@valbuild/next 0.116.0 → 0.117.1

package/CHANGELOG.md

@@ -0,0 +1,81 @@
+# @valbuild/next
+
+## 0.117.1
+
+### Patch Changes
+
+- Updated dependencies [[`0ae7bac`](https://github.com/valbuild/val/commit/0ae7bac8a186460bc2b31f2ded89b00027bafb55)]:
+  - @valbuild/ui@0.117.1
+  - @valbuild/react@0.117.1
+  - @valbuild/server@0.117.1
+  - @valbuild/language-server@0.117.1
+
+## 0.117.0
+
+### Minor Changes
+
+- [#582](https://github.com/valbuild/val/pull/582) [`fca3efa`](https://github.com/valbuild/val/commit/fca3efa389e2817401f55ea3dd184af7c611b807) Thanks [@freekh](https://github.com/freekh)! - Accept OAuth access tokens on the MCP endpoint, so editors can authorize as themselves
+
+  `initValMcp` takes an optional `oauth` config. Give it the authorization server's
+  URL and this endpoint's own URL, and every MCP call must then present an access
+  token that Val's authorization server issued:
+
+  ```ts
+  const { valMcpAuthorize, valMcpTools, valMcpMetadata } = initValMcp(
+    valModules,
+    config,
+    {
+      oauth: {
+        issuer: "https://admin.val.build",
+        resource: "https://your-app.com/api/mcp",
+      },
+    },
+  );
+  ```
+
+  The token is verified in your app — signature against the issuer's published
+  keys, plus issuer, audience and expiry — so the caller's identity is checked
+  rather than claimed. **Patches created over MCP now carry that profile as their
+  author**, which is what makes an edit made from a phone show up in the review
+  screen as somebody's rather than nobody's. Scopes are enforced too: a token
+  without `val:write` cannot reach a tool that writes.
+
+  Mount the discovery document so clients can find where to authorize:
+
+  ```ts
+  // app/.well-known/oauth-protected-resource/route.ts
+  import { valMcpMetadata } from "../../../val/mcp";
+  export const { GET, OPTIONS } = valMcpMetadata!;
+  ```
+
+  `valMcpMetadata` is `null` when no `oauth` config is given.
+
+  **Nothing changes if you leave `oauth` out.** Local development still works with
+  no authorization server, and an app already using a personal access token keeps
+  working as before.
+
+  One breaking change if you built your own host on `createValTools`:
+  `ValToolContext.auth` is now a tagged union, so `{ pat }` becomes
+  `{ type: "pat", pat }`. The new variant is
+  `{ type: "verified-profile", profileId, scopes }`, for a host that verified a
+  token itself.
+
+### Patch Changes
+
+- [#579](https://github.com/valbuild/val/pull/579) [`b2812ae`](https://github.com/valbuild/val/commit/b2812ae4ee03e005ecead3365f49c625e536f94d) Thanks [@freekh](https://github.com/freekh)! - Every release now ships a changelog. Each package's `CHANGELOG.md` records what
+  changed under the version that shipped it — with a link to the pull request, the
+  commit and the author — and the same entry becomes the body of the GitHub
+  Release for the tag. The file is included in the npm tarball, so it is also
+  readable from an installed copy.
+
+  Up to now those changelogs were generated empty, and the GitHub Releases with
+  them, so there was no record of what any given version contained. Releases from
+  this one on have one; earlier versions stay blank.
+
+- Updated dependencies [[`fca3efa`](https://github.com/valbuild/val/commit/fca3efa389e2817401f55ea3dd184af7c611b807), [`d94a40f`](https://github.com/valbuild/val/commit/d94a40f8bd11027636d183e293aced820b6f341f), [`b2812ae`](https://github.com/valbuild/val/commit/b2812ae4ee03e005ecead3365f49c625e536f94d)]:
+  - @valbuild/server@0.117.0
+  - @valbuild/language-server@0.117.0
+  - @valbuild/core@0.117.0
+  - @valbuild/react@0.117.0
+  - @valbuild/shared@0.117.0
+  - @valbuild/ui@0.117.0

