@valbuild/mcp 0.123.0

package/dist/valbuild-mcp.esm.js

@@ -0,0 +1,4381 @@
+import { _ as _asyncToGenerator, a as _regenerator } from './asyncToGenerator-500f022f.esm.js';
+import { z } from 'zod';
+import { createValOps, getSettings, resolveRemoteFileAuth, getFileExt, initHandlerOptions } from '@valbuild/server';
+import { Internal, getSourcePathFromRoute, DEFAULT_VAL_REMOTE_HOST } from '@valbuild/core';
+import { performSearch, createSearchIndex, indexModule, filterBlockingValidationErrors, describeContainerAtPath, safeParsePatch, buildDuplicatePatch, buildEmptyAtPathPatch, buildRemoveImageGalleryEntryPatch, resolveEncodeSettings, resolveSerializedSchemaAtPath, withExtension, fitWithin, isSkippedSource, ENCODE_MIME_TYPE_OF, isMimeTypeAccepted, chooseEncoded, buildImageGalleryPatch } from '@valbuild/shared/internal';
+import { minimatch } from 'minimatch';
+import { randomUUID, createPublicKey, verify } from 'node:crypto';
+import { JSONOps, applyPatch, deepClone } from '@valbuild/core/patch';
+import { result } from '@valbuild/core/fp';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+function _arrayWithHoles(r) {
+  if (Array.isArray(r)) return r;
+}
+
+function _iterableToArrayLimit(r, l) {
+  var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"];
+  if (null != t) {
+    var e,
+      n,
+      i,
+      u,
+      a = [],
+      f = !0,
+      o = !1;
+    try {
+      if (i = (t = t.call(r)).next, 0 === l) {
+        if (Object(t) !== t) return;
+        f = !1;
+      } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0);
+    } catch (r) {
+      o = !0, n = r;
+    } finally {
+      try {
+        if (!f && null != t.return && (u = t.return(), Object(u) !== u)) return;
+      } finally {
+        if (o) throw n;
+      }
+    }
+    return a;
+  }
+}
+
+function _arrayLikeToArray(r, a) {
+  (null == a || a > r.length) && (a = r.length);
+  for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
+  return n;
+}
+
+function _unsupportedIterableToArray(r, a) {
+  if (r) {
+    if ("string" == typeof r) return _arrayLikeToArray(r, a);
+    var t = {}.toString.call(r).slice(8, -1);
+    return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0;
+  }
+}
+
+function _nonIterableRest() {
+  throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+
+function _slicedToArray(r, e) {
+  return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest();
+}
+
+function _toPrimitive(t, r) {
+  if ("object" != typeof t || !t) return t;
+  var e = t[Symbol.toPrimitive];
+  if (void 0 !== e) {
+    var i = e.call(t, r || "default");
+    if ("object" != typeof i) return i;
+    throw new TypeError("@@toPrimitive must return a primitive value.");
+  }
+  return ("string" === r ? String : Number)(t);
+}
+
+function _toPropertyKey(t) {
+  var i = _toPrimitive(t, "string");
+  return "symbol" == typeof i ? i : i + "";
+}
+
+function _defineProperty(e, r, t) {
+  return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
+    value: t,
+    enumerable: !0,
+    configurable: !0,
+    writable: !0
+  }) : e[r] = t, e;
+}
+
+function ownKeys(e, r) {
+  var t = Object.keys(e);
+  if (Object.getOwnPropertySymbols) {
+    var o = Object.getOwnPropertySymbols(e);
+    r && (o = o.filter(function (r) {
+      return Object.getOwnPropertyDescriptor(e, r).enumerable;
+    })), t.push.apply(t, o);
+  }
+  return t;
+}
+function _objectSpread2(e) {
+  for (var r = 1; r < arguments.length; r++) {
+    var t = null != arguments[r] ? arguments[r] : {};
+    r % 2 ? ownKeys(Object(t), !0).forEach(function (r) {
+      _defineProperty(e, r, t[r]);
+    }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) {
+      Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r));
+    });
+  }
+  return e;
+}
+
+function _objectWithoutPropertiesLoose(r, e) {
+  if (null == r) return {};
+  var t = {};
+  for (var n in r) if ({}.hasOwnProperty.call(r, n)) {
+    if (-1 !== e.indexOf(n)) continue;
+    t[n] = r[n];
+  }
+  return t;
+}
+
+function _objectWithoutProperties(e, t) {
+  if (null == e) return {};
+  var o,
+    r,
+    i = _objectWithoutPropertiesLoose(e, t);
+  if (Object.getOwnPropertySymbols) {
+    var n = Object.getOwnPropertySymbols(e);
+    for (r = 0; r < n.length; r++) o = n[r], -1 === t.indexOf(o) && {}.propertyIsEnumerable.call(e, o) && (i[o] = e[o]);
+  }
+  return i;
+}
+
+function _createForOfIteratorHelper(r, e) {
+  var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"];
+  if (!t) {
+    if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) {
+      t && (r = t);
+      var n = 0,
+        F = function () {};
+      return {
+        s: F,
+        n: function () {
+          return n >= r.length ? {
+            done: !0
+          } : {
+            done: !1,
+            value: r[n++]
+          };
+        },
+        e: function (r) {
+          throw r;
+        },
+        f: F
+      };
+    }
+    throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+  }
+  var o,
+    a = !0,
+    u = !1;
+  return {
+    s: function () {
+      t = t.call(r);
+    },
+    n: function () {
+      var r = t.next();
+      return a = r.done, r;
+    },
+    e: function (r) {
+      u = !0, o = r;
+    },
+    f: function () {
+      try {
+        a || null == t.return || t.return();
+      } finally {
+        if (u) throw o;
+      }
+    }
+  };
+}
+
+function _arrayWithoutHoles(r) {
+  if (Array.isArray(r)) return _arrayLikeToArray(r);
+}
+
+function _iterableToArray(r) {
+  if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r);
+}
+
+function _nonIterableSpread() {
+  throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+
+function _toConsumableArray(r) {
+  return _arrayWithoutHoles(r) || _iterableToArray(r) || _unsupportedIterableToArray(r) || _nonIterableSpread();
+}
+
+function _typeof(o) {
+  "@babel/helpers - typeof";
+
+  return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
+    return typeof o;
+  } : function (o) {
+    return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+  }, _typeof(o);
+}
+
+/**
+ * How a tool is written, and what it is handed.
+ *
+ * Tools are defined with {@link defineTool} so that the handler's `args` are
+ * inferred from the tool's own `inputSchema`. Without that the array of tools
+ * would have to be typed at its widest and every handler would start by
+ * re-narrowing `unknown`, which is exactly where a tool and its schema drift
+ * apart unnoticed.
+ */
+
+/** Everything a tool is allowed to reach. Deliberately narrow. */
+
+/**
+ * Declare a tool, binding its handler to its input schema.
+ *
+ * The handler receives already-parsed arguments: the registry validates against
+ * `inputSchema` before calling, so a handler never sees input its schema would
+ * have rejected.
+ */
+function defineTool(definition, _handler) {
+  return _objectSpread2(_objectSpread2({}, definition), {}, {
+    handler: function handler(args, deps) {
+      return _handler(args, deps);
+    }
+  });
+}
+function ok(data) {
+  return {
+    status: "ok",
+    data: data
+  };
+}
+function err(code, message) {
+  return {
+    status: "error",
+    code: code,
+    message: message
+  };
+}
+
+/**
+ * Full-text search across a project's content, built fresh on every call.
+ *
+ * No index lifecycle, which `docs/plans/mcp.md` listed as the reason this tool
+ * was deferred. It turned out not to be needed, and the measurement is the
+ * argument — indexing `valbuild/web`, a real production site:
+ *
+ * ```
+ *  20 modules,   206 KB of source JSON   →  162 ms
+ * 200 modules,  2.0 MB (the same, x10)   →  1.4 s
+ * 1000 modules, 10 MB  (the same, x50)   →  7.9 s
+ * ```
+ *
+ * (node 22, 4-cpu container. Searching the built index is another 0.2 ms, which
+ * is why none of the numbers below are about searching.)
+ *
+ * Two things follow. Indexing is **linear and cheap** — a real project is a
+ * sixth of a second, and the 10 s default deadline is not reached until roughly
+ * 13 MB of content, which is far past any Val project anyone has. And loading
+ * the modules costs *more* than indexing them (843 ms for those same 20), which
+ * every tool call already pays in `loadState` — so search adds a fraction on top
+ * of a cost that is already sunk, rather than being the expensive thing it looks
+ * like.
+ *
+ * That ratio between building the index and querying it — 162 ms against
+ * 0.2 ms — is also why the tool takes a LIST of queries rather than one.
+ * Everything expensive about a call happens before the first query runs, so a
+ * second query against the same index is free next to a second call, which pays
+ * for the load and the build again. An agent exploring content asks several
+ * near-identical things, because the whole point of searching is not knowing
+ * which word the content uses; batching them turns five calls into one.
+ *
+ * It is also the wrong comparison that matters: the alternative is `get_source`
+ * on every module so the model can read them itself, which moves the whole
+ * corpus through the context window. This moves a handful of queries in and a
+ * page of hits back for each.
+ */
+
+/** Low on purpose. See the numbers above: reaching it means something is wrong. */
+var DEFAULT_TIMEOUT_MS = 10000;
+var MAX_TIMEOUT_MS = 120000;
+
+/**
+ * Hits per query, and high because the expensive work is already done by the
+ * time any of them is counted.
+ *
+ * A page-sized default made sense when the answer was a screen for a person to
+ * scroll. It is a model reading this, and it can filter a long list far more
+ * cheaply than it can ask again — a low default just buys a second call for
+ * content it was going to look at anyway.
+ */
+var DEFAULT_LIMIT = 100;
+var MAX_LIMIT = 500;
+
+/**
+ * Queries per call.
+ *
+ * Not a cost bound — the index is built either way and each query is
+ * sub-millisecond. It bounds the RESPONSE, which is `queries x limit` hits at
+ * worst and is the only part of this that reaches a context window.
+ */
+var MAX_QUERIES = 20;
+
+/** How many omitted module paths to name before summarising the rest. */
+var MAX_NAMED_OMISSIONS = 20;
+var ModulePatternSchema = z.array(z.string()).optional().describe('Module file path globs, e.g. ["/content/blogs/**"]. Matched against the whole module file path.');
+
+/**
+ * One query or several.
+ *
+ * A bare string is accepted because a caller that means one query will send one
+ * whatever the schema says, and refusing it teaches nothing. Normalised to a
+ * list here so the handler and the response have a single shape.
+ */
+var QueriesSchema = z.union([z.string(), z.array(z.string()).min(1).max(MAX_QUERIES)]).transform(function (queries) {
+  return typeof queries === "string" ? [queries] : queries;
+});
+function searchContentTool() {
+  return defineTool({
+    name: "search_content",
+    title: "Search content",
+    description: "Find content by text across the project's Val modules, with unpublished changes applied. Returns the source paths of matching values, which get_source reads. Pass every query you have in one call: the index is built per call and querying it is thousands of times cheaper than building it, so five queries cost about what one costs. Narrow with include/exclude when you know roughly where to look — that is also the fix if a search reports omitted modules.",
+    inputSchema: z.object({
+      queries: QueriesSchema.describe("The text to search for: one string, or up to ".concat(MAX_QUERIES, " of them answered in a single pass over the index. Matches are on word prefixes, so \"blog\" finds \"blogging\". Prefer several guesses in one call over one call per guess \u2014 the content may not use the word you would.")),
+      include: ModulePatternSchema.describe('Only search these modules, e.g. ["/content/blogs/**"]. Everything else is skipped and is NOT reported as omitted — omissions mean the deadline was hit, not that you excluded something.'),
+      exclude: ModulePatternSchema.describe("Skip these modules. Applied after include."),
+      limit: z.number()["int"]().min(1).max(MAX_LIMIT)["default"](DEFAULT_LIMIT).describe("Maximum hits to return PER QUERY, so a call returns up to queries x limit of them. Defaults to ".concat(DEFAULT_LIMIT, "; lower it when searching a common word across many queries at once.")),
+      offset: z.number()["int"]().min(0)["default"](0).describe("Number of hits to skip per query, for paging."),
+      timeoutMs: z.number()["int"]().min(100).max(MAX_TIMEOUT_MS)["default"](DEFAULT_TIMEOUT_MS).describe("How long to spend indexing before answering with what has been indexed so far. It bounds the indexing, which every query in the call shares — not the queries, which are free. The default is enough for any ordinary project; a search that reports omitted modules is better narrowed with include than given longer.")
+    }),
+    annotations: {
+      readOnlyHint: true,
+      idempotentHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(args, deps) {
+      var queries, selected, built;
+      return _regenerator().w(function (_context) {
+        while (1) switch (_context.n) {
+          case 0:
+            // First occurrence wins, so the answers stay in the order they were
+            // asked. A repeated query costs nothing to run and a duplicate page of
+            // hits to read, and every answer names its own query, so collapsing them
+            // loses nothing a caller can correlate by.
+            queries = _toConsumableArray(new Set(args.queries.map(function (query) {
+              return query.trim();
+            })));
+            if (!queries.some(function (query) {
+              return query === "";
+            })) {
+              _context.n = 1;
+              break;
+            }
+            return _context.a(2, err("invalid-args", "One of the queries is empty, so there is nothing to search for."));
+          case 1:
+            selected = selectModules(deps.state, args.include, args.exclude);
+            if (!(selected.length === 0)) {
+              _context.n = 2;
+              break;
+            }
+            return _context.a(2, err("not-found", args.include || args.exclude ? "No modules matched include/exclude. get_all_schema lists the module paths." : "This project has no Val modules to search."));
+          case 2:
+            built = buildWithDeadline(deps.state, selected, args.timeoutMs);
+            return _context.a(2, ok(_objectSpread2({
+              // Answered per query rather than merged, because which guess found the
+              // thing is most of why several were asked. One query gets a list of
+              // one: a response shape that changes with the arguments is a shape
+              // every caller has to branch on.
+              queries: queries.map(function (query) {
+                var found = performSearch(built.index, query, args.limit, args.offset);
+                return _objectSpread2({
+                  query: query,
+                  results: found.results.map(function (hit) {
+                    return {
+                      path: hit.path,
+                      // What the Studio would show for this hit, so an agent and an
+                      // editor are looking at the same thing.
+                      label: hit.label,
+                      moduleFilePath: moduleOf(hit.path)
+                    };
+                  }),
+                  // Matches for this query across the indexed modules, not the size
+                  // of the page above: it is how a caller knows whether narrowing or
+                  // paging is worth it.
+                  total: found.total
+                }, found.totalIsLowerBound ? {
+                  totalIsLowerBound: true
+                } : {});
+              }),
+              // What was actually searched, so the totals can be read for what they
+              // are: counts over these modules, not over the project.
+              searched: {
+                modules: built.indexedModules,
+                of: selected.length
+              },
+              // Present and empty rather than absent when nothing was dropped: a
+              // caller should not have to tell "no omissions" from "this tool does
+              // not report them".
+              omittedModules: built.omitted.slice(0, MAX_NAMED_OMISSIONS),
+              omittedModuleCount: built.omitted.length,
+              timedOut: built.timedOut
+            }, built.timedOut ? {
+              hint: "Indexing stopped after ".concat(args.timeoutMs, "ms with ").concat(built.omitted.length, " module(s) unread, so these results are partial \u2014 for every query in this call, including the ones that found plenty. Search again with include set to the modules you care about, or use count_entries to see which of the omitted ones are large.")
+            } : {})));
+        }
+      }, _callee);
+    }));
+    return function (_x, _x2) {
+      return _ref.apply(this, arguments);
+    };
+  }());
+}
+
+/**
+ * Which modules this search covers.
+ *
+ * Sorted, and that is load bearing rather than tidiness: indexing stops at a
+ * deadline, so the ORDER decides what a partial answer contains. A stable order
+ * means the same call twice gives the same partial answer, and that narrowing
+ * with `include` predictably reaches what was dropped. Indexing whatever
+ * `Object.keys` happened to yield would make a timed-out search irreproducible.
+ */
+function selectModules(state, include, exclude) {
+  return Object.keys(state.sources).filter(function (moduleFilePath) {
+    if (include && !include.some(function (p) {
+      return minimatch(moduleFilePath, p);
+    })) {
+      return false;
+    }
+    if (exclude && exclude.some(function (p) {
+      return minimatch(moduleFilePath, p);
+    })) {
+      return false;
+    }
+    return true;
+  }).sort().map(function (moduleFilePath) {
+    return moduleFilePath;
+  });
+}
+
+/**
+ * Index until the work is done or the clock runs out.
+ *
+ * Checked BETWEEN modules, so one module is always indexed whole. That is the
+ * only granularity the index has — `indexModule` is atomic, and half a module
+ * in the index is a module whose absent half looks like content that does not
+ * exist. It also means a single module larger than the whole deadline cannot be
+ * interrupted, which the numbers say is not a real case: the largest module in
+ * `valbuild/web` is 290 KB of source and indexes in well under a second.
+ *
+ * The first module is always indexed, deadline or not. A search that returned
+ * nothing at all because the clock had already run out would be a worse answer
+ * than a slow one.
+ *
+ * The deadline covers the indexing and nothing else, and there is nothing else
+ * for it to cover: the queries run against the finished index in well under a
+ * millisecond each, so no number of them can be what made a call slow.
+ *
+ * Exported for its own tests: driving the deadline through the tool would mean
+ * a corpus big enough to take longer than the smallest timeout the schema
+ * allows, which is a race on a fast machine and a slow suite on any machine.
+ */
+function buildWithDeadline(state, modules, timeoutMs) {
+  var index = createSearchIndex();
+  var deadline = Date.now() + timeoutMs;
+  var indexedModules = 0;
+  for (var i = 0; i < modules.length; i++) {
+    if (i > 0 && Date.now() >= deadline) {
+      return {
+        index: index,
+        indexedModules: indexedModules,
+        omitted: modules.slice(i),
+        timedOut: true
+      };
+    }
+    var moduleFilePath = modules[i];
+    var source = state.sources[moduleFilePath];
+    var schema = state.serializedSchemas[moduleFilePath];
+    if (source === undefined || schema === undefined) {
+      // A module with no schema is not searchable and is not an omission
+      // either: nothing was skipped for want of time.
+      continue;
+    }
+    indexModule(index, moduleFilePath, source, schema);
+    indexedModules++;
+  }
+  return {
+    index: index,
+    indexedModules: indexedModules,
+    omitted: [],
+    timedOut: false
+  };
+}
+function moduleOf(sourcePath) {
+  var _Internal$splitModule = Internal.splitModuleFilePathAndModulePath(sourcePath),
+    _Internal$splitModule2 = _slicedToArray(_Internal$splitModule, 1),
+    moduleFilePath = _Internal$splitModule2[0];
+  return moduleFilePath;
+}
+
+/**
+ * The tools that only read.
+ *
+ * Names match the Studio's chat tools exactly. MCP clients namespace by server,
+ * so there is no `val_` prefix to add, and keeping the names identical means
+ * converging the two definitions later is a move rather than a rename.
+ *
+ * All of these read from `deps.state`, which already has pending patches
+ * applied — an agent should see the content as the Studio would show it, not the
+ * last published version.
