown";
-    newInterval: number;
+  _tag: "SlowDown";
+  newInterval: number;
 } | {
-    _tag: "Error";
-    error: Error;
+  _tag: "Error";
+  error: Error;
 } | {
-    _tag: "Response";
-    response: {
-        text(): Promise<string>;
-    };
+  _tag: "Response";
+  response: {
+    text(): Promise<string>;
+  };
 };
-export declare function pollForToken({ request, oauth, }: {
-    request: DeviceAuthorizationRequest;
-    oauth: OAuth;
+declare function pollForToken({
+  request,
+  oauth
+}: {
+  request: DeviceAuthorizationRequest;
+  oauth: OAuth;
 }): AsyncGenerator<PollTokenItem, void, void>;
+//#endregion
+export { pollForToken };
+//# sourceMappingURL=poll-for-token.d.ts.map

package/dist/auth/poll-for-token.js

@@ -1,66 +1,81 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pollForToken = pollForToken;
-const promises_1 = require("node:timers/promises");
-const file_1 = require("./file");
-const oauth_1 = require("./oauth");
-async function* pollForToken({ request, oauth, }) {
-    const controller = new AbortController();
-    try {
-        let intervalMs = request.interval * 1000;
-        while (Date.now() < request.expiresAt) {
-            const [tokenResponseError, tokenResponse] = await oauth.deviceAccessTokenRequest(request.device_code);
-            if (tokenResponseError) {
-                // 2x backoff on connection timeouts per spec https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
-                if (tokenResponseError.message.includes("timeout")) {
-                    intervalMs *= 2;
-                    yield { _tag: "Timeout", newInterval: intervalMs };
-                    await (0, promises_1.setTimeout)(intervalMs, { signal: controller.signal });
-                    continue;
-                }
-                yield { _tag: "Error", error: tokenResponseError };
-                return;
-            }
-            yield {
-                _tag: "Response",
-                response: tokenResponse.clone(),
-            };
-            const [tokensError, tokens] = await oauth.processTokenResponse(tokenResponse);
-            if ((0, oauth_1.isOAuthError)(tokensError)) {
-                const { code } = tokensError;
-                switch (code) {
-                    case "authorization_pending":
-                        await (0, promises_1.setTimeout)(intervalMs, { signal: controller.signal });
-                        continue;
-                    case "slow_down":
-                        intervalMs += 5 * 1000;
-                        yield { _tag: "SlowDown", newInterval: intervalMs };
-                        await (0, promises_1.setTimeout)(intervalMs, { signal: controller.signal });
-                        continue;
-                    default:
-                        yield { _tag: "Error", error: tokensError.cause };
-                        return;
-                }
-            }
-            if (tokensError) {
-                yield { _tag: "Error", error: tokensError };
-                return;
-            }
-            (0, file_1.updateAuthConfig)({
-                token: tokens.access_token,
-                expiresAt: new Date(Date.now() + tokens.expires_in * 1000),
-                refreshToken: tokens.refresh_token,
-            });
-            return;
-        }
-        yield {
-            _tag: "Error",
-            error: new Error("Timed out waiting for authentication. Please try again."),
-        };
-        return;
-    }
-    finally {
-        controller.abort();
-    }
+import { updateAuthConfig } from "./file.js";
+import { isOAuthError } from "./oauth.js";
+import { setTimeout } from "node:timers/promises";
+
+//#region src/auth/poll-for-token.ts
+async function* pollForToken({ request, oauth }) {
+	const controller = new AbortController();
+	try {
+		let intervalMs = request.interval * 1e3;
+		while (Date.now() < request.expiresAt) {
+			const [tokenResponseError, tokenResponse] = await oauth.deviceAccessTokenRequest(request.device_code);
+			if (tokenResponseError) {
+				if (tokenResponseError.message.includes("timeout")) {
+					intervalMs *= 2;
+					yield {
+						_tag: "Timeout",
+						newInterval: intervalMs
+					};
+					await setTimeout(intervalMs, { signal: controller.signal });
+					continue;
+				}
+				yield {
+					_tag: "Error",
+					error: tokenResponseError
+				};
+				return;
+			}
+			yield {
+				_tag: "Response",
+				response: tokenResponse.clone()
+			};
+			const [tokensError, tokens] = await oauth.processTokenResponse(tokenResponse);
+			if (isOAuthError(tokensError)) {
+				const { code } = tokensError;
+				switch (code) {
+					case "authorization_pending":
+						await setTimeout(intervalMs, { signal: controller.signal });
+						continue;
+					case "slow_down":
+						intervalMs += 5 * 1e3;
+						yield {
+							_tag: "SlowDown",
+							newInterval: intervalMs
+						};
+						await setTimeout(intervalMs, { signal: controller.signal });
+						continue;
+					default:
+						yield {
+							_tag: "Error",
+							error: tokensError.cause
+						};
+						return;
+				}
+			}
+			if (tokensError) {
+				yield {
+					_tag: "Error",
+					error: tokensError
+				};
+				return;
+			}
+			updateAuthConfig({
+				token: tokens.access_token,
+				expiresAt: new Date(Date.now() + tokens.expires_in * 1e3),
+				refreshToken: tokens.refresh_token
+			});
+			return;
+		}
+		yield {
+			_tag: "Error",
+			error: /* @__PURE__ */ new Error("Timed out waiting for authentication. Please try again.")
