@valbuild/next 0.119.0 → 0.120.2

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # @valbuild/next
 
+## 0.120.2
+
+### Patch Changes
+
+- [#593](https://github.com/valbuild/val/pull/593) [`095ee0d`](https://github.com/valbuild/val/commit/095ee0dd011b069c30bc99ae58356e28796e106b) Thanks [@freekh](https://github.com/freekh)! - Publish the packages that 0.120.1 did not reach.
+
+  `@valbuild/server@0.120.1` made it to npm, but `@valbuild/cli`,
+  `@valbuild/language-server` and `@valbuild/next` did not — the release job
+  failed part-way through, and the version numbers it had already claimed could
+  not be reused. This release carries the same contents for those three packages:
+  they pick up the MCP signing-key rotation fix from `@valbuild/server@0.120.1`,
+  and there is nothing else in it.
+
+  If you are on 0.120.0, upgrade straight to this version. There is no 0.120.1 of
+  these three packages, and there will not be one.
+
+- Updated dependencies [[`095ee0d`](https://github.com/valbuild/val/commit/095ee0dd011b069c30bc99ae58356e28796e106b)]:
+  - @valbuild/language-server@0.120.2
+
+## 0.120.1
+
+### Patch Changes
+
+- [#590](https://github.com/valbuild/val/pull/590) [`6f318d4`](https://github.com/valbuild/val/commit/6f318d406295b772e721bf463283f47e2822e996) Thanks [@freekh](https://github.com/freekh)! - MCP: survive a signing-key rotation, and say what a refused local token means.
+
+  `@valbuild/next` caches the authorization server's JWKS for five minutes. Until
+  now a token signed with a key that arrived inside that window was refused
+  outright, so every warm instance rejected valid tokens until the cache expired —
+  a rotation on the issuer's side showed up as an outage on yours.
+
+  A token naming a key the cache does not hold now provokes one refetch of the key
+  set, at most once per issuer every 30 seconds. The rate limit matters because the
+  key id comes from the token: without it, unknown key ids would be a way to make
+  your app call its issuer once per request. It limits how often a fetch is
+  _started_, so requests that arrive while one is already running join it — which
+  is the normal shape of a rotation, where many requests meet the new key at once.
+
+  Separately, an MCP call that presents an access token to a project running in
+  local filesystem mode is still refused — there is nothing to authenticate against
+  — but the message now names the cause, which is that the project has an `oauth`
+  issuer configured (often `VAL_OAUTH_ISSUER` in a local `.env`) and should not
+  have one for local development.
+
+- Updated dependencies [[`6f318d4`](https://github.com/valbuild/val/commit/6f318d406295b772e721bf463283f47e2822e996)]:
+  - @valbuild/server@0.120.1
+  - @valbuild/language-server@0.120.1
+
+## 0.120.0
+
+### Minor Changes
+
+- [#589](https://github.com/valbuild/val/pull/589) [`c2d3c0e`](https://github.com/valbuild/val/commit/c2d3c0e6c2010c0a94c725d9dbaa618998773e8a) Thanks [@freekh](https://github.com/freekh)! - **Breaking:** `s.richtext()` options are flat.
+
+  The `style`, `block` and `inline` groups are gone — every option is a key of its
+  own. The names are unchanged, so updating a schema is only a matter of removing
+  the wrappers:
+
+  ```ts
+  // before
+  s.richtext({
+    style: { bold: true, italic: true },
+    block: { h1: true, ul: true },
+    inline: { a: true, img: s.image() },
+  });
+
+  // after
+  s.richtext({
+    bold: true,
+    italic: true,
+    h1: true,
+    ul: true,
+    a: true,
+    img: s.image(),
+  });
+  ```
+
+  The groups never carried any meaning the option names did not already have, and
+  they cost something real: an option name and its `ValRichText` theme key were
+  spelled differently (`block.h1` vs `theme.h1`), so the type that keeps a theme
+  exhaustive had to restate all thirteen options by hand. It is now a mapped type
+  over the options themselves — which also fixes an inconsistency in it: enabling
+  links with a schema (`a: s.route()`) rather than `a: true` now requires an `a`
+  key in the theme, the way `img` always has.
+
+  `ValRichText` themes were already flat and are unchanged. The serialized schema
+  that the server sends the Studio is flat too, so a project must not mix
+  `@valbuild/*` versions across this release.
+
+### Patch Changes
+
+- Updated dependencies [[`c2d3c0e`](https://github.com/valbuild/val/commit/c2d3c0e6c2010c0a94c725d9dbaa618998773e8a)]:
+  - @valbuild/core@0.120.0
+  - @valbuild/react@0.120.0
+  - @valbuild/shared@0.120.0
+  - @valbuild/ui@0.120.0
+  - @valbuild/language-server@0.120.0
+  - @valbuild/server@0.120.0
+
 ## 0.119.0
 
