@vercel/oidc 4.0.0 → 4.0.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @vercel/oidc
 
+## 4.0.2
+
+### Patch Changes
+
+- Updated dependencies [637c7b9]
+  - @vercel/cli-config@0.3.2
+
+## 4.0.1
+
+### Patch Changes
+
+- d032cfb: Add experimental Connect event delivery authentication scoped to project, environment, registered path, preview branch and delivery purpose, with envelope schema validation. Distinguish OIDC identity failures from temporary signing-key outages.
+
+  Preserve optional MCP event metadata and opaque cursors within the total delivery body limit.
+
 ## 4.0.0
 
 ### Major Changes

package/dist/verify-vercel-oidc-token.js

@@ -28,6 +28,13 @@ const VERCEL_OIDC_JWKS_URL = new URL(
 );
 const DEFAULT_ALGORITHMS = ["RS256"];
 const VERCEL_OIDC_JWKS = (0, import_jose.createRemoteJWKSet)(VERCEL_OIDC_JWKS_URL);
+class VercelOidcTokenValidationError extends TypeError {
+  constructor(message) {
+    super(message);
+    this.code = "ERR_VERCEL_OIDC_TOKEN_VALIDATION";
+    this.name = "VercelOidcTokenValidationError";
+  }
+}
 async function verifyVercelOidcToken(token, options) {
   const {
     algorithms,
@@ -72,7 +79,7 @@ function hasAudienceVerification(audience) {
 }
 function validateIssuer(actual) {
   if (actual !== VERCEL_OIDC_ISSUER && (typeof actual !== "string" || !actual.startsWith(`${VERCEL_OIDC_ISSUER}/`))) {
-    throw new TypeError(
+    throw new VercelOidcTokenValidationError(
       `Expected Vercel OIDC token iss claim to be "${VERCEL_OIDC_ISSUER}" or to start with "${VERCEL_OIDC_ISSUER}/".`
     );
   }
@@ -96,7 +103,7 @@ function validateClaim({
     return;
   }
   if (actual !== expected) {
-    throw new TypeError(
+    throw new VercelOidcTokenValidationError(
       Array.isArray(expected) ? `Expected Vercel OIDC token ${claim} claim to be one of: ${expected.map((value) => `"${value}"`).join(", ")}.` : `Expected Vercel OIDC token ${claim} claim to be "${expected}".`
     );
   }
@@ -110,7 +117,7 @@ function validateOptionalClaim({
     return;
   }
   if (actual !== expected) {
-    throw new TypeError(
+    throw new VercelOidcTokenValidationError(
       `Expected Vercel OIDC token ${claim} claim to be "${expected}".`
     );
   }

package/dist/verify-vercel-oidc-token.test.js

@@ -227,6 +227,17 @@ import_vitest.vi.mock("jose", () => ({
       "Expected VERCEL_PROJECT_ID to be set or projectId to be provided. Pass projectId: '*' to allow any project_id claim."
     );
   });
+  (0, import_vitest.test)("distinguishes token identity failures from signing-key outages", async () => {
+    mockVerifiedPayload({ project_id: "prj_other" });
+    const failure = (0, import_verify_vercel_oidc_token.verifyVercelOidcToken)("token");
+    await (0, import_vitest.expect)(failure).rejects.toBeInstanceOf(TypeError);
+    await (0, import_vitest.expect)(failure).rejects.toMatchObject({
+      code: "ERR_VERCEL_OIDC_TOKEN_VALIDATION"
+    });
+    const outage = new TypeError("fetch failed");
+    import_vitest.vi.mocked(import_jose.jwtVerify).mockRejectedValueOnce(outage);
+    await (0, import_vitest.expect)((0, import_verify_vercel_oidc_token.verifyVercelOidcToken)("token")).rejects.toBe(outage);
+  });
   (0, import_vitest.test)("rejects a token from a different owner", async () => {
     mockVerifiedPayload({
       owner_id: "team_other"

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const version = "4.0.0";
+export declare const version = "4.0.2";

package/dist/version.js

@@ -21,7 +21,7 @@ __export(version_exports, {
   version: () => version
 });
 module.exports = __toCommonJS(version_exports);
-const version = "4.0.0";
+const version = "4.0.2";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   version

package/docs/functions/verifyVercelOidcToken.md

@@ -6,7 +6,7 @@
 
 > **verifyVercelOidcToken**\<`PayloadType`\>(`token`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`JWTVerifyResult`\<`PayloadType`\>\>
 
-Defined in: [packages/oidc/src/verify-vercel-oidc-token.ts:53](https://github.com/vercel/vercel/blob/main/packages/oidc/src/verify-vercel-oidc-token.ts#L53)
+Defined in: [packages/oidc/src/verify-vercel-oidc-token.ts:63](https://github.com/vercel/vercel/blob/main/packages/oidc/src/verify-vercel-oidc-token.ts#L63)
 
 Verifies a Vercel OIDC token against Vercel's remote JWKS.
 

package/docs/type-aliases/VercelOidcPayload.md

@@ -6,7 +6,7 @@
 
 > **VercelOidcPayload** = `JWTPayload` & `object`
 
-Defined in: [packages/oidc/src/verify-vercel-oidc-token.ts:16](https://github.com/vercel/vercel/blob/main/packages/oidc/src/verify-vercel-oidc-token.ts#L16)
+Defined in: [packages/oidc/src/verify-vercel-oidc-token.ts:26](https://github.com/vercel/vercel/blob/main/packages/oidc/src/verify-vercel-oidc-token.ts#L26)
 
 ## Type Declaration
 

package/package.json

@@ -18,7 +18,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "4.0.0",
+  "version": "4.0.2",
   "repository": {
     "directory": "packages/oidc",
     "type": "git",
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "jose": "^5.9.6",
-    "@vercel/cli-config": "0.3.1",
+    "@vercel/cli-config": "0.3.2",
     "@vercel/cli-exec": "1.0.1"
   },
   "devDependencies": {