@valbuild/next 0.115.0 → 0.116.0

package/dist/declarations/src/server/index.d.ts

@@ -1,2 +1,4 @@
 import "server-only";
 export { initValServer } from "./initValServer.js";
+export { initValMcp } from "./initValMcp.js";
+export type { ValMcp, ValMcpAuthorizationResult } from "./initValMcp.js";

package/dist/declarations/src/server/initValMcp.d.ts

@@ -0,0 +1,42 @@
+import { ValConfig, ValModules } from "@valbuild/core";
+import { type ValToolContext, type ValTools } from "@valbuild/server";
+/**
+ * Val's tools over MCP, and the two checks that have to happen before a request
+ * gets to them.
+ *
+ * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
+ * route, which framework — and this owns the parts that must not be re-decided
+ * per app: whether the request is allowed to reach the tools at all, and whose
+ * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
+ * version is that the SDK reorganised itself once already, and the security
+ * checks should not move when it does again.
+ */
+export type ValMcpAuthorizationResult = {
+    status: "ok";
+    tools: ValTools;
+    ctx: ValToolContext;
+} | {
+    status: "refused";
+    response: Response;
+};
+export type ValMcp = {
+    /**
+     * Check a request and, if it is allowed, hand back the tools and the context
+     * to call them with.
+     *
+     * Call this per request — both halves are per request. Refusing early is the
+     * point: a refused request must not reach the protocol layer, let alone a
+     * tool.
+     */
+    valMcpAuthorize: (request: Request | undefined) => Promise<ValMcpAuthorizationResult>;
+    /**
+     * The registry itself, for listing tools at startup.
+     *
+     * Listing needs no credential — it reads no content — so registering tools
+     * with an MCP server can happen once rather than per request.
+     */
+    valMcpTools: () => Promise<ValTools>;
+};
+export declare function initValMcp(valModules: ValModules, config: ValConfig, opts?: {
+    formatter?: (code: string, filePath: string) => string | Promise<string>;
+}): ValMcp;

package/package.json

@@ -12,7 +12,7 @@
     "next",
     "react"
   ],
-  "version": "0.115.0",
+  "version": "0.116.0",
   "main": "dist/valbuild-next.cjs.js",
   "module": "dist/valbuild-next.esm.js",
   "exports": {
@@ -48,11 +48,11 @@
     "client-only": "^0.0.1",
     "server-only": "^0.0.1",
     "@valbuild/core": "0.111.0",
-    "@valbuild/language-server": "0.115.0",
-    "@valbuild/server": "0.115.0",
-    "@valbuild/shared": "0.114.0",
-    "@valbuild/react": "0.114.0",
-    "@valbuild/ui": "0.114.0"
+    "@valbuild/language-server": "0.116.0",
+    "@valbuild/react": "0.116.0",
+    "@valbuild/server": "0.116.0",
+    "@valbuild/shared": "0.116.0",
+    "@valbuild/ui": "0.116.0"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.3",

package/server/dist/valbuild-next-server.cjs.dev.js

@@ -120,4 +120,262 @@ function initValServer(valModules, config, nextConfig) {
   };
 }
 
