@valbuild/next 0.116.0 → 0.117.0

package/server/dist/valbuild-next-server.cjs.prod.js

@@ -9,6 +9,8 @@ var objectSpread2 = require('../../dist/objectSpread2-13f847a9.cjs.prod.js');
 var core = require('@valbuild/core');
 var server = require('@valbuild/server');
 var server$1 = require('next/server');
+var _typeof = require('../../dist/typeof-16428c61.cjs.prod.js');
+var node_crypto = require('node:crypto');
 require('../../dist/unsupportedIterableToArray-0d2087a2.cjs.prod.js');
 require('../../dist/defineProperty-8951f469.cjs.prod.js');
 
@@ -120,6 +122,578 @@ function initValServer(valModules, config, nextConfig) {
   };
 }
 
+/**
+ * Verifying an OAuth access token, which is the whole of what makes this app a
+ * resource server rather than a relay.
+ *
+ * The token is issued by Val's authorization server and presented by an MCP
+ * client. This app holds no signing key for it and cannot mint one — it fetches
+ * the issuer's *public* keys and checks a signature. That asymmetry is the
+ * point: a verified `sub` is a fact about the token rather than a claim by
+ * whoever sent it, which is what lets the tools attribute a patch to that
+ * profile at all.
+ *
+ * ## Why this is not `jose`
+ *
+ * `jose` was the first choice and was rejected on a fact rather than a
+ * preference: version 6 is ESM-only (`"type": "module"`, no CJS export). This
+ * package is built by preconstruct and `require`d by Next.js server code, so an
+ * ESM-only dependency here is a runtime failure in consumers' apps, not a build
+ * inconvenience. Adding it would also put a dependency in every install of
+ * `@valbuild/next` for one function.
+ *
+ * The actual cryptography is still not hand-rolled — `node:crypto` does the
+ * ECDSA and the JWK import. What is written here is the JWS envelope and the
+ * claim checks, and the rules that keep that safe are worth stating because
+ * this repository has already shipped the counterexample (`decodeJwt`: `exp`
+ * never checked, a non-constant-time compare, verification skippable):
+ *
+ * - **`alg` is pinned**, not read from the token. The header is only consulted
+ *   for `kid`. A verifier that honours the token's own `alg` can be handed
+ *   `HS256` and will treat the *published* public key as a shared secret.
+ * - **Nothing is read from the payload before the signature verifies.** Claims
+ *   from an unverified token are attacker input.
+ * - **Keys come only from the configured issuer's JWKS**, never from the token.
+ * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
+ *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
+ *   is rejected — or worse, a future change makes it accept the wrong thing.
+ */
+
+var DEFAULT_CLOCK_TOLERANCE_SECONDS = 60;
+/** How long a fetched key set is reused before it is fetched again. */
+var JWKS_TTL_MS = 5 * 60 * 1000;
+/**
+ * How long to wait before re-fetching after a failure.
+ *
+ * Shorter than the success TTL so a key rotation recovers quickly, but not zero:
+ * an unreachable issuer must not turn every tool call into another request to
+ * it.
+ */
+var JWKS_ERROR_TTL_MS = 30 * 1000;
+/**
+ * One cache per issuer, and it has to outlive the request or it is not a cache:
+ * a fetch per tool call would put a network round trip in front of every read.
+ */
+var jwksCache = new Map();
+/** Concurrent misses share one fetch rather than starting several. */
+var inFlight = new Map();
+function jwksUrl(issuer) {
+  // Not discovered from the issuer's metadata document, deliberately:
+  // discovery would mean one more request on the hot path and one more thing
+  // that can be pointed elsewhere. The location is fixed by convention and by
+  // Val's own authorization server.
