vercel 59.11.2 → 59.12.0

package/dist/chunks/chunk-ABSZNJQO.js

@@ -0,0 +1,522 @@
+import { createRequire as __createRequire } from 'node:module';
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __dirname_ } from 'node:path';
+const require = __createRequire(import.meta.url);
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __dirname_(__filename);
+import {
+  fetch
+} from "./chunk-XNIZGCN5.js";
+import {
+  findProjectsFromPath,
+  getLinkFromDir,
+  getRepoLink,
+  getTeamByIdOrSlug,
+  getUser,
+  getVercelDirectory
+} from "./chunk-MADFAH3O.js";
+import {
+  InvalidToken,
+  TeamDeleted
+} from "./chunk-CV5YC2EN.js";
+import {
+  output_manager_default
+} from "./chunk-2JIX6UMI.js";
+import {
+  pkg_default
+} from "./chunk-P4QNYOFB.js";
+
+// src/util/ua.ts
+import os from "os";
+var ua_default = `${pkg_default.name} ${pkg_default.version} node-${process.version} ${os.platform()} (${os.arch()})`;
+
+// src/util/oauth.ts
+import { hostname } from "os";
+var VERCEL_ISSUER = new URL("https://vercel.com");
+var VERCEL_CLI_CLIENT_ID = "cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp";
+var userAgent = `${hostname()} @ ${ua_default}`;
+var _as;
+async function as() {
+  if (!_as) {
+    const discoveryResponse = await discoveryEndpointRequest(VERCEL_ISSUER);
+    const [discoveryResponseError, as2] = await processDiscoveryEndpointResponse(discoveryResponse);
+    if (discoveryResponseError) {
+      throw discoveryResponseError;
+    }
+    _as = as2;
+  }
+  return _as;
+}
+async function discoveryEndpointRequest(issuer) {
+  return await fetch(new URL(".well-known/openid-configuration", issuer), {
+    headers: { "Content-Type": "application/json", "user-agent": userAgent }
+  });
+}
+async function processDiscoveryEndpointResponse(response) {
+  const json = await response.json();
+  if (!response.ok) {
+    return [new Error("Discovery endpoint request failed")];
+  }
+  if (typeof json !== "object" || json === null || !canParseURL(json.issuer) || !canParseURL(json.device_authorization_endpoint) || !canParseURL(json.token_endpoint) || !canParseURL(json.revocation_endpoint) || !canParseURL(json.jwks_uri) || !canParseURL(json.introspection_endpoint)) {
+    return [new TypeError("Invalid discovery response")];
+  }
+  const issuer = new URL(json.issuer);
+  if (issuer.href !== VERCEL_ISSUER.href) {
+    return [new Error("Issuer mismatch")];
+  }
+  return [
+    null,
+    {
+      issuer,
+      device_authorization_endpoint: new URL(
+        json.device_authorization_endpoint
+      ),
+      token_endpoint: new URL(json.token_endpoint),
+      revocation_endpoint: new URL(json.revocation_endpoint),
+      jwks_uri: new URL(json.jwks_uri),
+      introspection_endpoint: new URL(json.introspection_endpoint)
+    }
+  ];
+}
+async function deviceAuthorizationRequest(options) {
+  const body = new URLSearchParams({
+    client_id: VERCEL_CLI_CLIENT_ID
+  });
+  if (options?.refresh_token) {
+    body.set("refresh_token", options.refresh_token);
+    if (options.acr_values) {
+      body.set("acr_values", options.acr_values);
+    }
+  } else {
+    body.set("scope", "openid offline_access");
+  }
+  return await fetch((await as()).device_authorization_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "user-agent": userAgent
+    },
+    body
+  });
+}
+async function processDeviceAuthorizationResponse(response) {
+  const json = await response.json();
+  if (!response.ok) {
+    return [new OAuthError("Device authorization request failed", json)];
+  }
+  if (typeof json !== "object" || json === null)
+    return [new TypeError("Expected response to be an object")];
+  if (!("device_code" in json) || typeof json.device_code !== "string")
+    return [new TypeError("Expected `device_code` to be a string")];
+  if (!("user_code" in json) || typeof json.user_code !== "string")
+    return [new TypeError("Expected `user_code` to be a string")];
+  if (!("verification_uri" in json) || typeof json.verification_uri !== "string" || !canParseURL(json.verification_uri)) {
+    return [new TypeError("Expected `verification_uri` to be a string")];
+  }
+  if (!("verification_uri_complete" in json) || typeof json.verification_uri_complete !== "string" || !canParseURL(json.verification_uri_complete)) {
+    return [
+      new TypeError("Expected `verification_uri_complete` to be a string")
+    ];
+  }
