@valbuild/next 0.115.0 → 0.117.0

package/server/dist/valbuild-next-server.cjs.prod.js

@@ -9,6 +9,8 @@ var objectSpread2 = require('../../dist/objectSpread2-13f847a9.cjs.prod.js');
 var core = require('@valbuild/core');
 var server = require('@valbuild/server');
 var server$1 = require('next/server');
+var _typeof = require('../../dist/typeof-16428c61.cjs.prod.js');
+var node_crypto = require('node:crypto');
 require('../../dist/unsupportedIterableToArray-0d2087a2.cjs.prod.js');
 require('../../dist/defineProperty-8951f469.cjs.prod.js');
 
@@ -120,4 +122,872 @@ function initValServer(valModules, config, nextConfig) {
   };
 }
 
+/**
+ * Verifying an OAuth access token, which is the whole of what makes this app a
+ * resource server rather than a relay.
+ *
+ * The token is issued by Val's authorization server and presented by an MCP
+ * client. This app holds no signing key for it and cannot mint one — it fetches
+ * the issuer's *public* keys and checks a signature. That asymmetry is the
+ * point: a verified `sub` is a fact about the token rather than a claim by
+ * whoever sent it, which is what lets the tools attribute a patch to that
+ * profile at all.
+ *
+ * ## Why this is not `jose`
+ *
+ * `jose` was the first choice and was rejected on a fact rather than a
+ * preference: version 6 is ESM-only (`"type": "module"`, no CJS export). This
+ * package is built by preconstruct and `require`d by Next.js server code, so an
+ * ESM-only dependency here is a runtime failure in consumers' apps, not a build
+ * inconvenience. Adding it would also put a dependency in every install of
+ * `@valbuild/next` for one function.
+ *
+ * The actual cryptography is still not hand-rolled — `node:crypto` does the
+ * ECDSA and the JWK import. What is written here is the JWS envelope and the
+ * claim checks, and the rules that keep that safe are worth stating because
+ * this repository has already shipped the counterexample (`decodeJwt`: `exp`
+ * never checked, a non-constant-time compare, verification skippable):
+ *
+ * - **`alg` is pinned**, not read from the token. The header is only consulted
+ *   for `kid`. A verifier that honours the token's own `alg` can be handed
+ *   `HS256` and will treat the *published* public key as a shared secret.
+ * - **Nothing is read from the payload before the signature verifies.** Claims
+ *   from an unverified token are attacker input.
+ * - **Keys come only from the configured issuer's JWKS**, never from the token.
+ * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
+ *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
+ *   is rejected — or worse, a future change makes it accept the wrong thing.
+ */
+
+var DEFAULT_CLOCK_TOLERANCE_SECONDS = 60;
+/** How long a fetched key set is reused before it is fetched again. */
+var JWKS_TTL_MS = 5 * 60 * 1000;
+/**
+ * How long to wait before re-fetching after a failure.
+ *
+ * Shorter than the success TTL so a key rotation recovers quickly, but not zero:
+ * an unreachable issuer must not turn every tool call into another request to
+ * it.
+ */
+var JWKS_ERROR_TTL_MS = 30 * 1000;
+/**
+ * One cache per issuer, and it has to outlive the request or it is not a cache:
+ * a fetch per tool call would put a network round trip in front of every read.
+ */
+var jwksCache = new Map();
+/** Concurrent misses share one fetch rather than starting several. */
+var inFlight = new Map();
+function jwksUrl(issuer) {
+  // Not discovered from the issuer's metadata document, deliberately:
+  // discovery would mean one more request on the hot path and one more thing
+  // that can be pointed elsewhere. The location is fixed by convention and by
+  // Val's own authorization server.
