@valbuild/next 0.122.0 → 0.123.0

package/dist/declarations/src/server/valAccessToken.d.ts

@@ -1,93 +0,0 @@
-import { type ValToolAuth } from "@valbuild/server";
-/**
- * Verifying an OAuth access token, which is the whole of what makes this app a
- * resource server rather than a relay.
- *
- * The token is issued by Val's authorization server and presented by an MCP
- * client. This app holds no signing key for it and cannot mint one — it fetches
- * the issuer's *public* keys and checks a signature. That asymmetry is the
- * point: a verified `sub` is a fact about the token rather than a claim by
- * whoever sent it, which is what lets the tools attribute a patch to that
- * profile at all.
- *
- * ## Why this is not `jose`
- *
- * `jose` was the first choice and was rejected on a fact rather than a
- * preference: version 6 is ESM-only (`"type": "module"`, no CJS export). This
- * package is built by preconstruct and `require`d by Next.js server code, so an
- * ESM-only dependency here is a runtime failure in consumers' apps, not a build
- * inconvenience. Adding it would also put a dependency in every install of
- * `@valbuild/next` for one function.
- *
- * The actual cryptography is still not hand-rolled — `node:crypto` does the
- * ECDSA and the JWK import. What is written here is the JWS envelope and the
- * claim checks, and the rules that keep that safe are worth stating because
- * this repository has already shipped the counterexample (`decodeJwt`: `exp`
- * never checked, a non-constant-time compare, verification skippable):
- *
- * - **`alg` is pinned**, not read from the token. The header is only consulted
- *   for `kid`. A verifier that honours the token's own `alg` can be handed
- *   `HS256` and will treat the *published* public key as a shared secret.
- * - **Nothing is read from the payload before the signature verifies.** Claims
- *   from an unverified token are attacker input.
- * - **Keys come only from the configured issuer's JWKS**, never from the token.
- *   The key set is cached, but a token naming a `kid` the cache does not hold
- *   provokes one rate-limited refetch rather than a refusal — see
- *   {@link UNKNOWN_KID_REFETCH_INTERVAL_MS}. Without that, this server's own
- *   cache turns any key rotation into an outage lasting the rest of the TTL.
- * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
- *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
- *   is rejected — or worse, a future change makes it accept the wrong thing.
- */
-export type ValOAuthConfig = {
-    /**
-     * The authorization server, and therefore the expected `iss`.
-     *
-     * Also where the JWKS is fetched from, so it is the one value that decides
-     * which keys can produce a token this app accepts. Configuration, never
-     * request input — a request that could name its own issuer could name its own
-     * key.
-     */
-    issuer: string;
-    /**
-     * This endpoint's absolute URL, and therefore the expected `aud` (RFC 8707).
-     *
-     * Audience binding is what stops a token minted for one Val site being
-     * replayed against another: without it, any deployment the user has access to
-     * would accept a token issued for any other.
-     */
-    resource: string;
-    /**
-     * Clock skew allowance, in seconds.
-     *
-     * Servers disagree about the time by more than you would like, and a token
-     * refused for being a second early is indistinguishable, to the person using
-     * it, from a broken login.
-     */
-    clockToleranceSeconds?: number;
-    /** Test seam. Defaults to the global `fetch`. */
-    fetchImpl?: typeof fetch;
-};
-export type ValAccessTokenResult = {
-    status: "ok";
-    auth: Extract<ValToolAuth, {
-        type: "verified-profile";
-    }>;
-} | {
-    status: "refused";
-    /** For the `WWW-Authenticate` challenge: RFC 6750 section 3.1. */
-    error: "invalid_request" | "invalid_token" | "insufficient_scope";
-    description: string;
-};
-/** Test seam: a fresh process would have an empty cache anyway. */
-export declare function clearValAccessTokenCache(): void;
-/**
- * Read `Authorization: Bearer …`.
- *
- * Exported because the refusal needs to know whether a token was presented at
- * all: RFC 6750 distinguishes "no credential" — a bare `401`, which is an
- * invitation to authenticate — from "a bad credential", and a client that gets
- * the second when it deserved the first will not start the authorization flow.
- */
-export declare function readBearerToken(request: Request): string | null;
-export declare function verifyValAccessToken(request: Request, config: ValOAuthConfig): Promise<ValAccessTokenResult>;

package/dist/declarations/src/server/valMcpMetadata.d.ts

@@ -1,47 +0,0 @@
-import type { ValOAuthConfig } from "./valAccessToken.js";
-/**
- * The one document an MCP client needs before it can authorize: RFC 9728
- * Protected Resource Metadata, served by the *resource* server.
- *
- * This is how a client discovers where to authorize. It asks the resource — this
- * app — and the resource names its authorization server. Which is why this
- * belongs here and the RFC 8414 *authorization server* metadata does not: that
- * document lives at the issuer, describes the issuer's own endpoints, and is
- * served by the issuer. An app serving a copy would be asserting the issuer's
- * configuration on its behalf, and would be wrong the moment the issuer changed
- * anything.
- *
- * The flow, so the split reads as a whole:
- *
- * 1. client → `{app}/api/mcp` with no token → `401` naming this document
- * 2. client → `{app}/.well-known/oauth-protected-resource` → the issuer
- * 3. client → `{issuer}/.well-known/oauth-authorization-server` → endpoints
- * 4. client → issuer's `/authorize`, then `/token`
- * 5. client → `{app}/api/mcp` with the token
- */
-export type ValMcpMetadataHandlers = {
-    /** The metadata document. */
-    GET: (request: Request) => Response;
-    /**
-     * The CORS preflight.
-     *
-     * Required rather than defensive: the metadata document is fetched
-     * cross-origin by browser-based clients, and without a preflight answer the
-     * fetch fails before the document is read — which presents as "this connector
-     * cannot authorize" with nothing in any log to explain it.
-     */
-    OPTIONS: (request: Request) => Response;
-};
-export declare function createValMcpMetadata(oauth: ValOAuthConfig, scopesSupported: string[]): ValMcpMetadataHandlers;
-/**
- * The `WWW-Authenticate` value for a refusal (RFC 6750 section 3, RFC 9728
- * section 5.1).
- *
- * `resource_metadata` is the load-bearing parameter: it is how a client that has
- * never seen this server learns where to authorize. A `401` without it is a dead
- * end — the client knows it needs a token and has no way to find out from where.
- */
-export declare function wwwAuthenticate(oauth: ValOAuthConfig, scopesSupported: string[], refusal?: {
-    error: string;
-    description: string;
-}): string;

package/dist/typeof-16428c61.cjs.prod.js

@@ -1,13 +0,0 @@
-'use strict';
-
-function _typeof(o) {
-  "@babel/helpers - typeof";
-
-  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
-    return typeof o;
-  } : function (o) {
-    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-  }, _typeof(o);
-}
-
-exports._typeof = _typeof;

package/dist/typeof-a1531d8f.esm.js

@@ -1,11 +0,0 @@
-function _typeof(o) {
-  "@babel/helpers - typeof";
-
-  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
-    return typeof o;
-  } : function (o) {
-    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-  }, _typeof(o);
-}
-
-export { _typeof as _ };

package/dist/typeof-b568f48f.cjs.dev.js

@@ -1,13 +0,0 @@
-'use strict';
-
-function _typeof(o) {
-  "@babel/helpers - typeof";
-
-  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
-    return typeof o;
-  } : function (o) {
-    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-  }, _typeof(o);
-}
-
-exports._typeof = _typeof;