diff --git a/.changeset/pass-teamid-run-key.md b/.changeset/pass-teamid-run-key.md new file mode 100644 index 0000000000..94dfa202cc --- /dev/null +++ b/.changeset/pass-teamid-run-key.md @@ -0,0 +1,5 @@ +--- +"@workflow/world-vercel": patch +--- + +Pass `teamId` to the run-key API endpoint for team-scoped encryption key retrieval diff --git a/packages/world-vercel/src/encryption.ts b/packages/world-vercel/src/encryption.ts index f836d38792..887080cc18 100644 --- a/packages/world-vercel/src/encryption.ts +++ b/packages/world-vercel/src/encryption.ts @@ -94,6 +94,8 @@ export async function fetchRunKey( options?: { /** Auth token (from config). Falls back to OIDC or VERCEL_TOKEN. */ token?: string; + /** Team ID for team-scoped API requests. */ + teamId?: string; } ): Promise { // Authenticate via provided token (CLI/config), OIDC token (runtime), @@ -107,6 +109,9 @@ export async function fetchRunKey( } const params = new URLSearchParams({ projectId, runId }); + if (options?.teamId) { + params.set('teamId', options.teamId); + } const response = await fetch( `https://api.vercel.com/v1/workflow/run-key/${deploymentId}?${params}`, { @@ -143,11 +148,13 @@ export async function fetchRunKey( * - Fetching it from the Vercel API when the run belongs to a different deployment * * @param projectId - Vercel project ID for HKDF context isolation + * @param teamId - Optional team ID for team-scoped API requests * @param token - Optional auth token from config * @returns The `getEncryptionKeyForRun` function, or `undefined` if no projectId */ export function createGetEncryptionKeyForRun( projectId: string | undefined, + teamId?: string, token?: string ): World['getEncryptionKeyForRun'] { if (!projectId) return undefined; @@ -188,6 +195,6 @@ export function createGetEncryptionKeyForRun( // raw deployment key never leaves the API boundary. // Covers cross-deployment resumeHook() (OIDC auth) and o11y // tooling reading data from other deployments (VERCEL_TOKEN). - return fetchRunKey(deploymentId, projectId, runId, { token }); + return fetchRunKey(deploymentId, projectId, runId, { token, teamId }); }; } diff --git a/packages/world-vercel/src/index.ts b/packages/world-vercel/src/index.ts index 5221e3fbc3..1c15e6c297 100644 --- a/packages/world-vercel/src/index.ts +++ b/packages/world-vercel/src/index.ts @@ -27,6 +27,7 @@ export function createVercelWorld(config?: APIConfig): World { ...createStreamer(config), getEncryptionKeyForRun: createGetEncryptionKeyForRun( projectId, + config?.projectConfig?.teamId, config?.token ), };