+  return new URL("/.well-known/jwks.json", issuer).toString();
+}
+function loadJwks(_x, _x2) {
+  return _loadJwks.apply(this, arguments);
+}
+function _loadJwks() {
+  _loadJwks = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2(config, nowMs) {
+    var _config$fetchImpl;
+    var url, cached, age, ttl, existing, fetchImpl, pending, entry;
+    return version._regenerator().w(function (_context2) {
+      while (1) switch (_context2.p = _context2.n) {
+        case 0:
+          url = jwksUrl(config.issuer);
+          cached = jwksCache.get(url);
+          if (!cached) {
+            _context2.n = 1;
+            break;
+          }
+          age = cached.status === "keys" ? nowMs - cached.fetchedAtMs : nowMs - cached.failedAtMs;
+          ttl = cached.status === "keys" ? JWKS_TTL_MS : JWKS_ERROR_TTL_MS;
+          if (!(age < ttl)) {
+            _context2.n = 1;
+            break;
+          }
+          return _context2.a(2, cached);
+        case 1:
+          existing = inFlight.get(url);
+          if (!existing) {
+            _context2.n = 2;
+            break;
+          }
+          return _context2.a(2, existing);
+        case 2:
+          fetchImpl = (_config$fetchImpl = config.fetchImpl) !== null && _config$fetchImpl !== void 0 ? _config$fetchImpl : fetch;
+          pending = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
+            var res, body, keys;
+            return version._regenerator().w(function (_context) {
+              while (1) switch (_context.p = _context.n) {
+                case 0:
+                  _context.p = 0;
+                  _context.n = 1;
+                  return fetchImpl(url, {
+                    headers: {
+                      accept: "application/json"
+                    }
+                  });
+                case 1:
+                  res = _context.v;
+                  if (res.ok) {
+                    _context.n = 2;
+                    break;
+                  }
+                  return _context.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+                case 2:
+                  _context.n = 3;
+                  return res.json();
+                case 3:
+                  body = _context.v;
+                  keys = readKeys(body);
+                  if (!(keys === null)) {
+                    _context.n = 4;
+                    break;
+                  }
+                  return _context.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+                case 4:
+                  return _context.a(2, {
+                    status: "keys",
+                    keys: keys,
+                    fetchedAtMs: nowMs
+                  });
+                case 5:
+                  _context.p = 5;
+                  _context.v;
+                  return _context.a(2, {
+                    status: "error",
+                    failedAtMs: nowMs
+                  });
+              }
+            }, _callee, null, [[0, 5]]);
+          }))();
+          inFlight.set(url, pending);
+          _context2.p = 3;
+          _context2.n = 4;
+          return pending;
+        case 4:
+          entry = _context2.v;
+          jwksCache.set(url, entry);
+          return _context2.a(2, entry);
+        case 5:
+          _context2.p = 5;
+          inFlight["delete"](url);
+          return _context2.f(5);
+        case 6:
+          return _context2.a(2);
+      }
+    }, _callee2, null, [[3,, 5, 6]]);
+  }));
+  return _loadJwks.apply(this, arguments);
+}
+function readKeys(body) {
+  if (_typeof._typeof(body) !== "object" || body === null || !("keys" in body)) {
+    return null;
+  }
+  // `in` narrows the property into the type, so no assertion is needed to read
+  // it — and the `Array.isArray` below is what actually establishes the shape.
+  var keys = body.keys;
+  if (!Array.isArray(keys)) {
+    return null;
+  }
+  return keys.filter(function (key) {
+    return _typeof._typeof(key) === "object" && key !== null;
+  });
+}
+
+/**
+ * Read `Authorization: Bearer …`.
+ *
+ * Exported because the refusal needs to know whether a token was presented at
+ * all: RFC 6750 distinguishes "no credential" — a bare `401`, which is an
+ * invitation to authenticate — from "a bad credential", and a client that gets
+ * the second when it deserved the first will not start the authorization flow.
+ */
+function readBearerToken(request) {
+  var _match$;
+  var header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
+  return token ? token : null;
+}
+function verifyValAccessToken(_x3, _x4) {
+  return _verifyValAccessToken.apply(this, arguments);
+}
+function _verifyValAccessToken() {
+  _verifyValAccessToken = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3(request, config) {
+    var _config$clockToleranc;
+    var token, parts, _parts, encodedHeader, encodedPayload, encodedSignature, header, kid, nowMs, jwks, candidates, signature, signedData, verified, payload, tolerance, nowSeconds, subject, scopes;
+    return version._regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          token = readBearerToken(request);
+          if (!(token === null)) {
+            _context3.n = 1;
+            break;
+          }
+          return _context3.a(2, {
+            status: "refused",
+            error: "invalid_request",
+            description: "This Val MCP endpoint needs an access token. Authorize with the Val authorization server and present it as `Authorization: Bearer`."