+		};
+		return;
+	} finally {
+		controller.abort();
+	}
 }
+
+//#endregion
+export { pollForToken };
 //# sourceMappingURL=poll-for-token.js.map

package/dist/auth/poll-for-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"poll-for-token.js","sourceRoot":"","sources":["../../src/auth/poll-for-token.ts"],"names":[],"mappings":";;AAaA,oCA2EC;AAxFD,mDAAkD;AAClD,iCAA0C;AAC1C,mCAA0E;AAWnE,KAAK,SAAS,CAAC,CAAC,YAAY,CAAC,EAClC,OAAO,EACP,KAAK,GAIN;IACC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,kBAAkB,EAAE,aAAa,CAAC,GACvC,MAAM,KAAK,CAAC,wBAAwB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAE5D,IAAI,kBAAkB,EAAE,CAAC;gBACvB,uGAAuG;gBACvG,IAAI,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnD,UAAU,IAAI,CAAC,CAAC;oBAChB,MAAM,EAAE,IAAI,EAAE,SAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;oBAC5D,MAAM,IAAA,qBAAU,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBACD,MAAM,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM;gBACJ,IAAI,EAAE,UAAmB;gBACzB,QAAQ,EAAE,aAAa,CAAC,KAAK,EAAiC;aAC/D,CAAC;YAEF,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GACzB,MAAM,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAElD,IAAI,IAAA,oBAAY,EAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;gBAC7B,QAAQ,IAAI,EAAE,CAAC;oBACb,KAAK,uBAAuB;wBAC1B,MAAM,IAAA,qBAAU,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;wBAC5D,SAAS;oBACX,KAAK,WAAW;wBACd,UAAU,IAAI,CAAC,GAAG,IAAI,CAAC;wBACvB,MAAM,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;wBAC7D,MAAM,IAAA,qBAAU,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;wBAC5D,SAAS;oBACX;wBACE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;wBAClD,OAAO;gBACX,CAAC;YACH,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,IAAA,uBAAgB,EAAC;gBACf,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1D,YAAY,EAAE,MAAM,CAAC,aAAa;aACnC,CAAC,CAAC;YAEH,OAAO;QACT,CAAC;QAED,MAAM;YACJ,IAAI,EAAE,OAAgB;YACtB,KAAK,EAAE,IAAI,KAAK,CACd,yDAAyD,CAC1D;SACF,CAAC;QACF,OAAO;IACT,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"poll-for-token.js","names":[],"sources":["../../src/auth/poll-for-token.ts"],"sourcesContent":["import { setTimeout } from \"node:timers/promises\";\nimport { updateAuthConfig } from \"./file.js\";\nimport { DeviceAuthorizationRequest, isOAuthError, OAuth } from \"./oauth.js\";\n\nexport type PollTokenItem =\n  | { _tag: \"Timeout\"; newInterval: number }\n  | { _tag: \"SlowDown\"; newInterval: number }\n  | { _tag: \"Error\"; error: Error }\n  | {\n      _tag: \"Response\";\n      response: { text(): Promise<string> };\n    };\n\nexport async function* pollForToken({\n  request,\n  oauth,\n}: {\n  request: DeviceAuthorizationRequest;\n  oauth: OAuth;\n}): AsyncGenerator<PollTokenItem, void, void> {\n  const controller = new AbortController();\n  try {\n    let intervalMs = request.interval * 1000;\n    while (Date.now() < request.expiresAt) {\n      const [tokenResponseError, tokenResponse] =\n        await oauth.deviceAccessTokenRequest(request.device_code);\n\n      if (tokenResponseError) {\n        // 2x backoff on connection timeouts per spec https://datatracker.ietf.org/doc/html/rfc8628#section-3.5\n        if (tokenResponseError.message.includes(\"timeout\")) {\n          intervalMs *= 2;\n          yield { _tag: \"Timeout\" as const, newInterval: intervalMs };\n          await setTimeout(intervalMs, { signal: controller.signal });\n          continue;\n        }\n        yield { _tag: \"Error\" as const, error: tokenResponseError };\n        return;\n      }\n\n      yield {\n        _tag: \"Response\" as const,\n        response: tokenResponse.clone() as { text(): Promise<string> },\n      };\n\n      