+  return new URL("/.well-known/jwks.json", issuer).toString();
+}
+function loadJwks(_x, _x2) {
+  return _loadJwks.apply(this, arguments);
+}
+function _loadJwks() {
+  _loadJwks = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2(config, nowMs) {
+    var _config$fetchImpl;
+    var url, cached, age, ttl, existing, fetchImpl, pending, entry;
+    return version._regenerator().w(function (_context2) {
+      while (1) switch (_context2.p = _context2.n) {
+        case 0:
+          url = jwksUrl(config.issuer);
+          cached = jwksCache.get(url);
+          if (!cached) {
+            _context2.n = 1;
+            break;
+          }
+          age = cached.status === "keys" ? nowMs - cached.fetchedAtMs : nowMs - cached.failedAtMs;
+          ttl = cached.status === "keys" ? JWKS_TTL_MS : JWKS_ERROR_TTL_MS;
+          if (!(age < ttl)) {
+            _context2.n = 1;
+            break;
+          }
+          return _context2.a(2, cached);
+        case 1:
+          existing = inFlight.get(url);
+          if (!existing) {
+            _context2.n = 2;
+            break;
+          }
+          return _context2.a(2, existing);
+        case 2:
+          fetchImpl = (_config$fetchImpl = config.fetchImpl) !== null && _config$fetchImpl !== void 0 ? _config$fetchImpl : fetch;
+          pending = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
+            var res, body, keys;
+            return version._regenerator().w(function (_context) {
+              while (1) switch (_context.p = _context.n) {
+                case 0:
+                  _context.p = 0;
+                  _context.n = 1;
+                  return fetchImpl(url, {
+                    headers: {
+                      accept: "application/json"
+                    }
+                  });
+                case 1:
+                  res = _context.v;
+                  if (res.ok) {
+                    _context.n = 2;
+                    break;
+                  }
+                  return _context.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+                case 2:
+                  _context.n = 3;
+                  return res.json();
+                case 3:
+                  body = _context.v;
+                  keys = readKeys(body);
+                  if (!(keys === null)) {
+                    _context.n = 4;
+                    break;
+                  }
+                  return _context.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+                case 4:
+                  return _context.a(2, {
+                    status: "keys",
+                    keys: keys,
+                    fetchedAtMs: nowMs
+                  });
+                case 5:
+                  _context.p = 5;
+                  _context.v;
+                  return _context.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+              }
+            }, _callee, null, [[0, 5]]);
+          }))();
+          inFlight.set(url, pending);
+          _context2.p = 3;
+          _context2.n = 4;
+          return pending;
+        case 4:
+          entry = _context2.v;
+          jwksCache.set(url, entry);
+          return _context2.a(2, entry);
+        case 5:
+          _context2.p = 5;
+          inFlight["delete"](url);
+          return _context2.f(5);
+        case 6:
+          return _context2.a(2);
+      }
+    }, _callee2, null, [[3,, 5, 6]]);
+  }));
+  return _loadJwks.apply(this, arguments);
+}
+function readKeys(body) {
+  if (_typeof._typeof(body) !== "object" || body === null || !("keys" in body)) {
+    return null;
+  }
+  // `in` narrows the property into the type, so no assertion is needed to read
+  // it — and the `Array.isArray` below is what actually establishes the shape.
+  var keys = body.keys;
+  if (!Array.isArray(keys)) {
+    return null;
+  }
+  return keys.filter(function (key) {
+    return _typeof._typeof(key) === "object" && key !== null;
+  });
+}
+
+/**
+ * Read `Authorization: Bearer …`.
+ *
+ * Exported because the refusal needs to know whether a token was presented at
+ * all: RFC 6750 distinguishes "no credential" — a bare `401`, which is an
+ * invitation to authenticate — from "a bad credential", and a client that gets
+ * the second when it deserved the first will not start the authorization flow.
+ */
+function readBearerToken(request) {
+  var _match$;
+  var header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
+  return token ? token : null;
+}
+function verifyValAccessToken(_x3, _x4) {
+  return _verifyValAccessToken.apply(this, arguments);
+}
+function _verifyValAccessToken() {
+  _verifyValAccessToken = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3(request, config) {
+    var _config$clockToleranc;
+    var token, parts, _parts, encodedHeader, encodedPayload, encodedSignature, header, kid, nowMs, jwks, candidates, signature, signedData, verified, payload, tolerance, nowSeconds, subject, scopes;
+    return version._regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          token = readBearerToken(request);
+          if (!(token === null)) {
+            _context3.n = 1;
+            break;
+          }
+          return _context3.a(2, {
+            status: "refused",
+            error: "invalid_request",
+            description: "This Val MCP endpoint needs an access token. Authorize with the Val authorization server and present it as `Authorization: Bearer`."