+  if (!("expires_in" in json) || typeof json.expires_in !== "number")
+    return [new TypeError("Expected `expires_in` to be a number")];
+  if (!("interval" in json) || typeof json.interval !== "number")
+    return [new TypeError("Expected `interval` to be a number")];
+  return [
+    null,
+    {
+      device_code: json.device_code,
+      user_code: json.user_code,
+      verification_uri: json.verification_uri,
+      verification_uri_complete: json.verification_uri_complete,
+      expiresAt: Date.now() + json.expires_in * 1e3,
+      interval: json.interval
+    }
+  ];
+}
+async function deviceAccessTokenRequest(options) {
+  try {
+    return [
+      null,
+      await fetch((await as()).token_endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "user-agent": userAgent
+        },
+        body: new URLSearchParams({
+          client_id: VERCEL_CLI_CLIENT_ID,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          ...options
+        }),
+        signal: AbortSignal.timeout(10 * 1e3)
+      })
+    ];
+  } catch (error) {
+    if (error instanceof Error)
+      return [error];
+    return [
+      new Error("An unknown error occurred. See the logs for details.", {
+        cause: error
+      })
+    ];
+  }
+}
+async function processTokenResponse(response) {
+  const json = await response.json();
+  if (!response.ok) {
+    return [new OAuthError("Device access token request failed", json)];
+  }
+  if (typeof json !== "object" || json === null)
+    return [new TypeError("Expected response to be an object")];
+  if (!("access_token" in json) || typeof json.access_token !== "string")
+    return [new TypeError("Expected `access_token` to be a string")];
+  if (!("token_type" in json) || json.token_type !== "Bearer")
+    return [new TypeError('Expected `token_type` to be "Bearer"')];
+  if (!("expires_in" in json) || typeof json.expires_in !== "number")
+    return [new TypeError("Expected `expires_in` to be a number")];
+  if ("refresh_token" in json && (typeof json.refresh_token !== "string" || !json.refresh_token))
+    return [new TypeError("Expected `refresh_token` to be a string")];
+  if ("scope" in json && typeof json.scope !== "string")
+    return [new TypeError("Expected `scope` to be a string")];
+  return [null, json];
+}
+async function revocationRequest(options) {
+  return await fetch((await as()).revocation_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "user-agent": userAgent
+    },
+    body: new URLSearchParams({ ...options, client_id: VERCEL_CLI_CLIENT_ID })
+  });
+}
+async function processRevocationResponse(response) {
+  if (response.ok)
+    return [null, null];
+  const json = await response.json();
+  return [new OAuthError("Revocation request failed", json)];
+}
+async function refreshTokenRequest(options) {
+  return await fetch((await as()).token_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "user-agent": userAgent
+    },
+    body: new URLSearchParams({
+      client_id: VERCEL_CLI_CLIENT_ID,
+      grant_type: "refresh_token",
+      ...options
+    })
+  });
+}
+function processOAuthErrorResponse(json) {
+  if (typeof json !== "object" || json === null)
+    return new TypeError("Expected response to be an object");
+  if (!("error" in json) || typeof json.error !== "string")
+    return new TypeError("Expected `error` to be a string");
+  if ("error_description" in json && typeof json.error_description !== "string")
+    return new TypeError("Expected `error_description` to be a string");
+  if ("error_uri" in json && typeof json.error_uri !== "string")
+    return new TypeError("Expected `error_uri` to be a string");
+  return json;
+}
+var OAuthError = class extends Error {
+  constructor(message, response) {
+    var __super = (...args) => {
+      super(...args);
+    };
+    const error = processOAuthErrorResponse(response);
+    if (error instanceof TypeError) {
+      const message2 = `Unexpected server response: ${JSON.stringify(response)}`;
+      __super(message2);
+      this.cause = new Error(message2, { cause: error });
+      this.code = "server_error";
+      return;
+    }
+    let cause = error.error;
+    if (error.error_description)
+      cause += `: ${error.error_description}`;
+    if (error.error_uri)
+      cause += ` (${error.error_uri})`;
+    __super(message, { cause });
+    this.cause = new Error(cause);