package/client/dist/valbuild-next-client.cjs.dev.js

@@ -3,11 +3,12 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 require('client-only');
-var routeFromVal = require('../../dist/routeFromVal-b48a454a.cjs.dev.js');
+var _typeof = require('../../dist/typeof-b568f48f.cjs.dev.js');
 var core = require('@valbuild/core');
 var stega = require('@valbuild/react/stega');
 var React = require('react');
 var ValOverlayContext = require('../../dist/ValOverlayContext-5bd7628b.cjs.dev.js');
+var routeFromVal = require('../../dist/routeFromVal-7df20dfe.cjs.dev.js');
 require('../../dist/createForOfIteratorHelper-0445603c.cjs.dev.js');
 require('../../dist/unsupportedIterableToArray-c8ab77c9.cjs.dev.js');
 require('../../dist/objectSpread2-58024783.cjs.dev.js');
@@ -118,7 +119,7 @@ function useDraftModuleSource(moduleFilePath) {
  * bundled content is used only when there is no draft view.
  */
 function draftJsonEntry(draftSource, key) {
-  if (draftSource === undefined || draftSource === null || routeFromVal._typeof(draftSource) !== "object" || Array.isArray(draftSource)) {
+  if (draftSource === undefined || draftSource === null || _typeof._typeof(draftSource) !== "object" || Array.isArray(draftSource)) {
     return {
       status: "unavailable"
     };
@@ -190,7 +191,7 @@ function useValKeyStega(selector, key) {
 function readCommittedJsonEntry(selector, key) {
   var _Internal$getValPath;
   var source = selector && core.Internal.getSource(selector);
-  var marker = source && routeFromVal._typeof(source) === "object" ? source[key] : undefined;
+  var marker = source && _typeof._typeof(source) === "object" ? source[key] : undefined;
   if (!core.Internal.isJson(marker)) {
     return undefined;
   }

package/client/dist/valbuild-next-client.cjs.prod.js

@@ -3,11 +3,12 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 require('client-only');
-var routeFromVal = require('../../dist/routeFromVal-8ac2f984.cjs.prod.js');
+var _typeof = require('../../dist/typeof-16428c61.cjs.prod.js');
 var core = require('@valbuild/core');
 var stega = require('@valbuild/react/stega');
 var React = require('react');
 var ValOverlayContext = require('../../dist/ValOverlayContext-d690744f.cjs.prod.js');
+var routeFromVal = require('../../dist/routeFromVal-8032f5f7.cjs.prod.js');
 require('../../dist/createForOfIteratorHelper-d4afcad8.cjs.prod.js');
 require('../../dist/unsupportedIterableToArray-0d2087a2.cjs.prod.js');
 require('../../dist/objectSpread2-13f847a9.cjs.prod.js');
@@ -118,7 +119,7 @@ function useDraftModuleSource(moduleFilePath) {
  * bundled content is used only when there is no draft view.
  */
 function draftJsonEntry(draftSource, key) {
-  if (draftSource === undefined || draftSource === null || routeFromVal._typeof(draftSource) !== "object" || Array.isArray(draftSource)) {
+  if (draftSource === undefined || draftSource === null || _typeof._typeof(draftSource) !== "object" || Array.isArray(draftSource)) {
     return {
       status: "unavailable"
     };
@@ -190,7 +191,7 @@ function useValKeyStega(selector, key) {
 function readCommittedJsonEntry(selector, key) {
   var _Internal$getValPath;
   var source = selector && core.Internal.getSource(selector);
-  var marker = source && routeFromVal._typeof(source) === "object" ? source[key] : undefined;
+  var marker = source && _typeof._typeof(source) === "object" ? source[key] : undefined;
   if (!core.Internal.isJson(marker)) {
     return undefined;
   }

package/client/dist/valbuild-next-client.esm.js

@@ -1,9 +1,10 @@
 import 'client-only';
-import { g as getJsonEntryStegaRoot, _ as _typeof, a as isJsonValuesRecordSchema, b as getValRouteUrlFromVal, i as initValRouteFromVal } from '../../dist/routeFromVal-263eec96.esm.js';
+import { _ as _typeof } from '../../dist/typeof-a1531d8f.esm.js';
 import { Internal } from '@valbuild/core';
 import { getModuleIds, stegaEncode } from '@valbuild/react/stega';
 import React from 'react';
 import { useValOverlayContext } from '../../dist/ValOverlayContext-e42a2e14.esm.js';
+import { g as getJsonEntryStegaRoot, a as isJsonValuesRecordSchema, b as getValRouteUrlFromVal, i as initValRouteFromVal } from '../../dist/routeFromVal-bd69625f.esm.js';
 import '../../dist/createForOfIteratorHelper-5758a730.esm.js';
 import '../../dist/unsupportedIterableToArray-5baabfdc.esm.js';
 import '../../dist/objectSpread2-60d1bd93.esm.js';