+          });
+        case 1:
+          parts = token.split(".");
+          if (!(parts.length !== 3)) {
+            _context3.n = 2;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not a JWS."));
+        case 2:
+          _parts = slicedToArray._slicedToArray(parts, 3), encodedHeader = _parts[0], encodedPayload = _parts[1], encodedSignature = _parts[2];
+          header = decodeJsonSegment(encodedHeader);
+          if (!(header === null)) {
+            _context3.n = 3;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's header could not be read."));
+        case 3:
+          if (!(header.alg !== "ES256")) {
+            _context3.n = 4;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not signed with ES256, which is the only algorithm this server accepts."));
+        case 4:
+          kid = typeof header.kid === "string" ? header.kid : null;
+          nowMs = Date.now();
+          _context3.n = 5;
+          return loadJwks(config, nowMs);
+        case 5:
+          jwks = _context3.v;
+          if (!(jwks.status === "error")) {
+            _context3.n = 6;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
+        case 6:
+          candidates = jwks.keys.filter(function (key) {
+            return isVerifyingP256Key(key, kid);
+          });
+          if (!(candidates.length === 0)) {
+            _context3.n = 7;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token was signed with a key the Val authorization server does not publish."));
+        case 7:
+          signature = decodeBase64Url(encodedSignature);
+          if (!(signature === null)) {
+            _context3.n = 8;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's signature could not be read."));
+        case 8:
+          signedData = Buffer.from("".concat(encodedHeader, ".").concat(encodedPayload), "ascii"); // Every published key is tried when the token names no `kid`, so a rotation
+          // that has not yet propagated to clients still verifies. With a `kid` the
+          // filter above leaves one.
+          verified = candidates.some(function (key) {
+            return verifyWithJwk(key, signedData, signature);
+          });
+          if (verified) {
+            _context3.n = 9;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's signature could not be verified."));
+        case 9:
+          // Only now: everything below reads the payload, and before this line it was
+          // attacker input.
+          payload = decodeJsonSegment(encodedPayload);
+          if (!(payload === null)) {
+            _context3.n = 10;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's payload could not be read."));
+        case 10:
+          tolerance = (_config$clockToleranc = config.clockToleranceSeconds) !== null && _config$clockToleranc !== void 0 ? _config$clockToleranc : DEFAULT_CLOCK_TOLERANCE_SECONDS;
+          nowSeconds = Math.floor(nowMs / 1000);
+          if (!(typeof payload.exp !== "number")) {
+            _context3.n = 11;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token has no expiry."));
+        case 11:
+          if (!(payload.exp + tolerance <= nowSeconds)) {
+            _context3.n = 12;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token has expired. Refresh it and try again."));
+        case 12:
+          if (!(typeof payload.nbf === "number" && payload.nbf - tolerance > nowSeconds)) {
+            _context3.n = 13;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not valid yet."));
+        case 13:
+          if (!(payload.iss !== config.issuer)) {
+            _context3.n = 14;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token was not issued by this server's authorization server (iss claim)."));
+        case 14:
+          if (audienceMatches(payload.aud, config.resource)) {
+            _context3.n = 15;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not valid for this server (aud claim)."));
+        case 15:
+          subject = payload.sub;
+          if (!(typeof subject !== "string" || subject.length === 0)) {
+            _context3.n = 16;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token has no subject."));
+        case 16:
+          scopes = readScopes(payload.scope);
+          if (scopes.includes(server.VAL_SCOPE_READ)) {
+            _context3.n = 17;
+            break;
+          }
+          return _context3.a(2, {
+            status: "refused",
+            error: "insufficient_scope",
+            description: "The access token does not have the ".concat(server.VAL_SCOPE_READ, " scope, so it cannot read any content.")
+          });
+        case 17:
+          return _context3.a(2, {
+            status: "ok",
+            auth: {
+              type: "verified-profile",
+              profileId: server.authorIdFromVerifiedSubject(subject),
+              scopes: scopes
+            }
+          });
+      }
+    }, _callee3);
+  }));
+  return _verifyValAccessToken.apply(this, arguments);
+}
+function invalidToken(description) {
+  // Described by class, never by echoing the token or a raw error: a
+  // verification failure message is a place credentials leak into logs.
+  return {
+    status: "refused",
+    error: "invalid_token",
+    description: description
+  };
+}
+
+/**
+ * `aud` is a string or an array of strings (RFC 7519 section 4.1.3).