+    this.code = error.error;
+  }
+};
+function isOAuthError(error) {
+  return error instanceof OAuthError;
+}
+function canParseURL(url) {
+  try {
+    return !!new URL(url);
+  } catch {
+    return false;
+  }
+}
+async function inspectTokenRequest(token) {
+  return fetch((await as()).introspection_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "user-agent": userAgent
+    },
+    body: new URLSearchParams({ token })
+  });
+}
+async function processInspectTokenResponse(response) {
+  try {
+    const token = await response.json();
+    if (!token || typeof token !== "object" || !("active" in token)) {
+      throw new IntrospectionError("Invalid token introspection response");
+    }
+    return [null, token];
+  } catch (cause) {
+    return [new IntrospectionError("Could not introspect token.", { cause })];
+  }
+}
+var IntrospectionError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.name = "IntrospectionError";
+  }
+};
+
+// src/util/introspect-token.ts
+var VERCEL_API_ORIGIN = "https://api.vercel.com";
+async function introspectToken(client) {
+  const token = client.authConfig.token;
+  if (!token) {
+    throw new Error("No token to introspect");
+  }
+  if (new URL(client.apiUrl).origin !== VERCEL_API_ORIGIN) {
+    throw new Error(
+      "Token introspection is unavailable for custom API origins"
+    );
+  }
+  const [error, introspection] = await processInspectTokenResponse(
+    await inspectTokenRequest(token)
+  );
+  if (error) {
+    throw error;
+  }
+  return introspection;
+}
+
+// src/util/app.ts
+function isAppPrincipalEnabled() {
+  return !!process.env["APP_PRINCIPAL_ENABLED"];
+}
+function resolveAppFromToken(token) {
+  if (!token.active || !token.client_id) {
+    return null;
+  }
+  return {
+    id: token.client_id,
+    name: token.client_name
+  };
+}
+async function resolveAppTokenScope(client, scope) {
+  const token = await introspectToken(client).catch(() => null);
+  const app = token ? resolveAppFromToken(token) : null;
+  const team = token?.team;
+  if (!app || !team) {
+    return false;
+  }
+  if (team.id !== scope && team.slug !== scope) {
+    return false;
+  }
+  client.config.currentTeam = team.id;
+  return true;
+}
+
+// src/util/get-scope.ts
+import { relative } from "path";
+async function getScope(client, opts = {}) {
+  const { user, app, token } = await getPrincipal(client);
+  const defaultTeamId = user?.version === "northstar" ? user.defaultTeamId : void 0;
+  const appTeamId = !user && app ? token?.team?.id : void 0;
+  if (!user && app && opts.getTeam === false) {
+    throw new Error(`App principal scope resolution requires a team lookup.`);
+  }
+  if (!user && app) {
+    client.config.currentTeam = appTeamId;
+  }
+  if (!client.config.currentTeam && defaultTeamId) {
+    client.config.currentTeam = defaultTeamId;
+  }
+  const teamId = client.config.currentTeam || defaultTeamId;
+  const team = teamId && opts.getTeam !== false ? await getTeam(client, teamId) : null;
+  const contextName = team?.slug || user?.username || user?.email;
+  if (!contextName) {
+    throw new Error(`Unable to determine context name`);
+  }
+  if (!opts.resolveLocalScope) {
+    return { contextName, team, user, app };
+  }
+  return resolveLocalScopeContext(client, { user, app, team });
+}
+async function getPrincipal(client) {
+  if (!isAppPrincipalEnabled()) {
+    return { user: await getUser(client), app: null, token: null };
+  }
+  const [userResult, tokenResult] = await Promise.allSettled([
+    getUser(client),
+    introspectToken(client)
+  ]);
+  const token = tokenResult.status === "fulfilled" ? tokenResult.value : null;
+  const app = token ? resolveAppFromToken(token) : null;
+  if (userResult.status === "rejected") {
+    const isAppToken = app && userResult.reason instanceof InvalidToken;
+    if (!isAppToken) {
+      throw userResult.reason;
+    }
+  }
+  const user = userResult.status === "fulfilled" ? userResult.value : null;
+  return { user, app, token };
+}
+async function resolveLocalScopeContext(client, { user, app, team }) {
+  const explicitScopeProvided = detectExplicitScope(client);
+  const globalTeamId = client.config.currentTeam;
+  const { localOrgId, linkedRepo, isCrossTeamRepo } = await findLocalLink(client);
+  const isAppPrincipal = !user && Boolean(app);
+  const effectiveLocalOrgId = isAppPrincipal ? void 0 : localOrgId;