+/**
+ * Val's tools over MCP, and the two checks that have to happen before a request
+ * gets to them.
+ *
+ * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
+ * route, which framework — and this owns the parts that must not be re-decided
+ * per app: whether the request is allowed to reach the tools at all, and whose
+ * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
+ * version is that the SDK reorganised itself once already, and the security
+ * checks should not move when it does again.
+ */
+
+function initValMcp(valModules, config, opts) {
+  var route = "/api/val"; // TODO: get from config, as initValServer does
+  var coreVersion = core.Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var nextVersion = version.VERSION;
+  if (!nextVersion) {
+    throw new Error("Could not get @valbuild/next package version");
+  }
+
+  // Resolved once at module-eval time, awaited per request. The no-op catch is
+  // load bearing for the same reason it is in createValApiRouter: a config error
+  // on a promise with no handler attached becomes an unhandledRejection and
+  // takes the dev server down, and the error is reported per request below
+  // anyway.
+  var setupPromise = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
+    var options;
+    return version._regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          _context.n = 1;
+          return server.initHandlerOptions(route, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, config), {}, {
+            versions: {
+              core: coreVersion,
+              next: nextVersion
+            }
+          }), config);
+        case 1:
+          options = _context.v;
+          return _context.a(2, {
+            mode: options.mode,
+            tools: server.createValTools(valModules, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, options), {}, {
+              formatter: opts === null || opts === void 0 ? void 0 : opts.formatter
+            }))
+          });
+      }
+    }, _callee);
+  }))();
+  setupPromise["catch"](function () {
+    // handled per request
+  });
+  return {
+    valMcpTools: function valMcpTools() {
+      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2() {
+        return version._regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              _context2.n = 1;
+              return setupPromise;
+            case 1:
+              return _context2.a(2, _context2.v.tools);
+          }
+        }, _callee2);
+      }))();
+    },
+    valMcpAuthorize: function valMcpAuthorize(request) {
+      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
+        var setup, refusal, pat, _t;
+        return version._regenerator().w(function (_context3) {
+          while (1) switch (_context3.p = _context3.n) {
+            case 0:
+              _context3.p = 0;
+              _context3.n = 1;
+              return setupPromise;
+            case 1:
+              setup = _context3.v;
+              _context3.n = 3;
+              break;
+            case 2:
+              _context3.p = 2;
+              _t = _context3.v;
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: could not start the Val MCP server",
+                  details: _t instanceof Error ? _t.message : String(_t)
+                })
+              });
+            case 3:
+              if (!(request === undefined)) {
+                _context3.n = 4;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(401, {
+                  error: "Val: this MCP server needs the HTTP request to authorize a call, and none was available."
+                })
+              });
+            case 4:
+              refusal = refuseUnsafeRequest(request, setup.mode);
+              if (!refusal) {
+                _context3.n = 5;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: refusal
+              });
+            case 5:
+              pat = readBearerToken(request);
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  // Passed through unverified, deliberately: this app is not the
+                  // authority on what a token may do, and the registry sends it to the
+                  // backend that is. See `docs/plans/mcp.md` D.2.
+                  auth: pat === null ? null : {
+                    pat: pat
+                  },
+                  // Not the MCP session id. Val's patch `sessionId` names a Val AI
+                  // session, and putting an unrelated id in it would claim a
+                  // relationship that does not exist.
+                  sessionId: null
+                }
+              });
+          }
+        }, _callee3, null, [[0, 2]]);
+      }))();
+    }
+  };
+}
+
+/**
+ * The two ways this route is dangerous, both refused here.
+ *
+ * 1. **Local filesystem mode outside development.** In fs mode there is no
+ *    credential and no backend: the tools read and write the running process's