+ *
+ * A match on any member is a match, which is the spec's own rule — a token may
+ * legitimately be addressed to several resources.
+ */
+function audienceMatches(claim, resource) {
+  if (typeof claim === "string") {
+    return claim === resource;
+  }
+  if (Array.isArray(claim)) {
+    return claim.some(function (entry) {
+      return entry === resource;
+    });
+  }
+  return false;
+}
+
+/**
+ * `scope` is a space-delimited string (RFC 6749 section 3.3).
+ *
+ * Anything else is read as no scopes rather than coerced. A token whose scope
+ * claim is the wrong shape is a token we do not understand, and understanding
+ * it generously is how a write gets authorized by an array someone sent.
+ */
+function readScopes(claim) {
+  if (typeof claim !== "string") {
+    return [];
+  }
+  return claim.split(" ").filter(function (scope) {
+    return scope.length > 0;
+  });
+}
+function isVerifyingP256Key(key, kid) {
+  if (key.kty !== "EC" || key.crv !== "P-256") {
+    return false;
+  }
+  if (typeof key.x !== "string" || typeof key.y !== "string") {
+    return false;
+  }
+  // A key published for encryption is not a key to verify signatures with, and
+  // an `alg` that disagrees with what we verify is a key meant for something
+  // else.
+  if (key.use !== undefined && key.use !== "sig") {
+    return false;
+  }
+  if (key.alg !== undefined && key.alg !== "ES256") {
+    return false;
+  }
+  if (kid !== null && typeof key.kid === "string" && key.kid !== kid) {
+    return false;
+  }
+  return true;
+}
+function verifyWithJwk(key, signedData, signature) {
+  try {
+    var publicKey = node_crypto.createPublicKey({
+      key: {
+        kty: "EC",
+        crv: "P-256",
+        x: String(key.x),
+        y: String(key.y)
+      },
+      format: "jwk"
+    });
+    return node_crypto.verify("sha256", signedData,
+    // `ieee-p1363` because a JWS ECDSA signature is the raw `r||s` pair, while
+    // node defaults to DER for EC keys. Getting this wrong rejects every
+    // valid signature.
+    {
+      key: publicKey,
+      dsaEncoding: "ieee-p1363"
+    }, signature);
+  } catch (_unused) {
+    // A malformed key in an otherwise good key set should not take down
+    // verification against the other keys.
+    return false;
+  }
+}
+function decodeBase64Url(segment) {
+  if (segment === undefined || !/^[A-Za-z0-9_-]*$/.test(segment)) {
+    return null;
+  }
+  try {
+    return Buffer.from(segment, "base64url");
+  } catch (_unused2) {
+    return null;
+  }
+}
+function decodeJsonSegment(segment) {
+  var decoded = decodeBase64Url(segment);
+  if (decoded === null) {
+    return null;
+  }
+  try {
+    var parsed = JSON.parse(decoded.toString("utf8"));
+    if (_typeof._typeof(parsed) !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return objectSpread2._objectSpread2({}, parsed);
+  } catch (_unused3) {
+    return null;
+  }
+}
+
+/**
+ * The one document an MCP client needs before it can authorize: RFC 9728
+ * Protected Resource Metadata, served by the *resource* server.
+ *
+ * This is how a client discovers where to authorize. It asks the resource — this
+ * app — and the resource names its authorization server. Which is why this
+ * belongs here and the RFC 8414 *authorization server* metadata does not: that
+ * document lives at the issuer, describes the issuer's own endpoints, and is
+ * served by the issuer. An app serving a copy would be asserting the issuer's
+ * configuration on its behalf, and would be wrong the moment the issuer changed
+ * anything.
+ *
+ * The flow, so the split reads as a whole:
+ *
+ * 1. client → `{app}/api/mcp` with no token → `401` naming this document
+ * 2. client → `{app}/.well-known/oauth-protected-resource` → the issuer
+ * 3. client → `{issuer}/.well-known/oauth-authorization-server` → endpoints
+ * 4. client → issuer's `/authorize`, then `/token`
+ * 5. client → `{app}/api/mcp` with the token
+ */
+
+var CORS_HEADERS = {
+  // The document is public and contains no secrets — it exists to be read by
+  // clients whose origin we cannot know in advance, so `*` is the correct value
+  // rather than a lazy one. Note there is no `Access-Control-Allow-Credentials`:
+  // with it, `*` would be rejected by browsers, and this document is never
+  // fetched with credentials.