+ */
+
+var ModuleFilePathSchema$2 = z.string().describe('Path of the Val module, e.g. "/content/pages.val.ts". Use get_all_schema to discover these.');
+function readTools() {
+  return [searchContentTool(), defineTool({
+    name: "get_all_schema",
+    title: "Get all schemas",
+    description: "List every Val module in the project and its schema. Start here: the module paths this returns are what every other tool takes.",
+    inputSchema: z.object({}),
+    annotations: {
+      readOnlyHint: true,
+      idempotentHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(_args, _ref) {
+      var state;
+      return _regenerator().w(function (_context) {
+        while (1) switch (_context.n) {
+          case 0:
+            state = _ref.state;
+            return _context.a(2, ok(state.serializedSchemas));
+        }
+      }, _callee);
+    }));
+    return function (_x, _x2) {
+      return _ref2.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "get_source",
+    title: "Get source",
+    description: "Read the content of one Val module, with any unpublished changes already applied.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$2
+    }),
+    annotations: {
+      readOnlyHint: true,
+      idempotentHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref5 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(_ref3, _ref4) {
+      var moduleFilePath, state, path, source;
+      return _regenerator().w(function (_context2) {
+        while (1) switch (_context2.n) {
+          case 0:
+            moduleFilePath = _ref3.moduleFilePath;
+            state = _ref4.state;
+            path = moduleFilePath;
+            if (path in state.serializedSchemas) {
+              _context2.n = 1;
+              break;
+            }
+            return _context2.a(2, err("not-found", unknownModuleMessage(path, state)));
+          case 1:
+            source = state.sources[path];
+            return _context2.a(2, ok(source === undefined ? null : source));
+        }
+      }, _callee2);
+    }));
+    return function (_x3, _x4) {
+      return _ref5.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "get_record_keys",
+    title: "Get record keys",
+    description: "List the keys of the record or object at a path inside a module, a page at a time. Use this to enumerate entries without reading their contents — and before adding one, so you do not collide with an existing key. Fails on arrays, galleries, richtext and primitives: use count_entries for an array or richtext length, and get_source to read a gallery.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$2,
+      path: z.array(z.string())["default"]([]).describe("Path within the module to the record or object. Empty means the module root."),
+      // Clamped by the schema rather than in the handler: a negative offset
+      // makes `slice` read from the END and a negative limit makes it drop
+      // the last N, so either would return a window that is not the page
+      // asked for while `total` alongside implied it was.
+      limit: z.number()["int"]().min(1)["default"](100).describe("Maximum number of keys to return."),
+      offset: z.number()["int"]().min(0)["default"](0).describe("Number of keys to skip, for paging.")
+    }),
+    annotations: {
+      readOnlyHint: true,
+      idempotentHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref8 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(_ref6, _ref7) {
+      var moduleFilePath, path, limit, offset, state, described, container, value, keys;
+      return _regenerator().w(function (_context3) {
+        while (1) switch (_context3.n) {
+          case 0:
+            moduleFilePath = _ref6.moduleFilePath, path = _ref6.path, limit = _ref6.limit, offset = _ref6.offset;
+            state = _ref7.state;
+            described = describeContainer(state, moduleFilePath, path);
+            if (!(described.kind !== "ok")) {
+              _context3.n = 1;
+              break;
+            }
+            return _context3.a(2, described.result);
+          case 1:
+            container = described.container, value = described.value; // Records and objects only, matching the Studio's tool of the same name.
+            // A gallery's keys are file paths whose bytes live elsewhere, and
+            // richtext blocks are positional — neither is a key set to hand back.
+            if (!(container !== "record" && container !== "object" || !isPlainObject(value))) {
+              _context3.n = 2;
+              break;
+            }
+            return _context3.a(2, err("invalid-args", "The value at that path is ".concat(article(container), " ").concat(container, ". get_record_keys only works on a record or an object \u2014 ").concat(container === "array" ? "use count_entries for the array length" : container === "richtext" ? "use count_entries for the number of blocks" : "use get_source to read the gallery's entries", ".")));
+          case 2:
+            keys = Object.keys(value);
+            return _context3.a(2, ok({
+              kind: container,
+              keys: keys.slice(offset, offset + limit),
+              // The unpaged size, so a caller can tell a short page from the end of
+              // the record without asking for another one.
+              total: keys.length
+            }));
+        }
+      }, _callee3);
+    }));
+    return function (_x5, _x6) {
+      return _ref8.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "count_entries",
+    title: "Count entries",
+    description: "Count the entries at a path inside a module — record or gallery keys, object fields, array indices, or top-level richtext blocks — without reading them. Use this to answer 'how many?' or to size a record before paging through it.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$2,
+      path: z.array(z.string())["default"]([]).describe("Path within the module to count at. Empty means the module root.")
+    }),
+    annotations: {
+      readOnlyHint: true,
+      idempotentHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref1 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(_ref9, _ref0) {
+      var moduleFilePath, path, state, described, container, value;
+      return _regenerator().w(function (_context4) {
+        while (1) switch (_context4.n) {
+          case 0:
+            moduleFilePath = _ref9.moduleFilePath, path = _ref9.path;
+            state = _ref0.state;
+            described = describeContainer(state, moduleFilePath, path);
+            if (!(described.kind !== "ok")) {
+              _context4.n = 1;
+              break;
+            }
+            return _context4.a(2, described.result);
+          case 1:
+            container = described.container, value = described.value; // Every container `describeContainerAtPath` admits can be counted, so
+            // unlike get_record_keys this does not narrow further. Non-containers
+            // never get this far.
+            if (!Array.isArray(value)) {
+              _context4.n = 2;
+              break;
+            }
+            return _context4.a(2, ok({
+              kind: container,
+              count: value.length
+            }));
+          case 2:
+            if (!isPlainObject(value)) {
+              _context4.n = 3;
+              break;
+            }
+            return _context4.a(2, ok({
+              kind: container,
+              count: Object.keys(value).length
+            }));
+          case 3:
+            return _context4.a(2, err("invalid-args", "The value at that path is ".concat(article(container), " ").concat(container, ", which has nothing to count.")));
+        }
+      }, _callee4);
+    }));
+    return function (_x7, _x8) {
+      return _ref1.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "validate_content",
+    title: "Validate content",
+    description: "Check the project's content against its schemas, including unpublished changes. Returns only errors that would block publishing.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$2.optional().describe("Limit the check to one module. Omit to validate everything.")
+    }),
+    annotations: {
+      readOnlyHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref12 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(_ref10, _ref11) {
+      var moduleFilePath, ops, state, validation, fileErrors, bySourcePath, add, _i, _Object$values, moduleErrors, _i2, _Object$entries, _moduleErrors$validat, _Object$entries$_i, path, _errors, _i3, _Object$entries2, _Object$entries2$_i, _path, _errors2, blocking, unreadable, scope, errors, unreadableInScope;
+      return _regenerator().w(function (_context5) {
+        while (1) switch (_context5.n) {
+          case 0:
+            moduleFilePath = _ref10.moduleFilePath;
+            ops = _ref11.ops, state = _ref11.state;
+            _context5.n = 1;
+            return ops.validateSources(state.schemas, state.sources,
+            // Every module. The third argument filters which modules are
+            // validated at all, so passing the pending-patch analysis would make
+            // a project with no pending changes report `valid: true` without
+            // having checked anything. Scoping to one module, when asked, is done
+            // on the results below.
+            undefined);
+          case 1:
+            validation = _context5.v;
+            _context5.n = 2;
+            return ops.validateFiles(state.schemas, state.sources, validation.files, state.analysis.fileLastUpdatedByPatchId);
+          case 2:
+            fileErrors = _context5.v;
+            // Per-module results, flattened to the by-source-path shape the filter
+            // takes. Merged rather than overwritten: a path can pick up an error
+            // from validation and another from its file.
+            bySourcePath = {};
+            add = function add(path, errors) {
+              var _bySourcePath$path;
+              bySourcePath[path] = ((_bySourcePath$path = bySourcePath[path]) !== null && _bySourcePath$path !== void 0 ? _bySourcePath$path : []).concat(errors);
+            };
+            for (_i = 0, _Object$values = Object.values(validation.errors); _i < _Object$values.length; _i++) {
+              moduleErrors = _Object$values[_i];
+              for (_i2 = 0, _Object$entries = Object.entries((_moduleErrors$validat = moduleErrors.validations) !== null && _moduleErrors$validat !== void 0 ? _moduleErrors$validat : {}); _i2 < _Object$entries.length; _i2++) {
+                _Object$entries$_i = _slicedToArray(_Object$entries[_i2], 2), path = _Object$entries$_i[0], _errors = _Object$entries$_i[1];
+                add(path, _errors);
+              }
+            }
+            for (_i3 = 0, _Object$entries2 = Object.entries(fileErrors); _i3 < _Object$entries2.length; _i3++) {
+              _Object$entries2$_i = _slicedToArray(_Object$entries2[_i3], 2), _path = _Object$entries2$_i[0], _errors2 = _Object$entries2$_i[1];
+              add(_path, _errors2);
+            }
+
+            // Drops the errors the Studio would not show either: ones whose only
+            // effect is an offered fix. Left in, an agent would loop trying to
+            // "repair" content that is already publishable.
+            blocking = filterBlockingValidationErrors(bySourcePath, state.serializedSchemas, state.sources); // A module whose source could not be read at all has no source path to
+            // hang an error on, so it is reported separately rather than lost.
+            unreadable = Object.entries(validation.errors).filter(function (_ref13) {
+              var _ref14 = _slicedToArray(_ref13, 2),
+                moduleErrors = _ref14[1];
+              return moduleErrors.invalidSource;
+            }).map(function (_ref15) {
+              var _moduleErrors$invalid, _moduleErrors$invalid2;
+              var _ref16 = _slicedToArray(_ref15, 2),
+                path = _ref16[0],
+                moduleErrors = _ref16[1];
+              return {
+                moduleFilePath: path,
+                message: (_moduleErrors$invalid = (_moduleErrors$invalid2 = moduleErrors.invalidSource) === null || _moduleErrors$invalid2 === void 0 ? void 0 : _moduleErrors$invalid2.message) !== null && _moduleErrors$invalid !== void 0 ? _moduleErrors$invalid : "Invalid source"
+              };
+            });
+            scope = moduleFilePath;
+            errors = scope === undefined ? blocking : filterKeysByModule(blocking, scope);
+            unreadableInScope = scope === undefined ? unreadable : unreadable.filter(function (u) {
+              return u.moduleFilePath === scope;
+            });
+            return _context5.a(2, ok({
+              valid: Object.keys(errors).length === 0 && unreadableInScope.length === 0,
+              errors: Object.fromEntries(Object.entries(errors).map(function (_ref17) {
+                var _ref18 = _slicedToArray(_ref17, 2),
+                  path = _ref18[0],
+                  errs = _ref18[1];
+                return [path, errs.map(toJsonValidationError)];
+              })),
+              // Always present, empty when there are none: a caller should not have
+              // to tell "absent" from "empty" to decide whether content is publishable.
+              unreadableModules: unreadableInScope
+            }));
+        }
+      }, _callee5);
+    }));
+    return function (_x9, _x0) {
+      return _ref12.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "get_patches",
+    title: "Get patches",
+    description: "List the unpublished changes in the project, oldest first, with who made each one. A change reported as not applying is why a module's content may not match what publishing would produce, and why writing to that module is refused.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$2.optional().describe("Limit to changes touching one module.")
+    }),
+    annotations: {
+      readOnlyHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref21 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee6(_ref19, _ref20) {
+      var moduleFilePath, state, wanted, failures, _i4, _Object$values2, unapplied, _iterator, _step, failure;
+      return _regenerator().w(function (_context6) {
+        while (1) switch (_context6.n) {
+          case 0:
+            moduleFilePath = _ref19.moduleFilePath;
+            state = _ref20.state;
+            wanted = moduleFilePath === undefined ? state.patches.patches : state.patches.patches.filter(function (p) {
+              return p.path === moduleFilePath;
+            }); // Which patches would not apply, flattened to one lookup by id: without
+            // this a module's content can silently differ from what publishing
+            // would produce, and nothing anywhere says why.
+            failures = new Map();
+            for (_i4 = 0, _Object$values2 = Object.values(state.unappliedPatches); _i4 < _Object$values2.length; _i4++) {
+              unapplied = _Object$values2[_i4];
+              _iterator = _createForOfIteratorHelper(unapplied);
+              try {
+                for (_iterator.s(); !(_step = _iterator.n()).done;) {
+                  failure = _step.value;
+                  failures.set(failure.patchId, failure.error.message);
+                }
+              } catch (err) {
+                _iterator.e(err);
+              } finally {
+                _iterator.f();
+              }
+            }
+            return _context6.a(2, ok(wanted.map(function (patch) {
+              var failure = failures.get(patch.patchId);
+              return _objectSpread2({
+                patchId: patch.patchId,
+                moduleFilePath: patch.path,
+                createdAt: patch.createdAt,
+                authorId: patch.authorId,
+                // `appliedAt` non-null means this change is already committed, so
+                // it is history rather than something still pending.
+                published: patch.appliedAt !== null,
+                // Always present, so "applies cleanly" is stated rather than
+                // inferred from the absence of a field.
+                appliesCleanly: failure === undefined
+              }, failure === undefined ? {} : {
+                applyError: failure
+              });
+            })));
+        }
+      }, _callee6);
+    }));
+    return function (_x1, _x10) {
+      return _ref21.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "get_source_path_from_route",
+    title: "Get source path from route",
+    description: "Given a URL path on the site, find the Val module and source path that renders it. Use this when the user names a page rather than a module.",
+    inputSchema: z.object({
+      route: z.string().describe('A route on the site, e.g. "/blog/my-post".')
+    }),
+    annotations: {
+      readOnlyHint: true,
+      idempotentHint: true
+    }
+  }, /*#__PURE__*/function () {
+    var _ref24 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee7(_ref22, _ref23) {
+      var route, state, found;
+      return _regenerator().w(function (_context7) {
+        while (1) switch (_context7.n) {
+          case 0:
+            route = _ref22.route;
+            state = _ref23.state;
+            found = getSourcePathFromRoute(route, state.serializedSchemas);
+            if (found) {
+              _context7.n = 1;
+              break;
+            }
+            return _context7.a(2, err("not-found", "No Val module renders the route ".concat(JSON.stringify(route), ". Routes come from modules with a router configured; get_all_schema shows which have one.")));
+          case 1:
+            return _context7.a(2, ok(found));
+        }
+      }, _callee7);
+    }));
+    return function (_x11, _x12) {
+      return _ref24.apply(this, arguments);
+    };
+  }())];
+}
+
+/**
+ * Resolve a module and classify the value at a path inside it.
+ *
+ * Shared by `get_record_keys` and `count_entries` so the two cannot drift on
+ * what counts as a missing module, and so both map the same failure to the same
+ * error code: a path that is not there is `not-found`, while a path that is
+ * there but holds a string or an image is `invalid-args` — the caller should
+ * reach for a different tool, not go looking for the path again.
+ */
+function describeContainer(state, moduleFilePath, path) {
+  var modulePath = moduleFilePath;
+  var schema = state.serializedSchemas[modulePath];
+  if (!schema) {
+    return {
+      kind: "error",
+      result: err("not-found", unknownModuleMessage(modulePath, state))
+    };
+  }
+  var described = describeContainerAtPath(schema, state.sources[modulePath], path);
+  if (described.kind === "error") {
+    return {
+      kind: "error",
+      result: err(described.reason === "missing" ? "not-found" : "invalid-args", described.message)
+    };
+  }
+  return described;
+}
+
+/** "a record", but "an object" and "an array". */
+function article(container) {
+  return container === "object" || container === "array" ? "an" : "a";
+}
+function unknownModuleMessage(path, state) {
+  var known = Object.keys(state.serializedSchemas);
+  return "No Val module at ".concat(JSON.stringify(path), ". Known modules: ").concat(known.length === 0 ? "(none)" : known.join(", "));
+}
+
+/**
+ * Project a validation error into something JSON-safe and worth reading.
+ *
+ * `ValidationError.value` is dropped rather than serialized: it is `unknown` (so
+ * not `Json` to begin with) and it holds the offending source value, which can
+ * be arbitrarily large. A caller already has the source path and can read the
+ * value with `get_source` if it needs to — putting it here would bloat every
+ * result for the rare case that wants it.
+ *
+ * `fixes` is kept, because it names what Val already knows how to repair, which
+ * is directly actionable.
+ */
+function toJsonValidationError(error) {
+  return {
+    message: error.message,
+    fixes: error.fixes ? _toConsumableArray(error.fixes) : [],
+    typeError: error.typeError === true,
+    schemaError: error.schemaError === true,
+    keyError: error.keyError === true
+  };
+}
+function isPlainObject(value) {
+  return _typeof(value) === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Keep only the entries belonging to one module.
+ *
+ * Keyed by SourcePath, which begins with the module file path, so a prefix match
+ * is the right test — there is no per-module grouping left to index by.
+ */
+function filterKeysByModule(record, moduleFilePath) {
+  var out = {};
+  for (var _i5 = 0, _Object$entries3 = Object.entries(record); _i5 < _Object$entries3.length; _i5++) {
+    var _Object$entries3$_i = _slicedToArray(_Object$entries3[_i5], 2),
+      path = _Object$entries3$_i[0],
+      value = _Object$entries3$_i[1];
+    if (path.startsWith(moduleFilePath)) {
+      out[path] = value;
+    }
+  }
+  return out;
+}
+
+/**
+ * Everything the Studio does client-side before a patch can be saved, done
+ * server-side.
+ *
+ * Three things had no server equivalent, and each is a way to be quietly wrong:
+ * where the patch id comes from, what the patch says its parent is, and whether
+ * the result would even be valid. `docs/plans/mcp.md` Part C is the design.
+ */
+
+var jsonOps = new JSONOps();
+
+/**
+ * A patch id, minted before the write is attempted.
+ *
+ * Same shape the Studio mints (a v4 UUID), and minting one that never gets used
+ * costs nothing — ids are not registered anywhere until a patch carries them.
+ */
+function mintPatchId() {
+  // A branded string has no constructor; this is the same conversion the Studio
+  // and ValServer both make.
+  return randomUUID();
+}
+
+/**
+ * What the new patch should hang off.
+ *
+ * The last known patch if there is one, otherwise the current head. Note the
+ * asymmetry between the two backends: `ValOpsFS` ignores `parentRef` entirely
+ * because its append-only ordering log defines order, while `ValOpsHttp` sends
+ * it up as `parentPatchId` for optimistic concurrency. So a wrong value here is
+ * invisible locally and a conflict in production — which is why this is derived
+ * fresh rather than remembered.
+ */
+function deriveParentRef(_x, _x2) {
+  return _deriveParentRef.apply(this, arguments);
+}
+
+/**
+ * Would this patch leave the content valid?
+ *
+ * Applied to a **clone** of the sources, never the real ones: `applyPatch`
+ * mutates the document it is given, and ValOps carries a standing note that
+ * add operations misbehave without a clone. Validating in place would corrupt
+ * the sources every later call in this process reads.
+ *
+ * Server-side this is strictly better than the Studio's speculative check.
+ * `getSchemas()` returns real `Schema` instances, so the user's own `validate`
+ * closures run — and those are not carried by the serialized schema the browser
+ * has, which means the browser cannot run them at all.
+ */
+function _deriveParentRef() {
+  _deriveParentRef = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(ops,
+  // Only the ids matter, so this accepts either shape `fetchPatches` can
+  // return — the metadata-only variant omits the ops but keeps the ids.
+  patches) {
+    var last, _t;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          last = patches.patches[patches.patches.length - 1];
+          if (!last) {
+            _context.n = 1;
+            break;
+          }
+          return _context.a(2, {
+            type: "patch",
+            patchId: last.patchId
+          });
+        case 1:
+          _context.n = 2;
+          return ops.getBaseSha();
+        case 2:
+          _t = _context.v;
+          return _context.a(2, {
+            type: "head",
+            headBaseSha: _t
+          });
+      }
+    }, _callee);
+  }));
+  return _deriveParentRef.apply(this, arguments);
+}
+function validateSpeculatively(_x3, _x4, _x5, _x6) {
+  return _validateSpeculatively.apply(this, arguments);
+}
+function _validateSpeculatively() {
+  _validateSpeculatively = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(ops, state, moduleFilePath, patch) {
+    var pendingFiles,
+      current,
+      applied,
+      speculativeSources,
+      after,
+      before,
+      existing,
+      introduced,
+      _args2 = arguments;
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          pendingFiles = _args2.length > 4 && _args2[4] !== undefined ? _args2[4] : {};
+          current = state.sources[moduleFilePath];
+          if (!(current === undefined)) {
+            _context2.n = 1;
+            break;
+          }
+          return _context2.a(2, {
+            status: "unapplicable",
+            result: {
+              status: "error",
+              code: "not-found",
+              message: "No Val module at ".concat(JSON.stringify(moduleFilePath), ".")
