Pass teamId to the run-key endpoint (vercel#1183)

Author: TooTallNate

.changeset/pass-teamid-run-key.md

@@ -0,0 +1,5 @@
+---
+"@workflow/world-vercel": patch
+---
+
+Pass `teamId` to the run-key API endpoint for team-scoped encryption key retrieval

packages/world-vercel/src/encryption.ts

@@ -94,6 +94,8 @@ export async function fetchRunKey(
   options?: {
     /** Auth token (from config). Falls back to OIDC or VERCEL_TOKEN. */
     token?: string;
+    /** Team ID for team-scoped API requests. */
+    teamId?: string;
   }
 ): Promise<Uint8Array | undefined> {
   // Authenticate via provided token (CLI/config), OIDC token (runtime),
@@ -107,6 +109,9 @@ export async function fetchRunKey(
   }
 
   const params = new URLSearchParams({ projectId, runId });
+  if (options?.teamId) {
+    params.set('teamId', options.teamId);
+  }
   const response = await fetch(
     `https://api.vercel.com/v1/workflow/run-key/${deploymentId}?${params}`,
     {
@@ -143,11 +148,13 @@ export async function fetchRunKey(
  * - Fetching it from the Vercel API when the run belongs to a different deployment
  *
  * @param projectId - Vercel project ID for HKDF context isolation
+ * @param teamId - Optional team ID for team-scoped API requests
  * @param token - Optional auth token from config
  * @returns The `getEncryptionKeyForRun` function, or `undefined` if no projectId
  */
 export function createGetEncryptionKeyForRun(
   projectId: string | undefined,
+  teamId?: string,
   token?: string
 ): World['getEncryptionKeyForRun'] {
   if (!projectId) return undefined;
@@ -188,6 +195,6 @@ export function createGetEncryptionKeyForRun(
     // raw deployment key never leaves the API boundary.
     // Covers cross-deployment resumeHook() (OIDC auth) and o11y
     // tooling reading data from other deployments (VERCEL_TOKEN).
-    return fetchRunKey(deploymentId, projectId, runId, { token });
+    return fetchRunKey(deploymentId, projectId, runId, { token, teamId });
   };
 }

packages/world-vercel/src/index.ts

@@ -27,6 +27,7 @@ export function createVercelWorld(config?: APIConfig): World {
     ...createStreamer(config),
     getEncryptionKeyForRun: createGetEncryptionKeyForRun(
       projectId,
+      config?.projectConfig?.teamId,
       config?.token
     ),
   };