package/dist/declarations/src/server/initValMcp.d.ts

@@ -1,5 +1,7 @@
 import { ValConfig, ValModules } from "@valbuild/core";
 import { type ValToolContext, type ValTools } from "@valbuild/server";
+import { type ValOAuthConfig } from "./valAccessToken.js";
+import { type ValMcpMetadataHandlers } from "./valMcpMetadata.js";
 /**
  * Val's tools over MCP, and the two checks that have to happen before a request
  * gets to them.
@@ -36,7 +38,26 @@ export type ValMcp = {
      * with an MCP server can happen once rather than per request.
      */
     valMcpTools: () => Promise<ValTools>;
+    /**
+     * The RFC 9728 protected-resource document, for mounting at
+     * `/.well-known/oauth-protected-resource`.
+     *
+     * `null` when no `oauth` config was given: a project that has not been told
+     * where to authorize must not publish a document claiming it knows.
+     */
+    valMcpMetadata: ValMcpMetadataHandlers | null;
 };
 export declare function initValMcp(valModules: ValModules, config: ValConfig, opts?: {
     formatter?: (code: string, filePath: string) => string | Promise<string>;
+    /**
+     * Where to authorize, and what audience to expect.
+     *
+     * Omit it and nothing changes: the endpoint behaves exactly as it did
+     * before OAuth existed, which keeps local development a one-liner and keeps
+     * an app that has not been reconfigured working. Provide it and every call
+     * needs a verified access token — including in fs mode, where a token is
+     * refused rather than ignored, because a host that thinks it is
+     * authenticating should never silently get unauthenticated local access.
+     */
+    oauth?: ValOAuthConfig;
 }): ValMcp;

package/dist/declarations/src/server/valAccessToken.d.ts

@@ -0,0 +1,89 @@
+import { type ValToolAuth } from "@valbuild/server";
+/**
+ * Verifying an OAuth access token, which is the whole of what makes this app a
+ * resource server rather than a relay.
+ *
+ * The token is issued by Val's authorization server and presented by an MCP
+ * client. This app holds no signing key for it and cannot mint one — it fetches
+ * the issuer's *public* keys and checks a signature. That asymmetry is the
+ * point: a verified `sub` is a fact about the token rather than a claim by
+ * whoever sent it, which is what lets the tools attribute a patch to that
+ * profile at all.
+ *
+ * ## Why this is not `jose`
+ *
+ * `jose` was the first choice and was rejected on a fact rather than a
+ * preference: version 6 is ESM-only (`"type": "module"`, no CJS export). This
+ * package is built by preconstruct and `require`d by Next.js server code, so an
+ * ESM-only dependency here is a runtime failure in consumers' apps, not a build
+ * inconvenience. Adding it would also put a dependency in every install of
+ * `@valbuild/next` for one function.
+ *
+ * The actual cryptography is still not hand-rolled — `node:crypto` does the
+ * ECDSA and the JWK import. What is written here is the JWS envelope and the
+ * claim checks, and the rules that keep that safe are worth stating because
+ * this repository has already shipped the counterexample (`decodeJwt`: `exp`
+ * never checked, a non-constant-time compare, verification skippable):
+ *
+ * - **`alg` is pinned**, not read from the token. The header is only consulted
+ *   for `kid`. A verifier that honours the token's own `alg` can be handed
+ *   `HS256` and will treat the *published* public key as a shared secret.
+ * - **Nothing is read from the payload before the signature verifies.** Claims
+ *   from an unverified token are attacker input.
+ * - **Keys come only from the configured issuer's JWKS**, never from the token.
+ * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
+ *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
+ *   is rejected — or worse, a future change makes it accept the wrong thing.
+ */
+export type ValOAuthConfig = {
+    /**
+     * The authorization server, and therefore the expected `iss`.
+     *
+     * Also where the JWKS is fetched from, so it is the one value that decides
+     * which keys can produce a token this app accepts. Configuration, never
+     * request input — a request that could name its own issuer could name its own
+     * key.
+     */
+    issuer: string;
+    /**
+     * This endpoint's absolute URL, and therefore the expected `aud` (RFC 8707).
+     *
+     * Audience binding is what stops a token minted for one Val site being
+     * replayed against another: without it, any deployment the user has access to
+     * would accept a token issued for any other.
+     */
+    resource: string;
+    /**
+     * Clock skew allowance, in seconds.
+     *
+     * Servers disagree about the time by more than you would like, and a token
+     * refused for being a second early is indistinguishable, to the person using
+     * it, from a broken login.
+     */
+    clockToleranceSeconds?: number;
+    /** Test seam. Defaults to the global `fetch`. */
+    fetchImpl?: typeof fetch;
+};
+export type ValAccessTokenResult = {
+    status: "ok";
+    auth: Extract<ValToolAuth, {
+        type: "verified-profile";
+    }>;
+} | {
+    status: "refused";
+    /** For the `WWW-Authenticate` challenge: RFC 6750 section 3.1. */
+    error: "invalid_request" | "invalid_token" | "insufficient_scope";
+    description: string;
+};
+/** Test seam: a fresh process would have an empty cache anyway. */
+export declare function clearValAccessTokenCache(): void;
+/**
+ * Read `Authorization: Bearer …`.
+ *
+ * Exported because the refusal needs to know whether a token was presented at
+ * all: RFC 6750 distinguishes "no credential" — a bare `401`, which is an
+ * invitation to authenticate — from "a bad credential", and a client that gets
+ * the second when it deserved the first will not start the authorization flow.
+ */
+export declare function readBearerToken(request: Request): string | null;
+export declare function verifyValAccessToken(request: Request, config: ValOAuthConfig): Promise<ValAccessTokenResult>;