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
+  "Access-Control-Max-Age": "3600"
+};
+function createValMcpMetadata(oauth, scopesSupported) {
+  var document = {
+    // The resource identifier, which MUST be the value clients send as
+    // `resource` and the value that arrives back in `aud`. Same string as the
+    // audience this app verifies against — one value, so the two cannot drift.
+    resource: oauth.resource,
+    authorization_servers: [oauth.issuer],
+    scopes_supported: scopesSupported,
+    bearer_methods_supported: ["header"]
+  };
+  var body = JSON.stringify(document);
+  return {
+    GET: function GET() {
+      return new Response(body, {
+        status: 200,
+        headers: objectSpread2._objectSpread2({
+          "Content-Type": "application/json",
+          // Cacheable: it changes only when the app is reconfigured, and a
+          // client that re-reads it on every authorization costs a round trip
+          // for nothing.
+          "Cache-Control": "public, max-age=3600"
+        }, CORS_HEADERS)
+      });
+    },
+    OPTIONS: function OPTIONS() {
+      return new Response(null, {
+        status: 204,
+        headers: CORS_HEADERS
+      });
+    }
+  };
+}
+
+/**
+ * The `WWW-Authenticate` value for a refusal (RFC 6750 section 3, RFC 9728
+ * section 5.1).
+ *
+ * `resource_metadata` is the load-bearing parameter: it is how a client that has
+ * never seen this server learns where to authorize. A `401` without it is a dead
+ * end — the client knows it needs a token and has no way to find out from where.
+ */
+function wwwAuthenticate(oauth, scopesSupported, refusal) {
+  var metadataUrl = new URL("/.well-known/oauth-protected-resource", oauth.resource).toString();
+  var params = ["resource_metadata=\"".concat(metadataUrl, "\""), "scope=\"".concat(scopesSupported.join(" "), "\"")];
+  if (refusal) {
+    params.push("error=\"".concat(refusal.error, "\""));
+    params.push("error_description=\"".concat(headerSafe(refusal.description), "\""));
+  }
+  return "Bearer ".concat(params.join(", "));
+}
+
+/**
+ * Make a string safe to put inside a quoted header parameter.
+ *
+ * Three classes go, and the third is the one that matters most:
+ *
+ * - a **quote** would close the parameter early;
+ * - a **backslash** would start an escape the rest of the value does not
+ *   finish;
+ * - a **CR or LF** would end the header line, which is response splitting — an
+ *   attacker-influenced description could inject a header of their own, or a
+ *   whole second response.
+ *
+ * The descriptions passed here today are all literals from this package and
+ * contain none of it. That is a property of today's callers rather than of the
+ * type, and this function exists so it stays true when a future one interpolates
+ * something from a request.
+ */
+function headerSafe(value) {
+  // eslint-disable-next-line no-control-regex -- the point is to remove them
+  return value.replace(/["\\]/g, "").replace(/[\u0000-\u001f\u007f]/g, " ");
+}
+
+/**
+ * Val's tools over MCP, and the two checks that have to happen before a request
+ * gets to them.
+ *
+ * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
+ * route, which framework — and this owns the parts that must not be re-decided
+ * per app: whether the request is allowed to reach the tools at all, and whose
+ * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
+ * version is that the SDK reorganised itself once already, and the security
+ * checks should not move when it does again.
+ */
+
+function initValMcp(valModules, config, opts) {
+  var route = "/api/val"; // TODO: get from config, as initValServer does
+  var coreVersion = core.Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var nextVersion = version.VERSION;
+  if (!nextVersion) {
+    throw new Error("Could not get @valbuild/next package version");
+  }
+
+  // Resolved once at module-eval time, awaited per request. The no-op catch is
+  // load bearing for the same reason it is in createValApiRouter: a config error
+  // on a promise with no handler attached becomes an unhandledRejection and
+  // takes the dev server down, and the error is reported per request below
+  // anyway.