const [tokensError, tokens] =\n        await oauth.processTokenResponse(tokenResponse);\n\n      if (isOAuthError(tokensError)) {\n        const { code } = tokensError;\n        switch (code) {\n          case \"authorization_pending\":\n            await setTimeout(intervalMs, { signal: controller.signal });\n            continue;\n          case \"slow_down\":\n            intervalMs += 5 * 1000;\n            yield { _tag: \"SlowDown\" as const, newInterval: intervalMs };\n            await setTimeout(intervalMs, { signal: controller.signal });\n            continue;\n          default:\n            yield { _tag: \"Error\", error: tokensError.cause };\n            return;\n        }\n      }\n\n      if (tokensError) {\n        yield { _tag: \"Error\", error: tokensError };\n        return;\n      }\n\n      updateAuthConfig({\n        token: tokens.access_token,\n        expiresAt: new Date(Date.now() + tokens.expires_in * 1000),\n        refreshToken: tokens.refresh_token,\n      });\n\n      return;\n    }\n\n    yield {\n      _tag: \"Error\" as const,\n      error: new Error(\n        \"Timed out waiting for authentication. Please try again.\",\n      ),\n    };\n    return;\n  } finally {\n    controller.abort();\n  }\n}\n"],"mappings":";;;;;AAaA,gBAAuB,aAAa,EAClC,SACA,SAI4C;CAC5C,MAAM,aAAa,IAAI,iBAAiB;AACxC,KAAI;EACF,IAAI,aAAa,QAAQ,WAAW;AACpC,SAAO,KAAK,KAAK,GAAG,QAAQ,WAAW;GACrC,MAAM,CAAC,oBAAoB,iBACzB,MAAM,MAAM,yBAAyB,QAAQ,YAAY;AAE3D,OAAI,oBAAoB;AAEtB,QAAI,mBAAmB,QAAQ,SAAS,UAAU,EAAE;AAClD,mBAAc;AACd,WAAM;MAAE,MAAM;MAAoB,aAAa;MAAY;AAC3D,WAAM,WAAW,YAAY,EAAE,QAAQ,WAAW,QAAQ,CAAC;AAC3D;;AAEF,UAAM;KAAE,MAAM;KAAkB,OAAO;KAAoB;AAC3D;;AAGF,SAAM;IACJ,MAAM;IACN,UAAU,cAAc,OAAO;IAChC;GAED,MAAM,CAAC,aAAa,UAClB,MAAM,MAAM,qBAAqB,cAAc;AAEjD,OAAI,aAAa,YAAY,EAAE;IAC7B,MAAM,EAAE,SAAS;AACjB,YAAQ,MAAR;KACE,KAAK;AACH,YAAM,WAAW,YAAY,EAAE,QAAQ,WAAW,QAAQ,CAAC;AAC3D;KACF,KAAK;AACH,oBAAc,IAAI;AAClB,YAAM;OAAE,MAAM;OAAqB,aAAa;OAAY;AAC5D,YAAM,WAAW,YAAY,EAAE,QAAQ,WAAW,QAAQ,CAAC;AAC3D;KACF;AACE,YAAM;OAAE,MAAM;OAAS,OAAO,YAAY;OAAO;AACjD;;;AAIN,OAAI,aAAa;AACf,UAAM;KAAE,MAAM;KAAS,OAAO;KAAa;AAC3C;;AAGF,oBAAiB;IACf,OAAO,OAAO;IACd,WAAW,IAAI,KAAK,KAAK,KAAK,GAAG,OAAO,aAAa,IAAK;IAC1D,cAAc,OAAO;IACtB,CAAC;AAEF;;AAGF,QAAM;GACJ,MAAM;GACN,uBAAO,IAAI,MACT,0DACD;GACF;AACD;WACQ;AACR,aAAW,OAAO"}

package/dist/auth/project.cjs

@@ -0,0 +1,178 @@
+const require_rolldown_runtime = require('../_virtual/rolldown_runtime.cjs');
+const require_error = require('./error.cjs');
+const require_api = require('./api.cjs');
+const require_linked_project = require('./linked-project.cjs');
+let zod = require("zod");
+
+//#region src/auth/project.ts
+const UserSchema = zod.z.object({ user: zod.z.object({
+	defaultTeamId: zod.z.string().nullable(),
+	username: zod.z.string()
+}) });
+const TeamSchema = zod.z.object({
+	id: zod.z.string(),
+	slug: zod.z.string(),
+	updatedAt: zod.z.number(),
+	membership: zod.z.object({ role: zod.z.string() }),
+	billing: zod.z.object({ plan: zod.z.string() })
+});
+const TeamsSchema = zod.z.object({
+	teams: zod.z.array(TeamSchema),
+	pagination: zod.z.object({
+		count: zod.z.number(),
+		next: zod.z.number().nullable()
+	})
+});
+const DEFAULT_PROJECT_NAME = "vercel-sandbox-default-project";
+/** Status codes that mean "this team can't be used, try the next one". */
+function isSkippableTeamError(e) {
+	return e instanceof require_error.NotOk && (e.response.statusCode === 402 || e.response.statusCode === 403);
+}
+/**
+* Resolves the team and project scope for sandbox operations.
+*
+* First checks for a locally linked project in `.vercel/project.json`.
+* If found, uses the `projectId` and `orgId` from there.