package/dist/declarations/src/server/valMcpMetadata.d.ts

@@ -0,0 +1,47 @@
+import type { ValOAuthConfig } from "./valAccessToken.js";
+/**
+ * The one document an MCP client needs before it can authorize: RFC 9728
+ * Protected Resource Metadata, served by the *resource* server.
+ *
+ * This is how a client discovers where to authorize. It asks the resource — this
+ * app — and the resource names its authorization server. Which is why this
+ * belongs here and the RFC 8414 *authorization server* metadata does not: that
+ * document lives at the issuer, describes the issuer's own endpoints, and is
+ * served by the issuer. An app serving a copy would be asserting the issuer's
+ * configuration on its behalf, and would be wrong the moment the issuer changed
+ * anything.
+ *
+ * The flow, so the split reads as a whole:
+ *
+ * 1. client → `{app}/api/mcp` with no token → `401` naming this document
+ * 2. client → `{app}/.well-known/oauth-protected-resource` → the issuer
+ * 3. client → `{issuer}/.well-known/oauth-authorization-server` → endpoints
+ * 4. client → issuer's `/authorize`, then `/token`
+ * 5. client → `{app}/api/mcp` with the token
+ */
+export type ValMcpMetadataHandlers = {
+    /** The metadata document. */
+    GET: (request: Request) => Response;
+    /**
+     * The CORS preflight.
+     *
+     * Required rather than defensive: the metadata document is fetched
+     * cross-origin by browser-based clients, and without a preflight answer the
+     * fetch fails before the document is read — which presents as "this connector
+     * cannot authorize" with nothing in any log to explain it.
+     */
+    OPTIONS: (request: Request) => Response;
+};
+export declare function createValMcpMetadata(oauth: ValOAuthConfig, scopesSupported: string[]): ValMcpMetadataHandlers;
+/**
+ * The `WWW-Authenticate` value for a refusal (RFC 6750 section 3, RFC 9728
+ * section 5.1).
+ *
+ * `resource_metadata` is the load-bearing parameter: it is how a client that has
+ * never seen this server learns where to authorize. A `401` without it is a dead
+ * end — the client knows it needs a token and has no way to find out from where.
+ */
+export declare function wwwAuthenticate(oauth: ValOAuthConfig, scopesSupported: string[], refusal?: {
+    error: string;
+    description: string;
+}): string;

package/dist/{routeFromVal-b48a454a.cjs.dev.js → routeFromVal-7df20dfe.cjs.dev.js}

@@ -3,19 +3,10 @@
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-0445603c.cjs.dev.js');
 var objectSpread2 = require('./objectSpread2-58024783.cjs.dev.js');
 var slicedToArray = require('./slicedToArray-44036a76.cjs.dev.js');
+var _typeof = require('./typeof-b568f48f.cjs.dev.js');
 var core = require('@valbuild/core');
 var internal = require('@valbuild/shared/internal');
 
