ima2-gen 2.0.5 → 2.0.13

package/node_modules/@vercel/oidc/dist/token-util.js

@@ -0,0 +1,198 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var token_util_exports = {};
+__export(token_util_exports, {
+  assertVercelOidcTokenResponse: () => assertVercelOidcTokenResponse,
+  findProjectInfo: () => findProjectInfo,
+  getTokenPayload: () => getTokenPayload,
+  getVercelCliToken: () => getVercelCliToken,
+  getVercelDataDir: () => getVercelDataDir,
+  getVercelOidcToken: () => getVercelOidcToken,
+  isExpired: () => isExpired,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+module.exports = __toCommonJS(token_util_exports);
+var path = __toESM(require("path"));
+var fs = __toESM(require("fs"));
+var import_token_error = require("./token-error");
+var import_token_io = require("./token-io");
+var import_auth_config = require("./auth-config");
+var import_oauth = require("./oauth");
+function getVercelDataDir() {
+  const vercelFolder = "com.vercel.cli";
+  const dataDir = (0, import_token_io.getUserDataDir)();
+  if (!dataDir) {
+    return null;
+  }
+  return path.join(dataDir, vercelFolder);
+}
+async function getVercelCliToken() {
+  const authConfig = (0, import_auth_config.readAuthConfig)();
+  if (!authConfig) {
+    return null;
+  }
+  if ((0, import_auth_config.isValidAccessToken)(authConfig)) {
+    return authConfig.token || null;
+  }
+  if (!authConfig.refreshToken) {
+    (0, import_auth_config.writeAuthConfig)({});
+    return null;
+  }
+  try {
+    const tokenResponse = await (0, import_oauth.refreshTokenRequest)({
+      refresh_token: authConfig.refreshToken
+    });
+    const [tokensError, tokens] = await (0, import_oauth.processTokenResponse)(tokenResponse);
+    if (tokensError || !tokens) {
+      (0, import_auth_config.writeAuthConfig)({});
+      return null;
+    }
+    const updatedConfig = {
+      token: tokens.access_token,
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    if (tokens.refresh_token) {
+      updatedConfig.refreshToken = tokens.refresh_token;
+    }
+    (0, import_auth_config.writeAuthConfig)(updatedConfig);
+    return updatedConfig.token ?? null;
+  } catch (error) {
+    (0, import_auth_config.writeAuthConfig)({});
+    return null;
+  }
+}
+async function getVercelOidcToken(authToken, projectId, teamId) {
+  const url = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${authToken}`
+    }
+  });
+  if (!res.ok) {
+    throw new import_token_error.VercelOidcTokenError(
+      `Failed to refresh OIDC token: ${res.statusText}`
+    );
+  }
+  const tokenRes = await res.json();
+  assertVercelOidcTokenResponse(tokenRes);
+  return tokenRes;
+}
+function assertVercelOidcTokenResponse(res) {
+  if (!res || typeof res !== "object") {
+    throw new TypeError(
+      "Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again"
+    );
+  }
+  if (!("token" in res) || typeof res.token !== "string") {
+    throw new TypeError(
+      "Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again"
+    );
+  }
+}
+function findProjectInfo() {
+  const dir = (0, import_token_io.findRootDir)();
+  if (!dir) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Unable to find project root directory. Have you linked your project with `vc link?`"
+    );
+  }
+  const prjPath = path.join(dir, ".vercel", "project.json");
+  if (!fs.existsSync(prjPath)) {
+    throw new import_token_error.VercelOidcTokenError(
+      "project.json not found, have you linked your project with `vc link?`"
+    );
+  }
+  const prj = JSON.parse(fs.readFileSync(prjPath, "utf8"));
+  if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
+    throw new TypeError(
+      "Expected a string-valued projectId property. Try running `vc link` to re-link your project."
+    );
+  }
+  return { projectId: prj.projectId, teamId: prj.orgId };
+}
+function saveToken(token, projectId) {
+  const dir = (0, import_token_io.getUserDataDir)();
+  if (!dir) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Unable to find user data directory. Please reach out to Vercel support."
+    );
+  }
+  const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
+  const tokenJson = JSON.stringify(token);
+  fs.mkdirSync(path.dirname(tokenPath), { mode: 504, recursive: true });
+  fs.writeFileSync(tokenPath, tokenJson);
+  fs.chmodSync(tokenPath, 432);
+  return;
+}
+function loadToken(projectId) {
+  const dir = (0, import_token_io.getUserDataDir)();
+  if (!dir) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Unable to find user data directory. Please reach out to Vercel support."
+    );
+  }
+  const tokenPath = path.join(dir, "com.vercel.token", `${projectId}.json`);
+  if (!fs.existsSync(tokenPath)) {
+    return null;
+  }
+  const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
+  assertVercelOidcTokenResponse(token);
+  return token;
+}
+function getTokenPayload(token) {
+  const tokenParts = token.split(".");
+  if (tokenParts.length !== 3) {
+    throw new import_token_error.VercelOidcTokenError(
+      "Invalid token. Please run `vc env pull` and try again"
+    );
+  }
+  const base64 = tokenParts[1].replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + (4 - base64.length % 4) % 4,
+    "="
+  );
+  return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+}
+function isExpired(token) {
+  return token.exp * 1e3 < Date.now();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertVercelOidcTokenResponse,
+  findProjectInfo,
+  getTokenPayload,
+  getVercelCliToken,
+  getVercelDataDir,
+  getVercelOidcToken,
+  isExpired,
+  loadToken,
+  saveToken
+});