 ### Patch Changes

package/README.md

@@ -662,27 +662,21 @@ import { s, c } from "./val.config";
 
 export const schema = s.richtext({
   // styling
-  style: {
-    bold: true, // enables bold
-    italic: true, // enables italic text
-    lineThrough: true, // enables line/strike-through
-  },
+  bold: true, // enables bold
+  italic: true, // enables italic text
+  lineThrough: true, // enables line/strike-through
   // tags:
-  block: {
-    //ul: true, // enables unordered lists
-    //ol: true, // enables ordered lists
-    // headings:
-    h1: true,
-    h2: true,
-    // h3: true,
-    // h4: true,
-    // h5: true,
-    // h6: true
-  },
-  inline: {
-    //a: true, // enables links
-    //img: true, // enables images
-  },
+  //ul: true, // enables unordered lists
+  //ol: true, // enables ordered lists
+  // headings:
+  h1: true,
+  h2: true,
+  // h3: true,
+  // h4: true,
+  // h5: true,
+  // h6: true,
+  //a: true, // enables links
+  //img: true, // enables images
 });
 
 export default c.define("/src/app/content", schema, [
@@ -713,9 +707,7 @@ export default function Page() {
     <main>
       <ValRichText
         theme={{
-          style: {
-            bold: "font-bold", // <- maps bold to a class. NOTE: tailwind classes are supported
-          },
+          bold: "font-bold", // <- maps bold to a class. NOTE: tailwind classes are supported
           //
         }}
         content={content}
@@ -739,7 +731,7 @@ To add classes to `ValRichText` you can use the theme property:
 />
 ```
 
-**NOTE**: if a theme is defined, you must define a mapping for every tag that the you get. What tags you have is decided based on the `options` defined on the `s.richtext()` schema. For example: `s.richtext({ style: { bold: true } })` requires that you add a `bold` theme.
+**NOTE**: if a theme is defined, you must define a mapping for every tag you can get. What tags you have is decided based on the `options` defined on the `s.richtext()` schema. For example: `s.richtext({ bold: true })` requires that you add a `bold` theme.
 
 ```tsx
 <ValRichText

package/dist/declarations/src/server/valAccessToken.d.ts

@@ -31,6 +31,10 @@ import { type ValToolAuth } from "@valbuild/server";
  * - **Nothing is read from the payload before the signature verifies.** Claims
  *   from an unverified token are attacker input.
  * - **Keys come only from the configured issuer's JWKS**, never from the token.
+ *   The key set is cached, but a token naming a `kid` the cache does not hold
+ *   provokes one rate-limited refetch rather than a refusal — see
+ *   {@link UNKNOWN_KID_REFETCH_INTERVAL_MS}. Without that, this server's own
+ *   cache turns any key rotation into an outage lasting the rest of the TTL.
  * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
  *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
  *   is rejected — or worse, a future change makes it accept the wrong thing.

package/package.json

@@ -12,7 +12,7 @@
     "next",
     "react"
   ],
-  "version": "0.119.0",
+  "version": "0.120.2",
   "main": "dist/valbuild-next.cjs.js",
   "module": "dist/valbuild-next.esm.js",
   "exports": {
@@ -47,12 +47,12 @@
   "dependencies": {
     "client-only": "^0.0.1",
     "server-only": "^0.0.1",
-    "@valbuild/core": "0.117.0",
-    "@valbuild/react": "0.119.0",
-    "@valbuild/server": "0.119.0",
-    "@valbuild/ui": "0.119.0",
-    "@valbuild/shared": "0.118.0",
-    "@valbuild/language-server": "0.119.0"
+    "@valbuild/language-server": "0.120.2",
+    "@valbuild/core": "0.120.0",
+    "@valbuild/react": "0.120.0",
+    "@valbuild/server": "0.120.1",
+    "@valbuild/shared": "0.120.0",
+    "@valbuild/ui": "0.120.0"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.3",