+*
+* Otherwise, if `teamId` is not provided, builds an ordered list of candidate
+* teams to try: the user's `defaultTeamId` first (if set), then hobby-plan
+* teams where the user has an OWNER role (preferring the personal team matching
+* the username, then the most recently updated). Tries each candidate until one
+* succeeds.
+*
+* @param opts.token - Vercel API authentication token.
+* @param opts.teamId - Optional team slug. If omitted, candidate teams are resolved automatically.
+* @param opts.cwd - Optional directory to search for `.vercel/project.json`. Defaults to `process.cwd()`.
+* @returns The resolved scope with `projectId`, `teamId`, and whether the project was `created`.
+*
+* @throws {NotOk} If the API returns an error other than 404 when checking the project.
+*
+* @example
+* ```ts
+* const scope = await inferScope({ token: "vercel_..." });
+* // => { projectId: "vercel-sandbox-default-project", teamId: "my-team", created: false }
+* ```
+*/
+async function inferScope(opts) {
+	const linkedProject = await require_linked_project.readLinkedProject(opts.cwd ?? process.cwd());
+	if (linkedProject) {
+		const slugs = await resolveLinkedProjectSlugs(opts.token, linkedProject.teamId, linkedProject.projectId);
+		return {
+			...linkedProject,
+			created: false,
+			...slugs
+		};
+	}
+	if (opts.teamId) return tryTeam(opts.token, opts.teamId);
+	const { defaultTeamId, username } = (await require_api.fetchApi({
+		token: opts.token,
+		endpoint: "/v2/user"
+	}).then(UserSchema.parse)).user;
+	if (defaultTeamId) try {
+		const result = await tryTeam(opts.token, defaultTeamId);
+		try {
+			const team = await require_api.fetchApi({
+				token: opts.token,
+				endpoint: `/v2/teams/${encodeURIComponent(defaultTeamId)}`
+			}).then(zod.z.object({ slug: zod.z.string() }).parse);
+			return {
+				...result,
+				teamSlug: team.slug
+			};
+		} catch {
+			return result;
+		}
+	} catch (e) {
+		if (!isSkippableTeamError(e)) throw e;
+	}
+	let next = null;
+	do {
+		const endpoint = next === null ? "/v2/teams?limit=20" : `/v2/teams?limit=20&until=${next}`;
+		const page = await require_api.fetchApi({
+			token: opts.token,
+			endpoint
+		}).then(TeamsSchema.parse);
+		next = page.pagination.next;
+		const hobbyOwnerTeams = page.teams.filter((t) => t.membership.role === "OWNER" && t.billing.plan === "hobby");
+		if (hobbyOwnerTeams.length === 0) continue;
+		const bestHobbyTeam = hobbyOwnerTeams.find((t) => t.slug === username) ?? hobbyOwnerTeams.sort((a, b) => b.updatedAt - a.updatedAt)[0];
+		if (bestHobbyTeam && bestHobbyTeam.id !== defaultTeamId) try {
+			return {
+				...await tryTeam(opts.token, bestHobbyTeam.id),
+				teamSlug: bestHobbyTeam.slug
+			};
+		} catch (e) {
+			if (!isSkippableTeamError(e)) throw e;
+		}
+	} while (next !== null);
+	try {
+		return {
+			...await tryTeam(opts.token, username),
+			teamSlug: username
+		};
+	} catch (e) {
+		if (!isSkippableTeamError(e)) throw e;
+	}
+	throw new require_error.NotOk({
+		statusCode: 403,
+		responseText: `Authenticated as "${username}" but none of the available teams allow sandbox creation. Specify a team explicitly with --scope <team-id-or-slug>.`
+	});
+}
+/**
+* Attempts to use a specific team for sandbox operations by checking for
+* (or creating) the default project within that team.
+*
+* @returns The resolved scope if the team is usable.
+* @throws {NotOk} On authorization or other API errors.
+*/
+async function tryTeam(token, teamId) {
+	const teamParam = teamId.startsWith("team_") ? `teamId=${encodeURIComponent(teamId)}` : `slug=${encodeURIComponent(teamId)}`;
+	let created = false;
+	try {
+		await require_api.fetchApi({
+			token,
+			endpoint: `/v2/projects/${encodeURIComponent(DEFAULT_PROJECT_NAME)}?${teamParam}`
+		});
+	} catch (e) {
+		if (!(e instanceof require_error.NotOk) || e.response.statusCode !== 404) throw e;
+		await require_api.fetchApi({
+			token,
+			endpoint: `/v11/projects?${teamParam}`,
+			method: "POST",
+			body: JSON.stringify({ name: DEFAULT_PROJECT_NAME })
+		});
+		created = true;
+	}
+	return {
+		projectId: DEFAULT_PROJECT_NAME,
+		teamId,
+		created
+	};
+}
+/**
+* Best-effort resolution of team slug and project name for a linked project.
+* Both IDs may be opaque (e.g. `team_xxx`, `prj_xxx`), so we fetch the
+* human-readable names from the API in parallel.