package/node_modules/@vercel/oidc/dist/token-util.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@vercel/oidc/dist/token-util.test.js

@@ -0,0 +1,229 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var import_token_util = require("./token-util");
+var authConfig = __toESM(require("./auth-config"));
+var oauth = __toESM(require("./oauth"));
+import_vitest.vi.mock("fs");
+import_vitest.vi.mock("./token-io", () => ({
+  getUserDataDir: import_vitest.vi.fn(() => "/mock/user/data"),
+  findRootDir: import_vitest.vi.fn(() => "/mock/root")
+}));
+(0, import_vitest.describe)("getVercelCliToken", () => {
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.clearAllMocks();
+  });
+  (0, import_vitest.afterEach)(() => {
+    import_vitest.vi.restoreAllMocks();
+  });
+  (0, import_vitest.it)("should return token if valid and not expired", async () => {
+    const validToken = {
+      token: "valid-access-token",
+      refreshToken: "refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) + 3600
+      // expires in 1 hour
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(validToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBe("valid-access-token");
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.it)("should return null if auth config does not exist", async () => {
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(null);
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBeNull();
+  });
+  (0, import_vitest.it)("should refresh token if expired and refresh token exists", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "valid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+      // expired 1 hour ago
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600,
+        refresh_token: "new-refresh-token"
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBe("new-access-token");
+    (0, import_vitest.expect)(oauth.refreshTokenRequest).toHaveBeenCalledWith({
+      refresh_token: "valid-refresh-token"
+    });
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.objectContaining({
+        token: "new-access-token",
+        refreshToken: "new-refresh-token",
+        expiresAt: import_vitest.expect.any(Number)
+      })
+    );
+  });
+  (0, import_vitest.it)("should clear auth and return null if token expired and no refresh token", async () => {
+    const expiredTokenNoRefresh = {
+      token: "expired-access-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(
+      expiredTokenNoRefresh
+    );
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBeNull();
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+  });
+  (0, import_vitest.it)("should clear auth if refresh fails with OAuth error", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "invalid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockErrorResponse = {
+      ok: false,
+      json: async () => ({
+        error: "invalid_grant",
+        error_description: "Refresh token expired"
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockErrorResponse);
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBeNull();
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+  });
+  (0, import_vitest.it)("should clear auth if refresh fails with network error", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "valid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockRejectedValue(
+      new Error("Network error")
+    );
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBeNull();
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith({});
+  });
+  (0, import_vitest.it)("should treat token as valid if expiresAt is missing (--token case)", async () => {
+    const tokenWithoutExpiry = {
+      token: "cli-provided-token"
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(tokenWithoutExpiry);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    const token = await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(token).toBe("cli-provided-token");
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.it)("should preserve new refresh token if provided in response", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "old-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600,
+        refresh_token: "new-refresh-token"
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    await (0, import_token_util.getVercelCliToken)();
+    (0, import_vitest.expect)(authConfig.writeAuthConfig).toHaveBeenCalledWith(
+      import_vitest.expect.objectContaining({
+        refreshToken: "new-refresh-token"
+      })
+    );
+  });
+  (0, import_vitest.it)("should not overwrite refresh token if not provided in response", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "existing-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 3600
+        // No refresh_token in response
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    await (0, import_token_util.getVercelCliToken)();
+    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
+    (0, import_vitest.expect)(writeCall).not.toHaveProperty("refreshToken");
+  });
+  (0, import_vitest.it)("should calculate expiresAt correctly from expires_in", async () => {
+    const expiredToken = {
+      token: "expired-access-token",
+      refreshToken: "valid-refresh-token",
+      expiresAt: Math.floor(Date.now() / 1e3) - 3600
+    };
+    const mockResponse = {
+      ok: true,
+      json: async () => ({
+        access_token: "new-access-token",
+        token_type: "Bearer",
+        expires_in: 7200
+        // 2 hours
+      })
+    };
+    import_vitest.vi.spyOn(authConfig, "readAuthConfig").mockReturnValue(expiredToken);
+    import_vitest.vi.spyOn(authConfig, "writeAuthConfig").mockImplementation(() => {
+    });
+    import_vitest.vi.spyOn(oauth, "refreshTokenRequest").mockResolvedValue(mockResponse);
+    const beforeCall = Math.floor(Date.now() / 1e3);
+    await (0, import_token_util.getVercelCliToken)();
+    const afterCall = Math.floor(Date.now() / 1e3);
+    const writeCall = import_vitest.vi.mocked(authConfig.writeAuthConfig).mock.calls[0][0];
+    (0, import_vitest.expect)(writeCall.expiresAt).toBeGreaterThanOrEqual(beforeCall + 7200);
+    (0, import_vitest.expect)(writeCall.expiresAt).toBeLessThanOrEqual(afterCall + 7200);
+  });
+});