+          });
+        case 1:
+          parts = token.split(".");
+          if (!(parts.length !== 3)) {
+            _context3.n = 2;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not a JWS."));
+        case 2:
+          _parts = slicedToArray._slicedToArray(parts, 3), encodedHeader = _parts[0], encodedPayload = _parts[1], encodedSignature = _parts[2];
+          header = decodeJsonSegment(encodedHeader);
+          if (!(header === null)) {
+            _context3.n = 3;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's header could not be read."));
+        case 3:
+          if (!(header.alg !== "ES256")) {
+            _context3.n = 4;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not signed with ES256, which is the only algorithm this server accepts."));
+        case 4:
+          kid = typeof header.kid === "string" ? header.kid : null;
+          nowMs = Date.now();
+          _context3.n = 5;
+          return loadJwks(config, nowMs);
+        case 5:
+          jwks = _context3.v;
+          if (!(jwks.status === "error")) {
+            _context3.n = 6;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
+        case 6:
+          candidates = jwks.keys.filter(function (key) {
+            return isVerifyingP256Key(key, kid);
+          });
+          if (!(candidates.length === 0)) {
+            _context3.n = 7;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token was signed with a key the Val authorization server does not publish."));
+        case 7:
+          signature = decodeBase64Url(encodedSignature);
+          if (!(signature === null)) {
+            _context3.n = 8;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's signature could not be read."));
+        case 8:
+          signedData = Buffer.from("".concat(encodedHeader, ".").concat(encodedPayload), "ascii"); // Every published key is tried when the token names no `kid`, so a rotation
+          // that has not yet propagated to clients still verifies. With a `kid` the
+          // filter above leaves one.
+          verified = candidates.some(function (key) {
+            return verifyWithJwk(key, signedData, signature);
+          });
+          if (verified) {
+            _context3.n = 9;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's signature could not be verified."));
+        case 9:
+          // Only now: everything below reads the payload, and before this line it was
+          // attacker input.
+          payload = decodeJsonSegment(encodedPayload);
+          if (!(payload === null)) {
+            _context3.n = 10;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token's payload could not be read."));
+        case 10:
+          tolerance = (_config$clockToleranc = config.clockToleranceSeconds) !== null && _config$clockToleranc !== void 0 ? _config$clockToleranc : DEFAULT_CLOCK_TOLERANCE_SECONDS;
+          nowSeconds = Math.floor(nowMs / 1000);
+          if (!(typeof payload.exp !== "number")) {
+            _context3.n = 11;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token has no expiry."));
+        case 11:
+          if (!(payload.exp + tolerance <= nowSeconds)) {
+            _context3.n = 12;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token has expired. Refresh it and try again."));
+        case 12:
+          if (!(typeof payload.nbf === "number" && payload.nbf - tolerance > nowSeconds)) {
+            _context3.n = 13;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not valid yet."));
+        case 13:
+          if (!(payload.iss !== config.issuer)) {
+            _context3.n = 14;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token was not issued by this server's authorization server (iss claim)."));
+        case 14:
+          if (audienceMatches(payload.aud, config.resource)) {
+            _context3.n = 15;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token is not valid for this server (aud claim)."));
+        case 15:
+          subject = payload.sub;
+          if (!(typeof subject !== "string" || subject.length === 0)) {
+            _context3.n = 16;
+            break;
+          }
+          return _context3.a(2, invalidToken("The access token has no subject."));
+        case 16:
+          scopes = readScopes(payload.scope);
+          if (scopes.includes(server.VAL_SCOPE_READ)) {
+            _context3.n = 17;
+            break;
+          }
+          return _context3.a(2, {
+            status: "refused",
+            error: "insufficient_scope",
+            description: "The access token does not have the ".concat(server.VAL_SCOPE_READ, " scope, so it cannot read any content.")