-function _typeof(o) {
-  "@babel/helpers - typeof";
-
-  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
-    return typeof o;
-  } : function (o) {
-    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-  }, _typeof(o);
-}
-
 /**
  * True when the module's schema is a `.jsonValues()` record/router — i.e. each
  * entry value is a lazily-loaded `c.json(() => import(...))` marker. Used by the
@@ -70,8 +61,8 @@ val) {
   if (val === null) {
     return null;
   }
-  if (_typeof(val) !== "object") {
-    console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: expected type object, found ").concat(_typeof(val), " instead)."));
+  if (_typeof._typeof(val) !== "object") {
+    console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: expected type object, found ").concat(_typeof._typeof(val), " instead)."));
     return null;
   }
   if (Array.isArray(val)) {
@@ -90,7 +81,7 @@ val) {
     console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: router is not the Next.js App Router or External URL Page Router)."));
     return null;
   }
-  if (_typeof(resolvedParams) !== "object") {
+  if (_typeof._typeof(resolvedParams) !== "object") {
     console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: params is not an object)."));
     return null;
   }
@@ -110,7 +101,7 @@ val) {
   var parsedPattern = internal.parseRoutePattern(pattern);
   var missingPatterns = [];
   var fullPathParts = [];
-  var missingParamKeys = _typeof(resolvedParams) === "object" && resolvedParams !== null && !Array.isArray(resolvedParams) ? objectSpread2._objectSpread2({}, resolvedParams) : {};
+  var missingParamKeys = _typeof._typeof(resolvedParams) === "object" && resolvedParams !== null && !Array.isArray(resolvedParams) ? objectSpread2._objectSpread2({}, resolvedParams) : {};
   var _iterator = createForOfIteratorHelper._createForOfIteratorHelper(parsedPattern !== null && parsedPattern !== void 0 ? parsedPattern : []),
     _step;
   try {
@@ -195,7 +186,6 @@ val) {
   return actualRoute;
 }
 
-exports._typeof = _typeof;
 exports.getJsonEntryStegaRoot = getJsonEntryStegaRoot;
 exports.getValRouteUrlFromVal = getValRouteUrlFromVal;
 exports.initValRouteFromVal = initValRouteFromVal;

package/dist/{routeFromVal-8ac2f984.cjs.prod.js → routeFromVal-8032f5f7.cjs.prod.js}

@@ -3,19 +3,10 @@
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-d4afcad8.cjs.prod.js');
 var objectSpread2 = require('./objectSpread2-13f847a9.cjs.prod.js');
 var slicedToArray = require('./slicedToArray-ce613de6.cjs.prod.js');
+var _typeof = require('./typeof-16428c61.cjs.prod.js');
 var core = require('@valbuild/core');
 var internal = require('@valbuild/shared/internal');
 
-function _typeof(o) {
-  "@babel/helpers - typeof";
-
-  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
-    return typeof o;
-  } : function (o) {
-    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-  }, _typeof(o);
-}
-
 /**
  * True when the module's schema is a `.jsonValues()` record/router — i.e. each
  * entry value is a lazily-loaded `c.json(() => import(...))` marker. Used by the
@@ -70,8 +61,8 @@ val) {
   if (val === null) {
     return null;
   }
-  if (_typeof(val) !== "object") {
-    console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: expected type object, found ").concat(_typeof(val), " instead)."));
+  if (_typeof._typeof(val) !== "object") {
+    console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: expected type object, found ").concat(_typeof._typeof(val), " instead)."));
     return null;
   }
   if (Array.isArray(val)) {
@@ -90,7 +81,7 @@ val) {
     console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: router is not the Next.js App Router or External URL Page Router)."));
     return null;
   }
-  if (_typeof(resolvedParams) !== "object") {
+  if (_typeof._typeof(resolvedParams) !== "object") {
     console.error("Val: ".concat(methodName, " must be used with a Val Module that is a s.record().router(...) (details: params is not an object)."));
     return null;
   }
@@ -110,7 +101,7 @@ val) {
   var parsedPattern = internal.parseRoutePattern(pattern);
   var missingPatterns = [];
   var fullPathParts = [];
-  var missingParamKeys = _typeof(resolvedParams) === "object" && resolvedParams !== null && !Array.isArray(resolvedParams) ? objectSpread2._objectSpread2({}, resolvedParams) : {};
+  var missingParamKeys = _typeof._typeof(resolvedParams) === "object" && resolvedParams !== null && !Array.isArray(resolvedParams) ? objectSpread2._objectSpread2({}, resolvedParams) : {};
   var _iterator = createForOfIteratorHelper._createForOfIteratorHelper(parsedPattern !== null && parsedPattern !== void 0 ? parsedPattern : []),
     _step;
   try {
@@ -195,7 +186,6 @@ val) {
   return actualRoute;
 }
 