+ *    own working tree, and every permission check Val has lives on the other
+ *    side of a backend that is not in this path. Exposed on a deployed host,
+ *    that is unauthenticated write access to the site's content for anyone who
+ *    can reach the port. There is no configuration that makes it safe, so there
+ *    is no flag to turn this off — a project that wants MCP in production wants
+ *    proxy mode, where every call carries its caller's own token.
+ *
+ * 2. **A browser driving the local server.** A page on any origin can `fetch`
+ *    `http://localhost:3000/api/mcp` while a developer has the app running, and
+ *    with DNS rebinding it can do so with a `Host` of its own choosing. Neither
+ *    needs a credential in fs mode. So a cross-origin `Origin` is refused, and
+ *    in fs mode the request must actually be addressed to a loopback host.
+ *
+ * MCP clients are not browsers and send no `Origin`, so the check costs them
+ * nothing.
+ */
+function refuseUnsafeRequest(request, mode) {
+  if (mode === "fs" && process.env.NODE_ENV !== "development") {
+    return jsonResponse(403, {
+      error: "Val: the MCP endpoint is disabled. This project is running in local filesystem mode, where MCP calls are unauthenticated and write directly to the working tree, so it is only served in development. Configure Val for proxy mode to use MCP on a deployed host."
+    });
+  }
+  var host = requestHost(request);
+  var origin = request.headers.get("origin");
+  if (origin !== null) {
+    // `Origin: null` is refused along with the rest. It is the *opaque* origin —
+    // a sandboxed iframe, a `file://` page, some redirects — so it cannot be
+    // compared to anything, and "cannot be compared" has to mean refuse: a page
+    // that would fail the check can otherwise pass it by arranging to have no
+    // origin at all. Absent entirely is the case that is allowed, and that is
+    // the one MCP clients produce.
+    var originHost = origin === "null" ? null : hostOf(origin);
+    if (originHost === null || host === null || originHost !== host) {
+      return jsonResponse(403, {
+        error: "Val: refusing a cross-origin MCP request from ".concat(JSON.stringify(origin), ". MCP clients do not send an Origin header; a browser does.")
+      });
+    }
+  }
+  if (mode === "fs") {
+    var hostname = host === null ? null : hostnameOf(host);
+    if (hostname === null || !LOOPBACK_HOSTNAMES.has(hostname)) {
+      return jsonResponse(403, {
+        error: "Val: refusing an MCP request addressed to ".concat(JSON.stringify(host !== null && host !== void 0 ? host : "an unknown host"), ". In local filesystem mode this endpoint only answers on localhost, because a name that resolves to 127.0.0.1 is how a web page reaches a developer's own machine.")
+      });
+    }
+  }
+  return null;
+}
+var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+
+/**
+ * Which host the request was addressed to, as `hostname:port`.
+ *
+ * `Host` only, and deliberately **not** `X-Forwarded-Host`. The forwarded header
+ * is what a client asked for behind a proxy, but nothing stops a client sending
+ * it directly — so preferring it hands an attacker the value both checks below
+ * are decided on. `Host`, by contrast, a browser sets from the URL and page
+ * script cannot override, which is exactly the property the loopback check
+ * depends on.
+ *
+ * The cost is that behind a proxy that rewrites `Host`, a *browser* request
+ * whose `Origin` is the public name no longer matches. That is acceptable: such
+ * a request carries no personal access token, so proxy mode refuses it anyway,
+ * and a non-browser MCP client sends no `Origin` and never reaches the
+ * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * configuration, which is a bigger thing than this needs.
+ */
+function requestHost(request) {
+  var host = request.headers.get("host");
+  if (host) {
+    return host.trim().toLowerCase();
+  }
+  // Last resort: the URL the framework saw.
+  try {
+    return new URL(request.url).host.toLowerCase();
+  } catch (_unused) {
+    return null;
+  }
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).host.toLowerCase();
+  } catch (_unused2) {
+    return null;
+  }
+}
+
+/** Strips the port, keeping IPv6 brackets — `[::1]:3000` is hostname `[::1]`. */
+function hostnameOf(host) {
+  if (host.startsWith("[")) {
+    var end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  var colon = host.indexOf(":");
+  return colon === -1 ? host : host.slice(0, colon);
+}
+function readBearerToken(request) {
+  var _match$;
+  var header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
+  return token ? token : null;
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status: status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+exports.initValMcp = initValMcp;
 exports.initValServer = initValServer;