+          });
+        case 17:
+          return _context3.a(2, {
+            status: "ok",
+            auth: {
+              type: "verified-profile",
+              profileId: server.authorIdFromVerifiedSubject(subject),
+              scopes: scopes
+            }
+          });
+      }
+    }, _callee3);
+  }));
+  return _verifyValAccessToken.apply(this, arguments);
+}
+function invalidToken(description) {
+  // Described by class, never by echoing the token or a raw error: a
+  // verification failure message is a place credentials leak into logs.
+  return {
+    status: "refused",
+    error: "invalid_token",
+    description: description
+  };
+}
+
+/**
+ * `aud` is a string or an array of strings (RFC 7519 section 4.1.3).
+ *
+ * A match on any member is a match, which is the spec's own rule — a token may
+ * legitimately be addressed to several resources.
+ */
+function audienceMatches(claim, resource) {
+  if (typeof claim === "string") {
+    return claim === resource;
+  }
+  if (Array.isArray(claim)) {
+    return claim.some(function (entry) {
+      return entry === resource;
+    });
+  }
+  return false;
+}
+
+/**
+ * `scope` is a space-delimited string (RFC 6749 section 3.3).
+ *
+ * Anything else is read as no scopes rather than coerced. A token whose scope
+ * claim is the wrong shape is a token we do not understand, and understanding
+ * it generously is how a write gets authorized by an array someone sent.
+ */
+function readScopes(claim) {
+  if (typeof claim !== "string") {
+    return [];
+  }
+  return claim.split(" ").filter(function (scope) {
+    return scope.length > 0;
+  });
+}
+function isVerifyingP256Key(key, kid) {
+  if (key.kty !== "EC" || key.crv !== "P-256") {
+    return false;
+  }
+  if (typeof key.x !== "string" || typeof key.y !== "string") {
+    return false;
+  }
+  // A key published for encryption is not a key to verify signatures with, and
+  // an `alg` that disagrees with what we verify is a key meant for something
+  // else.
+  if (key.use !== undefined && key.use !== "sig") {
+    return false;
+  }
+  if (key.alg !== undefined && key.alg !== "ES256") {
+    return false;
+  }
+  if (kid !== null && typeof key.kid === "string" && key.kid !== kid) {
+    return false;
+  }
+  return true;
+}
+function verifyWithJwk(key, signedData, signature) {
+  try {
+    var publicKey = node_crypto.createPublicKey({
+      key: {
+        kty: "EC",
+        crv: "P-256",
+        x: String(key.x),
+        y: String(key.y)
+      },
+      format: "jwk"
+    });
+    return node_crypto.verify("sha256", signedData,
+    // `ieee-p1363` because a JWS ECDSA signature is the raw `r||s` pair, while
+    // node defaults to DER for EC keys. Getting this wrong rejects every
+    // valid signature.
+    {
+      key: publicKey,
+      dsaEncoding: "ieee-p1363"
+    }, signature);
+  } catch (_unused) {
+    // A malformed key in an otherwise good key set should not take down
+    // verification against the other keys.
+    return false;
+  }
+}
+function decodeBase64Url(segment) {
+  if (segment === undefined || !/^[A-Za-z0-9_-]*$/.test(segment)) {
+    return null;
+  }
+  try {
+    return Buffer.from(segment, "base64url");
+  } catch (_unused2) {
+    return null;
+  }
+}
+function decodeJsonSegment(segment) {
+  var decoded = decodeBase64Url(segment);
+  if (decoded === null) {
+    return null;
+  }
+  try {
+    var parsed = JSON.parse(decoded.toString("utf8"));
+    if (_typeof._typeof(parsed) !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    return objectSpread2._objectSpread2({}, parsed);
+  } catch (_unused3) {
+    return null;
+  }
+}
+
+/**
+ * The one document an MCP client needs before it can authorize: RFC 9728
+ * Protected Resource Metadata, served by the *resource* server.