+            }
+          });
+        case 1:
+          applied = applyPatch(deepClone(current), jsonOps,
+          // Without `file` ops: `JSONOps` refuses one outright ("Cannot apply a file
+          // patch here"), and rightly — a file op carries bytes, not a change to the
+          // document. The change those bytes belong to is the `replace` or `add`
+          // beside them, which is in this list and is what there is to validate.
+          patch.filter(Internal.notFileOp));
+          if (!result.isErr(applied)) {
+            _context2.n = 2;
+            break;
+          }
+          return _context2.a(2, {
+            status: "unapplicable",
+            result: {
+              status: "error",
+              code: "invalid-args",
+              message: "The patch cannot be applied to ".concat(moduleFilePath, ": ").concat(applied.error.message)
+            }
+          });
+        case 2:
+          speculativeSources = _objectSpread2(_objectSpread2({}, state.sources), {}, _defineProperty({}, moduleFilePath, applied.value));
+          _context2.n = 3;
+          return blockingErrorsIn(ops, state, speculativeSources, moduleFilePath, pendingFiles);
+        case 3:
+          after = _context2.v;
+          if (!(after.length === 0)) {
+            _context2.n = 4;
+            break;
+          }
+          return _context2.a(2, {
+            status: "valid"
+          });
+        case 4:
+          _context2.n = 5;
+          return blockingErrorsIn(ops, state, state.sources, moduleFilePath, pendingFiles);
+        case 5:
+          before = _context2.v;
+          existing = new Set(before.map(identify));
+          introduced = after.filter(function (error) {
+            return !existing.has(identify(error));
+          });
+          if (!(introduced.length === 0)) {
+            _context2.n = 6;
+            break;
+          }
+          return _context2.a(2, {
+            status: "valid"
+          });
+        case 6:
+          return _context2.a(2, {
+            status: "invalid",
+            errors: describeErrors(introduced)
+          });
+      }
+    }, _callee2);
+  }));
+  return _validateSpeculatively.apply(this, arguments);
+}
+/** Path and message together: the same message at another path is another problem. */
+function identify(error) {
+  return "".concat(error.path, "\0").concat(error.message);
+}
+
+/**
+ * The publishing-blocking errors in one module, for a given set of sources.
+ *
+ * Scoped to one module by source path, which starts with the module file path.
+ * Errors elsewhere in the project are somebody else's: refusing on them would
+ * let the first broken module in a repo make every other module read-only.
+ */
+function blockingErrorsIn(_x7, _x8, _x9, _x0, _x1) {
+  return _blockingErrorsIn.apply(this, arguments);
+}
+function _blockingErrorsIn() {
+  _blockingErrorsIn = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(ops, state, sources, moduleFilePath, pendingFiles) {
+    var validation, fileErrors, bySourcePath, add, _i, _Object$values, moduleErrors, _i2, _Object$entries, _moduleErrors$validat, _Object$entries$_i, path, errors, _i3, _Object$entries2, _Object$entries2$_i, _path, _errors, blocking, located, _i4, _Object$entries3, _Object$entries3$_i, _path2, _errors2, _iterator, _step, error;
+    return _regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          _context3.n = 1;
+          return ops.validateSources(state.schemas, sources,
+          // Every module, deliberately -- `patchesByModule` is a FILTER on which
+          // modules get validated, not context for validating them. Passing the
+          // analysis from before this write skips the very module being written
+          // whenever it had no pending patch, so the first change to a module went
+          // unchecked; and a change that breaks a `keyOf` or a router in a *different*
+          // module reports its error there, which a filtered run never visits.
+          undefined);
+        case 1:
+          validation = _context3.v;
+          _context3.n = 2;
+          return ops.validateFiles(state.schemas, sources, validation.files, // The pending upload wins over the analysis, and has to: it is the newer
+          // answer to "where are this path's bytes", and the analysis predates it.
+          _objectSpread2(_objectSpread2({}, state.analysis.fileLastUpdatedByPatchId), pendingFiles));
+        case 2:
+          fileErrors = _context3.v;
+          // Merged rather than overwritten: a path can pick up an error from validation
+          // and another from its file.
+          bySourcePath = {};
+          add = function add(path, errors) {
+            var _bySourcePath$path;
+            bySourcePath[path] = ((_bySourcePath$path = bySourcePath[path]) !== null && _bySourcePath$path !== void 0 ? _bySourcePath$path : []).concat(errors);
+          };
+          for (_i = 0, _Object$values = Object.values(validation.errors); _i < _Object$values.length; _i++) {
+            moduleErrors = _Object$values[_i];
+            for (_i2 = 0, _Object$entries = Object.entries((_moduleErrors$validat = moduleErrors.validations) !== null && _moduleErrors$validat !== void 0 ? _moduleErrors$validat : {}); _i2 < _Object$entries.length; _i2++) {
+              _Object$entries$_i = _slicedToArray(_Object$entries[_i2], 2), path = _Object$entries$_i[0], errors = _Object$entries$_i[1];
+              add(path, errors);
+            }
+          }
+          for (_i3 = 0, _Object$entries2 = Object.entries(fileErrors); _i3 < _Object$entries2.length; _i3++) {
+            _Object$entries2$_i = _slicedToArray(_Object$entries2[_i3], 2), _path = _Object$entries2$_i[0], _errors = _Object$entries2$_i[1];
+            add(_path, _errors);
+          }
+          blocking = filterBlockingValidationErrors(bySourcePath, state.serializedSchemas, sources);
+          located = [];
+          _i4 = 0, _Object$entries3 = Object.entries(blocking);
+        case 3:
+          if (!(_i4 < _Object$entries3.length)) {
+            _context3.n = 6;
+            break;
+          }
+          _Object$entries3$_i = _slicedToArray(_Object$entries3[_i4], 2), _path2 = _Object$entries3$_i[0], _errors2 = _Object$entries3$_i[1];
+          if (_path2.startsWith(moduleFilePath)) {
+            _context3.n = 4;
+            break;
+          }
+          return _context3.a(3, 5);
+        case 4:
+          _iterator = _createForOfIteratorHelper(_errors2);
+          try {
+            for (_iterator.s(); !(_step = _iterator.n()).done;) {
+              error = _step.value;
+              located.push({
+                path: _path2,
+                message: error.message
+              });
+            }
+          } catch (err) {
+            _iterator.e(err);
+          } finally {
+            _iterator.f();
+          }
+        case 5:
+          _i4++;
+          _context3.n = 3;
+          break;
+        case 6:
+          return _context3.a(2, located);
+      }
+    }, _callee3);
+  }));
+  return _blockingErrorsIn.apply(this, arguments);
+}
+function describeErrors(errors) {
+  return errors.map(function (e) {
+    return "".concat(e.path, ": ").concat(e.message);
+  }).join("; ");
+}
+
+/**
+ * What to do when the change would leave the content invalid.
+ *
+ * `"reject"` for a tool that is editing existing content: an agent should not be
+ * able to break a site, and a rejected patch stores nothing.
+ *
+ * `"report"` for a tool whose whole purpose is to create something incomplete.
+ * `empty_at_path` scaffolds an entry the caller is then expected to fill in, so
+ * on most real schemas — anything with a non-empty string — the value it creates
+ * is invalid by construction. Rejecting that would make the tool useless on
+ * exactly the schemas it exists for, so instead the patch is saved and the
+ * remaining errors come back as a to-do list. This mirrors the Studio, where
+ * creating an empty entry is normal and the errors show until it is filled in.
+ */
+
+/**
+ * Put the bytes a `file` op refers to where the patch can find them.
+ *
+ * Called with the ids the patch is about to be written under, because that is
+ * the whole reason this is a hook rather than something the caller does first:
+ * an upload is keyed by the patch id, and the patch id is minted here — once
+ * per attempt, so a conflict retry uploads under the id that actually lands
+ * rather than orphaning the bytes under the one that did not.
+ *
+ * Uploads run BEFORE `createPatch`, which is the order the Studio uses and the
+ * only one that works: a `file` op carries a hash, not data, so a patch stored
+ * before its bytes points at nothing, and a reader that arrives in between sees
+ * a broken image rather than a missing one.
+ */
+
+/**
+ * Files uploaded for a patch that does not exist yet.
+ *
+ * Deliberately the analysis's own type rather than a lookalike: the whole point
+ * is that these merge over `fileLastUpdatedByPatchId`, and a second shape that
+ * happens to fit today would drift the first time a field is added there.
+ */
+
+/**
+ * What a successful write reports back.
+ *
+ * Named, rather than left as the `Json` that `ValToolResult` widens it to, so
+ * that a tool building on `savePatch` — the image tool adds its own fields to
+ * this — can spread it without re-narrowing `Json` and without an assertion.
+ */
+
+/**
+ * Upload, validate, then save — and retry once if someone else got there first.
+ *
+ * The retry exists because the parent ref is derived from a read that happened
+ * before the write. A conflict means the chain moved underneath us, and
+ * re-deriving is usually enough. Once only: a loop here would be an agent
+ * fighting a human editor in the Studio, and losing slowly is worse than
+ * failing clearly.
+ *
+ * The order of the first two is the part that is easy to get backwards. A
+ * patch's `file` op carries a hash, not bytes, so validation asks the store
+ * where those bytes are — and if they are not there yet, the check that was
+ * supposed to say "this image is fine" says "this image is missing" and rejects
+ * the write that would have uploaded it. So the bytes go up first, and the
+ * upload says where it put them.
+ *
+ * The cost is that a REJECTED write leaves an upload no patch refers to. That
+ * is a state the patch store already expects and already collects — see
+ * `dropStaleUploads` in `patchStore.ts`, which exists because a browser can
+ * abandon an upload the same way — so it is bounded rather than untidy, and it
+ * is the cheaper of the two failures by a distance: the other one is a write
+ * that cannot succeed at all.
+ */
+function savePatch(_x10, _x11, _x12) {
+  return _savePatch.apply(this, arguments);
+}
+function _savePatch() {
+  _savePatch = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(deps, moduleFilePath, patch) {
+    var _options$onInvalid, _ctx$auth;
+    var options,
+      ops,
+      ctx,
+      state,
+      onInvalid,
+      unapplied,
+      patchId,
+      parentRef,
+      pendingFiles,
+      uploaded,
+      speculative,
+      unresolved,
+      authorId,
+      attempt,
+      saved,
+      _args4 = arguments,
+      _t2,
+      _t3;
+    return _regenerator().w(function (_context4) {
+      while (1) switch (_context4.n) {
+        case 0:
+          options = _args4.length > 3 && _args4[3] !== undefined ? _args4[3] : {};
+          ops = deps.ops, ctx = deps.ctx, state = deps.state;
+          onInvalid = (_options$onInvalid = options.onInvalid) !== null && _options$onInvalid !== void 0 ? _options$onInvalid : "reject";
+          unapplied = state.unappliedPatches[moduleFilePath];
+          if (!(unapplied && unapplied.length > 0)) {
+            _context4.n = 1;
+            break;
+          }
+          return _context4.a(2, {
+            status: "error",
+            code: "internal",
+            message: "Cannot write to ".concat(moduleFilePath, ": it has ").concat(unapplied.length, " pending change").concat(unapplied.length === 1 ? "" : "s", " that will not apply, so what is stored is not what publishing would produce. Resolve or discard ").concat(unapplied.map(function (u) {
+              return u.patchId;
+            }).join(", "), " first -- get_patches shows them.")
+          });
+        case 1:
+          // Minted once for the whole call, not once per attempt: an id is not
+          // registered anywhere until a patch carries it, so a conflicted attempt has
+          // not spent it — and reusing it keeps the upload below valid instead of
+          // orphaning it under an id nothing will ever refer to.
+          patchId = mintPatchId();
+          _context4.n = 2;
+          return deriveParentRef(ops, state.patches);
+        case 2:
+          parentRef = _context4.v;
+          pendingFiles = {};
+          if (!options.uploadFiles) {
+            _context4.n = 5;
+            break;
+          }
+          _context4.n = 3;
+          return options.uploadFiles({
+            patchId: patchId,
+            parentRef: parentRef
+          });
+        case 3:
+          uploaded = _context4.v;
+          if (!(uploaded.status === "error")) {
+            _context4.n = 4;
+            break;
+          }
+          return _context4.a(2, uploaded.result);
+        case 4:
+          pendingFiles = uploaded.files;
+        case 5:
+          _context4.n = 6;
+          return validateSpeculatively(ops, state, moduleFilePath, patch, pendingFiles);
+        case 6:
+          speculative = _context4.v;
+          if (!(speculative.status === "unapplicable")) {
+            _context4.n = 7;
+            break;
+          }
+          return _context4.a(2, speculative.result);
+        case 7:
+          unresolved = null;
+          if (!(speculative.status === "invalid")) {
+            _context4.n = 9;
+            break;
+          }
+          if (!(onInvalid === "reject")) {
+            _context4.n = 8;
+            break;
+          }
+          return _context4.a(2, {
+            status: "error",
+            code: "validation-failed",
+            message: "The change was rejected and nothing was saved, because it would leave the content invalid: ".concat(speculative.errors)
+          });
+        case 8:
+          unresolved = speculative.errors;
+        case 9:
+          /**
+           * The verified profile, or null when there was nothing to verify.
+           *
+           * An author is written only when somebody checked it. On the token path the
+           * host verified a signature over a key it does not hold, so the profile is
+           * checked rather than claimed, and the backend has no token of its own to
+           * attribute from — the call reaches it under the app's API key. If this
+           * stayed null there, every edit made through a signed-in editor's own session
+           * would land with no author at all, which is worse than useless on a CMS
+           * whose review screen is organised by who changed what.
+           *
+           * Null is what local filesystem mode gets, where there is no credential to
+           * resolve, exactly as the Studio does locally. It is also what the removed
+           * personal-access-token path got, and for a reason worth keeping in view: an
+           * id derived from a credential the app cannot resolve is an unverified claim
+           * dressed up as a checked one. Should another unverified credential ever
+           * reach here, null remains its only honest author.
+           */
+          authorId = ((_ctx$auth = ctx.auth) === null || _ctx$auth === void 0 ? void 0 : _ctx$auth.type) === "verified-profile" ? ctx.auth.profileId : null;
+          attempt = 0;
+        case 10:
+          if (!(attempt < 2)) {
+            _context4.n = 18;
+            break;
+          }
+          if (!(attempt > 0)) {
+            _context4.n = 13;
+            break;
+          }
+          _t2 = deriveParentRef;
+          _t3 = ops;
+          _context4.n = 11;
+          return ops.fetchPatches({
+            excludePatchOps: true
+          });
+        case 11:
+          _context4.n = 12;
+          return _t2(_t3, _context4.v);
+        case 12:
+          parentRef = _context4.v;
+        case 13:
+          _context4.n = 14;
+          return ops.createPatch(moduleFilePath, patch, patchId, parentRef, ctx.sessionId, authorId);
+        case 14:
+          saved = _context4.v;
+          if (!result.isOk(saved)) {
+            _context4.n = 15;
+            break;
+          }
+          return _context4.a(2, {
+            status: "ok",
+            data: {
+              patchId: saved.value.patchId,
+              moduleFilePath: moduleFilePath,
+              createdAt: saved.value.createdAt,
+              unresolvedValidationErrors: unresolved
+            }
+          });
+        case 15:
+          if (!(saved.error.errorType === "patch-head-conflict")) {
+            _context4.n = 16;
+            break;
+          }
+          return _context4.a(3, 17);
+        case 16:
+          return _context4.a(2, {
+            status: "error",
+            code: "internal",
+            // Note the nesting: createPatch wraps the underlying flat error as
+            // `{ errorType: "other", error: <that> }`.
+            message: saved.error.error.message
+          });
+        case 17:
+          attempt++;
+          _context4.n = 10;
+          break;
+        case 18:
+          return _context4.a(2, {
+            status: "error",
+            code: "conflict",
+            message: "Another change was saved while this one was being written, twice in a row. Read the content again before retrying — it has moved."
+          });
+      }
+    }, _callee4);
+  }));
+  return _savePatch.apply(this, arguments);
+}
+
+/**
+ * The tools that change content.
+ *
+ * Every one of them goes through {@link savePatch}, so they all inherit the same
+ * guarantees: the change is validated against the real schemas before anything
+ * is stored, a rejected change stores nothing, and a lost race with another
+ * writer is retried once and then reported rather than looped on.
+ *
+ * Images are not here. The Studio's image tools work from a handle into Val's
+ * AI session store — bytes the browser got from the vision system — and MCP has
+ * no equivalent, so they need a different affordance (a local file path, or
+ * inline base64) rather than a port. `docs/plans/mcp.md` Part B has the reasoning.
+ */
+
+var ModuleFilePathSchema$1 = z.string().describe('Path of the Val module, e.g. "/content/pages.val.ts".');
+function writeTools() {
+  return [defineTool({
+    name: "create_patch",
+    title: "Create patch",
+    description: "Change content in a Val module by applying JSON Patch operations. The change is validated first and is rejected outright if it would make the content invalid. Text and JSON values only — not files or images.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$1,
+      patch: z.array(z.unknown()).describe('JSON Patch operations, e.g. [{"op":"replace","path":["title"],"value":"New title"}]. Paths are arrays of keys, not slash-separated strings.')
+    }),
+    annotations: {
+      idempotentHint: false
+    }
+  }, /*#__PURE__*/function () {
+    var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(_ref, deps) {
+      var moduleFilePath, patch, rejected, parsed;
+      return _regenerator().w(function (_context) {
+        while (1) switch (_context.n) {
+          case 0:
+            moduleFilePath = _ref.moduleFilePath, patch = _ref.patch;
+            // Before parsing, not after: a file op that is also malformed should be
+            // told that files are not supported, rather than handed a schema error
+            // about the shape of a thing it was never going to be allowed to do.
+            rejected = rejectFileOps(patch);
+            if (!rejected) {
+              _context.n = 1;
+              break;
+            }
+            return _context.a(2, rejected);
+          case 1:
+            parsed = safeParsePatch(patch);
+            if (!(parsed.kind !== "ok")) {
+              _context.n = 2;
+              break;
+            }
+            return _context.a(2, fromBuildResult$1(parsed));
+          case 2:
+            return _context.a(2, savePatch(deps, moduleFilePath, parsed.patch));
+        }
+      }, _callee);
+    }));
+    return function (_x, _x2) {
+      return _ref2.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "duplicate_source",
+    title: "Duplicate source",
+    description: "Copy the value at one path in a module to another path. Use this to add an entry modelled on an existing one, rather than composing it field by field.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$1,
+      sourcePath: z.array(z.string()).describe("Path of the value to copy."),
+      destinationPath: z.array(z.string()).describe("Path to copy it to. Must not already exist.")
+    }),
+    annotations: {
+      idempotentHint: false
+    }
+  }, /*#__PURE__*/function () {
+    var _ref4 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(_ref3, deps) {
+      var moduleFilePath, sourcePath, destinationPath, modulePath, schema, built;
+      return _regenerator().w(function (_context2) {
+        while (1) switch (_context2.n) {
+          case 0:
+            moduleFilePath = _ref3.moduleFilePath, sourcePath = _ref3.sourcePath, destinationPath = _ref3.destinationPath;
+            modulePath = moduleFilePath;
+            schema = deps.state.serializedSchemas[modulePath];
+            if (schema) {
+              _context2.n = 1;
+              break;
+            }
+            return _context2.a(2, err("not-found", "No Val module at ".concat(JSON.stringify(modulePath), ".")));
+          case 1:
+            built = buildDuplicatePatch({
+              sourcePath: sourcePath,
+              destinationPath: destinationPath
+            }, schema, deps.state.sources[modulePath]);
+            if (!(built.kind !== "ok")) {
+              _context2.n = 2;
+              break;
+            }
+            return _context2.a(2, fromBuildResult$1(built));
+          case 2:
+            return _context2.a(2, savePatch(deps, modulePath, built.patch));
+        }
+      }, _callee2);
+    }));
+    return function (_x3, _x4) {
+      return _ref4.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "empty_at_path",
+    title: "Create an empty value at a path",
+    description: "Create a new, schema-correct empty value at a path — an empty entry in a record or array, for instance. Prefer this over composing one by hand: it derives the shape from the schema, including required fields. The value it creates is usually not yet publishable; the result lists what still needs filling in, which you can then do with create_patch.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$1,
+      destinationPath: z.array(z.string()).describe("Path to create the empty value at.")