package/server/dist/valbuild-next-server.cjs.prod.js

@@ -120,4 +120,262 @@ function initValServer(valModules, config, nextConfig) {
   };
 }
 
+/**
+ * Val's tools over MCP, and the two checks that have to happen before a request
+ * gets to them.
+ *
+ * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
+ * route, which framework — and this owns the parts that must not be re-decided
+ * per app: whether the request is allowed to reach the tools at all, and whose
+ * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
+ * version is that the SDK reorganised itself once already, and the security
+ * checks should not move when it does again.
+ */
+
+function initValMcp(valModules, config, opts) {
+  var route = "/api/val"; // TODO: get from config, as initValServer does
+  var coreVersion = core.Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var nextVersion = version.VERSION;
+  if (!nextVersion) {
+    throw new Error("Could not get @valbuild/next package version");
+  }
+
+  // Resolved once at module-eval time, awaited per request. The no-op catch is
+  // load bearing for the same reason it is in createValApiRouter: a config error
+  // on a promise with no handler attached becomes an unhandledRejection and
+  // takes the dev server down, and the error is reported per request below
+  // anyway.
+  var setupPromise = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
+    var options;
+    return version._regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          _context.n = 1;
+          return server.initHandlerOptions(route, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, config), {}, {
+            versions: {
+              core: coreVersion,
+              next: nextVersion
+            }
+          }), config);
+        case 1:
+          options = _context.v;
+          return _context.a(2, {
+            mode: options.mode,
+            tools: server.createValTools(valModules, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, options), {}, {
+              formatter: opts === null || opts === void 0 ? void 0 : opts.formatter
+            }))
+          });
+      }
+    }, _callee);
+  }))();
+  setupPromise["catch"](function () {
+    // handled per request
+  });
+  return {
+    valMcpTools: function valMcpTools() {
+      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2() {
+        return version._regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              _context2.n = 1;
+              return setupPromise;
+            case 1:
+              return _context2.a(2, _context2.v.tools);
+          }
+        }, _callee2);
+      }))();
+    },
+    valMcpAuthorize: function valMcpAuthorize(request) {
+      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
+        var setup, refusal, pat, _t;
+        return version._regenerator().w(function (_context3) {
+          while (1) switch (_context3.p = _context3.n) {
+            case 0:
+              _context3.p = 0;
+              _context3.n = 1;
+              return setupPromise;
+            case 1:
+              setup = _context3.v;
+              _context3.n = 3;
+              break;
+            case 2:
+              _context3.p = 2;
+              _t = _context3.v;
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: could not start the Val MCP server",
+                  details: _t instanceof Error ? _t.message : String(_t)
+                })
+              });
+            case 3:
+              if (!(request === undefined)) {
+                _context3.n = 4;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(401, {
+                  error: "Val: this MCP server needs the HTTP request to authorize a call, and none was available."
+                })
+              });
+            case 4:
+              refusal = refuseUnsafeRequest(request, setup.mode);
+              if (!refusal) {
+                _context3.n = 5;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: refusal
+              });
+            case 5:
+              pat = readBearerToken(request);
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  // Passed through unverified, deliberately: this app is not the
+                  // authority on what a token may do, and the registry sends it to the
+                  // backend that is. See `docs/plans/mcp.md` D.2.
+                  auth: pat === null ? null : {
+                    pat: pat
+                  },
+                  // Not the MCP session id. Val's patch `sessionId` names a Val AI
+                  // session, and putting an unrelated id in it would claim a
+                  // relationship that does not exist.
+                  sessionId: null
+                }
+              });
+          }
+        }, _callee3, null, [[0, 2]]);
+      }))();
+    }
+  };
+}
+
+/**
+ * The two ways this route is dangerous, both refused here.
+ *
+ * 1. **Local filesystem mode outside development.** In fs mode there is no