-exports._typeof = _typeof;
 exports.getJsonEntryStegaRoot = getJsonEntryStegaRoot;
 exports.getValRouteUrlFromVal = getValRouteUrlFromVal;
 exports.initValRouteFromVal = initValRouteFromVal;

package/dist/{routeFromVal-263eec96.esm.js → routeFromVal-bd69625f.esm.js}

@@ -1,19 +1,10 @@
 import { _ as _createForOfIteratorHelper } from './createForOfIteratorHelper-5758a730.esm.js';
 import { _ as _objectSpread2 } from './objectSpread2-60d1bd93.esm.js';
 import { _ as _slicedToArray } from './slicedToArray-aa291011.esm.js';
+import { _ as _typeof } from './typeof-a1531d8f.esm.js';
 import { RecordSchema, Internal } from '@valbuild/core';
 import { getNextAppRouterSourceFolder, getPatternFromModuleFilePath, parseRoutePattern } from '@valbuild/shared/internal';
 
-function _typeof(o) {
-  "@babel/helpers - typeof";
-
-  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
-    return typeof o;
-  } : function (o) {
-    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-  }, _typeof(o);
-}
-
 /**
  * True when the module's schema is a `.jsonValues()` record/router — i.e. each
  * entry value is a lazily-loaded `c.json(() => import(...))` marker. Used by the
@@ -193,4 +184,4 @@ val) {
   return actualRoute;
 }
 
-export { _typeof as _, isJsonValuesRecordSchema as a, getValRouteUrlFromVal as b, getJsonEntryStegaRoot as g, initValRouteFromVal as i };
+export { isJsonValuesRecordSchema as a, getValRouteUrlFromVal as b, getJsonEntryStegaRoot as g, initValRouteFromVal as i };

package/dist/typeof-16428c61.cjs.prod.js

@@ -0,0 +1,13 @@
+'use strict';
+
+function _typeof(o) {
+  "@babel/helpers - typeof";
+
+  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
+    return typeof o;
+  } : function (o) {
+    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+  }, _typeof(o);
+}
+
+exports._typeof = _typeof;

package/dist/typeof-a1531d8f.esm.js

@@ -0,0 +1,11 @@
+function _typeof(o) {
+  "@babel/helpers - typeof";
+
+  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
+    return typeof o;
+  } : function (o) {
+    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+  }, _typeof(o);
+}
+
+export { _typeof as _ };

package/dist/typeof-b568f48f.cjs.dev.js

@@ -0,0 +1,13 @@
+'use strict';
+
+function _typeof(o) {
+  "@babel/helpers - typeof";
+
+  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
+    return typeof o;
+  } : function (o) {
+    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+  }, _typeof(o);
+}
+
+exports._typeof = _typeof;

package/package.json

@@ -12,7 +12,7 @@
     "next",
     "react"
   ],
-  "version": "0.116.0",
+  "version": "0.117.1",
   "main": "dist/valbuild-next.cjs.js",
   "module": "dist/valbuild-next.esm.js",
   "exports": {
@@ -47,12 +47,12 @@
   "dependencies": {
     "client-only": "^0.0.1",
     "server-only": "^0.0.1",
-    "@valbuild/core": "0.111.0",
-    "@valbuild/language-server": "0.116.0",
-    "@valbuild/react": "0.116.0",
-    "@valbuild/server": "0.116.0",
-    "@valbuild/shared": "0.116.0",
-    "@valbuild/ui": "0.116.0"
+    "@valbuild/core": "0.117.0",
+    "@valbuild/language-server": "0.117.1",
+    "@valbuild/react": "0.117.1",
+    "@valbuild/server": "0.117.1",
+    "@valbuild/ui": "0.117.1",
+    "@valbuild/shared": "0.117.0"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.3",
@@ -73,6 +73,7 @@
     "next"
   ],
   "files": [
+    "CHANGELOG.md",
     "dist",
     "client",
     "server",