+ *
+ * This is how a client discovers where to authorize. It asks the resource — this
+ * app — and the resource names its authorization server. Which is why this
+ * belongs here and the RFC 8414 *authorization server* metadata does not: that
+ * document lives at the issuer, describes the issuer's own endpoints, and is
+ * served by the issuer. An app serving a copy would be asserting the issuer's
+ * configuration on its behalf, and would be wrong the moment the issuer changed
+ * anything.
+ *
+ * The flow, so the split reads as a whole:
+ *
+ * 1. client → `{app}/api/mcp` with no token → `401` naming this document
+ * 2. client → `{app}/.well-known/oauth-protected-resource` → the issuer
+ * 3. client → `{issuer}/.well-known/oauth-authorization-server` → endpoints
+ * 4. client → issuer's `/authorize`, then `/token`
+ * 5. client → `{app}/api/mcp` with the token
+ */
+
+var CORS_HEADERS = {
+  // The document is public and contains no secrets — it exists to be read by
+  // clients whose origin we cannot know in advance, so `*` is the correct value
+  // rather than a lazy one. Note there is no `Access-Control-Allow-Credentials`:
+  // with it, `*` would be rejected by browsers, and this document is never
+  // fetched with credentials.
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
+  "Access-Control-Max-Age": "3600"
+};
+function createValMcpMetadata(oauth, scopesSupported) {
+  var document = {
+    // The resource identifier, which MUST be the value clients send as
+    // `resource` and the value that arrives back in `aud`. Same string as the
+    // audience this app verifies against — one value, so the two cannot drift.
+    resource: oauth.resource,
+    authorization_servers: [oauth.issuer],
+    scopes_supported: scopesSupported,
+    bearer_methods_supported: ["header"]
+  };
+  var body = JSON.stringify(document);
+  return {
+    GET: function GET() {
+      return new Response(body, {
+        status: 200,
+        headers: objectSpread2._objectSpread2({
+          "Content-Type": "application/json",
+          // Cacheable: it changes only when the app is reconfigured, and a
+          // client that re-reads it on every authorization costs a round trip
+          // for nothing.
+          "Cache-Control": "public, max-age=3600"
+        }, CORS_HEADERS)
+      });
+    },
+    OPTIONS: function OPTIONS() {
+      return new Response(null, {
+        status: 204,
+        headers: CORS_HEADERS
+      });
+    }
+  };
+}
+
+/**
+ * The `WWW-Authenticate` value for a refusal (RFC 6750 section 3, RFC 9728
+ * section 5.1).
+ *
+ * `resource_metadata` is the load-bearing parameter: it is how a client that has
+ * never seen this server learns where to authorize. A `401` without it is a dead
+ * end — the client knows it needs a token and has no way to find out from where.
+ */
+function wwwAuthenticate(oauth, scopesSupported, refusal) {
+  var metadataUrl = new URL("/.well-known/oauth-protected-resource", oauth.resource).toString();
+  var params = ["resource_metadata=\"".concat(metadataUrl, "\""), "scope=\"".concat(scopesSupported.join(" "), "\"")];
+  if (refusal) {
+    params.push("error=\"".concat(refusal.error, "\""));
+    params.push("error_description=\"".concat(headerSafe(refusal.description), "\""));
+  }
+  return "Bearer ".concat(params.join(", "));
+}
+
+/**
+ * Make a string safe to put inside a quoted header parameter.
+ *
+ * Three classes go, and the third is the one that matters most:
+ *
+ * - a **quote** would close the parameter early;
+ * - a **backslash** would start an escape the rest of the value does not
+ *   finish;
+ * - a **CR or LF** would end the header line, which is response splitting — an
+ *   attacker-influenced description could inject a header of their own, or a
+ *   whole second response.
+ *
+ * The descriptions passed here today are all literals from this package and
+ * contain none of it. That is a property of today's callers rather than of the
+ * type, and this function exists so it stays true when a future one interpolates
+ * something from a request.