+ *    credential and no backend: the tools read and write the running process's
+ *    own working tree, and every permission check Val has lives on the other
+ *    side of a backend that is not in this path. Exposed on a deployed host,
+ *    that is unauthenticated write access to the site's content for anyone who
+ *    can reach the port. There is no configuration that makes it safe, so there
+ *    is no flag to turn this off — a project that wants MCP in production wants
+ *    proxy mode, where every call carries its caller's own token.
+ *
+ * 2. **A browser driving the local server.** A page on any origin can `fetch`
+ *    `http://localhost:3000/api/mcp` while a developer has the app running, and
+ *    with DNS rebinding it can do so with a `Host` of its own choosing. Neither
+ *    needs a credential in fs mode. So a cross-origin `Origin` is refused, and
+ *    in fs mode the request must actually be addressed to a loopback host.
+ *
+ * MCP clients are not browsers and send no `Origin`, so the check costs them
+ * nothing.
+ */
+function refuseUnsafeRequest(request, mode) {
+  if (mode === "fs" &&         "production" !== "development") {
+    return jsonResponse(403, {
+      error: "Val: the MCP endpoint is disabled. This project is running in local filesystem mode, where MCP calls are unauthenticated and write directly to the working tree, so it is only served in development. Configure Val for proxy mode to use MCP on a deployed host."
+    });
+  }
+  var host = requestHost(request);
+  var origin = request.headers.get("origin");
+  if (origin !== null) {
+    // `Origin: null` is refused along with the rest. It is the *opaque* origin —
+    // a sandboxed iframe, a `file://` page, some redirects — so it cannot be
+    // compared to anything, and "cannot be compared" has to mean refuse: a page
+    // that would fail the check can otherwise pass it by arranging to have no
+    // origin at all. Absent entirely is the case that is allowed, and that is
+    // the one MCP clients produce.
+    var originHost = origin === "null" ? null : hostOf(origin);
+    if (originHost === null || host === null || originHost !== host) {
+      return jsonResponse(403, {
+        error: "Val: refusing a cross-origin MCP request from ".concat(JSON.stringify(origin), ". MCP clients do not send an Origin header; a browser does.")
+      });
+    }
+  }
+  if (mode === "fs") {
+    var hostname = host === null ? null : hostnameOf(host);
+    if (hostname === null || !LOOPBACK_HOSTNAMES.has(hostname)) {
+      return jsonResponse(403, {
+        error: "Val: refusing an MCP request addressed to ".concat(JSON.stringify(host !== null && host !== void 0 ? host : "an unknown host"), ". In local filesystem mode this endpoint only answers on localhost, because a name that resolves to 127.0.0.1 is how a web page reaches a developer's own machine.")
+      });
+    }
+  }
+  return null;
+}
+var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+
+/**
+ * Which host the request was addressed to, as `hostname:port`.
+ *
+ * `Host` only, and deliberately **not** `X-Forwarded-Host`. The forwarded header
+ * is what a client asked for behind a proxy, but nothing stops a client sending
+ * it directly — so preferring it hands an attacker the value both checks below
+ * are decided on. `Host`, by contrast, a browser sets from the URL and page
+ * script cannot override, which is exactly the property the loopback check
+ * depends on.
+ *
+ * The cost is that behind a proxy that rewrites `Host`, a *browser* request
+ * whose `Origin` is the public name no longer matches. That is acceptable: such
+ * a request carries no personal access token, so proxy mode refuses it anyway,
+ * and a non-browser MCP client sends no `Origin` and never reaches the
+ * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * configuration, which is a bigger thing than this needs.
+ */
+function requestHost(request) {
+  var host = request.headers.get("host");
+  if (host) {
+    return host.trim().toLowerCase();
+  }
+  // Last resort: the URL the framework saw.
+  try {
+    return new URL(request.url).host.toLowerCase();
+  } catch (_unused) {
+    return null;
+  }
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).host.toLowerCase();
+  } catch (_unused2) {
+    return null;
+  }
+}
+
+/** Strips the port, keeping IPv6 brackets — `[::1]:3000` is hostname `[::1]`. */
+function hostnameOf(host) {
+  if (host.startsWith("[")) {
+    var end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  var colon = host.indexOf(":");
+  return colon === -1 ? host : host.slice(0, colon);
+}
+function readBearerToken(request) {
+  var _match$;
+  var header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
+  return token ? token : null;
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status: status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+exports.initValMcp = initValMcp;
 exports.initValServer = initValServer;