+    }),
+    annotations: {
+      idempotentHint: false
+    }
+  }, /*#__PURE__*/function () {
+    var _ref6 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(_ref5, deps) {
+      var moduleFilePath, destinationPath, modulePath, schema, built;
+      return _regenerator().w(function (_context3) {
+        while (1) switch (_context3.n) {
+          case 0:
+            moduleFilePath = _ref5.moduleFilePath, destinationPath = _ref5.destinationPath;
+            modulePath = moduleFilePath;
+            schema = deps.state.serializedSchemas[modulePath];
+            if (schema) {
+              _context3.n = 1;
+              break;
+            }
+            return _context3.a(2, err("not-found", "No Val module at ".concat(JSON.stringify(modulePath), ".")));
+          case 1:
+            built = buildEmptyAtPathPatch({
+              destinationPath: destinationPath
+            }, schema, deps.state.sources[modulePath]);
+            if (!(built.kind !== "ok")) {
+              _context3.n = 2;
+              break;
+            }
+            return _context3.a(2, fromBuildResult$1(built));
+          case 2:
+            return _context3.a(2, savePatch(deps, modulePath, built.patch, {
+              onInvalid: "report"
+            }));
+        }
+      }, _callee3);
+    }));
+    return function (_x5, _x6) {
+      return _ref6.apply(this, arguments);
+    };
+  }()), defineTool({
+    name: "remove_image_gallery_entry",
+    title: "Remove an image gallery entry",
+    description: "Remove one image from an image gallery module by its file path. This deletes the entry and the file it refers to.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema$1.describe("The gallery module, i.e. one declared with s.images() or s.files()."),
+      filePath: z.string().describe('The gallery key to remove, e.g. "/public/val/photo_a1b2c.jpg".')
+    }),
+    // Destructive: it removes content and the underlying file, so a host
+    // that asks for confirmation should ask here.
+    annotations: {
+      destructiveHint: true,
+      idempotentHint: false
+    }
+  }, /*#__PURE__*/function () {
+    var _ref8 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(_ref7, deps) {
+      var moduleFilePath, filePath, modulePath, schema, built;
+      return _regenerator().w(function (_context4) {
+        while (1) switch (_context4.n) {
+          case 0:
+            moduleFilePath = _ref7.moduleFilePath, filePath = _ref7.filePath;
+            modulePath = moduleFilePath;
+            schema = deps.state.serializedSchemas[modulePath];
+            if (schema) {
+              _context4.n = 1;
+              break;
+            }
+            return _context4.a(2, err("not-found", "No Val module at ".concat(JSON.stringify(modulePath), ".")));
+          case 1:
+            built = buildRemoveImageGalleryEntryPatch({
+              filePath: filePath
+            }, schema, deps.state.sources[modulePath]);
+            if (!(built.kind !== "ok")) {
+              _context4.n = 2;
+              break;
+            }
+            return _context4.a(2, fromBuildResult$1(built));
+          case 2:
+            return _context4.a(2, savePatch(deps, modulePath, built.patch));
+        }
+      }, _callee4);
+    }));
+    return function (_x7, _x8) {
+      return _ref8.apply(this, arguments);
+    };
+  }())];
+}
+
+/**
+ * Turn a helper's build failure into a tool error.
+ *
+ * `wrong-tool` is worth keeping distinct: the helpers can tell that the caller
+ * reached for the wrong tool and which one it should have used, and passing that
+ * through is what lets a model correct itself in one step instead of retrying
+ * the same call.
+ */
+function fromBuildResult$1(built) {
+  if (built.kind === "wrong-tool") {
+    return {
+      status: "error",
+      code: "invalid-args",
+      message: "".concat(built.reason, " Use the ").concat(built.suggestedTool, " tool instead.")
+    };
+  }
+  return {
+    status: "error",
+    code: "invalid-args",
+    message: built.message
+  };
+}
+
+/**
+ * File operations are refused rather than half-supported.
+ *
+ * A `file` op carries binary content that has to be uploaded before the patch
+ * is synced — a two-phase flow this pass does not implement. Letting one through
+ * would store a patch referring to bytes that were never uploaded, which fails
+ * later and a long way from the cause.
+ *
+ * Takes the unparsed patch, so this answer does not depend on the op being
+ * otherwise well formed. All it needs is the caller's own claim about what the
+ * op is.
+ */
+function rejectFileOps(patch) {
+  var hasFileOp = patch.some(function (op) {
+    return _typeof(op) === "object" && op !== null && "op" in op && op.op === "file";
+  });
+  if (!hasFileOp) {
+    return null;
+  }
+  return {
+    status: "error",
+    code: "unsupported",
+    message: "This patch contains a file operation. Uploading files is not supported over MCP yet — only text and JSON values can be changed."
+  };
+}
+
+/**
+ * The public surface of Val's server-side tool registry.
+ *
+ * Types only, deliberately: this file is the contract that the MCP hosts, the
+ * CLI's stdio transport and the tools themselves are all written against, and
+ * keeping it free of implementation means those can be built in any order
+ * without one of them owning the shape.
+ *
+ * The design this implements is `docs/plans/mcp.md`, Part A. Two constraints
+ * from it are load-bearing and easy to break by accident:
+ *
+ * 1. **Nothing here may import an MCP SDK.** That is what lets hosts other
+ *    than the template consume these tools, and it is not hypothetical
+ *    hygiene — the TypeScript SDK reorganised itself at v2.0.0, and a registry
+ *    coupled to it would have moved with it.
+ * 2. **The result type is deliberately not MCP's `CallToolResult`.** Each host
+ *    adapts {@link ValToolResult} at its own edge, which is also where an
+ *    error becomes an in-band `isError` result the model can recover from
+ *    rather than a transport failure.
+ */
+
+/** Why a tool call failed, in a form a host can map onto its own errors. */
+
+/**
+ * The same definition with `inputSchema` as JSON Schema, for hosts that want the
+ * wire shape rather than a Standard Schema.
+ *
+ * Typed as whatever zod's own converter produces, so deriving it needs no cast
+ * and no second hand-written description of the same input.
+ */
+
+/**
+ * How the caller was established, and there is one acceptable answer: the host
+ * **checked a signature**.
+ *
+ * A union of one, deliberately. It carried a second variant — a personal access
+ * token relayed to the backend unchecked, on the reasoning that the app cannot
+ * resolve one and the backend can. The reasoning held; the shape did not. A
+ * credential the host cannot check is one it also cannot refuse, so accepting
+ * one made "a deployed endpoint that authenticates nobody" a supported
+ * configuration, and it let a host serve these tools without ever being told
+ * where callers should authorize. The discriminant stays so that adding a
+ * second *verified* kind stays a one-line change at every call site.
+ */
+
+/**
+ * Who is calling, established once per request by the host.
+ *
+ * `null` means local fs mode, where there is no credential to hold and patches
+ * are written with no author, exactly as the Studio does locally (D.1). In
+ * proxy mode `null` is refused rather than falling back to the app's own API
+ * key: that key can do more than any single user, and quietly substituting it
+ * would turn a missing credential into full access.
+ */
+
+/**
+ * Brand a verified subject as an {@link AuthorId}.
+ *
+ * `AuthorId` is a branded string so that an id cannot be conjured from any
+ * string that happens to be lying around — which is exactly the mistake this
+ * type is guarding against. That makes one assertion unavoidable at the boundary
+ * where a real id enters the system, so it lives here, once, with a name that
+ * says what makes it legitimate: the caller has *verified* this subject, not
+ * received it.
+ *
+ * Do not reach for this to satisfy a type. If you are holding a string you did
+ * not verify, the honest value is `null`.
+ */
+function authorIdFromVerifiedSubject(subject) {
+  return subject;
+}
+
+/** Read access. Every call needs it, the writes included. */
+var VAL_SCOPE_READ = "val:read";
+/** Write access. Needed *in addition* by any tool not marked `readOnlyHint`. */
+var VAL_SCOPE_WRITE = "val:write";
+
+/**
+ * The failure half of {@link ValToolResult}, on its own.
+ *
+ * Named because several internal steps can only fail — speculative validation
+ * rejecting a patch, an upload that did not land — and typing those as the
+ * whole union means the compiler cannot see that an early return is in fact an
+ * error return.
+ */
+
+var _excluded = ["handler"],
+  _excluded2 = ["handler", "inputSchema"];
+/**
+ * Val's server-side tool registry.
+ *
+ * This is the piece Val did not have: the Studio's chat tools are defined *and
+ * executed in the browser*, against its client stores, so nothing here could be
+ * re-exposed. These tools run against {@link ValOps} instead, which is what lets
+ * an MCP server — or a stdio transport, or anything else — drive Val content
+ * without a browser.
+ *
+ * Transport-agnostic on purpose: nothing under `tools/` imports an MCP SDK. A
+ * host adapts {@link ValToolResult} at its own edge.
+ */
+function createValTools(valModules, options) {
+  var extraTools = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : [];
+  var resolveOps = createOpsResolver(valModules, options);
+  var tools = [].concat(_toConsumableArray(readTools()), _toConsumableArray(writeTools()), _toConsumableArray(extraTools));
+  var byName = new Map();
+  var _iterator = _createForOfIteratorHelper(tools),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var tool = _step.value;
+      if (byName.has(tool.name)) {
+        // Refused rather than resolved either way. A host that shadows
+        // `get_source` with something else would be a genuinely confusing
+        // afternoon for whoever debugs the agent afterwards, and "last one wins"
+        // is not a rule anybody can see from the call site.
+        throw new Error("Val: two tools are registered as ".concat(JSON.stringify(tool.name), ". Extra tools must not reuse a built-in tool's name."));
+      }
+      byName.set(tool.name, tool);
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return {
+    list: function list() {
+      return tools.map(function (_ref) {
+        _ref.handler;
+          var definition = _objectWithoutProperties(_ref, _excluded);
+        return definition;
+      });
+    },
+    listJsonSchema: function listJsonSchema() {
+      return tools.map(function (_ref2) {
+        _ref2.handler;
+          var inputSchema = _ref2.inputSchema,
+          rest = _objectWithoutProperties(_ref2, _excluded2);
+        return _objectSpread2(_objectSpread2({}, rest), {}, {
+          // zod 4 derives this itself, so there is no JSON-Schema-to-zod
+          // converter anywhere in the stack and no second description of the
+          // same input to keep in step.
+          inputSchema: z.toJSONSchema(inputSchema, {
+            io: "input"
+          })
+        });
+      });
+    },
+    call: function call(name, args, ctx) {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+        var tool, parsed, insufficient, resolved, ops, state, deps, _t;
+        return _regenerator().w(function (_context) {
+          while (1) switch (_context.p = _context.n) {
+            case 0:
+              tool = byName.get(name);
+              if (tool) {
+                _context.n = 1;
+                break;
+              }
+              return _context.a(2, {
+                status: "error",
+                code: "unknown-tool",
+                message: "No tool named ".concat(JSON.stringify(name), ". Available: ").concat(tools.map(function (t) {
+                  return t.name;
+                }).join(", "))
+              });
+            case 1:
+              parsed = tool.inputSchema.safeParse(args !== null && args !== void 0 ? args : {});
+              if (parsed.success) {
+                _context.n = 2;
+                break;
+              }
+              return _context.a(2, {
+                status: "error",
+                code: "invalid-args",
+                message: describeZodError(parsed.error)
+              });
+            case 2:
+              insufficient = refuseInsufficientScope(tool, ctx);
+              if (!insufficient) {
+                _context.n = 3;
+                break;
+              }
+              return _context.a(2, insufficient);
+            case 3:
+              resolved = resolveOps(ctx);
+              if (!(resolved.status === "error")) {
+                _context.n = 4;
+                break;
+              }
+              return _context.a(2, resolved.result);
+            case 4:
+              ops = resolved.ops;
+              _context.p = 5;
+              _context.n = 6;
+              return loadState(ops);
+            case 6:
+              state = _context.v;
+              if (!(state.status === "error")) {
+                _context.n = 7;
+                break;
+              }
+              return _context.a(2, state.result);
+            case 7:
+              deps = {
+                ops: ops,
+                config: options,
+                ctx: ctx,
+                state: state.state
+              };
+              _context.n = 8;
+              return tool.handler(parsed.data, deps);
+            case 8:
+              return _context.a(2, _context.v);
+            case 9:
+              _context.p = 9;
+              _t = _context.v;
+              return _context.a(2, {
+                status: "error",
+                code: "internal",
+                message: _t instanceof Error ? _t.message : String(_t)
+              });
+          }
+        }, _callee, null, [[5, 9]]);
+      }))();
+    },
+    dispose: function dispose() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
+        return _regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              return _context2.a(2);
+          }
+        }, _callee2);
+      }))();
+    } // Nothing to release today: ValOps holds no handle that needs closing, and
+    // the fs watcher it can start is owned by the Studio's server. Kept in the
+    // contract so hosts wire up teardown now rather than when it starts to
+    // matter.
+  };
+}
+
+/**
+ * Pick the data layer for a call, which in proxy mode means picking whose
+ * credential the backend will see.
+ *
+ * This is the one place authorization is decided, and in proxy mode there is
+ * exactly one credential it will act on: an access token whose signature,
+ * issuer, audience and expiry the host verified against the authorization
+ * server's published key. Anything less is refused here rather than forwarded.
+ *
+ * There used to be a second route — the caller's personal access token, passed
+ * through unread on the reasoning that the backend, not the app, is the
+ * authority on what it may do. That was true, and it was still the wrong shape:
+ * it made an unauthenticated bearer token on a deployed endpoint a supported
+ * configuration, and it meant `initValMcp` had a path where an app served MCP
+ * without ever being told where to authorize. A host that has not verified
+ * anything now gets a refusal that names the missing `oauth` config.
+ *
+ * What has *not* changed is why a verified token does not become the app's own
+ * API key by some other name. The app authenticates to the backend with its own
+ * key here, and who did what travels as the patch's `authorId` — so the
+ * profile has to be one the host checked cryptographically, never one it was
+ * handed. An `authenticate()` that decided a credential's rights inside the app
+ * would make every bug in it full access to every project that key can reach.
+ */
+function createOpsResolver(valModules, options) {
+  if (options.mode === "fs") {
+    // One instance, built once: fs mode is a developer's own working tree, so
+    // there is no credential to vary by and no reason to re-evaluate modules.
+    var ops = createValOps(valModules, options);
+    return function (ctx) {
+      if (ctx.auth) {
+        // Refused rather than ignored. A host that thinks it is passing a
+        // credential should not silently get local filesystem access instead —
+        // and the difference matters, because fs mode writes straight to disk
+        // with no backend permission check at all.
+        //
+        // A verified access token is not something the caller chose to send: it
+        // only exists because this app advertised an authorization server, so
+        // the developer seeing this did not do anything wrong — a config file
+        // did, and naming it is the difference between a two-minute fix and an
+        // afternoon.
+        return {
+          status: "error",
+          result: {
+            status: "error",
+            code: "unsupported",
+            message: "This Val project is running in local filesystem mode, so there is nothing to authenticate against, but it is configured with an `oauth` issuer and is therefore asking clients for an access token it cannot use. Remove the `oauth` config (or `VAL_OAUTH_ISSUER` from your local `.env`) for local development."
+          }
+        };
+      }
+      return {
+        status: "ok",
+        ops: ops
+      };
+    };
+  }
+
+  /**
+   * One instance for every verified caller, and that is correct rather than a
+   * shortcut: this instance authenticates with the app's own API key, so there
+   * is nothing per-caller in it to keep apart. Who did what travels as the
+   * patch's `authorId` instead — see `writePath`.
+   *
+   * One instance is also all proxy mode keeps now. It could not share while a
+   * personal access token reached this function: each token needed its own
+   * `ValOpsHttp` to hold it, each of those cached the project's evaluated
+   * modules, and the bounded cache that kept that memory in check turned an
+   * eviction into a re-evaluation of every module on the next call.
+   */
+  var sharedOps = null;
+  return function (ctx) {
+    var _ctx$auth;
+    if (((_ctx$auth = ctx.auth) === null || _ctx$auth === void 0 ? void 0 : _ctx$auth.type) !== "verified-profile") {
+      return {
+        status: "error",
+        result: {
+          status: "error",
+          code: "forbidden",
+          message: "This Val project talks to the Val content backend, so every call needs an access token from the Val authorization server. If this endpoint is not asking clients to authorize, it has no `oauth` config — give `initValMcp` one, or run the project in local filesystem mode for development."
+        }
+      };
+    }
+    if (!options.apiKey) {
+      // Proxy mode is inferred from the api key being present, so this is
+      // unreachable through `initHandlerOptions`. It stays because the
+      // alternative to refusing is building ops with no credential at all.
+      return {
+        status: "error",
+        result: {
+          status: "error",
+          code: "forbidden",
+          message: "This Val project has no API key configured, so a verified access token cannot be exchanged for backend access."
+        }
+      };
+    }
+    if (!sharedOps) {
+      sharedOps = createValOps(valModules, options);
+    }
+    return {
+      status: "ok",
+      ops: sharedOps
+    };
+  };
+}
+/**
+ * The content as the caller should see it, loaded once per call.
+ *
+ * Pending patches are applied, because an agent looking at a project mid-edit
+ * should see what the Studio would show rather than the last published state.
+ *
+ * Deliberately not cached across calls. In fs mode a save recomputes the base
+ * sha within the same process, so a cached view would go stale silently — and
+ * the cost of being wrong here is an agent writing a patch against content that
+ * has already moved.
+ *
+ * Exported for `toolsFixture`, not for consumers: `tools/index.ts` re-exports by
+ * name, so this stays inside the package. A test that assembled its own state
+ * would be asserting against a view no real call ever sees.
+ */
+function loadState(_x) {
+  return _loadState.apply(this, arguments);
+}
+function _loadState() {
+  _loadState = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(ops) {
+    var patches, analysis, sourcesRes, _yield$Promise$all, _yield$Promise$all2, schemas, serializedSchemas;
+    return _regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          _context3.n = 1;
+          return ops.fetchPatches({
+            excludePatchOps: false
+          });
+        case 1:
+          patches = _context3.v;
+          if (!patches.unauthorized) {
+            _context3.n = 2;
+            break;
+          }
+          return _context3.a(2, {
+            status: "error",
+            result: {
+              status: "error",
+              code: "forbidden",
+              message: "Not authorized to read this project's pending changes. Check that the credential is valid and has access."
+            }
+          });
+        case 2:
+          if (!patches.networkError) {
+            _context3.n = 3;
+            break;
+          }
+          return _context3.a(2, {
+            status: "error",
+            result: {
+              status: "error",
+              code: "internal",
+              message: "Could not reach the Val content backend."
+            }
+          });
+        case 3:
+          if (!patches.error) {
+            _context3.n = 4;
+            break;
+          }
+          return _context3.a(2, {
+            status: "error",
+            result: {
+              status: "error",
+              code: "internal",
+              message: patches.error.message
+            }
+          });
+        case 4:
+          analysis = ops.analyzePatches(patches.patches); // getSourcesWithPatchesApplied, not getSources(analysis): the latter returns
+          // only the modules that had patches, and validating that subset reports
+          // spurious errors for anything that looks across modules, like keyOf or a
+          // router.
+          _context3.n = 5;
+          return ops.getSourcesWithPatchesApplied(_objectSpread2(_objectSpread2({}, analysis), patches));
+        case 5:
+          sourcesRes = _context3.v;
+          _context3.n = 6;
+          return Promise.all([ops.getSchemas(), ops.getSerializedSchemas()]);
+        case 6:
+          _yield$Promise$all = _context3.v;
+          _yield$Promise$all2 = _slicedToArray(_yield$Promise$all, 2);
+          schemas = _yield$Promise$all2[0];
+          serializedSchemas = _yield$Promise$all2[1];
+          return _context3.a(2, {
+            status: "ok",
+            state: {
+              schemas: schemas,
+              serializedSchemas: serializedSchemas,
+              sources: sourcesRes.sources,
+              patches: patches,
+              analysis: analysis,
+              // Which modules hold a pending patch that would not apply. Carried rather
+              // than discarded because their `sources` silently lack that change: the
+              // content here is not what publishing would produce, so a write against
+              // it would be based on a state that does not exist. See
+              // `unappliedPatchesFor`.