+*/
+async function resolveLinkedProjectSlugs(token, teamId, projectId) {
+	try {
+		const teamParam = teamId.startsWith("team_") ? `teamId=${encodeURIComponent(teamId)}` : `slug=${encodeURIComponent(teamId)}`;
+		const [teamData, projectData] = await Promise.all([require_api.fetchApi({
+			token,
+			endpoint: `/v2/teams/${encodeURIComponent(teamId)}`
+		}).then(zod.z.object({ slug: zod.z.string() }).parse), require_api.fetchApi({
+			token,
+			endpoint: `/v2/projects/${encodeURIComponent(projectId)}?${teamParam}`
+		}).then(zod.z.object({ name: zod.z.string() }).parse)]);
+		return {
+			teamSlug: teamData.slug,
+			projectSlug: projectData.name
+		};
+	} catch {
+		return {};
+	}
+}
+
+//#endregion
+exports.inferScope = inferScope;
+//# sourceMappingURL=project.cjs.map

package/dist/auth/project.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.cjs","names":["z","NotOk","readLinkedProject","fetchApi","next: number | null","endpoint: string"],"sources":["../../src/auth/project.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { fetchApi } from \"./api.js\";\nimport { NotOk } from \"./error.js\";\nimport { readLinkedProject } from \"./linked-project.js\";\n\nconst UserSchema = z.object({\n  user: z.object({\n    defaultTeamId: z.string().nullable(),\n    username: z.string(),\n  }),\n});\n\nconst TeamSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  updatedAt: z.number(),\n  membership: z.object({\n    role: z.string(),\n  }),\n  billing: z.object({\n    plan: z.string(),\n  }),\n});\n\nconst TeamsSchema = z.object({\n  teams: z.array(TeamSchema),\n  pagination: z.object({\n    count: z.number(),\n    next: z.number().nullable(),\n  }),\n});\n\nconst DEFAULT_PROJECT_NAME = \"vercel-sandbox-default-project\";\n\n/** Status codes that mean \"this team can't be used, try the next one\". */\nfunction isSkippableTeamError(e: unknown): boolean {\n  return e instanceof NotOk && (e.response.statusCode === 402 || e.response.statusCode === 403);\n}\n\n/**\n * Resolves the team and project scope for sandbox operations.\n *\n * First checks for a locally linked project in `.vercel/project.json`.\n * If found, uses the `projectId` and `orgId` from there.\n *\n * Otherwise, if `teamId` is not provided, builds an ordered list of candidate\n * teams to try: the user's `defaultTeamId` first (if set), then hobby-plan\n * teams where the user has an OWNER role (preferring the personal team matching\n * the username, then the most recently updated). Tries each candidate until one\n * succeeds.\n *\n * @param opts.token - Vercel API authentication token.\n * @param opts.teamId - Optional team slug. If omitted, candidate teams are resolved automatically.\n * @param opts.cwd - Optional directory to search for `.vercel/project.json`. Defaults to `process.cwd()`.\n * @returns The resolved scope with `projectId`, `teamId`, and whether the project was `created`.\n *\n * @throws {NotOk} If the API returns an error other than 404 when checking the project.\n *\n * @example\n * ```ts\n * const scope = await inferScope({ token: \"vercel_...\" });\n * // => { projectId: \"vercel-sandbox-default-project\", teamId: \"my-team\", created: false }\n * ```\n */\nexport async function inferScope(opts: {\n  token: string;\n  teamId?: string;\n  cwd?: string;\n}): Promise<{\n  projectId: string;\n  teamId: string;\n  created: boolean;\n  teamSlug?: string;\n  projectSlug?: string;\n}> {\n  const linkedProject = await readLinkedProject(opts.cwd ?? process.cwd());\n  if (linkedProject) {\n    const slugs = await resolveLinkedProjectSlugs(\n      opts.token,\n      linkedProject.teamId,\n      linkedProject.projectId,\n    );\n    return { ...linkedProject, created: false, ...slugs };\n  }\n\n  if (opts.teamId) {\n    return tryTeam(opts.token, opts.teamId);\n  }\n\n  const userData = await fetchApi({\n    token: opts.token,\n    endpoint: \"/v2/user\",\n  }).then(UserSchema.parse);\n  const { defaultTeamId, username } = userData.user;\n\n  // 1. Try defaultTeamId first\n  if (defaultTeamId) {\n    try {\n      const result = await tryTeam(opts.token, defaultTeamId);\n      // Resolve team slug (best-effort)\n      try {\n        const team = await fetchApi({\n          token: opts.token,\n          endpoint: `/v2/teams/${encodeURIComponent(defaultTeamId)}`,\n        }).then(z.object({ slug: z.string() }).parse);\n        return { ...result, teamSlug: team.slug };\n      } catch {\n        return result;\n      }\n    } catch (e) {\n      if (!isSkippableTeamError(e)) throw e;\n    }\n  }\n\n  // 2. Paginate teams in pages of 20, try best hobby team per page\n  let next: number | null = null;\n  do {\n    const endpoint: string =\n      next === null\n        ? \"/v2/teams?limit=20\"\n        : `/v2/teams?limit=20&until=${next}`;\n    const page = await fetchApi({ token: opts.token, endpoint }).then(\n      TeamsSchema.parse,\n    );\n\n    next = page.pagination.next;\n\n    const hobbyOwnerTeams = page.teams.filter(\n      (t) => t.membership.role === \"OWNER\" && t.billing.plan === \"hobby\",\n    );\n    if (hobbyOwnerTeams.length === 0) {\n      continue;\n    }\n\n    const bestHobbyTeam =\n      hobbyOwnerTeams.find((t) => t.slug === username) ??\n      hobbyOwnerTeams.sort((a, b) => b.updatedAt - a.updatedAt)[0];\n\n    if (bestHobbyTeam && bestHobbyTeam.id !== defaultTeamId) {\n      try {\n        const result = await tryTeam(opts.token, bestHobbyTeam.id);\n        return { ...result, teamSlug: bestHobbyTeam.slug };\n      } catch (e) {\n        if (!isSkippableTeamError(e)) throw e;\n      }\n    }\n  } while (next !== null);\n\n  // 3. Fall back to username as personal team\n  try {\n    const result = await tryTeam(opts.token, username);\n    return { ...result, teamSlug: username };\n  } catch (e) {\n    if (!isSkippableTeamError(e)) throw e;\n  }\n\n  throw new NotOk({\n    statusCode: 403,\n    responseText: `Authenticated as \"${username}\" but none of the available teams allow sandbox creation. Specify a team explicitly with --scope <team-id-or-slug>.`,\n  });\n}\n\n/**\n * Attempts to use a specific team for sandbox operations by checking for\n * (or creating) the default project within that team.\n *\n * @returns The resolved scope if the team is usable.\n * @throws {NotOk} On authorization or other API errors.\n */\nasync function tryTeam(\n  token: string,\n  teamId: string,\n): Promise<{ projectId: string; teamId: string; created: boolean }> {\n  const teamParam = teamId.startsWith(\"team_\")\n    ? `teamId=${encodeURIComponent(teamId)}`\n    : `slug=${encodeURIComponent(teamId)}`;\n\n  let created = false;\n  try {\n    await fetchApi({\n      token,\n      endpoint: `/v2/projects/${encodeURIComponent(DEFAULT_PROJECT_NAME)}?${teamParam}`,\n    });\n  } catch (e) {\n    if (!(e instanceof NotOk) || e.response.statusCode !== 404) {\n      throw e;\n    }\n\n    await fetchApi({\n      token,\n      endpoint: `/v11/projects?${teamParam}`,\n      method: \"POST\",\n      body: JSON.stringify({\n        name: DEFAULT_PROJECT_NAME,\n      }),\n    });\n    created = true;\n  }\n\n  return { projectId: DEFAULT_PROJECT_NAME, teamId, created };\n}\n\n/**\n * Best-effort resolution of team slug and project name for a linked project.\n * Both IDs may be opaque (e.g. `team_xxx`, `prj_xxx`), so we fetch the\n * human-readable names from the API in parallel.