package/server/dist/valbuild-next-server.esm.js

@@ -3,7 +3,7 @@ import { _ as _slicedToArray } from '../../dist/slicedToArray-aa291011.esm.js';
 import { _ as _asyncToGenerator, a as _regenerator, V as VERSION } from '../../dist/version-4d7b692c.esm.js';
 import { _ as _objectSpread2 } from '../../dist/objectSpread2-60d1bd93.esm.js';
 import { Internal } from '@valbuild/core';
-import { createValApiRouter, createValServer } from '@valbuild/server';
+import { createValApiRouter, createValServer, createValTools, initHandlerOptions } from '@valbuild/server';
 import { NextResponse } from 'next/server';
 import '../../dist/unsupportedIterableToArray-5baabfdc.esm.js';
 import '../../dist/defineProperty-cca5affa.esm.js';
@@ -116,4 +116,261 @@ function initValServer(valModules, config, nextConfig) {
   };
 }
 
-export { initValServer };
+/**
+ * Val's tools over MCP, and the two checks that have to happen before a request
+ * gets to them.
+ *
+ * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
+ * route, which framework — and this owns the parts that must not be re-decided
+ * per app: whether the request is allowed to reach the tools at all, and whose
+ * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
+ * version is that the SDK reorganised itself once already, and the security
+ * checks should not move when it does again.
+ */
+
+function initValMcp(valModules, config, opts) {
+  var route = "/api/val"; // TODO: get from config, as initValServer does
+  var coreVersion = Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var nextVersion = VERSION;
+  if (!nextVersion) {
+    throw new Error("Could not get @valbuild/next package version");
+  }
+
+  // Resolved once at module-eval time, awaited per request. The no-op catch is
+  // load bearing for the same reason it is in createValApiRouter: a config error
+  // on a promise with no handler attached becomes an unhandledRejection and
+  // takes the dev server down, and the error is reported per request below
+  // anyway.
+  var setupPromise = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+    var options;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          _context.n = 1;
+          return initHandlerOptions(route, _objectSpread2(_objectSpread2({}, config), {}, {
+            versions: {
+              core: coreVersion,
+              next: nextVersion
+            }
+          }), config);
+        case 1:
+          options = _context.v;
+          return _context.a(2, {
+            mode: options.mode,
+            tools: createValTools(valModules, _objectSpread2(_objectSpread2({}, options), {}, {
+              formatter: opts === null || opts === void 0 ? void 0 : opts.formatter
+            }))
+          });
+      }
+    }, _callee);
+  }))();
+  setupPromise["catch"](function () {
+    // handled per request
+  });
+  return {
+    valMcpTools: function valMcpTools() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
+        return _regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              _context2.n = 1;
+              return setupPromise;
+            case 1:
+              return _context2.a(2, _context2.v.tools);
+          }
+        }, _callee2);
+      }))();
+    },
+    valMcpAuthorize: function valMcpAuthorize(request) {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3() {
+        var setup, refusal, pat, _t;
+        return _regenerator().w(function (_context3) {
+          while (1) switch (_context3.p = _context3.n) {
+            case 0:
+              _context3.p = 0;
+              _context3.n = 1;
+              return setupPromise;
+            case 1:
+              setup = _context3.v;
+              _context3.n = 3;
+              break;
+            case 2:
+              _context3.p = 2;
+              _t = _context3.v;
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: could not start the Val MCP server",
+                  details: _t instanceof Error ? _t.message : String(_t)
+                })
+              });
+            case 3:
+              if (!(request === undefined)) {
+                _context3.n = 4;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(401, {
+                  error: "Val: this MCP server needs the HTTP request to authorize a call, and none was available."
+                })
+              });
+            case 4:
+              refusal = refuseUnsafeRequest(request, setup.mode);
+              if (!refusal) {
+                _context3.n = 5;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: refusal
+              });
+            case 5:
+              pat = readBearerToken(request);
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  // Passed through unverified, deliberately: this app is not the
+                  // authority on what a token may do, and the registry sends it to the
+                  // backend that is. See `docs/plans/mcp.md` D.2.
+                  auth: pat === null ? null : {
+                    pat: pat
+                  },
+                  // Not the MCP session id. Val's patch `sessionId` names a Val AI
+                  // session, and putting an unrelated id in it would claim a
+                  // relationship that does not exist.