+              unappliedPatches: sourcesRes.errors
+            }
+          });
+      }
+    }, _callee3);
+  }));
+  return _loadState.apply(this, arguments);
+}
+function describeZodError(error) {
+  return error.issues.map(function (issue) {
+    var path = issue.path.join(".");
+    return path ? "".concat(path, ": ").concat(issue.message) : issue.message;
+  }).join("; ");
+}
+
+/**
+ * Refuse a call the token was not granted, before anything is attempted.
+ *
+ * Derived from `readOnlyHint` rather than from a second list of tool names,
+ * because a second list is a thing that drifts. The derivation also fails in
+ * the safe direction: a tool that forgets the hint is treated as a write and
+ * demands the wider scope, rather than a write slipping through as a read.
+ *
+ * The early return is a call carrying no verified credential, and there is no
+ * scope to check because nothing granted one. In Val's own host that means
+ * local filesystem mode, where a project writing a developer's own working tree
+ * has no wider authority to withhold. A host assembling its own context can
+ * also reach it with an unauthenticated proxy-mode call — refused a few lines
+ * later, by `resolveOps`, for the credential rather than the scope. Every other
+ * caller arrives as a verified profile, carrying the scopes its token was
+ * issued with.
+ */
+function refuseInsufficientScope(tool, ctx) {
+  var _ctx$auth2, _tool$annotations;
+  if (((_ctx$auth2 = ctx.auth) === null || _ctx$auth2 === void 0 ? void 0 : _ctx$auth2.type) !== "verified-profile") {
+    return null;
+  }
+  // Read is needed by every call, including the writes: a tool that changes
+  // content reads it first, and `ValToolAuth` says as much. Checking only the
+  // wider scope would let a write-but-not-read token through here — today's
+  // verifier refuses such a token before this point, but `createValTools` is
+  // exported and another host may not.
+  var needed = (_tool$annotations = tool.annotations) !== null && _tool$annotations !== void 0 && _tool$annotations.readOnlyHint ? [VAL_SCOPE_READ] : [VAL_SCOPE_READ, VAL_SCOPE_WRITE];
+  var granted = ctx.auth.scopes;
+  var missing = needed.filter(function (scope) {
+    return !granted.includes(scope);
+  });
+  if (missing.length === 0) {
+    return null;
+  }
+  return {
+    status: "error",
+    code: "forbidden",
+    message: "This access token does not have the ".concat(missing.join(" and "), " scope, which ").concat(tool.name, " requires. Granted: ").concat(granted.length > 0 ? granted.join(" ") : "(none)", ".")
+  };
+}
+
+/**
+ * Where a remote image goes, and what its ref has to say.
+ *
+ * Only one thing here needs the network: a project's `publicProjectId` and its
+ * list of buckets, which `getSettings` answers. Everything else is arithmetic
+ * over bytes the caller already handed us.
+ *
+ * And **no credential comes from the MCP caller**, in either mode. The rule is
+ * `resolveRemoteFileAuth` in `@valbuild/server`, shared with the Studio's own
+ * api routes: the app's api key where there is one, and otherwise — local
+ * development — the developer's own `val login` token off disk. That is the
+ * same precondition `val validate --fix` has, and the same one the Studio has
+ * when it uploads a remote image from a laptop.
+ *
+ * What this does NOT do is upload anything to the content host. A remote
+ * image's bytes go into the patch store like any other pending file, and the
+ * push to `remote.val.build` happens at publish, from
+ * `ValOpsFS.saveOrUploadFiles(mode: "upload-remote")`. See
+ * `docs/plans/mcp-remote-images.md` Part A.
+ */
+
+/**
+ * Resolves the project's remote-file settings, once.
+ *
+ * Cached for the life of the process because the answer does not move — a
+ * project's public id never changes and its bucket list changes when someone
+ * adds a bucket, which is not something an agent's upload should pay a network
+ * round trip to notice. Held as the promise rather than the value so that two
+ * uploads arriving together make one request rather than two.
+ */
+
+function createRemoteSettingsLoader(options) {
+  var inFlight = null;
+  return function () {
+    if (inFlight === null) {
+      inFlight = load(options).then(function (result) {
+        if (result.status !== "success") {
+          // Not cached: a missing `val login` is a thing a developer fixes
+          // while the dev server keeps running, and caching the refusal would
+          // mean they had to restart it to find out they had.
+          inFlight = null;
+        }
+        return result;
+      });
+    }
+    return inFlight;
+  };
+}
+function load(_x) {
+  return _load.apply(this, arguments);
+}
+/**
+ * Which bucket the next remote file goes in.
+ *
+ * Round-robin from a per-process counter, which is what `val validate --fix`
+ * does. It spreads a project's files rather than balancing anything, and the
+ * bucket is baked into the ref, so where a given file lands does not matter as
+ * long as it is remembered — which the ref does. A restarted server starts the
+ * rotation again, and that is fine for the same reason.
+ */
+function _load() {
+  _load = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(options) {
+    var auth, settings, buckets;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          if (options.project) {
+            _context.n = 1;
+            break;
+          }
+          return _context.a(2, err("unsupported", "This Val project is not connected to Val Build, so there is nowhere to upload a remote image to. Set `project` in val.config (or the VAL_PROJECT environment variable), or use a schema without `remote: true`."));
+        case 1:
+          _context.n = 2;
+          return resolveRemoteFileAuth(options);
+        case 2:
+          auth = _context.v;
+          if (!(auth.status === "error")) {
+            _context.n = 3;
+            break;
+          }
+          return _context.a(2, err("forbidden", auth.errorCode === "pat-error" ?
+          // The CLI's own wording, near enough: this is the same missing file,
+          // and someone who has seen it once should recognise it.
+          "This project stores its images remotely, and uploading one needs you to be logged in. Run `npx val login` in the project directory, then try again." : "Could not work out which credential to upload remote files with: ".concat(auth.message)));
+        case 3:
+          _context.n = 4;
+          return getSettings(options.project, auth.auth);
+        case 4:
+          settings = _context.v;
+          if (settings.success) {
+            _context.n = 5;
+            break;
+          }
+          return _context.a(2, err("internal", "Could not read this project's remote file settings: ".concat(settings.message)));
+        case 5:
+          buckets = settings.data.remoteFileBuckets.map(function (b) {
+            return b.bucket;
+          });
+          if (!(buckets.length === 0)) {
+            _context.n = 6;
+            break;
+          }
+          return _context.a(2, err("internal", "The project ".concat(options.project, " has no remote file buckets configured, so there is nowhere to put a remote image.")));
+        case 6:
+          return _context.a(2, {
+            status: "success",
+            publicProjectId: settings.data.publicProjectId,
+            buckets: buckets
+          });
+      }
+    }, _callee);
+  }));
+  return _load.apply(this, arguments);
+}
+var bucketCounter = 0;
+function nextBucket(buckets) {
+  bucketCounter += 1;
+  return buckets[bucketCounter % buckets.length];
+}
+function resolveRemoteUploadTarget(_x2) {
+  return _resolveRemoteUploadTarget.apply(this, arguments);
+}
+
+/**
+ * The remote ref for these bytes, under this schema.
+ *
+ * The validation hash is the delicate part, and the reason `schema` is a
+ * parameter rather than something derived here: it is baked into the ref, and
+ * the validator recomputes it from the schema it finds at the path. Hand this
+ * the wrong schema and the upload succeeds and then never validates — see
+ * `docs/plans/mcp-remote-images.md` Part D, and `remoteImageSchemaFor`, which
+ * is where a gallery's synthesized schema comes from.
+ */
+function _resolveRemoteUploadTarget() {
+  _resolveRemoteUploadTarget = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(loadSettings) {
+    var settings, coreVersion;
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          _context2.n = 1;
+          return loadSettings();
+        case 1:
+          settings = _context2.v;
+          if (!(settings.status !== "success")) {
+            _context2.n = 2;
+            break;
+          }
+          return _context2.a(2, settings);
+        case 2:
+          coreVersion = Internal.VERSION.core;
+          if (coreVersion) {
+            _context2.n = 3;
+            break;
+          }
+          return _context2.a(2, err("internal", "Could not get @valbuild/core package version"));
+        case 3:
+          return _context2.a(2, {
+            status: "success",
+            target: {
+              publicProjectId: settings.publicProjectId,
+              bucket: nextBucket(settings.buckets),
+              coreVersion: coreVersion,
+              // Read the way `val validate --fix` reads it. Deliberately not from
+              // `ValConfig`, which has no such field: the remote host is where Val's
+              // own file service lives rather than something a project configures, and
+              // the env var is the escape hatch for pointing at another one.
+              remoteHost: process.env.VAL_REMOTE_HOST || DEFAULT_VAL_REMOTE_HOST
+            }
+          });
+      }
+    }, _callee2);
+  }));
+  return _resolveRemoteUploadTarget.apply(this, arguments);
+}
+function buildRemoteRef(input) {
+  var target = input.target;
+  var fileHash = Internal.remote.getFileHash(Buffer.from(input.bytes));
+  return Internal.remote.createRemoteRef(target.remoteHost, {
+    publicProjectId: target.publicProjectId,
+    coreVersion: target.coreVersion,
+    bucket: target.bucket,
+    validationHash: Internal.remote.getValidationHash(target.coreVersion, input.schema, input.fileExt, input.metadata, fileHash, new TextEncoder()),
+    fileHash: fileHash,
+    filePath: input.filePath
+  });
+}
+
+/**
+ * Uploading an image over MCP.
+ *
+ * Not part of the default tool set, and constructed separately for a reason
+ * that is about dependencies rather than about design: reading the dimensions
+ * out of a JPEG and converting it to WebP needs an image library, and `sharp`
+ * is a native dependency that would otherwise be installed by every project
+ * that installs Val. So the host builds this one and hands it in — see
+ * `createValTools`'s `extraTools`, and `@valbuild/mcp/sharp`.
+ *
+ * What it deliberately does NOT do: remote files. `s.image({ remote: true })`
+ * uploads straight to Val's content host through a presigned nonce, which is
+ * the one path in local mode that needs a personal access token
+ * (`docs/plans/mcp.md` D.1). Refused with a message that says so rather than
+ * half-implemented, because a remote ref whose bytes were never uploaded fails
+ * a long way from here.
+ */
+
+var ModuleFilePathSchema = z.string().describe('Path of the Val module, e.g. "/content/pages.val.ts".');
+
+/**
+ * How big an inline image may be, in bytes of decoded binary.
+ *
+ * Base64 arrives inside a JSON-RPC message that the host has already buffered,
+ * so this is not the memory bound it looks like — the bound is on how much of
+ * a model's context an image is worth spending, and on not writing a 200MB
+ * file into `.val/patches` because an argument was malformed. A file on disk
+ * is not subject to it: nothing had to carry those bytes to get here.
+ */
+var MAX_INLINE_BYTES = 20 * 1024 * 1024;
+function createValImageTools(processor, options) {
+  /**
+   * One settings loader per config, made on first use.
+   *
+   * Not made here, because the config arrives with the call: the host builds
+   * these tools and hands them to `createValTools`, which is what knows how the
+   * project is configured. Keyed by identity rather than remade every call so
+   * that a gallery of twenty images asks the content host once — and so that
+   * the same tools handed to two registries do not share one answer.
+   */
+  var loader = null;
+  var loaderConfig = null;
+  var settingsFor = function settingsFor(config) {
+    if (options !== null && options !== void 0 && options.loadRemoteSettings) {
+      return options.loadRemoteSettings;
+    }
+    if (loader === null || loaderConfig !== config) {
+      loader = createRemoteSettingsLoader(config);
+      loaderConfig = config;
+    }
+    return loader;
+  };
+  return [defineTool({
+    name: "upload_image",
+    title: "Upload an image",
+    description: "Upload an image file and put it in an image field, or add it to an image gallery module (one declared with s.images()). Give it either imageFilePath — a path to a file on the machine this app runs on — or imageBase64. The image is re-encoded first if the schema asks for that. Works for remotely stored images too (s.image({ remote: true })), which need the project to be connected to Val Build.",
+    inputSchema: z.object({
+      moduleFilePath: ModuleFilePathSchema,
+      path: z.array(z.string())["default"]([]).describe('Path of the image field within the module, e.g. ["hero","image"]. Leave empty when the module itself is an image gallery — the image is then added to it under a generated key.'),
+      imageFilePath: z.string().optional().describe("Absolute path to an image file on the machine running this app. Prefer this over imageBase64: it does not have to travel through the conversation."),
+      imageBase64: z.string().optional().describe("The image itself, as a data URL or bare base64. Use only when there is no file to point at."),
+      filename: z.string().optional().describe("Name to base the stored filename on. Defaults to the name of imageFilePath. A content hash is appended either way, and the extension is taken from the bytes rather than from this."),
+      alt: z.string().optional().describe("Alt text describing the image, for screen readers.")
+    }),
+    annotations: {
+      idempotentHint: false
+    }
+  }, /*#__PURE__*/function () {
+    var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(args, deps) {
+      var modulePath, moduleSchema, target, read, prepared, metadata, fileHash, dataUrl, generated, storedPath, resolvedRef, file, saved, _t, _t2;
+      return _regenerator().w(function (_context) {
+        while (1) switch (_context.n) {
+          case 0:
+            modulePath = args.moduleFilePath;
+            moduleSchema = deps.state.serializedSchemas[modulePath];
+            if (moduleSchema) {
+              _context.n = 1;
+              break;
+            }
+            return _context.a(2, err("not-found", "No Val module at ".concat(JSON.stringify(modulePath), ".")));
+          case 1:
+            target = resolveTarget(deps, moduleSchema, args.path);
+            if (!(target.status === "error")) {
+              _context.n = 2;
+              break;
+            }
+            return _context.a(2, target.result);
+          case 2:
+            if (!(target.altRequired && args.alt === undefined)) {
+              _context.n = 3;
+              break;
+            }
+            return _context.a(2, err("invalid-args", "This gallery requires alt text for every image, so pass `alt` — a short description of what the image shows, for people using a screen reader."));
+          case 3:
+            _context.n = 4;
+            return readInputImage(args);
+          case 4:
+            read = _context.v;
+            if (!(read.status === "error")) {
+              _context.n = 5;
+              break;
+            }
+            return _context.a(2, read.result);
+          case 5:
+            _context.n = 6;
+            return prepareImage(processor, read.bytes, read.filename, target.encode, target.accept);
+          case 6:
+            prepared = _context.v;
+            if (!(prepared.status === "error")) {
+              _context.n = 7;
+              break;
+            }
+            return _context.a(2, prepared.result);
+          case 7:
+            metadata = _objectSpread2({
+              width: prepared.width,
+              height: prepared.height,
+              mimeType: prepared.mimeType
+            }, args.alt !== undefined ? {
+              alt: args.alt
+            } : {});
+            fileHash = Internal.getSHA256Hash(prepared.bytes);
+            dataUrl = "data:".concat(prepared.mimeType, ";base64,").concat(Buffer.from(prepared.bytes).toString("base64"));
+            generated = Internal.createFilename(dataUrl, prepared.filename, metadata, fileHash);
+            if (generated) {
+              _context.n = 8;
+              break;
+            }
+            return _context.a(2, err("internal", "Could not derive a filename for the uploaded image."));
+          case 8:
+            // Where the bytes live, always: a `/public/...` path in the patch
+            // store. For a remote image the CONTENT points somewhere else, but the
+            // bytes still land here and stay here until publish pushes them.
+            storedPath = "".concat(target.directory, "/").concat(generated);
+            _context.n = 9;
+            return resolveRef(target, settingsFor(deps.config), {
+              bytes: prepared.bytes,
+              storedPath: storedPath,
+              generated: generated,
+              metadata: metadata
+            });
+          case 9:
+            resolvedRef = _context.v;
+            if (!(resolvedRef.status === "error")) {
+              _context.n = 10;
+              break;
+            }
+            return _context.a(2, resolvedRef);
+          case 10:
+            file = {
+              ref: resolvedRef.ref,
+              storedPath: storedPath,
+              remote: target.remote !== null,
+              dataUrl: dataUrl,
+              metadata: metadata
+            };
+            if (!(target.kind === "gallery")) {
+              _context.n = 12;
+              break;
+            }
+            _context.n = 11;
+            return uploadToGallery(deps, modulePath, target.gallerySchema, file);
+          case 11:
+            _t = _context.v;
+            _context.n = 17;
+            break;
+          case 12:
+            if (!target.galleryBacked) {
+              _context.n = 14;
+              break;
+            }
+            _context.n = 13;
+            return uploadToGalleryBackedField(deps, {
+              fieldModule: modulePath,
+              fieldPath: args.path,
+              galleryModule: target.referencedModule,
+              file: file
+            });
+          case 13:
+            _t2 = _context.v;
+            _context.n = 16;
+            break;
+          case 14:
+            _context.n = 15;
+            return uploadToField(deps, modulePath, args.path, file);
+          case 15:
+            _t2 = _context.v;
+          case 16:
+            _t = _t2;
+          case 17:
+            saved = _t;
+            if (!(saved.status === "error")) {
+              _context.n = 18;
+              break;
+            }
+            return _context.a(2, saved);
+          case 18:
+            return _context.a(2, {
+              status: "ok",
+              data: _objectSpread2(_objectSpread2({}, saved.data), {}, {
+                filePath: file.ref,
+                remote: file.remote,
+                width: prepared.width,
+                height: prepared.height,
+                mimeType: prepared.mimeType,
+                // Said out loud rather than left to be inferred from the mime
+                // type: `encode` silently keeps the original when the conversion
+                // would have made the file bigger, and "why is this still a PNG"
+                // is otherwise unanswerable from the result.
+                reEncoded: prepared.reEncoded
+              })
+            });
+        }
+      }, _callee);
+    }));
+    return function (_x, _x2) {
+      return _ref.apply(this, arguments);
+    };
+  }())];
+}
+
+/**
+ * What the content will point at: a local path, or a remote ref.
+ *
+ * The remote branch is the only thing in this tool that talks to the network,
+ * and all it asks for is which project and which bucket. The bytes do not go to
+ * the content host here — they go to the patch store like any other pending
+ * file, and publish pushes them. See `docs/plans/mcp-remote-images.md` Part A.
+ */
+function resolveRef(_x3, _x4, _x5) {
+  return _resolveRef.apply(this, arguments);
+}
+/**
+ * Where the image is going, and what the schema there says about it.
+ *
+ * Two shapes, and they are genuinely different rather than two spellings of
+ * one: a gallery is a record keyed by file path, so an upload ADDS an entry
+ * under a key it generates, while a field is a single value, so an upload
+ * REPLACES it. Resolving both here keeps that difference in one place instead
+ * of scattered through the handler.
+ */
+function _resolveRef() {
+  _resolveRef = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(target, loadSettings, file) {
+    var relative, resolved;
+    return _regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          if (!(target.remote === null)) {
+            _context3.n = 1;
+            break;
+          }
+          return _context3.a(2, {
+            status: "ok",
+            ref: file.storedPath
+          });
+        case 1:
+          relative = file.storedPath.startsWith("/public/") ? file.storedPath.slice(1) : null;
+          if (!(relative === null)) {
+            _context3.n = 2;
+            break;
+          }
+          return _context3.a(2, err("invalid-args", "A remote image has to be stored under /public, and this schema's directory is ".concat(JSON.stringify(target.directory), ".")));
+        case 2:
+          _context3.n = 3;
+          return resolveRemoteUploadTarget(loadSettings);
+        case 3:
+          resolved = _context3.v;
+          if (!(resolved.status !== "success")) {
+            _context3.n = 4;
+            break;
+          }
+          return _context3.a(2, resolved);
+        case 4:
+          return _context3.a(2, {
+            status: "ok",
+            ref: buildRemoteRef({
+              target: resolved.target,
+              bytes: file.bytes,
+              filePath: relative,
+              fileExt: getFileExt(file.generated),
+              metadata: file.metadata,
+              schema: target.remote.schema
+            })
+          });
+      }
+    }, _callee3);
+  }));
+  return _resolveRef.apply(this, arguments);
+}
+/**
+ * That this image is stored remotely, and the schema its ref is hashed against.