+ */
+function headerSafe(value) {
+  // eslint-disable-next-line no-control-regex -- the point is to remove them
+  return value.replace(/["\\]/g, "").replace(/[\u0000-\u001f\u007f]/g, " ");
+}
+
 /**
  * Val's tools over MCP, and the two checks that have to happen before a request
  * gets to them.
@@ -174,7 +748,10 @@ function initValMcp(valModules, config, opts) {
   setupPromise["catch"](function () {
     // handled per request
   });
+  var oauth = opts === null || opts === void 0 ? void 0 : opts.oauth;
+  var scopesSupported = [server.VAL_SCOPE_READ, server.VAL_SCOPE_WRITE];
   return {
+    valMcpMetadata: oauth ? createValMcpMetadata(oauth, scopesSupported) : null,
     valMcpTools: function valMcpTools() {
       return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2() {
         return version._regenerator().w(function (_context2) {
@@ -190,7 +767,7 @@ function initValMcp(valModules, config, opts) {
     },
     valMcpAuthorize: function valMcpAuthorize(request) {
       return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
-        var setup, refusal, pat, _t;
+        var setup, refusal, sessionId, verified, status, pat, _t;
         return version._regenerator().w(function (_context3) {
           while (1) switch (_context3.p = _context3.n) {
             case 0:
@@ -233,21 +810,66 @@ function initValMcp(valModules, config, opts) {
                 response: refusal
               });
             case 5:
+              // Not the MCP session id, in either branch below. Val's patch `sessionId`
+              // names a Val AI session, and putting an unrelated id in it would claim a
+              // relationship that does not exist.
+              sessionId = null;
+              if (!oauth) {
+                _context3.n = 8;
+                break;
+              }
+              _context3.n = 6;
+              return verifyValAccessToken(request, oauth);
+            case 6:
+              verified = _context3.v;
+              if (!(verified.status === "refused")) {
+                _context3.n = 7;
+                break;
+              }
+              // 401 for a missing or bad token, 403 once the token is good but does
+              // not carry the scope: RFC 6750 section 3.1, and the distinction is
+              // what tells a client whether to authorize again or to give up.
+              status = verified.error === "insufficient_scope" ? 403 : 401;
+              return _context3.a(2, {
+                status: "refused",
+                response: new Response(JSON.stringify({
+                  error: verified.error,
+                  error_description: verified.description
+                }), {
+                  status: status,
+                  headers: {
+                    "Content-Type": "application/json",
+                    "WWW-Authenticate": wwwAuthenticate(oauth, scopesSupported, {
+                      error: verified.error,
+                      description: verified.description
+                    })
+                  }
+                })
+              });
+            case 7:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: verified.auth,
+                  sessionId: sessionId
+                }
+              });
+            case 8:
               pat = readBearerToken(request);
               return _context3.a(2, {
                 status: "ok",
                 tools: setup.tools,
                 ctx: {
-                  // Passed through unverified, deliberately: this app is not the
-                  // authority on what a token may do, and the registry sends it to the
+                  // Passed through unverified, deliberately: without an `oauth` config
+                  // this app has no key to check anything against, so it is not the
+                  // authority on what the token may do and the registry sends it to the
                   // backend that is. See `docs/plans/mcp.md` D.2.
                   auth: pat === null ? null : {
+                    type: "pat",
                     pat: pat
                   },
-                  // Not the MCP session id. Val's patch `sessionId` names a Val AI
-                  // session, and putting an unrelated id in it would claim a
-                  // relationship that does not exist.
-                  sessionId: null
+                  sessionId: sessionId
                 }
               });
           }
@@ -358,16 +980,6 @@ function hostnameOf(host) {
   var colon = host.indexOf(":");
   return colon === -1 ? host : host.slice(0, colon);
 }
-function readBearerToken(request) {
-  var _match$;
-  var header = request.headers.get("authorization");
-  if (!header) {
-    return null;
-  }
-  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
-  return token ? token : null;
-}
 function jsonResponse(status, body) {
   return new Response(JSON.stringify(body), {
     status: status,