From 34f1962a41d6d7058d4d42e786b57147a953c843 Mon Sep 17 00:00:00 2001 From: Nathan Rajlich Date: Thu, 19 Feb 2026 09:10:18 -0800 Subject: [PATCH 1/3] Pass teamId to the get-key endpoint --- packages/world-vercel/src/encryption.ts | 11 +++++++++-- packages/world-vercel/src/index.ts | 3 ++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/packages/world-vercel/src/encryption.ts b/packages/world-vercel/src/encryption.ts index f836d38792..a225b69d43 100644 --- a/packages/world-vercel/src/encryption.ts +++ b/packages/world-vercel/src/encryption.ts @@ -94,6 +94,8 @@ export async function fetchRunKey( options?: { /** Auth token (from config). Falls back to OIDC or VERCEL_TOKEN. */ token?: string; + /** Team ID for team-scoped API requests. */ + teamId?: string; } ): Promise { // Authenticate via provided token (CLI/config), OIDC token (runtime), @@ -107,6 +109,9 @@ export async function fetchRunKey( } const params = new URLSearchParams({ projectId, runId }); + if (options?.teamId) { + params.set('teamId', options.teamId); + } const response = await fetch( `https://api.vercel.com/v1/workflow/run-key/${deploymentId}?${params}`, { @@ -144,11 +149,13 @@ export async function fetchRunKey( * * @param projectId - Vercel project ID for HKDF context isolation * @param token - Optional auth token from config + * @param teamId - Optional team ID for team-scoped API requests * @returns The `getEncryptionKeyForRun` function, or `undefined` if no projectId */ export function createGetEncryptionKeyForRun( projectId: string | undefined, - token?: string + token?: string, + teamId?: string ): World['getEncryptionKeyForRun'] { if (!projectId) return undefined; @@ -188,6 +195,6 @@ export function createGetEncryptionKeyForRun( // raw deployment key never leaves the API boundary. // Covers cross-deployment resumeHook() (OIDC auth) and o11y // tooling reading data from other deployments (VERCEL_TOKEN). - return fetchRunKey(deploymentId, projectId, runId, { token }); + return fetchRunKey(deploymentId, projectId, runId, { token, teamId }); }; } diff --git a/packages/world-vercel/src/index.ts b/packages/world-vercel/src/index.ts index 5221e3fbc3..52f145964d 100644 --- a/packages/world-vercel/src/index.ts +++ b/packages/world-vercel/src/index.ts @@ -27,7 +27,8 @@ export function createVercelWorld(config?: APIConfig): World { ...createStreamer(config), getEncryptionKeyForRun: createGetEncryptionKeyForRun( projectId, - config?.token + config?.token, + config?.projectConfig?.teamId ), }; } From d5ed2e37c34e0cfa0ca4109e3b44c37f729b88ef Mon Sep 17 00:00:00 2001 From: Nathan Rajlich Date: Tue, 24 Feb 2026 16:32:22 -0800 Subject: [PATCH 2/3] . --- packages/world-vercel/src/encryption.ts | 6 +++--- packages/world-vercel/src/index.ts | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/world-vercel/src/encryption.ts b/packages/world-vercel/src/encryption.ts index a225b69d43..887080cc18 100644 --- a/packages/world-vercel/src/encryption.ts +++ b/packages/world-vercel/src/encryption.ts @@ -148,14 +148,14 @@ export async function fetchRunKey( * - Fetching it from the Vercel API when the run belongs to a different deployment * * @param projectId - Vercel project ID for HKDF context isolation - * @param token - Optional auth token from config * @param teamId - Optional team ID for team-scoped API requests + * @param token - Optional auth token from config * @returns The `getEncryptionKeyForRun` function, or `undefined` if no projectId */ export function createGetEncryptionKeyForRun( projectId: string | undefined, - token?: string, - teamId?: string + teamId?: string, + token?: string ): World['getEncryptionKeyForRun'] { if (!projectId) return undefined; diff --git a/packages/world-vercel/src/index.ts b/packages/world-vercel/src/index.ts index 52f145964d..1c15e6c297 100644 --- a/packages/world-vercel/src/index.ts +++ b/packages/world-vercel/src/index.ts @@ -27,8 +27,8 @@ export function createVercelWorld(config?: APIConfig): World { ...createStreamer(config), getEncryptionKeyForRun: createGetEncryptionKeyForRun( projectId, - config?.token, - config?.projectConfig?.teamId + config?.projectConfig?.teamId, + config?.token ), }; } From ab88de42cef6de491f6031eed868afb9638f53c5 Mon Sep 17 00:00:00 2001 From: Nathan Rajlich Date: Tue, 24 Feb 2026 16:33:36 -0800 Subject: [PATCH 3/3] Add changeset for teamId run-key support --- .changeset/pass-teamid-run-key.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/pass-teamid-run-key.md diff --git a/.changeset/pass-teamid-run-key.md b/.changeset/pass-teamid-run-key.md new file mode 100644 index 0000000000..94dfa202cc --- /dev/null +++ b/.changeset/pass-teamid-run-key.md @@ -0,0 +1,5 @@ +--- +"@workflow/world-vercel": patch +--- + +Pass `teamId` to the run-key API endpoint for team-scoped encryption key retrieval