+  var setupPromise = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
+    var options;
+    return version._regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          _context.n = 1;
+          return server.initHandlerOptions(route, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, config), {}, {
+            versions: {
+              core: coreVersion,
+              next: nextVersion
+            }
+          }), config);
+        case 1:
+          options = _context.v;
+          return _context.a(2, {
+            mode: options.mode,
+            tools: server.createValTools(valModules, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, options), {}, {
+              formatter: opts === null || opts === void 0 ? void 0 : opts.formatter
+            }))
+          });
+      }
+    }, _callee);
+  }))();
+  setupPromise["catch"](function () {
+    // handled per request
+  });
+  var oauth = opts === null || opts === void 0 ? void 0 : opts.oauth;
+  var scopesSupported = [server.VAL_SCOPE_READ, server.VAL_SCOPE_WRITE];
+  return {
+    valMcpMetadata: oauth ? createValMcpMetadata(oauth, scopesSupported) : null,
+    valMcpTools: function valMcpTools() {
+      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2() {
+        return version._regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              _context2.n = 1;
+              return setupPromise;
+            case 1:
+              return _context2.a(2, _context2.v.tools);
+          }
+        }, _callee2);
+      }))();
+    },
+    valMcpAuthorize: function valMcpAuthorize(request) {
+      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
+        var setup, refusal, sessionId, verified, status, pat, _t;
+        return version._regenerator().w(function (_context3) {
+          while (1) switch (_context3.p = _context3.n) {
+            case 0:
+              _context3.p = 0;
+              _context3.n = 1;
+              return setupPromise;
+            case 1:
+              setup = _context3.v;
+              _context3.n = 3;
+              break;
+            case 2:
+              _context3.p = 2;
+              _t = _context3.v;
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: could not start the Val MCP server",
+                  details: _t instanceof Error ? _t.message : String(_t)
+                })
+              });
+            case 3:
+              if (!(request === undefined)) {
+                _context3.n = 4;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(401, {
+                  error: "Val: this MCP server needs the HTTP request to authorize a call, and none was available."
+                })
+              });
+            case 4:
+              refusal = refuseUnsafeRequest(request, setup.mode);
+              if (!refusal) {
+                _context3.n = 5;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: refusal
+              });
+            case 5:
+              // Not the MCP session id, in either branch below. Val's patch `sessionId`
+              // names a Val AI session, and putting an unrelated id in it would claim a
+              // relationship that does not exist.
+              sessionId = null;
+              if (!oauth) {
+                _context3.n = 8;
+                break;
+              }
+              _context3.n = 6;
+              return verifyValAccessToken(request, oauth);
+            case 6:
+              verified = _context3.v;
+              if (!(verified.status === "refused")) {
+                _context3.n = 7;
+                break;
+              }
+              // 401 for a missing or bad token, 403 once the token is good but does
+              // not carry the scope: RFC 6750 section 3.1, and the distinction is
+              // what tells a client whether to authorize again or to give up.
+              status = verified.error === "insufficient_scope" ? 403 : 401;
+              return _context3.a(2, {
+                status: "refused",
+                response: new Response(JSON.stringify({
+                  error: verified.error,
+                  error_description: verified.description
+                }), {
+                  status: status,
+                  headers: {
+                    "Content-Type": "application/json",
+                    "WWW-Authenticate": wwwAuthenticate(oauth, scopesSupported, {
+                      error: verified.error,
+                      description: verified.description
+                    })
+                  }
+                })
+              });
+            case 7:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: verified.auth,
+                  sessionId: sessionId
+                }
+              });
+            case 8:
+              pat = readBearerToken(request);
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  // Passed through unverified, deliberately: without an `oauth` config
+                  // this app has no key to check anything against, so it is not the
+                  // authority on what the token may do and the registry sends it to the
+                  // backend that is. See `docs/plans/mcp.md` D.2.
+                  auth: pat === null ? null : {
+                    type: "pat",
+                    pat: pat
+                  },
+                  sessionId: sessionId
+                }
+              });
+          }
+        }, _callee3, null, [[0, 2]]);
+      }))();
+    }
+  };
+}
+
+/**
+ * The two ways this route is dangerous, both refused here.
+ *
+ * 1. **Local filesystem mode outside development.** In fs mode there is no
+ *    credential and no backend: the tools read and write the running process's
+ *    own working tree, and every permission check Val has lives on the other
+ *    side of a backend that is not in this path. Exposed on a deployed host,
+ *    that is unauthenticated write access to the site's content for anyone who
+ *    can reach the port. There is no configuration that makes it safe, so there
+ *    is no flag to turn this off — a project that wants MCP in production wants
+ *    proxy mode, where every call carries its caller's own token.