package/node_modules/@vercel/oidc/dist/token.d.ts

@@ -0,0 +1 @@
+export declare function refreshToken(): Promise<void>;

package/node_modules/@vercel/oidc/dist/token.js

@@ -0,0 +1,53 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var token_exports = {};
+__export(token_exports, {
+  refreshToken: () => refreshToken
+});
+module.exports = __toCommonJS(token_exports);
+var import_token_error = require("./token-error");
+var import_token_util = require("./token-util");
+async function refreshToken() {
+  const { projectId, teamId } = (0, import_token_util.findProjectInfo)();
+  let maybeToken = (0, import_token_util.loadToken)(projectId);
+  if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token))) {
+    const authToken = await (0, import_token_util.getVercelCliToken)();
+    if (!authToken) {
+      throw new import_token_error.VercelOidcTokenError(
+        "Failed to refresh OIDC token: Log in to Vercel CLI and link your project with `vc link`"
+      );
+    }
+    if (!projectId) {
+      throw new import_token_error.VercelOidcTokenError(
+        "Failed to refresh OIDC token: Try re-linking your project with `vc link`"
+      );
+    }
+    maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
+    if (!maybeToken) {
+      throw new import_token_error.VercelOidcTokenError("Failed to refresh OIDC token");
+    }
+    (0, import_token_util.saveToken)(maybeToken, projectId);
+  }
+  process.env.VERCEL_OIDC_TOKEN = maybeToken.token;
+  return;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  refreshToken
+});

package/node_modules/@vercel/oidc/dist/token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@vercel/oidc/dist/token.test.js

@@ -0,0 +1,84 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_crypto = require("crypto");
+var import_vitest = require("vitest");
+var os = __toESM(require("os"));
+var path = __toESM(require("path"));
+var fs = __toESM(require("fs"));
+var import_token_io = require("./token-io");
+var tokenUtil = __toESM(require("./token-util"));
+var import_token = require("./token");
+import_vitest.vi.mock("./token-io");
+(0, import_vitest.describe)("refreshToken", () => {
+  let rootDir;
+  let userDataDir;
+  let cliDataDir;
+  let tokenDataDir;
+  const projectId = "test-project-id";
+  (0, import_vitest.beforeEach)(() => {
+    import_vitest.vi.clearAllMocks();
+    process.env.VERCEL_OIDC_TOKEN = void 0;
+    const random = `test-${(0, import_crypto.randomUUID)()}`;
+    rootDir = path.join(os.tmpdir(), random);
+    userDataDir = path.join(rootDir, "data");
+    cliDataDir = path.join(userDataDir, "com.vercel.cli");
+    tokenDataDir = path.join(userDataDir, "com.vercel.token");
+    fs.mkdirSync(cliDataDir, { recursive: true });
+    fs.mkdirSync(tokenDataDir, { recursive: true });
+    fs.mkdirSync(path.join(rootDir, ".vercel"), {
+      recursive: true
+    });
+    fs.writeFileSync(path.join(cliDataDir, "auth.json"), '{token: "test"}');
+    fs.writeFileSync(
+      path.join(rootDir, ".vercel", "project.json"),
+      JSON.stringify({ projectId })
+    );
+    import_vitest.vi.spyOn(process, "cwd").mockReturnValue(rootDir);
+    import_vitest.vi.mocked(import_token_io.findRootDir).mockReturnValue(rootDir);
+    import_vitest.vi.mocked(import_token_io.getUserDataDir).mockReturnValue(userDataDir);
+    import_vitest.vi.spyOn(tokenUtil, "getVercelCliToken").mockResolvedValue("test");
+    import_vitest.vi.spyOn(tokenUtil, "getVercelOidcToken").mockResolvedValue({
+      token: "test-token"
+    });
+    import_vitest.vi.spyOn(tokenUtil, "getTokenPayload").mockReturnValue({
+      sub: "test-sub",
+      name: "test-name",
+      exp: Date.now() + 1e5
+    });
+  });
+  (0, import_vitest.test)("should correctly load saved token from file", async () => {
+    const token = { token: "test-saved" };
+    const tokenPath = path.join(tokenDataDir, `${projectId}.json`);
+    fs.writeFileSync(tokenPath, JSON.stringify(token));
+    await (0, import_token.refreshToken)();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("test-saved");
+  });
+  (0, import_vitest.test)("should correctly save token to file", async () => {
+    await (0, import_token.refreshToken)();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("test-token");
+    const tokenPath = path.join(tokenDataDir, `${projectId}.json`);
+    const token = JSON.parse(fs.readFileSync(tokenPath, "utf8"));
+    (0, import_vitest.expect)(token).toEqual({ token: "test-token" });
+  });
+});