+  const scopeMismatch = Boolean(
+    effectiveLocalOrgId && globalTeamId && globalTeamId !== effectiveLocalOrgId
+  );
+  if (!isAppPrincipal && !explicitScopeProvided && !effectiveLocalOrgId && isCrossTeamRepo) {
+    output_manager_default.warn(
+      `This repository has projects across multiple teams. Use \`--scope\` to specify which team, or \`cd\` into a project directory.`
+    );
+  }
+  const resolvedTeam = !explicitScopeProvided && effectiveLocalOrgId ? await applyLocalOrg(client, effectiveLocalOrgId) : team;
+  const { org, contextName } = resolveOrg(resolvedTeam, user);
+  return {
+    org,
+    contextName,
+    user,
+    team: resolvedTeam,
+    app,
+    globalTeam: team,
+    linkedRepo,
+    isCrossTeamRepo,
+    scopeMismatch,
+    explicitScopeProvided
+  };
+}
+async function applyLocalOrg(client, localOrgId) {
+  client.config.currentTeam = localOrgId.startsWith("team_") ? localOrgId : void 0;
+  return client.config.currentTeam ? await getTeamByIdOrSlug(client, client.config.currentTeam) : null;
+}
+async function getTeam(client, teamId) {
+  const team = await getTeamByIdOrSlug(client, teamId);
+  if (!team) {
+    throw new TeamDeleted();
+  }
+  return team;
+}
+function resolveOrg(team, user) {
+  if (team) {
+    return {
+      org: { type: "team", id: team.id, slug: team.slug },
+      contextName: team.slug
+    };
+  }
+  if (user) {
+    return {
+      org: { type: "user", id: user.id, slug: user.username },
+      contextName: user.username || user.email
+    };
+  }
+  throw new Error(
+    `Unable to determine scope: no team or personal account is available for this token. Use \`--scope\` to specify a team.`
+  );
+}
+async function findLocalLink(client) {
+  const [projectLink, repoLink] = await Promise.all([
+    findProjectLink(client),
+    findRepoLink(client)
+  ]);
+  return {
+    localOrgId: findLocalOrgId(client.cwd, projectLink, repoLink),
+    linkedRepo: repoLink?.repoConfig ? { repoConfig: repoLink.repoConfig, rootPath: repoLink.rootPath } : null,
+    isCrossTeamRepo: detectCrossTeamRepo(repoLink?.repoConfig)
+  };
+}
+async function findProjectLink(client) {
+  try {
+    return await getLinkFromDir(getVercelDirectory(client.cwd));
+  } catch (_error) {
+    return null;
+  }
+}
+async function findRepoLink(client) {
+  try {
+    return await getRepoLink(client, client.cwd);
+  } catch (_error) {
+    return null;
+  }
+}
+function findLocalOrgId(cwd, projectLink, repoLink) {
+  if (projectLink) {
+    return projectLink.orgId;
+  }
+  if (repoLink?.repoConfig) {
+    return findRepoOrgId(repoLink.repoConfig, relative(repoLink.rootPath, cwd));
+  }
+  return void 0;
+}
+function findRepoOrgId(repoConfig, pathFromRepoRoot) {
+  const projects = findProjectsFromPath(repoConfig.projects, pathFromRepoRoot);
+  const orgIds = new Set(projects.map((p) => p.orgId ?? repoConfig.orgId ?? ""));
+  if (orgIds.size !== 1) {
+    return void 0;
+  }
+  const [orgId] = orgIds;
+  return orgId || void 0;
+}
+function detectExplicitScope(client) {
+  const argv = client.argv;
+  for (const arg of argv) {
+    if (arg === "--") {
+      break;
+    }
+    if (arg === "--scope" || arg === "--team" || arg.startsWith("--scope=") || arg.startsWith("--team=") || arg === "-S" || arg === "-T") {
+      return true;
+    }
+  }
+  if (client.localConfig?.scope) {
+    return true;
+  }
+  return false;
+}
+function detectCrossTeamRepo(repoConfig) {
+  if (!repoConfig?.projects || repoConfig.projects.length < 2) {
+    return false;
+  }
+  const orgIds = /* @__PURE__ */ new Set();
+  for (const project of repoConfig.projects) {
+    const orgId = project.orgId ?? repoConfig.orgId;
+    if (orgId) {
+      orgIds.add(orgId);
+    }
+  }
+  return orgIds.size > 1;
+}
+
+export {
+  ua_default,
+  deviceAuthorizationRequest,
+  processDeviceAuthorizationResponse,
+  deviceAccessTokenRequest,
+  processTokenResponse,
+  revocationRequest,
+  processRevocationResponse,
+  refreshTokenRequest,
+  isOAuthError,
+  isAppPrincipalEnabled,
+  resolveAppTokenScope,
+  getScope,
+  detectExplicitScope
+};

package/dist/chunks/{chunk-7ST552E3.js → chunk-AKLTIZCU.js}

@@ -6,7 +6,7 @@ const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
 import {
   output_manager_default
-} from "./chunk-QFAS4OVW.js";
+} from "./chunk-2JIX6UMI.js";
 import {
   require_source
 } from "./chunk-S7KYDPEM.js";