+ *
+ * The schema is carried rather than looked up later because getting it wrong is
+ * silent: the validation hash is baked into the ref, the validator recomputes it
+ * from the schema it finds at the path, and a mismatch means a file that uploads
+ * and then never validates. See `docs/plans/mcp-remote-images.md` Part D.
+ */
+/** The default in `createFilePatch`, and the same default here. */
+var DEFAULT_DIRECTORY = "/public/val";
+function resolveTarget(deps, moduleSchema, fieldPath) {
+  var _ref2, _schema$options$direc, _schema$options, _schema$options$accep, _schema$options2, _schema$options3;
+  if (fieldPath.length === 0) {
+    var _moduleSchema$directo;
+    if (moduleSchema.type !== "record" || moduleSchema.mediaType !== "images") {
+      return {
+        status: "error",
+        result: err("invalid-args", "The module is not an image gallery (it is a ".concat(moduleSchema.type, "), so an image cannot be added to it directly. Give a path to the image field within it."))
+      };
+    }
+    return {
+      status: "ok",
+      kind: "gallery",
+      gallerySchema: moduleSchema,
+      directory: (_moduleSchema$directo = moduleSchema.directory) !== null && _moduleSchema$directo !== void 0 ? _moduleSchema$directo : DEFAULT_DIRECTORY,
+      accept: moduleSchema.accept,
+      encode: resolveEncodeSettings(undefined, moduleSchema.encode),
+      altRequired: altIsRequired(moduleSchema),
+      remote: moduleSchema.remote ? {
+        schema: galleryEntryImageSchema(moduleSchema)
+      } : null
+    };
+  }
+  var resolved = resolveSerializedSchemaAtPath(moduleSchema, fieldPath);
+  if (resolved.kind === "gallery-traversed") {
+    return {
+      status: "error",
+      result: err("invalid-args", "That path addresses an entry inside an image gallery. Upload to the gallery module itself, with an empty path — the key is generated from the image.")
+    };
+  }
+  if (resolved.kind !== "leaf") {
+    return {
+      status: "error",
+      result: err("not-found", "No image field at ".concat(JSON.stringify(fieldPath.join(".")), " in this module."))
+    };
+  }
+  var schema = resolved.schema;
+  if (schema.type !== "image") {
+    return {
+      status: "error",
+      result: err("invalid-args", "The value at ".concat(JSON.stringify(fieldPath.join(".")), " is a ").concat(schema.type, ", not an image."))
+    };
+  }
+  // A gallery-backed field (`s.image(galleryVal)`) serializes with EMPTY
+  // options, so `accept`, `directory` and `encode` all have to fall through to
+  // the gallery or it would never honour what the gallery asked for. The
+  // field's own option wins where it has one — this is `ImageField`'s
+  // resolution order, and the two must not disagree.
+  var referencedModule = schema.referencedModule;
+  var gallerySchema = referencedModule ? deps.state.serializedSchemas[referencedModule] : undefined;
+  var galleryRecord = (gallerySchema === null || gallerySchema === void 0 ? void 0 : gallerySchema.type) === "record" ? gallerySchema : undefined;
+  // Where the bytes end up is what decides which schema the ref is hashed
+  // against. A gallery-backed field's image is a GALLERY entry — the field only
+  // points at it — so it is the gallery's synthesized schema either way, and a
+  // plain field is hashed against its own. `s.image(gallery)` has no `remote`
+  // option of its own, so a gallery-backed field is remote exactly when its
+  // gallery is.
+  var remote = galleryRecord ? galleryRecord.remote ? {
+    schema: galleryEntryImageSchema(galleryRecord)
+  } : null : schema.remote ? {
+    schema: schema
+  } : null;
+  return {
+    status: "ok",
+    kind: "field",
+    referencedModule: referencedModule,
+    galleryBacked: referencedModule !== undefined,
+    directory: (_ref2 = (_schema$options$direc = (_schema$options = schema.options) === null || _schema$options === void 0 ? void 0 : _schema$options.directory) !== null && _schema$options$direc !== void 0 ? _schema$options$direc : galleryRecord === null || galleryRecord === void 0 ? void 0 : galleryRecord.directory) !== null && _ref2 !== void 0 ? _ref2 : DEFAULT_DIRECTORY,
+    accept: (_schema$options$accep = (_schema$options2 = schema.options) === null || _schema$options2 === void 0 ? void 0 : _schema$options2.accept) !== null && _schema$options$accep !== void 0 ? _schema$options$accep : galleryRecord === null || galleryRecord === void 0 ? void 0 : galleryRecord.accept,
+    encode: resolveEncodeSettings((_schema$options3 = schema.options) === null || _schema$options3 === void 0 ? void 0 : _schema$options3.encode, galleryRecord === null || galleryRecord === void 0 ? void 0 : galleryRecord.encode),
+    // Only a gallery has an alt schema to satisfy. A plain `s.image()` field
+    // stores `alt` if it is given and is fine without it.
+    altRequired: galleryRecord ? altIsRequired(galleryRecord) : false,
+    remote: remote
+  };
+}
+
+/**
+ * The image schema a gallery ENTRY is validated as.
+ *
+ * A gallery's item schema is an object (width/height/mimeType/alt), but the
+ * remote ref's validation hash is computed over a `SerializedImageSchema` — so
+ * one has to be synthesized, carrying the `accept` and `directory` of the record
+ * that holds the entry. This is `handleRemoteGalleryFileUpload`'s synthesis, and
+ * it has to stay identical to it: the CLI's `--fix` writes refs this way and the
+ * check that validates them reads them the same way, so a third shape here would
+ * bake a hash that can never match.
+ */
+function galleryEntryImageSchema(gallery) {
+  return {
+    type: "image",
+    opt: false,
+    options: _objectSpread2(_objectSpread2({}, gallery.accept ? {
+      accept: gallery.accept
+    } : {}), gallery.directory ? {
+      directory: gallery.directory
+    } : {})
+  };
+}
+
+/**
+ * Does this gallery insist on alt text?
+ *
+ * `s.images()` gives `alt` a nullable string by default, and an entry written
+ * without one stores `null`. A gallery that passed its own — `s.images({ alt:
+ * s.string().minLength(4) })`, which the example app does — has made it
+ * required, and an upload with no `alt` cannot satisfy it however it is
+ * written. Asked here so the caller is told what to pass, rather than shown a
+ * validation error about a null it never chose.
+ */
+function altIsRequired(gallerySchema) {
+  if (gallerySchema.type !== "record") {
+    return false;
+  }
+  return gallerySchema.alt !== undefined && !gallerySchema.alt.opt;
+}
+
+/** The bytes to upload, from whichever of the two arguments was given. */
+function readInputImage(_x6) {
+  return _readInputImage.apply(this, arguments);
+}
+function _readInputImage() {
+  _readInputImage = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(args) {
+    var _args$imageBase, _args$filename2;
+    var hasPath, hasBase64, _args$filename, _bytes, base64, comma, payload, bytes, _t3;
+    return _regenerator().w(function (_context4) {
+      while (1) switch (_context4.p = _context4.n) {
+        case 0:
+          hasPath = args.imageFilePath !== undefined;
+          hasBase64 = args.imageBase64 !== undefined;
+          if (!(hasPath === hasBase64)) {
+            _context4.n = 1;
+            break;
+          }
+          return _context4.a(2, {
+            status: "error",
+            result: err("invalid-args", hasPath ? "Give either imageFilePath or imageBase64, not both." : "Give either imageFilePath — a path to a file on the machine this app runs on — or imageBase64.")
+          });
+        case 1:
+          if (!(args.imageFilePath !== undefined)) {
+            _context4.n = 5;
+            break;
+          }
+          _context4.p = 2;
+          _context4.n = 3;
+          return fs.readFile(args.imageFilePath);
+        case 3:
+          _bytes = _context4.v;
+          return _context4.a(2, {
+            status: "ok",
+            bytes: new Uint8Array(_bytes),
+            filename: (_args$filename = args.filename) !== null && _args$filename !== void 0 ? _args$filename : path.basename(args.imageFilePath)
+          });
+        case 4:
+          _context4.p = 4;
+          _t3 = _context4.v;
+          return _context4.a(2, {
+            status: "error",
+            result: err("not-found", "Could not read ".concat(JSON.stringify(args.imageFilePath), ": ").concat(_t3 instanceof Error ? _t3.message : String(_t3)))
+          });
+        case 5:
+          base64 = (_args$imageBase = args.imageBase64) !== null && _args$imageBase !== void 0 ? _args$imageBase : ""; // A data URL and a bare base64 string are both accepted, because a model
+          // asked for "base64" produces either and neither is wrong.
+          comma = base64.startsWith("data:") ? base64.indexOf(",") : -1;
+          payload = comma === -1 ? base64 : base64.slice(comma + 1);
+          _context4.p = 6;
+          bytes = Buffer.from(payload, "base64");
+          _context4.n = 8;
+          break;
+        case 7:
+          _context4.p = 7;
+          _context4.v;
+          return _context4.a(2, {
+            status: "error",
+            result: err("invalid-args", "imageBase64 is not valid base64.")
+          });
+        case 8:
+          if (!(bytes.length === 0)) {
+            _context4.n = 9;
+            break;
+          }
+          return _context4.a(2, {
+            status: "error",
+            result: err("invalid-args", "imageBase64 decoded to no bytes at all.")
+          });
+        case 9:
+          if (!(bytes.length > MAX_INLINE_BYTES)) {
+            _context4.n = 10;
+            break;
+          }
+          return _context4.a(2, {
+            status: "error",
+            result: err("invalid-args", "That image is ".concat(Math.round(bytes.length / (1024 * 1024)), "MB, over the ").concat(MAX_INLINE_BYTES / (1024 * 1024), "MB limit for an inline image. Write it to a file and pass imageFilePath instead."))
+          });
+        case 10:
+          return _context4.a(2, {
+            status: "ok",
+            bytes: new Uint8Array(bytes),
+            filename: (_args$filename2 = args.filename) !== null && _args$filename2 !== void 0 ? _args$filename2 : null
+          });
+      }
+    }, _callee4, null, [[6, 7], [2, 4]]);
+  }));
+  return _readInputImage.apply(this, arguments);
+}
+/**
+ * Read the image, and re-encode it when the schema asked for that.
+ *
+ * The conversion happens BEFORE the caller hashes anything, which is the whole
+ * reason it is here rather than after the patch is built: the SHA-256 becomes
+ * the filename suffix, the mime type picks the extension, and the width and
+ * height are stored — so converting afterwards would make every one of those
+ * describe a file that was never uploaded. Same rule as the browser's
+ * `readImageFromFile`, and the decisions are literally the same functions.
+ */
+function prepareImage(_x7, _x8, _x9, _x0, _x1) {
+  return _prepareImage.apply(this, arguments);
+}
+/**
+ * Refuse an image the schema says it does not store — checked on the FINAL
+ * bytes, never on the ones that arrived.
+ *
+ * The order is the whole point, and getting it backwards breaks the one
+ * combination `accept` and `encode` exist to serve together:
+ * `s.image({ accept: "image/webp", encode: { type: "webp" } })` means "I store
+ * webp, and I will convert what you give me". Checking the SOURCE against
+ * `accept` refuses the PNG that the conversion was there to turn into a webp —
+ * so the check belongs after the conversion, on what is actually stored.
+ *
+ * That the check happens at all is the one thing here the Studio does not do,
+ * and it is not a difference of opinion about `accept`. `ImageSchema` reports a
+ * mismatch with `fixes: ["image:check-metadata"]`, which
+ * `partitionValidationErrors` treats as server-repairable and therefore
+ * non-blocking — so nothing downstream would refuse this. The Studio does not
+ * need it to: its file picker carries `accept`, so a person cannot choose one.
+ * An agent has no picker, and this is it.
+ */
+function _prepareImage() {
+  _prepareImage = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(processor, bytes, filename, settings, accept) {
+    var original, asIs, targetMimeType, resizeTo, encoded, converted, _t5;
+    return _regenerator().w(function (_context5) {
+      while (1) switch (_context5.p = _context5.n) {
+        case 0:
+          _context5.p = 0;
+          _context5.n = 1;
+          return processor.read(bytes);
+        case 1:
+          original = _context5.v;
+          _context5.n = 3;
+          break;
+        case 2:
+          _context5.p = 2;
+          _t5 = _context5.v;
+          return _context5.a(2, {
+            status: "error",
+            result: err("internal", "Could not read the image: ".concat(_t5 instanceof Error ? _t5.message : String(_t5)))
+          });
+        case 3:
+          if (original) {
+            _context5.n = 4;
+            break;
+          }
+          return _context5.a(2, {
+            status: "error",
+            result: err("invalid-args", "Those bytes are not an image, or not one this app's image library can read.")
+          });
+        case 4:
+          asIs = {
+            status: "ok",
+            bytes: bytes,
+            width: original.width,
+            height: original.height,
+            mimeType: original.mimeType,
+            filename: filename,
+            reEncoded: false
+          };
+          if (!(settings === null)) {
+            _context5.n = 5;
+            break;
+          }
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 5:
+          targetMimeType = ENCODE_MIME_TYPE_OF[settings.type];
+          if (isMimeTypeAccepted(targetMimeType, accept)) {
+            _context5.n = 6;
+            break;
+          }
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 6:
+          resizeTo = fitWithin(original.width, original.height, settings.maxWidth, settings.maxHeight);
+          if (!isSkippedSource(original.mimeType, targetMimeType, resizeTo !== null)) {
+            _context5.n = 7;
+            break;
+          }
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 7:
+          _context5.p = 7;
+          _context5.n = 8;
+          return processor.encode(bytes, {
+            mimeType: targetMimeType,
+            quality: settings.quality,
+            resizeTo: resizeTo
+          });
+        case 8:
+          encoded = _context5.v;
+          _context5.n = 10;
+          break;
+        case 9:
+          _context5.p = 9;
+          _context5.v;
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 10:
+          if (encoded) {
+            _context5.n = 11;
+            break;
+          }
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 11:
+          _context5.p = 11;
+          _context5.n = 12;
+          return processor.read(encoded.bytes);
+        case 12:
+          converted = _context5.v;
+          _context5.n = 14;
+          break;
+        case 13:
+          _context5.p = 13;
+          _context5.v;
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 14:
+          if (!(!converted || !chooseEncoded({
+            originalSize: bytes.length,
+            encodedSize: encoded.bytes.length,
+            encodedType: converted.mimeType,
+            targetMimeType: targetMimeType,
+            needsDownscale: resizeTo !== null
+          }))) {
+            _context5.n = 15;
+            break;
+          }
+          return _context5.a(2, refuseUnaccepted(asIs, accept));
+        case 15:
+          return _context5.a(2, refuseUnaccepted({
+            status: "ok",
+            bytes: encoded.bytes,
+            width: converted.width,
+            height: converted.height,
+            mimeType: converted.mimeType,
+            filename: filename === null ? null : withExtension(filename, settings.type),
+            reEncoded: true
+          }, accept));
+      }
+    }, _callee5, null, [[11, 13], [7, 9], [0, 2]]);
+  }));
+  return _prepareImage.apply(this, arguments);
+}
+function refuseUnaccepted(prepared, accept) {
+  if (isMimeTypeAccepted(prepared.mimeType, accept)) {
+    return prepared;
+  }
+  return {
+    status: "error",
+    result: err("validation-failed", "This field only accepts ".concat(accept, ", and the image ").concat(prepared.reEncoded ? "converts to" : "is", " ").concat(prepared.mimeType, ". Convert it yourself first, or add `encode` to the schema so Val converts uploads for you."))
+  };
+}
+
+/**
+ * An uploaded image, and where it is going to live.
+ *
+ * Two paths, because a remote image has two. `ref` is what the content refers
+ * to — a `/public/...` path locally, a `remote.val.build` URL remotely — and it
+ * is what the patch stores. `storedPath` is where the BYTES go, which is the
+ * patch store in both cases and always a `/public/...` path: a remote ref is a
+ * URL that encodes one, and the store keys files by the path, not the URL.
+ *
+ * They are the same string for a local image, and separating them anyway is
+ * what stops the remote branch being a set of ad-hoc splits at each use.
+ */
+/** Add the image to a gallery module: it is a record keyed by the file path. */
+function uploadToGallery(_x10, _x11, _x12, _x13) {
+  return _uploadToGallery.apply(this, arguments);
+}
+/** Put the image in a field of its own: `replace` the value, `file` carries the bytes. */
+function _uploadToGallery() {
+  _uploadToGallery = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee6(deps, galleryModule, gallerySchema, file) {
+    var built, _splitFileOps, patchOps, uploadFiles;
+    return _regenerator().w(function (_context6) {
+      while (1) switch (_context6.n) {
+        case 0:
+          built = buildImageGalleryPatch({
+            filePath: file.ref,
+            imageKey: file.dataUrl,
+            metadata: file.metadata
+          }, gallerySchema);
+          if (!(built.kind !== "ok")) {
+            _context6.n = 1;
+            break;
+          }
+          return _context6.a(2, fromBuildResult(built));
+        case 1:
+          _splitFileOps = splitFileOps(built.patch, deps, file), patchOps = _splitFileOps.patchOps, uploadFiles = _splitFileOps.uploadFiles;
+          return _context6.a(2, savePatch(deps, galleryModule, patchOps, {
+            uploadFiles: uploadFiles
+          }));
+      }
+    }, _callee6);
+  }));
+  return _uploadToGallery.apply(this, arguments);
+}
+function uploadToField(_x14, _x15, _x16, _x17) {
+  return _uploadToField.apply(this, arguments);
+}
+/**
+ * `s.image(galleryVal)`: two modules, and the gallery goes first.
+ *
+ * The field carries only the path — the dimensions and the mime type live in
+ * the gallery, and a second copy on the field is how two copies of one fact get
+ * to disagree. So the bytes and the metadata are written to the gallery, and
+ * then the field is pointed at them.
+ *
+ * The order is not a preference. `s.image(gallery)` validates that the gallery
+ * HAS an entry for the path the field names, so a field written first refers to
+ * something that does not exist yet and the write is refused — correctly, by
+ * the same check that would catch a typo'd path.
+ */
+function _uploadToField() {
+  _uploadToField = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee7(deps, fieldModule, fieldPath, file) {
+    var built, _splitFileOps2, patchOps, uploadFiles;
+    return _regenerator().w(function (_context7) {
+      while (1) switch (_context7.n) {
+        case 0:
+          built = safeParsePatch([{
+            op: "replace",
+            path: fieldPath,
+            value: _objectSpread2({
+              path: file.ref
+            }, file.metadata)
+          }, {
+            op: "file",
+            path: fieldPath,
+            filePath: file.ref,
+            value: file.dataUrl,
+            metadata: file.metadata,
+            remote: false
+          }]);
+          if (!(built.kind !== "ok")) {
+            _context7.n = 1;
+            break;
+          }
+          return _context7.a(2, fromBuildResult(built));
+        case 1:
+          _splitFileOps2 = splitFileOps(built.patch, deps, file), patchOps = _splitFileOps2.patchOps, uploadFiles = _splitFileOps2.uploadFiles;
+          return _context7.a(2, savePatch(deps, fieldModule, patchOps, {
+            uploadFiles: uploadFiles
+          }));
+      }
+    }, _callee7);
+  }));
+  return _uploadToField.apply(this, arguments);
+}
+function uploadToGalleryBackedField(_x18, _x19) {
+  return _uploadToGalleryBackedField.apply(this, arguments);
+}
+/**
+ * Take the bytes out of the patch, and hand back the upload that puts them
+ * back.
+ *
+ * A patch that reaches the store must never carry binary data: the server
+ * never reads a `file` op's value as data, so base64 left in one produces NO
+ * file and fails silently — the patch applies, the source points at a path,
+ * and nothing is there. The hash that replaces it is the only thing in the
+ * patch that says WHICH bytes the op meant. This is `splitPatchFileOps` from
+ * the Studio, in the one place server-side that needs it.