package/rsc/dist/valbuild-next-rsc.cjs.dev.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 require('server-only');
-var routeFromVal = require('../../dist/routeFromVal-b48a454a.cjs.dev.js');
+var _typeof = require('../../dist/typeof-b568f48f.cjs.dev.js');
 var objectSpread2 = require('../../dist/objectSpread2-58024783.cjs.dev.js');
 var version = require('../../dist/version-c311d818.cjs.dev.js');
 var defineProperty = require('../../dist/defineProperty-f90345d7.cjs.dev.js');
@@ -11,6 +11,7 @@ var stega = require('@valbuild/react/stega');
 var core = require('@valbuild/core');
 var internal = require('@valbuild/shared/internal');
 var server = require('@valbuild/server');
+var routeFromVal = require('../../dist/routeFromVal-7df20dfe.cjs.dev.js');
 require('../../dist/createForOfIteratorHelper-0445603c.cjs.dev.js');
 require('../../dist/unsupportedIterableToArray-c8ab77c9.cjs.dev.js');
 require('../../dist/slicedToArray-44036a76.cjs.dev.js');
@@ -306,7 +307,7 @@ function _loadJsonEntryContent() {
     return version._regenerator().w(function (_context17) {
       while (1) switch (_context17.n) {
         case 0:
-          if (!(!source || routeFromVal._typeof(source) !== "object")) {
+          if (!(!source || _typeof._typeof(source) !== "object")) {
             _context17.n = 1;
             break;
           }

package/rsc/dist/valbuild-next-rsc.cjs.prod.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 require('server-only');
-var routeFromVal = require('../../dist/routeFromVal-8ac2f984.cjs.prod.js');
+var _typeof = require('../../dist/typeof-16428c61.cjs.prod.js');
 var objectSpread2 = require('../../dist/objectSpread2-13f847a9.cjs.prod.js');
 var version = require('../../dist/version-0e6da9a7.cjs.prod.js');
 var defineProperty = require('../../dist/defineProperty-8951f469.cjs.prod.js');
@@ -11,6 +11,7 @@ var stega = require('@valbuild/react/stega');
 var core = require('@valbuild/core');
 var internal = require('@valbuild/shared/internal');
 var server = require('@valbuild/server');
+var routeFromVal = require('../../dist/routeFromVal-8032f5f7.cjs.prod.js');
 require('../../dist/createForOfIteratorHelper-d4afcad8.cjs.prod.js');
 require('../../dist/unsupportedIterableToArray-0d2087a2.cjs.prod.js');
 require('../../dist/slicedToArray-ce613de6.cjs.prod.js');
@@ -306,7 +307,7 @@ function _loadJsonEntryContent() {
     return version._regenerator().w(function (_context17) {
       while (1) switch (_context17.n) {
         case 0:
-          if (!(!source || routeFromVal._typeof(source) !== "object")) {
+          if (!(!source || _typeof._typeof(source) !== "object")) {
             _context17.n = 1;
             break;
           }

package/rsc/dist/valbuild-next-rsc.esm.js

@@ -1,5 +1,5 @@
 import 'server-only';
-import { i as initValRouteFromVal, g as getJsonEntryStegaRoot, a as isJsonValuesRecordSchema, b as getValRouteUrlFromVal, _ as _typeof } from '../../dist/routeFromVal-263eec96.esm.js';
+import { _ as _typeof } from '../../dist/typeof-a1531d8f.esm.js';
 import { _ as _objectSpread2 } from '../../dist/objectSpread2-60d1bd93.esm.js';
 import { _ as _asyncToGenerator, V as VERSION, a as _regenerator } from '../../dist/version-4d7b692c.esm.js';
 import { _ as _defineProperty } from '../../dist/defineProperty-cca5affa.esm.js';
@@ -7,6 +7,7 @@ import { SET_RSC, stegaEncode, SET_AUTO_TAG_JSX_ENABLED } from '@valbuild/react/
 import { Internal } from '@valbuild/core';
 import { VAL_SESSION_COOKIE } from '@valbuild/shared/internal';
 import { createValServer } from '@valbuild/server';
+import { i as initValRouteFromVal, g as getJsonEntryStegaRoot, a as isJsonValuesRecordSchema, b as getValRouteUrlFromVal } from '../../dist/routeFromVal-bd69625f.esm.js';
 import '../../dist/createForOfIteratorHelper-5758a730.esm.js';
 import '../../dist/unsupportedIterableToArray-5baabfdc.esm.js';
 import '../../dist/slicedToArray-aa291011.esm.js';