\n */\nasync function resolveLinkedProjectSlugs(\n  token: string,\n  teamId: string,\n  projectId: string,\n): Promise<{ teamSlug?: string; projectSlug?: string }> {\n  try {\n    const teamParam = teamId.startsWith(\"team_\")\n      ? `teamId=${encodeURIComponent(teamId)}`\n      : `slug=${encodeURIComponent(teamId)}`;\n    const [teamData, projectData] = await Promise.all([\n      fetchApi({\n        token,\n        endpoint: `/v2/teams/${encodeURIComponent(teamId)}`,\n      }).then(z.object({ slug: z.string() }).parse),\n      fetchApi({\n        token,\n        endpoint: `/v2/projects/${encodeURIComponent(projectId)}?${teamParam}`,\n      }).then(z.object({ name: z.string() }).parse),\n    ]);\n    return { teamSlug: teamData.slug, projectSlug: projectData.name };\n  } catch {\n    return {};\n  }\n}\n"],"mappings":";;;;;;;AAKA,MAAM,aAAaA,MAAE,OAAO,EAC1B,MAAMA,MAAE,OAAO;CACb,eAAeA,MAAE,QAAQ,CAAC,UAAU;CACpC,UAAUA,MAAE,QAAQ;CACrB,CAAC,EACH,CAAC;AAEF,MAAM,aAAaA,MAAE,OAAO;CAC1B,IAAIA,MAAE,QAAQ;CACd,MAAMA,MAAE,QAAQ;CAChB,WAAWA,MAAE,QAAQ;CACrB,YAAYA,MAAE,OAAO,EACnB,MAAMA,MAAE,QAAQ,EACjB,CAAC;CACF,SAASA,MAAE,OAAO,EAChB,MAAMA,MAAE,QAAQ,EACjB,CAAC;CACH,CAAC;AAEF,MAAM,cAAcA,MAAE,OAAO;CAC3B,OAAOA,MAAE,MAAM,WAAW;CAC1B,YAAYA,MAAE,OAAO;EACnB,OAAOA,MAAE,QAAQ;EACjB,MAAMA,MAAE,QAAQ,CAAC,UAAU;EAC5B,CAAC;CACH,CAAC;AAEF,MAAM,uBAAuB;;AAG7B,SAAS,qBAAqB,GAAqB;AACjD,QAAO,aAAaC,wBAAU,EAAE,SAAS,eAAe,OAAO,EAAE,SAAS,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4B3F,eAAsB,WAAW,MAU9B;CACD,MAAM,gBAAgB,MAAMC,yCAAkB,KAAK,OAAO,QAAQ,KAAK,CAAC;AACxE,KAAI,eAAe;EACjB,MAAM,QAAQ,MAAM,0BAClB,KAAK,OACL,cAAc,QACd,cAAc,UACf;AACD,SAAO;GAAE,GAAG;GAAe,SAAS;GAAO,GAAG;GAAO;;AAGvD,KAAI,KAAK,OACP,QAAO,QAAQ,KAAK,OAAO,KAAK,OAAO;CAOzC,MAAM,EAAE,eAAe,cAJN,MAAMC,qBAAS;EAC9B,OAAO,KAAK;EACZ,UAAU;EACX,CAAC,CAAC,KAAK,WAAW,MAAM,EACoB;AAG7C,KAAI,cACF,KAAI;EACF,MAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,cAAc;AAEvD,MAAI;GACF,MAAM,OAAO,MAAMA,qBAAS;IAC1B,OAAO,KAAK;IACZ,UAAU,aAAa,mBAAmB,cAAc;IACzD,CAAC,CAAC,KAAKH,MAAE,OAAO,EAAE,MAAMA,MAAE,QAAQ,EAAE,CAAC,CAAC,MAAM;AAC7C,UAAO;IAAE,GAAG;IAAQ,UAAU,KAAK;IAAM;UACnC;AACN,UAAO;;UAEF,GAAG;AACV,MAAI,CAAC,qBAAqB,EAAE,CAAE,OAAM;;CAKxC,IAAII,OAAsB;AAC1B,IAAG;EACD,MAAMC,WACJ,SAAS,OACL,uBACA,4BAA4B;EAClC,MAAM,OAAO,MAAMF,qBAAS;GAAE,OAAO,KAAK;GAAO;GAAU,CAAC,CAAC,KAC3D,YAAY,MACb;AAED,SAAO,KAAK,WAAW;EAEvB,MAAM,kBAAkB,KAAK,MAAM,QAChC,MAAM,EAAE,WAAW,SAAS,WAAW,EAAE,QAAQ,SAAS,QAC5D;AACD,MAAI,gBAAgB,WAAW,EAC7B;EAGF,MAAM,gBACJ,gBAAgB,MAAM,MAAM,EAAE,SAAS,SAAS,IAChD,gBAAgB,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC;AAE5D,MAAI,iBAAiB,cAAc,OAAO,cACxC,KAAI;AAEF,UAAO;IAAE,GADM,MAAM,QAAQ,KAAK,OAAO,cAAc,GAAG;IACtC,UAAU,cAAc;IAAM;WAC3C,GAAG;AACV,OAAI,CAAC,qBAAqB,EAAE,CAAE,OAAM;;UAGjC,SAAS;AAGlB,KAAI;AAEF,SAAO;GAAE,GADM,MAAM,QAAQ,KAAK,OAAO,SAAS;GAC9B,UAAU;GAAU;UACjC,GAAG;AACV,MAAI,CAAC,qBAAqB,EAAE,CAAE,OAAM;;AAGtC,OAAM,IAAIF,oBAAM;EACd,YAAY;EACZ,cAAc,qBAAqB,SAAS;EAC7C,CAAC;;;;;;;;;AAUJ,eAAe,QACb,OACA,QACkE;CAClE,MAAM,YAAY,OAAO,WAAW,QAAQ,GACxC,UAAU,mBAAmB,OAAO,KACpC,QAAQ,mBAAmB,OAAO;CAEtC,IAAI,UAAU;AACd,KAAI;AACF,QAAME,qBAAS;GACb;GACA,UAAU,gBAAgB,mBAAmB,qBAAqB,CAAC,GAAG;GACvE,CAAC;UACK,GAAG;AACV,MAAI,EAAE,aAAaF,wBAAU,EAAE,SAAS,eAAe,IACrD,OAAM;AAGR,QAAME,qBAAS;GACb;GACA,UAAU,iBAAiB;GAC3B,QAAQ;GACR,MAAM,KAAK,UAAU,EACnB,MAAM,sBACP,CAAC;GACH,CAAC;AACF,YAAU;;AAGZ,QAAO;EAAE,WAAW;EAAsB;EAAQ;EAAS;;;;;;;AAQ7D,eAAe,0BACb,OACA,QACA,WACsD;AACtD,KAAI;EACF,MAAM,YAAY,OAAO,WAAW,QAAQ,GACxC,UAAU,mBAAmB,OAAO,KACpC,QAAQ,mBAAmB,OAAO;EACtC,MAAM,CAAC,UAAU,eAAe,MAAM,QAAQ,IAAI,CAChDA,qBAAS;GACP;GACA,UAAU,aAAa,mBAAmB,OAAO;GAClD,CAAC,CAAC,KAAKH,MAAE,OAAO,EAAE,MAAMA,MAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAC7CG,qBAAS;GACP;GACA,UAAU,gBAAgB,mBAAmB,UAAU,CAAC,GAAG;GAC5D,CAAC,CAAC,KAAKH,MAAE,OAAO,EAAE,MAAMA,MAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAC9C,CAAC;AACF,SAAO;GAAE,UAAU,SAAS;GAAM,aAAa,YAAY;GAAM;SAC3D;AACN,SAAO,EAAE"}

package/dist/auth/project.d.cts

@@ -0,0 +1,40 @@
+//#region src/auth/project.d.ts
+/**
+ * Resolves the team and project scope for sandbox operations.