+ */
+function _uploadToGalleryBackedField() {
+  _uploadToGalleryBackedField = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee8(deps, target) {
+    var gallerySchema, savedEntry, reloaded, fresh, built, savedField;
+    return _regenerator().w(function (_context8) {
+      while (1) switch (_context8.n) {
+        case 0:
+          gallerySchema = deps.state.serializedSchemas[target.galleryModule];
+          if (gallerySchema) {
+            _context8.n = 1;
+            break;
+          }
+          return _context8.a(2, err("not-found", "This field takes its images from ".concat(target.galleryModule, ", and there is no Val module there.")));
+        case 1:
+          _context8.n = 2;
+          return uploadToGallery(deps, target.galleryModule, gallerySchema, target.file);
+        case 2:
+          savedEntry = _context8.v;
+          if (!(savedEntry.status === "error")) {
+            _context8.n = 3;
+            break;
+          }
+          return _context8.a(2, savedEntry);
+        case 3:
+          _context8.n = 4;
+          return loadState(deps.ops);
+        case 4:
+          reloaded = _context8.v;
+          if (!(reloaded.status === "error")) {
+            _context8.n = 5;
+            break;
+          }
+          return _context8.a(2, reloaded.result);
+        case 5:
+          fresh = _objectSpread2(_objectSpread2({}, deps), {}, {
+            state: reloaded.state
+          });
+          built = safeParsePatch([{
+            op: "replace",
+            path: target.fieldPath,
+            // No `file` op and no metadata: the bytes are already in the gallery
+            // patch above, and the gallery is where everything about them lives.
+            value: {
+              path: target.file.ref
+            }
+          }]);
+          if (!(built.kind !== "ok")) {
+            _context8.n = 6;
+            break;
+          }
+          return _context8.a(2, fromBuildResult(built));
+        case 6:
+          _context8.n = 7;
+          return savePatch(fresh, target.fieldModule, built.patch, {
+            onInvalid: "report"
+          });
+        case 7:
+          savedField = _context8.v;
+          if (!(savedField.status === "error")) {
+            _context8.n = 8;
+            break;
+          }
+          return _context8.a(2, {
+            status: "error",
+            code: savedField.code,
+            // The image IS in the gallery, so reporting only that the second write
+            // failed would leave the caller thinking nothing happened.
+            message: "The image was uploaded and added to the gallery ".concat(target.galleryModule, ", but ").concat(target.fieldModule, " could not be pointed at it: ").concat(savedField.message)
+          });
+        case 8:
+          return _context8.a(2, savedField);
+      }
+    }, _callee8);
+  }));
+  return _uploadToGalleryBackedField.apply(this, arguments);
+}
+function splitFileOps(patch, deps, file) {
+  var ref = file.ref,
+    storedPath = file.storedPath,
+    remote = file.remote,
+    dataUrl = file.dataUrl,
+    metadata = file.metadata;
+  var textEncoder = new TextEncoder();
+  var patchOps = patch.map(function (op) {
+    return op.op === "file" && typeof op.value === "string" ? _objectSpread2(_objectSpread2({}, op), {}, {
+      value: Internal.getSHA256Hash(textEncoder.encode(op.value))
+    }) : op;
+  });
+  var uploadFiles = /*#__PURE__*/function () {
+    var _ref4 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(_ref3) {
+      var patchId, parentRef, saved;
+      return _regenerator().w(function (_context2) {
+        while (1) switch (_context2.n) {
+          case 0:
+            patchId = _ref3.patchId, parentRef = _ref3.parentRef;
+            _context2.n = 1;
+            return deps.ops.saveBase64EncodedBinaryFileFromPatch(storedPath, parentRef, patchId, dataUrl, "image", metadata);
+          case 1:
+            saved = _context2.v;
+            if (!saved.error) {
+              _context2.n = 2;
+              break;
+            }
+            return _context2.a(2, {
+              status: "error",
+              result: err("internal", "Could not store the uploaded image: ".concat(saved.error.message))
+            });
+          case 2:
+            return _context2.a(2, {
+              status: "ok",
+              // Keyed by the REF, which is what `analyzePatches` will key the real
+              // patch by once it exists — the file op carries the ref, not the path.
+              files: _defineProperty({}, ref, {
+                patchId: patchId,
+                remote: remote,
+                isDelete: false
+              })
+            });
+        }
+      }, _callee2);
+    }));
+    return function uploadFiles(_x20) {
+      return _ref4.apply(this, arguments);
+    };
+  }();
+  return {
+    patchOps: patchOps,
+    uploadFiles: uploadFiles
+  };
+}
+function fromBuildResult(built) {
+  if (built.kind === "wrong-tool") {
+    return err("invalid-args", "".concat(built.reason, " Use the ").concat(built.suggestedTool, " tool instead."));
+  }
+  return err("invalid-args", built.message);
+}
+
+var VERSION = function () {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require("../package.json").version;
+  } catch (_unused) {
+    return null;
+  }
+}();
+
+/**
+ * Verifying an OAuth access token, which is the whole of what makes this app a
+ * resource server rather than a relay.
+ *
+ * The token is issued by Val's authorization server and presented by an MCP
+ * client. This app holds no signing key for it and cannot mint one — it fetches
+ * the issuer's *public* keys and checks a signature. That asymmetry is the
+ * point: a verified `sub` is a fact about the token rather than a claim by
+ * whoever sent it, which is what lets the tools attribute a patch to that
+ * profile at all.
+ *
+ * ## Why this is not `jose`
+ *
+ * `jose` was the first choice and was rejected on a fact rather than a
+ * preference: version 6 is ESM-only (`"type": "module"`, no CJS export). This
+ * package is built by preconstruct and `require`d by Next.js server code, so an
+ * ESM-only dependency here is a runtime failure in consumers' apps, not a build
+ * inconvenience. Adding it would also put a dependency in every install of
+ * `@valbuild/next` for one function.
+ *
+ * The actual cryptography is still not hand-rolled — `node:crypto` does the
+ * ECDSA and the JWK import. What is written here is the JWS envelope and the
+ * claim checks, and the rules that keep that safe are worth stating because
+ * this repository has already shipped the counterexample (`decodeJwt`: `exp`
+ * never checked, a non-constant-time compare, verification skippable):
+ *
+ * - **`alg` is pinned**, not read from the token. The header is only consulted
+ *   for `kid`. A verifier that honours the token's own `alg` can be handed
+ *   `HS256` and will treat the *published* public key as a shared secret.
+ * - **Nothing is read from the payload before the signature verifies.** Claims
+ *   from an unverified token are attacker input.
+ * - **Keys come only from the configured issuer's JWKS**, never from the token.
+ *   The key set is cached, but a token naming a `kid` the cache does not hold
+ *   provokes one rate-limited refetch rather than a refusal — see
+ *   {@link UNKNOWN_KID_REFETCH_INTERVAL_MS}. Without that, this server's own
+ *   cache turns any key rotation into an outage lasting the rest of the TTL.
+ * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
+ *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
+ *   is rejected — or worse, a future change makes it accept the wrong thing.
+ */
+
+var DEFAULT_CLOCK_TOLERANCE_SECONDS = 60;
+/** How long a fetched key set is reused before it is fetched again. */
+var JWKS_TTL_MS = 5 * 60 * 1000;
+/**
+ * How long to wait before re-fetching after a failure.
+ *
+ * Shorter than the success TTL so a key rotation recovers quickly, but not zero:
+ * an unreachable issuer must not turn every tool call into another request to
+ * it.
+ */
+var JWKS_ERROR_TTL_MS = 30 * 1000;
+/**
+ * The floor between two refetches provoked by an unknown `kid`.
+ *
+ * A token naming a key this process has not seen is the one case where the TTL
+ * is the wrong answer: the issuer may have just rotated, and refusing for the
+ * rest of the five minutes turns a rotation into an outage. So an unknown `kid`
+ * bypasses the TTL — but only this often, because the `kid` comes from the
+ * token and the token comes from whoever is calling. Without a floor, a stream
+ * of random `kid`s would be a way to make this server hammer its own issuer.
+ *
+ * Note what the floor costs when it bites: a refusal, for a token that would
+ * have verified, for at most this long. That is the same failure the TTL used
+ * to guarantee for five minutes, so the trade only ever improves.
+ */
+var UNKNOWN_KID_REFETCH_INTERVAL_MS = 30 * 1000;
+/**
+ * One cache per issuer, and it has to outlive the request or it is not a cache:
+ * a fetch per tool call would put a network round trip in front of every read.
+ */
+var jwksCache = new Map();
+/** Concurrent misses share one fetch rather than starting several. */
+var inFlight = new Map();
+/**
+ * When an unknown `kid` last made us go back to the issuer, per issuer.
+ *
+ * Separate from the cache because it is a rate limit rather than a cache: it
+ * records an *attempt*, so a refetch that found nothing new still spends the
+ * window. Keyed by issuer, not by `kid`, or an attacker would simply use a new
+ * one each time.
+ */
+var unknownKidRefetchAtMs = new Map();
+function jwksUrl(issuer) {
+  // Not discovered from the issuer's metadata document, deliberately:
+  // discovery would mean one more request on the hot path and one more thing
+  // that can be pointed elsewhere. The location is fixed by convention and by
+  // Val's own authorization server.
+  return new URL("/.well-known/jwks.json", issuer).toString();
+}
+function loadJwks(_x, _x2) {
+  return _loadJwks.apply(this, arguments);
+}
+/**
+ * Go back to the issuer because the token named a key we do not have.
+ *
+ * Rate-limited, and the limit is the whole reason this is not just a call to
+ * {@link fetchJwks}: the `kid` that triggers it is attacker-controlled. Returns
+ * `null` when the window has not elapsed, which the caller reads as "nothing
+ * new to try" rather than as a failure.
+ *
+ * The limit is on *starting* a fetch, not on benefiting from one. A fetch
+ * already in flight is joined whatever the window says, because joining it
+ * costs the issuer nothing — and the case that matters is precisely a burst:
+ * at a rotation, many requests arrive at once carrying the same new `kid`, and
+ * refusing all but the first would be the outage this whole path exists to
+ * prevent, merely shortened from five minutes to thirty seconds.
+ *
+ * Only ever called with a successfully-fetched key set in hand. An error entry
+ * has its own, shorter TTL and its own recovery, and letting an unknown `kid`
+ * shortcut it would hand an unreachable issuer a retry storm.
+ */
+function _loadJwks() {
+  _loadJwks = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(config, nowMs) {
+    var url, cached, age, ttl, _t;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          url = jwksUrl(config.issuer);
+          cached = jwksCache.get(url);
+          if (!cached) {
+            _context.n = 1;
+            break;
+          }
+          age = cached.status === "keys" ? nowMs - cached.fetchedAtMs : nowMs - cached.failedAtMs;
+          ttl = cached.status === "keys" ? JWKS_TTL_MS : JWKS_ERROR_TTL_MS;
+          if (!(age < ttl)) {
+            _context.n = 1;
+            break;
+          }
+          return _context.a(2, {
+            entry: cached,
+            fromCache: true
+          });
+        case 1:
+          _context.n = 2;
+          return fetchJwks(config, nowMs);
+        case 2:
+          _t = _context.v;
+          return _context.a(2, {
+            entry: _t,
+            fromCache: false
+          });
+      }
+    }, _callee);
+  }));
+  return _loadJwks.apply(this, arguments);
+}
+function refetchForUnknownKid(_x3, _x4) {
+  return _refetchForUnknownKid.apply(this, arguments);
+}
+/**
+ * Fetch the key set, ignoring whatever is cached, and cache the result.
+ *
+ * Shares {@link inFlight} with every other caller, so a forced refetch that
+ * lands during an ordinary miss joins it rather than opening a second request.
+ * Only the caller that *starts* a fetch writes the cache — a joiner returns the
+ * shared promise above — so `keepCacheOnError` is a property of the fetch, not a
+ * race between callers.
+ */
+function _refetchForUnknownKid() {
+  _refetchForUnknownKid = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(config, nowMs) {
+    var url, existing, lastAttemptMs;
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          url = jwksUrl(config.issuer);
+          existing = inFlight.get(url);
+          if (!existing) {
+            _context2.n = 1;
+            break;
+          }
+          return _context2.a(2, existing);
+        case 1:
+          lastAttemptMs = unknownKidRefetchAtMs.get(url);
+          if (!(lastAttemptMs !== undefined && nowMs - lastAttemptMs < UNKNOWN_KID_REFETCH_INTERVAL_MS)) {
+            _context2.n = 2;
+            break;
+          }
+          return _context2.a(2, null);
+        case 2:
+          // Recorded before the await, so that once this fetch has finished the window
+          // is already closed against the next unknown `kid`.
+          unknownKidRefetchAtMs.set(url, nowMs);
+          return _context2.a(2, fetchJwks(config, nowMs, {
+            keepCacheOnError: true
+          }));
+      }
+    }, _callee2);
+  }));
+  return _refetchForUnknownKid.apply(this, arguments);
+}
+function fetchJwks(_x5, _x6) {
+  return _fetchJwks.apply(this, arguments);
+}
+function _fetchJwks() {
+  _fetchJwks = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(config, nowMs) {
+    var _config$fetchImpl;
+    var _ref,
+      _ref$keepCacheOnError,
+      keepCacheOnError,
+      url,
+      existing,
+      fetchImpl,
+      pending,
+      entry,
+      cached,
+      _args4 = arguments;
+    return _regenerator().w(function (_context4) {
+      while (1) switch (_context4.p = _context4.n) {
+        case 0:
+          _ref = _args4.length > 2 && _args4[2] !== undefined ? _args4[2] : {}, _ref$keepCacheOnError = _ref.keepCacheOnError, keepCacheOnError = _ref$keepCacheOnError === void 0 ? false : _ref$keepCacheOnError;
+          url = jwksUrl(config.issuer);
+          existing = inFlight.get(url);
+          if (!existing) {
+            _context4.n = 1;
+            break;
+          }
+          return _context4.a(2, existing);
+        case 1:
+          fetchImpl = (_config$fetchImpl = config.fetchImpl) !== null && _config$fetchImpl !== void 0 ? _config$fetchImpl : fetch;
+          pending = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3() {
+            var res, body, keys;
+            return _regenerator().w(function (_context3) {
+              while (1) switch (_context3.p = _context3.n) {
+                case 0:
+                  _context3.p = 0;
+                  _context3.n = 1;
+                  return fetchImpl(url, {
+                    headers: {
+                      accept: "application/json"
+                    }
+                  });
+                case 1:
+                  res = _context3.v;
+                  if (res.ok) {
+                    _context3.n = 2;
+                    break;
+                  }
+                  return _context3.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+                case 2:
+                  _context3.n = 3;
+                  return res.json();
+                case 3:
+                  body = _context3.v;
+                  keys = readKeys(body);
+                  if (!(keys === null)) {
+                    _context3.n = 4;
+                    break;
+                  }
+                  return _context3.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+                case 4:
+                  return _context3.a(2, {
+                    status: "keys",
+                    keys: keys,
+                    fetchedAtMs: nowMs
+                  });
+                case 5:
+                  _context3.p = 5;
+                  _context3.v;
+                  return _context3.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+              }
+            }, _callee3, null, [[0, 5]]);
+          }))();
+          inFlight.set(url, pending);
+          _context4.p = 2;
+          _context4.n = 3;
+          return pending;
+        case 3:
+          entry = _context4.v;
+          cached = jwksCache.get(url);
+          if (!(entry.status === "error" && keepCacheOnError && (cached === null || cached === void 0 ? void 0 : cached.status) === "keys")) {
+            _context4.n = 4;
+            break;
+          }
+          return _context4.a(2, entry);
+        case 4:
+          jwksCache.set(url, entry);
+          return _context4.a(2, entry);
+        case 5:
+          _context4.p = 5;
+          inFlight["delete"](url);
+          return _context4.f(5);
+        case 6:
+          return _context4.a(2);
+      }
+    }, _callee4, null, [[2,, 5, 6]]);
+  }));
+  return _fetchJwks.apply(this, arguments);
+}
+function readKeys(body) {
+  if (_typeof(body) !== "object" || body === null || !("keys" in body)) {
+    return null;
+  }
+  // `in` narrows the property into the type, so no assertion is needed to read
+  // it — and the `Array.isArray` below is what actually establishes the shape.
+  var keys = body.keys;
+  if (!Array.isArray(keys)) {
+    return null;
+  }
+  return keys.filter(function (key) {
+    return _typeof(key) === "object" && key !== null;
+  });
+}
+
+/**
+ * Read `Authorization: Bearer …`.
+ *
+ * Exported because the refusal needs to know whether a token was presented at
+ * all: RFC 6750 distinguishes "no credential" — a bare `401`, which is an
+ * invitation to authenticate — from "a bad credential", and a client that gets
+ * the second when it deserved the first will not start the authorization flow.
+ */
+function readBearerToken(request) {
+  var _match$;
+  var header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
+  return token ? token : null;
+}
+function verifyValAccessToken(_x7, _x8) {
+  return _verifyValAccessToken.apply(this, arguments);
+}
+function _verifyValAccessToken() {
+  _verifyValAccessToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(request, config) {
+    var _config$clockToleranc;
+    var token, parts, _parts, encodedHeader, encodedPayload, encodedSignature, header, kid, nowMs, loaded, candidates, refetched, signature, signedData, verified, payload, tolerance, nowSeconds, subject, scopes;
+    return _regenerator().w(function (_context5) {
+      while (1) switch (_context5.n) {
+        case 0:
+          token = readBearerToken(request);
+          if (!(token === null)) {
+            _context5.n = 1;
+            break;
+          }
+          return _context5.a(2, {
+            status: "refused",
+            error: "invalid_request",
+            description: "This Val MCP endpoint needs an access token. Authorize with the Val authorization server and present it as `Authorization: Bearer`."
+          });
+        case 1:
+          parts = token.split(".");
+          if (!(parts.length !== 3)) {
+            _context5.n = 2;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token is not a JWS."));
+        case 2:
+          _parts = _slicedToArray(parts, 3), encodedHeader = _parts[0], encodedPayload = _parts[1], encodedSignature = _parts[2];
+          header = decodeJsonSegment(encodedHeader);
+          if (!(header === null)) {
+            _context5.n = 3;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token's header could not be read."));
+        case 3:
+          if (!(header.alg !== "ES256")) {
+            _context5.n = 4;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token is not signed with ES256, which is the only algorithm this server accepts."));
+        case 4:
+          kid = typeof header.kid === "string" ? header.kid : null;
+          nowMs = Date.now();
+          _context5.n = 5;
+          return loadJwks(config, nowMs);
+        case 5:
+          loaded = _context5.v;
+          if (!(loaded.entry.status === "error")) {
+            _context5.n = 6;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
+        case 6:
+          candidates = loaded.entry.keys.filter(function (key) {
+            return isVerifyingP256Key(key, kid);
+          });
+          if (!(candidates.length === 0 && kid !== null && loaded.fromCache)) {
+            _context5.n = 9;
+            break;
+          }
+          _context5.n = 7;
+          return refetchForUnknownKid(config, nowMs);
+        case 7:
+          refetched = _context5.v;
+          if (!(refetched !== null)) {
+            _context5.n = 9;
+            break;
+          }
+          if (!(refetched.status === "error")) {
+            _context5.n = 8;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
+        case 8:
+          candidates = refetched.keys.filter(function (key) {
+            return isVerifyingP256Key(key, kid);
+          });
+        case 9:
+          if (!(candidates.length === 0)) {
+            _context5.n = 10;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token was signed with a key the Val authorization server does not publish."));
+        case 10:
+          signature = decodeBase64Url(encodedSignature);
+          if (!(signature === null)) {
+            _context5.n = 11;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token's signature could not be read."));
+        case 11:
+          signedData = Buffer.from("".concat(encodedHeader, ".").concat(encodedPayload), "ascii"); // Every published key is tried when the token names no `kid`, so a rotation
+          // that has not yet propagated to clients still verifies. With a `kid` the
+          // filter above leaves one — or, if this process had not yet seen that key,
+          // the one the refetch just found.
+          verified = candidates.some(function (key) {
+            return verifyWithJwk(key, signedData, signature);
+          });
+          if (verified) {
+            _context5.n = 12;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token's signature could not be verified."));
+        case 12:
+          // Only now: everything below reads the payload, and before this line it was
+          // attacker input.