+ *
+ * 2. **A browser driving the local server.** A page on any origin can `fetch`
+ *    `http://localhost:3000/api/mcp` while a developer has the app running, and
+ *    with DNS rebinding it can do so with a `Host` of its own choosing. Neither
+ *    needs a credential in fs mode. So a cross-origin `Origin` is refused, and
+ *    in fs mode the request must actually be addressed to a loopback host.
+ *
+ * MCP clients are not browsers and send no `Origin`, so the check costs them
+ * nothing.
+ */
+function refuseUnsafeRequest(request, mode) {
+  if (mode === "fs" &&         "production" !== "development") {
+    return jsonResponse(403, {
+      error: "Val: the MCP endpoint is disabled. This project is running in local filesystem mode, where MCP calls are unauthenticated and write directly to the working tree, so it is only served in development. Configure Val for proxy mode to use MCP on a deployed host."
+    });
+  }
+  var host = requestHost(request);
+  var origin = request.headers.get("origin");
+  if (origin !== null) {
+    // `Origin: null` is refused along with the rest. It is the *opaque* origin —
+    // a sandboxed iframe, a `file://` page, some redirects — so it cannot be
+    // compared to anything, and "cannot be compared" has to mean refuse: a page
+    // that would fail the check can otherwise pass it by arranging to have no
+    // origin at all. Absent entirely is the case that is allowed, and that is
+    // the one MCP clients produce.
+    var originHost = origin === "null" ? null : hostOf(origin);
+    if (originHost === null || host === null || originHost !== host) {
+      return jsonResponse(403, {
+        error: "Val: refusing a cross-origin MCP request from ".concat(JSON.stringify(origin), ". MCP clients do not send an Origin header; a browser does.")
+      });
+    }
+  }
+  if (mode === "fs") {
+    var hostname = host === null ? null : hostnameOf(host);
+    if (hostname === null || !LOOPBACK_HOSTNAMES.has(hostname)) {
+      return jsonResponse(403, {
+        error: "Val: refusing an MCP request addressed to ".concat(JSON.stringify(host !== null && host !== void 0 ? host : "an unknown host"), ". In local filesystem mode this endpoint only answers on localhost, because a name that resolves to 127.0.0.1 is how a web page reaches a developer's own machine.")
+      });
+    }
+  }
+  return null;
+}
+var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+
+/**
+ * Which host the request was addressed to, as `hostname:port`.
+ *
+ * `Host` only, and deliberately **not** `X-Forwarded-Host`. The forwarded header
+ * is what a client asked for behind a proxy, but nothing stops a client sending
+ * it directly — so preferring it hands an attacker the value both checks below
+ * are decided on. `Host`, by contrast, a browser sets from the URL and page
+ * script cannot override, which is exactly the property the loopback check
+ * depends on.
+ *
+ * The cost is that behind a proxy that rewrites `Host`, a *browser* request
+ * whose `Origin` is the public name no longer matches. That is acceptable: such
+ * a request carries no personal access token, so proxy mode refuses it anyway,
+ * and a non-browser MCP client sends no `Origin` and never reaches the
+ * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * configuration, which is a bigger thing than this needs.
+ */
+function requestHost(request) {
+  var host = request.headers.get("host");
+  if (host) {
+    return host.trim().toLowerCase();
+  }
+  // Last resort: the URL the framework saw.
+  try {
+    return new URL(request.url).host.toLowerCase();
+  } catch (_unused) {
+    return null;
+  }
+}
+function hostOf(origin) {
+  try {
+    return new URL(origin).host.toLowerCase();
+  } catch (_unused2) {
+    return null;
+  }
+}
+
+/** Strips the port, keeping IPv6 brackets — `[::1]:3000` is hostname `[::1]`. */
+function hostnameOf(host) {
+  if (host.startsWith("[")) {
+    var end = host.indexOf("]");
+    return end === -1 ? host : host.slice(0, end + 1);
+  }
+  var colon = host.indexOf(":");
+  return colon === -1 ? host : host.slice(0, colon);
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status: status,
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+}
+
+exports.initValMcp = initValMcp;
 exports.initValServer = initValServer;