package/node_modules/@vercel/oidc/docs/README.md

@@ -0,0 +1,104 @@
+# @vercel/oidc
+
+## Table of contents
+
+### Functions
+
+- [getContext](README.md#getcontext)
+- [getVercelOidcToken](README.md#getverceloidctoken)
+- [getVercelOidcTokenSync](README.md#getverceloidctokensync)
+
+## Functions
+
+### getContext
+
+▸ **getContext**(): `Context`
+
+#### Returns
+
+`Context`
+
+#### Defined in
+
+[get-context.ts:7](https://github.com/vercel/vercel/blob/main/packages/oidc/src/get-context.ts#L7)
+
+---
+
+### getVercelOidcToken
+
+▸ **getVercelOidcToken**(): [`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise)<`string`\>
+
+Gets the current OIDC token from the request context or the environment variable.
+
+Do not cache this value, as it is subject to change in production!
+
+This function is used to retrieve the OIDC token from the request context or the environment variable.
+It checks for the `x-vercel-oidc-token` header in the request context and falls back to the `VERCEL_OIDC_TOKEN` environment variable if the header is not present.
+
+Unlike the `getVercelOidcTokenSync` function, this function will refresh the token if it is expired in a development environment.
+
+**`Throws`**
+
+If the `x-vercel-oidc-token` header is missing from the request context and the environment variable `VERCEL_OIDC_TOKEN` is not set. If the token
+is expired in a development environment, will also throw an error if the token cannot be refreshed: no CLI credentials are available, CLI credentials are expired, no project configuration is available
+or the token refresh request fails.
+
+**`Example`**
+
+```js
+// Using the OIDC token
+getVercelOidcToken()
+  .then(token => {
+    console.log('OIDC Token:', token);
+  })
+  .catch(error => {
+    console.error('Error:', error.message);
+  });
+```
+
+#### Returns
+
+[`Promise`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise)<`string`\>
+
+A promise that resolves to the OIDC token.
+
+#### Defined in
+
+[get-vercel-oidc-token.ts:30](https://github.com/vercel/vercel/blob/main/packages/oidc/src/get-vercel-oidc-token.ts#L30)
+
+---
+
+### getVercelOidcTokenSync
+
+▸ **getVercelOidcTokenSync**(): `string`
+
+Gets the current OIDC token from the request context or the environment variable.
+
+Do not cache this value, as it is subject to change in production!
+
+This function is used to retrieve the OIDC token from the request context or the environment variable.
+It checks for the `x-vercel-oidc-token` header in the request context and falls back to the `VERCEL_OIDC_TOKEN` environment variable if the header is not present.
+
+This function will not refresh the token if it is expired. For refreshing the token, use the @{link getVercelOidcToken} function.
+
+**`Throws`**
+
+If the `x-vercel-oidc-token` header is missing from the request context and the environment variable `VERCEL_OIDC_TOKEN` is not set.
+
+**`Example`**
+
+```js
+// Using the OIDC token
+const token = getVercelOidcTokenSync();
+console.log('OIDC Token:', token);
+```
+
+#### Returns
+
+`string`
+
+The OIDC token.
+
+#### Defined in
+
+[get-vercel-oidc-token.ts:85](https://github.com/vercel/vercel/blob/main/packages/oidc/src/get-vercel-oidc-token.ts#L85)