+ *
+ * First checks for a locally linked project in `.vercel/project.json`.
+ * If found, uses the `projectId` and `orgId` from there.
+ *
+ * Otherwise, if `teamId` is not provided, builds an ordered list of candidate
+ * teams to try: the user's `defaultTeamId` first (if set), then hobby-plan
+ * teams where the user has an OWNER role (preferring the personal team matching
+ * the username, then the most recently updated). Tries each candidate until one
+ * succeeds.
+ *
+ * @param opts.token - Vercel API authentication token.
+ * @param opts.teamId - Optional team slug. If omitted, candidate teams are resolved automatically.
+ * @param opts.cwd - Optional directory to search for `.vercel/project.json`. Defaults to `process.cwd()`.
+ * @returns The resolved scope with `projectId`, `teamId`, and whether the project was `created`.
+ *
+ * @throws {NotOk} If the API returns an error other than 404 when checking the project.
+ *
+ * @example
+ * ```ts
+ * const scope = await inferScope({ token: "vercel_..." });
+ * // => { projectId: "vercel-sandbox-default-project", teamId: "my-team", created: false }
+ * ```
+ */
+declare function inferScope(opts: {
+  token: string;
+  teamId?: string;
+  cwd?: string;
+}): Promise<{
+  projectId: string;
+  teamId: string;
+  created: boolean;
+  teamSlug?: string;
+  projectSlug?: string;
+}>;
+//#endregion
+export { inferScope };
+//# sourceMappingURL=project.d.cts.map

package/dist/auth/project.d.ts

@@ -1,19 +1,22 @@
+//#region src/auth/project.d.ts
 /**
  * Resolves the team and project scope for sandbox operations.
  *
  * First checks for a locally linked project in `.vercel/project.json`.
  * If found, uses the `projectId` and `orgId` from there.
  *
- * Otherwise, if `teamId` is not provided, selects the first available team for the account.
- * Ensures a default project exists within the team, creating it if necessary.
+ * Otherwise, if `teamId` is not provided, builds an ordered list of candidate
+ * teams to try: the user's `defaultTeamId` first (if set), then hobby-plan
+ * teams where the user has an OWNER role (preferring the personal team matching
+ * the username, then the most recently updated). Tries each candidate until one
+ * succeeds.
  *
  * @param opts.token - Vercel API authentication token.
- * @param opts.teamId - Optional team slug. If omitted, the first team is selected.
+ * @param opts.teamId - Optional team slug. If omitted, candidate teams are resolved automatically.
  * @param opts.cwd - Optional directory to search for `.vercel/project.json`. Defaults to `process.cwd()`.
  * @returns The resolved scope with `projectId`, `teamId`, and whether the project was `created`.
  *
  * @throws {NotOk} If the API returns an error other than 404 when checking the project.
- * @throws {ZodError} If no teams exist for the account.
  *
  * @example
  * ```ts
@@ -21,20 +24,17 @@
  * // => { projectId: "vercel-sandbox-default-project", teamId: "my-team", created: false }
  * ```
  */
-export declare function inferScope(opts: {
-    token: string;
-    teamId?: string;
-    cwd?: string;
+declare function inferScope(opts: {
+  token: string;
+  teamId?: string;
+  cwd?: string;
 }): Promise<{
-    projectId: string;
-    teamId: string;
-    created: boolean;
+  projectId: string;
+  teamId: string;
+  created: boolean;
+  teamSlug?: string;
+  projectSlug?: string;
 }>;
-/**
- * Selects a team for the current token by querying the Teams API and
- * returning the slug of the first team in the result set.
- *
- * @param token - Authentication token used to call the Vercel API.
- * @returns A promise that resolves to the first team's slug.
- */
-export declare function selectTeam(token: string): Promise<string>;
+//#endregion
+export { inferScope };
+//# sourceMappingURL=project.d.ts.map