+          payload = decodeJsonSegment(encodedPayload);
+          if (!(payload === null)) {
+            _context5.n = 13;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token's payload could not be read."));
+        case 13:
+          tolerance = (_config$clockToleranc = config.clockToleranceSeconds) !== null && _config$clockToleranc !== void 0 ? _config$clockToleranc : DEFAULT_CLOCK_TOLERANCE_SECONDS;
+          nowSeconds = Math.floor(nowMs / 1000);
+          if (!(typeof payload.exp !== "number")) {
+            _context5.n = 14;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token has no expiry."));
+        case 14:
+          if (!(payload.exp + tolerance <= nowSeconds)) {
+            _context5.n = 15;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token has expired. Refresh it and try again."));
+        case 15:
+          if (!(typeof payload.nbf === "number" && payload.nbf - tolerance > nowSeconds)) {
+            _context5.n = 16;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token is not valid yet."));
+        case 16:
+          if (!(payload.iss !== config.issuer)) {
+            _context5.n = 17;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token was not issued by this server's authorization server (iss claim)."));
+        case 17:
+          if (audienceMatches(payload.aud, config.resource)) {
+            _context5.n = 18;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token is not valid for this server (aud claim)."));
+        case 18:
+          subject = payload.sub;
+          if (!(typeof subject !== "string" || subject.length === 0)) {
+            _context5.n = 19;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token has no subject."));
+        case 19:
+          scopes = readScopes(payload.scope);
+          if (scopes.includes(VAL_SCOPE_READ)) {
+            _context5.n = 20;
+            break;
+          }
+          return _context5.a(2, {
+            status: "refused",
+            error: "insufficient_scope",
+            description: "The access token does not have the ".concat(VAL_SCOPE_READ, " scope, so it cannot read any content.")
+          });
+        case 20:
+          return _context5.a(2, {
+            status: "ok",
+            auth: {
+              type: "verified-profile",
+              profileId: authorIdFromVerifiedSubject(subject),
+              scopes: scopes
+            }
+          });
+      }
+    }, _callee5);
+  }));
+  return _verifyValAccessToken.apply(this, arguments);
+}
+function invalidToken(description) {
+  // Described by class, never by echoing the token or a raw error: a
+  // verification failure message is a place credentials leak into logs.
+  return {
+    status: "refused",
+    error: "invalid_token",
+    description: description
+  };
+}
+
+/**
+ * `aud` is a string or an array of strings (RFC 7519 section 4.1.3).
+ *
+ * A match on any member is a match, which is the spec's own rule — a token may
+ * legitimately be addressed to several resources.
+ */
+function audienceMatches(claim, resource) {
+  if (typeof claim === "string") {
+    return claim === resource;
+  }
+  if (Array.isArray(claim)) {
+    return claim.some(function (entry) {
+      return entry === resource;
+    });
+  }
+  return false;
+}
+
+/**
+ * `scope` is a space-delimited string (RFC 6749 section 3.3).
+ *
+ * Anything else is read as no scopes rather than coerced. A token whose scope
+ * claim is the wrong shape is a token we do not understand, and understanding
+ * it generously is how a write gets authorized by an array someone sent.
+ */
+function readScopes(claim) {
+  if (typeof claim !== "string") {
+    return [];
+  }
+  return claim.split(" ").filter(function (scope) {
+    return scope.length > 0;
+  });
+}
+function isVerifyingP256Key(key, kid) {
+  if (key.kty !== "EC" || key.crv !== "P-256") {
+    return false;
+  }
+  if (typeof key.x !== "string" || typeof key.y !== "string") {
+    return false;
+  }
+  // A key published for encryption is not a key to verify signatures with, and
+  // an `alg` that disagrees with what we verify is a key meant for something
+  // else.
+  if (key.use !== undefined && key.use !== "sig") {
+    return false;
+  }
+  if (key.alg !== undefined && key.alg !== "ES256") {
+    return false;
+  }
+  if (kid !== null && typeof key.kid === "string" && key.kid !== kid) {
+    return false;
+  }
+  return true;
+}
+function verifyWithJwk(key, signedData, signature) {
+  try {
+    var publicKey = createPublicKey({
+      key: {
+        kty: "EC",
+        crv: "P-256",
+        x: String(key.x),
+        y: String(key.y)
+      },
+      format: "jwk"
+    });
+    return verify("sha256", signedData,
+    // `ieee-p1363` because a JWS ECDSA signature is the raw `r||s` pair, while
+    // node defaults to DER for EC keys. Getting this wrong rejects every
+    // valid signature.
+    {
+      key: publicKey,
+      dsaEncoding: "ieee-p1363"
+    }, signature);
+  } catch (_unused) {
+    // A malformed key in an otherwise good key set should not take down
+    // verification against the other keys.
+    return false;
+  }
+}
+function decodeBase64Url(segment) {
+  if (segment === undefined || !/^[A-Za-z0-9_-]*$/.test(segment)) {
+    return null;
+  }
+  try {
+    return Buffer.from(segment, "base64url");
+  } catch (_unused2) {
+    return null;
+  }
+}
+function decodeJsonSegment(segment) {
+  var decoded = decodeBase64Url(segment);
+  if (decoded === null) {
+    return null;
+  }
+  try {
+    var parsed = JSON.parse(decoded.toString("utf8"));
+    if (_typeof(parsed) !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return _objectSpread2({}, parsed);
+  } catch (_unused3) {
+    return null;
+  }
+}
+
+/**
+ * The one document an MCP client needs before it can authorize: RFC 9728
+ * Protected Resource Metadata, served by the *resource* server.
+ *
+ * This is how a client discovers where to authorize. It asks the resource — this
+ * app — and the resource names its authorization server. Which is why this
+ * belongs here and the RFC 8414 *authorization server* metadata does not: that
+ * document lives at the issuer, describes the issuer's own endpoints, and is
+ * served by the issuer. An app serving a copy would be asserting the issuer's
+ * configuration on its behalf, and would be wrong the moment the issuer changed
+ * anything.
+ *
+ * The flow, so the split reads as a whole:
+ *
+ * 1. client → `{app}/api/mcp` with no token → `401` naming this document
+ * 2. client → `{app}/.well-known/oauth-protected-resource` → the issuer
+ * 3. client → `{issuer}/.well-known/oauth-authorization-server` → endpoints
+ * 4. client → issuer's `/authorize`, then `/token`
+ * 5. client → `{app}/api/mcp` with the token
+ */
+
+var CORS_HEADERS = {
+  // The document is public and contains no secrets — it exists to be read by
+  // clients whose origin we cannot know in advance, so `*` is the correct value
+  // rather than a lazy one. Note there is no `Access-Control-Allow-Credentials`:
+  // with it, `*` would be rejected by browsers, and this document is never
+  // fetched with credentials.
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
+  "Access-Control-Max-Age": "3600"
+};
+function createValMcpMetadata(oauth, scopesSupported) {
+  var document = {
+    // The resource identifier, which MUST be the value clients send as
+    // `resource` and the value that arrives back in `aud`. Same string as the
+    // audience this app verifies against — one value, so the two cannot drift.
+    resource: oauth.resource,
+    authorization_servers: [oauth.issuer],
+    scopes_supported: scopesSupported,
+    bearer_methods_supported: ["header"]
+  };
+  var body = JSON.stringify(document);
+  return {
+    GET: function GET() {
+      return new Response(body, {
+        status: 200,
+        headers: _objectSpread2({
+          "Content-Type": "application/json",
+          // Cacheable: it changes only when the app is reconfigured, and a
+          // client that re-reads it on every authorization costs a round trip
+          // for nothing.
+          "Cache-Control": "public, max-age=3600"
+        }, CORS_HEADERS)
+      });
+    },
+    OPTIONS: function OPTIONS() {
+      return new Response(null, {
+        status: 204,
+        headers: CORS_HEADERS
+      });
+    }
+  };
+}
+
+/**
+ * The `WWW-Authenticate` value for a refusal (RFC 6750 section 3, RFC 9728
+ * section 5.1).
+ *
+ * `resource_metadata` is the load-bearing parameter: it is how a client that has
+ * never seen this server learns where to authorize. A `401` without it is a dead
+ * end — the client knows it needs a token and has no way to find out from where.
+ */
+function wwwAuthenticate(oauth, scopesSupported, refusal) {
+  var metadataUrl = new URL("/.well-known/oauth-protected-resource", oauth.resource).toString();
+  var params = ["resource_metadata=\"".concat(metadataUrl, "\""), "scope=\"".concat(scopesSupported.join(" "), "\"")];
+  if (refusal) {
+    params.push("error=\"".concat(refusal.error, "\""));
+    params.push("error_description=\"".concat(headerSafe(refusal.description), "\""));
+  }
+  return "Bearer ".concat(params.join(", "));
+}
+
+/**
+ * Make a string safe to put inside a quoted header parameter.
+ *
+ * Three classes go, and the third is the one that matters most:
+ *
+ * - a **quote** would close the parameter early;
+ * - a **backslash** would start an escape the rest of the value does not
+ *   finish;
+ * - a **CR or LF** would end the header line, which is response splitting — an
+ *   attacker-influenced description could inject a header of their own, or a
+ *   whole second response.
+ *
+ * The descriptions passed here today are all literals from this package and
+ * contain none of it. That is a property of today's callers rather than of the
+ * type, and this function exists so it stays true when a future one interpolates
+ * something from a request.
+ */
+function headerSafe(value) {
+  // eslint-disable-next-line no-control-regex -- the point is to remove them
+  return value.replace(/["\\]/g, "").replace(/[\u0000-\u001f\u007f]/g, " ");
+}
+
+/**
+ * Val's tools over MCP, and the two checks that have to happen before a request
+ * gets to them.
+ *
+ * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
+ * route, which framework — and this owns the parts that must not be re-decided
+ * per app: whether the request is allowed to reach the tools at all, and whose
+ * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
+ * version is that the SDK reorganised itself once already, and the security
+ * checks should not move when it does again.
+ */
+
+function initValMcp(valModules, config, opts) {
+  var _opts$route, _opts$versions$core, _opts$versions, _opts$versions$next, _opts$versions2;
+  var route = (_opts$route = opts === null || opts === void 0 ? void 0 : opts.route) !== null && _opts$route !== void 0 ? _opts$route : "/api/val";
+  var coreVersion = (_opts$versions$core = opts === null || opts === void 0 || (_opts$versions = opts.versions) === null || _opts$versions === void 0 ? void 0 : _opts$versions.core) !== null && _opts$versions$core !== void 0 ? _opts$versions$core : Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var hostVersion = (_opts$versions$next = opts === null || opts === void 0 || (_opts$versions2 = opts.versions) === null || _opts$versions2 === void 0 ? void 0 : _opts$versions2.next) !== null && _opts$versions$next !== void 0 ? _opts$versions$next : VERSION;
+  if (!hostVersion) {
+    throw new Error("Could not get @valbuild/mcp package version");
+  }
+
+  // Resolved once at module-eval time, awaited per request. The no-op catch is
+  // load bearing for the same reason it is in createValApiRouter: a config error
+  // on a promise with no handler attached becomes an unhandledRejection and
+  // takes the dev server down, and the error is reported per request below
+  // anyway.
+  var setupPromise = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+    var options;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          _context.n = 1;
+          return initHandlerOptions(route, _objectSpread2(_objectSpread2({}, config), {}, {
+            versions: {
+              core: coreVersion,
+              next: hostVersion
+            }
+          }), config);
+        case 1:
+          options = _context.v;
+          return _context.a(2, {
+            mode: options.mode,
+            tools: createValTools(valModules, _objectSpread2(_objectSpread2({}, options), {}, {
+              formatter: opts === null || opts === void 0 ? void 0 : opts.formatter
+            }), opts === null || opts === void 0 ? void 0 : opts.extraTools)
+          });
+      }
+    }, _callee);
+  }))();
+  setupPromise["catch"](function () {
+    // handled per request
+  });
+  var oauth = opts === null || opts === void 0 ? void 0 : opts.oauth;
+  var scopesSupported = [VAL_SCOPE_READ, VAL_SCOPE_WRITE];
+  return {
+    valMcpMetadata: oauth ? createValMcpMetadata(oauth, scopesSupported) : null,
+    valMcpTools: function valMcpTools() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
+        return _regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              _context2.n = 1;
+              return setupPromise;
+            case 1:
+              return _context2.a(2, _context2.v.tools);
+          }
+        }, _callee2);
+      }))();
+    },
+    valMcpAuthorize: function valMcpAuthorize(request) {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3() {
+        var setup, refusal, sessionId, verified, status, _t;
+        return _regenerator().w(function (_context3) {
+          while (1) switch (_context3.p = _context3.n) {
+            case 0:
+              _context3.p = 0;
+              _context3.n = 1;
+              return setupPromise;
+            case 1:
+              setup = _context3.v;
+              _context3.n = 3;
+              break;
+            case 2:
+              _context3.p = 2;
+              _t = _context3.v;
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: could not start the Val MCP server",
+                  details: _t instanceof Error ? _t.message : String(_t)
+                })
+              });
+            case 3:
+              if (!(request === undefined)) {
+                _context3.n = 4;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(401, {
+                  error: "Val: this MCP server needs the HTTP request to authorize a call, and none was available."
+                })
+              });
+            case 4:
+              refusal = refuseUnsafeRequest(request, setup.mode);
+              if (!refusal) {
+                _context3.n = 5;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: refusal
+              });
+            case 5:
+              // Not the MCP session id, in any branch below. Val's patch `sessionId`
+              // names a Val AI session, and putting an unrelated id in it would claim a
+              // relationship that does not exist.
+              sessionId = null;
+              if (oauth) {
+                _context3.n = 8;
+                break;
+              }
+              if (!(setup.mode !== "fs")) {
+                _context3.n = 6;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: this MCP endpoint has no `oauth` config, and this project is configured to talk to the Val content backend. Pass `oauth` to `initValMcp` with the authorization server's URL and this endpoint's own URL, so callers authorize as themselves."
+                })
+              });
+            case 6:
+              if (!(readBearerToken(request) !== null)) {
+                _context3.n = 7;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(400, {
+                  error: "Val: this project is running in local filesystem mode, where there is nothing to authenticate against — the tools read and write this working tree directly. Remove the credential from this MCP client's configuration: a token sent here is checked by nothing."
+                })
+              });
+            case 7:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: null,
+                  sessionId: sessionId
+                }
+              });
+            case 8:
+              _context3.n = 9;
+              return verifyValAccessToken(request, oauth);
+            case 9:
+              verified = _context3.v;
+              if (!(verified.status === "refused")) {
+                _context3.n = 10;
+                break;
+              }
+              // 401 for a missing or bad token, 403 once the token is good but does
+              // not carry the scope: RFC 6750 section 3.1, and the distinction is
+              // what tells a client whether to authorize again or to give up.
+              status = verified.error === "insufficient_scope" ? 403 : 401;
+              return _context3.a(2, {
+                status: "refused",
+                response: new Response(JSON.stringify({
+                  error: verified.error,
+                  error_description: verified.description
+                }), {
+                  status: status,
+                  headers: {
+                    "Content-Type": "application/json",
+                    "WWW-Authenticate": wwwAuthenticate(oauth, scopesSupported, {
+                      error: verified.error,
+                      description: verified.description
+                    })
+                  }
+                })
+              });
+            case 10:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: verified.auth,
+                  sessionId: sessionId
+                }
+              });
+          }
+        }, _callee3, null, [[0, 2]]);
+      }))();
+    }
+  };
+}
+
+/**
+ * The two ways this route is dangerous, both refused here.
+ *
+ * 1. **Local filesystem mode outside development.** In fs mode there is no
+ *    credential and no backend: the tools read and write the running process's
+ *    own working tree, and every permission check Val has lives on the other
+ *    side of a backend that is not in this path. Exposed on a deployed host,
+ *    that is unauthenticated write access to the site's content for anyone who
+ *    can reach the port. There is no configuration that makes it safe, so there
+ *    is no flag to turn this off — a project that wants MCP in production wants
+ *    proxy mode with an `oauth` config, where every call carries an access
+ *    token this app verified itself.
+ *
+ * 2. **A browser driving the local server.** A page on any origin can `fetch`
+ *    `http://localhost:3000/api/mcp` while a developer has the app running, and
+ *    with DNS rebinding it can do so with a `Host` of its own choosing. Neither
+ *    needs a credential in fs mode. So a cross-origin `Origin` is refused, and
+ *    in fs mode the request must actually be addressed to a loopback host.
+ *
+ * MCP clients are not browsers and send no `Origin`, so the check costs them
+ * nothing.
+ */
+function refuseUnsafeRequest(request, mode) {
+  if (mode === "fs" && process.env.NODE_ENV !== "development") {
+    return jsonResponse(403, {
+      error: "Val: the MCP endpoint is disabled. This project is running in local filesystem mode, where MCP calls are unauthenticated and write directly to the working tree, so it is only served in development. Configure Val for proxy mode to use MCP on a deployed host."
+    });
+  }
+  var host = requestHost(request);
+  var origin = request.headers.get("origin");
+  if (origin !== null) {
+    // `Origin: null` is refused along with the rest. It is the *opaque* origin —
+    // a sandboxed iframe, a `file://` page, some redirects — so it cannot be
+    // compared to anything, and "cannot be compared" has to mean refuse: a page
+    // that would fail the check can otherwise pass it by arranging to have no
+    // origin at all. Absent entirely is the case that is allowed, and that is
+    // the one MCP clients produce.
+    var originHost = origin === "null" ? null : hostOf(origin);
+    if (originHost === null || host === null || originHost !== host) {
+      return jsonResponse(403, {
+        error: "Val: refusing a cross-origin MCP request from ".concat(JSON.stringify(origin), ". MCP clients do not send an Origin header; a browser does.")
+      });
+    }
+  }
+  if (mode === "fs") {
+    var hostname = host === null ? null : hostnameOf(host);
+    if (hostname === null || !LOOPBACK_HOSTNAMES.has(hostname)) {
+      return jsonResponse(403, {
+        error: "Val: refusing an MCP request addressed to ".concat(JSON.stringify(host !== null && host !== void 0 ? host : "an unknown host"), ". In local filesystem mode this endpoint only answers on localhost, because a name that resolves to 127.0.0.1 is how a web page reaches a developer's own machine.")
+      });
+    }
+  }
+  return null;
+}
+var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+
+/**
+ * Which host the request was addressed to, as `hostname:port`.
+ *
+ * `Host` only, and deliberately **not** `X-Forwarded-Host`. The forwarded header
+ * is what a client asked for behind a proxy, but nothing stops a client sending
+ * it directly — so preferring it hands an attacker the value both checks below
+ * are decided on. `Host`, by contrast, a browser sets from the URL and page
+ * script cannot override, which is exactly the property the loopback check
+ * depends on.
+ *
+ * The cost is that behind a proxy that rewrites `Host`, a *browser* request
+ * whose `Origin` is the public name no longer matches. That is acceptable: such
+ * a request carries no access token, so proxy mode refuses it anyway, and a
+ * non-browser MCP client sends no `Origin` and never reaches the comparison.
+ * Trusting the forwarded header would need an explicit trusted-proxy
+ * configuration, which is a bigger thing than this needs.
+ */
+function requestHost(request) {
+  var host = request.headers.get("host");
+  if (host) {
+    return host.trim().toLowerCase();
+  }
+  // Last resort: the URL the framework saw.
+  try {
+    return new URL(request.url).host.toLowerCase();
+  } catch (_unused) {
+    return null;
+  }
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).host.toLowerCase();
+  } catch (_unused2) {
+    return null;
+  }
+}
+
+/** Strips the port, keeping IPv6 brackets — `[::1]:3000` is hostname `[::1]`. */
+function hostnameOf(host) {
+  if (host.startsWith("[")) {
+    var end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  var colon = host.indexOf(":");
+  return colon === -1 ? host : host.slice(0, colon);
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status: status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+export { VAL_SCOPE_READ, VAL_SCOPE_WRITE, authorIdFromVerifiedSubject, createValImageTools, createValTools, defineTool, err, initValMcp, ok, savePatch };