+                  sessionId: null
+                }
+              });
+          }
+        }, _callee3, null, [[0, 2]]);
+      }))();
+    }
+  };
+}
+
+/**
+ * The two ways this route is dangerous, both refused here.
+ *
+ * 1. **Local filesystem mode outside development.** In fs mode there is no
+ *    credential and no backend: the tools read and write the running process's
+ *    own working tree, and every permission check Val has lives on the other
+ *    side of a backend that is not in this path. Exposed on a deployed host,
+ *    that is unauthenticated write access to the site's content for anyone who
+ *    can reach the port. There is no configuration that makes it safe, so there
+ *    is no flag to turn this off — a project that wants MCP in production wants
+ *    proxy mode, where every call carries its caller's own token.
+ *
+ * 2. **A browser driving the local server.** A page on any origin can `fetch`
+ *    `http://localhost:3000/api/mcp` while a developer has the app running, and
+ *    with DNS rebinding it can do so with a `Host` of its own choosing. Neither
+ *    needs a credential in fs mode. So a cross-origin `Origin` is refused, and
+ *    in fs mode the request must actually be addressed to a loopback host.
+ *
+ * MCP clients are not browsers and send no `Origin`, so the check costs them
+ * nothing.
+ */
+function refuseUnsafeRequest(request, mode) {
+  if (mode === "fs" && process.env.NODE_ENV !== "development") {
+    return jsonResponse(403, {
+      error: "Val: the MCP endpoint is disabled. This project is running in local filesystem mode, where MCP calls are unauthenticated and write directly to the working tree, so it is only served in development. Configure Val for proxy mode to use MCP on a deployed host."
+    });
+  }
+  var host = requestHost(request);
+  var origin = request.headers.get("origin");
+  if (origin !== null) {
+    // `Origin: null` is refused along with the rest. It is the *opaque* origin —
+    // a sandboxed iframe, a `file://` page, some redirects — so it cannot be
+    // compared to anything, and "cannot be compared" has to mean refuse: a page
+    // that would fail the check can otherwise pass it by arranging to have no
+    // origin at all. Absent entirely is the case that is allowed, and that is
+    // the one MCP clients produce.
+    var originHost = origin === "null" ? null : hostOf(origin);
+    if (originHost === null || host === null || originHost !== host) {
+      return jsonResponse(403, {
+        error: "Val: refusing a cross-origin MCP request from ".concat(JSON.stringify(origin), ". MCP clients do not send an Origin header; a browser does.")
+      });
+    }
+  }
+  if (mode === "fs") {
+    var hostname = host === null ? null : hostnameOf(host);
+    if (hostname === null || !LOOPBACK_HOSTNAMES.has(hostname)) {
+      return jsonResponse(403, {
+        error: "Val: refusing an MCP request addressed to ".concat(JSON.stringify(host !== null && host !== void 0 ? host : "an unknown host"), ". In local filesystem mode this endpoint only answers on localhost, because a name that resolves to 127.0.0.1 is how a web page reaches a developer's own machine.")
+      });
+    }
+  }
+  return null;
+}
+var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+
+/**
+ * Which host the request was addressed to, as `hostname:port`.
+ *
+ * `Host` only, and deliberately **not** `X-Forwarded-Host`. The forwarded header
+ * is what a client asked for behind a proxy, but nothing stops a client sending
+ * it directly — so preferring it hands an attacker the value both checks below
+ * are decided on. `Host`, by contrast, a browser sets from the URL and page
+ * script cannot override, which is exactly the property the loopback check
+ * depends on.
+ *
+ * The cost is that behind a proxy that rewrites `Host`, a *browser* request
+ * whose `Origin` is the public name no longer matches. That is acceptable: such
+ * a request carries no personal access token, so proxy mode refuses it anyway,
+ * and a non-browser MCP client sends no `Origin` and never reaches the
+ * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * configuration, which is a bigger thing than this needs.
+ */
+function requestHost(request) {
+  var host = request.headers.get("host");
+  if (host) {
+    return host.trim().toLowerCase();
+  }
+  // Last resort: the URL the framework saw.
+  try {
+    return new URL(request.url).host.toLowerCase();
+  } catch (_unused) {
+    return null;
+  }
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).host.toLowerCase();
+  } catch (_unused2) {
+    return null;
+  }
+}
+
+/** Strips the port, keeping IPv6 brackets — `[::1]:3000` is hostname `[::1]`. */
+function hostnameOf(host) {
+  if (host.startsWith("[")) {
+    var end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  var colon = host.indexOf(":");
+  return colon === -1 ? host : host.slice(0, colon);
+}
+function readBearerToken(request) {
+  var _match$;
+  var header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
+  return token ? token : null;
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status: status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+export { initValMcp, initValServer };