@valbuild/next 0.121.0 → 0.122.0

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # @valbuild/next
 
+## 0.122.0
+
+### Minor Changes
+
+- [#597](https://github.com/valbuild/val/pull/597) [`5d14612`](https://github.com/valbuild/val/commit/5d14612f612d657a37338136188f2b3c02b28fe7) Thanks [@freekh](https://github.com/freekh)! - MCP: remove personal access token auth. The endpoint now needs an `oauth`
+  config, or local filesystem mode.
+
+  Until now, an MCP endpoint with no `oauth` config accepted whatever bearer token
+  a caller presented and relayed it to the Val content backend unread. The
+  reasoning was that without an issuer the app has no key to check a token
+  against, so it should not pretend to be the authority on what that token may
+  do — and that much was right. The shape was not: a credential the app cannot
+  check is one it cannot refuse either, so "a deployed endpoint that authenticates
+  nobody" was a supported configuration, and an app could serve content-rewriting
+  tools without ever being told where its callers should authorize.
+
+  **If you run Val in proxy mode**, MCP now requires the `oauth` config that
+  shipped in `0.120.0`. Callers authorize as themselves against the Val
+  authorization server, this app verifies the token's signature, issuer, audience
+  and expiry itself, and patches carry the verified profile as their author:
+
+  ```ts
+  initValMcp(valModules, config, {
+    oauth: {
+      issuer: "https://admin.val.build",
+      resource: "https://your-app.com/api/mcp",
+    },
+  });
+  ```
+
+  Leave it out and the endpoint answers `500` naming the missing config, rather
+  than serving the request.
+
+  **If you run Val in local filesystem mode**, nothing changes. Local development
+  still needs no `oauth` config and no authorization server: there is no backend
+  to authenticate to, and patches are written with no author. A token presented
+  to such a project is still refused rather than ignored — the endpoint answers
+  `400` and says to take the credential out of the client's configuration, since
+  what it reached was a working tree with no permission check in front of it.
+
+  Two API changes if you built your own host on `createValTools`:
+
+  - `ValToolContext.auth` no longer has a `{ type: "pat", pat }` variant.
+    `{ type: "verified-profile", profileId, scopes }` is the only credential the
+    registry accepts, and `null` still means local filesystem mode.
+  - `createValOps` no longer takes an `auth` argument. `ValOpsHttp` still accepts
+    a personal access token directly — that is how `val debug` uses the token from
+    `val login` — but no server request builds one.
+
+  Proxy mode also stops keeping one data layer per credential. Each personal
+  access token needed its own `ValOpsHttp` to hold it, each of those cached the
+  project's evaluated modules, and the bounded cache that kept the memory in
+  check turned an eviction into a re-evaluation of every module on the next call.
+  Verified callers all share one instance, because they all reach the backend
+  under the app's own API key.
+
+### Patch Changes
+
+- Updated dependencies [[`be32261`](https://github.com/valbuild/val/commit/be32261af19db8018bc37b180d903416018c0b79), [`5d14612`](https://github.com/valbuild/val/commit/5d14612f612d657a37338136188f2b3c02b28fe7), [`da6794f`](https://github.com/valbuild/val/commit/da6794f3dbd77d49ccfe780b359bab1689ee1b11), [`1c8b7fd`](https://github.com/valbuild/val/commit/1c8b7fda1e84cd8bd32a03a85d2789598b98c3fb)]:
+  - @valbuild/server@0.122.0
+  - @valbuild/shared@0.122.0
+  - @valbuild/ui@0.122.0
+  - @valbuild/language-server@0.122.0
+  - @valbuild/react@0.122.0
+
 ## 0.121.0
 
 ### Minor Changes

package/dist/{ValApp-e17eb734.esm.js → ValApp-074c8289.esm.js}

@@ -3,7 +3,7 @@ import { _ as _slicedToArray } from './slicedToArray-aa291011.esm.js';
 import { VERSION, VAL_APP_PATH, VAL_APP_ID } from '@valbuild/ui';
 import Script from 'next/script';
 import { useState, useRef, useEffect } from 'react';
-import { u as useConfigStorageSave, v as valPrefixedClass, c as cn, a as canvasDarkBg, b as canvasLightBg } from './fallbackColors-5ead2c26.esm.js';
+import { u as useConfigStorageSave, v as valPrefixedClass, c as cn, a as canvasDarkBg, b as canvasLightBg } from './fallbackColors-77aeedf8.esm.js';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import './unsupportedIterableToArray-5baabfdc.esm.js';
 import '@valbuild/shared/internal';

package/dist/ValApp-17eb6e93.cjs.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === "production") {
+  module.exports = require("./ValApp-17eb6e93.cjs.prod.js");
+} else {
+  module.exports = require("./ValApp-17eb6e93.cjs.dev.js");
+}

package/dist/{ValApp-90c4171d.cjs.prod.js → ValApp-17eb6e93.cjs.prod.js}

@@ -7,7 +7,7 @@ var slicedToArray = require('./slicedToArray-ce613de6.cjs.prod.js');
 var ui = require('@valbuild/ui');
 var Script = require('next/script');
 var React = require('react');
-var fallbackColors = require('./fallbackColors-d4a5b0da.cjs.prod.js');
+var fallbackColors = require('./fallbackColors-8842243c.cjs.prod.js');
 var jsxRuntime = require('react/jsx-runtime');
 require('./unsupportedIterableToArray-0d2087a2.cjs.prod.js');
 require('@valbuild/shared/internal');

package/dist/{ValApp-c1c3ef55.cjs.dev.js → ValApp-2bdb460a.cjs.dev.js}

@@ -7,7 +7,7 @@ var slicedToArray = require('./slicedToArray-44036a76.cjs.dev.js');
 var ui = require('@valbuild/ui');
 var Script = require('next/script');
 var React = require('react');
-var fallbackColors = require('./fallbackColors-9a2ac53a.cjs.dev.js');
+var fallbackColors = require('./fallbackColors-a491e700.cjs.dev.js');
 var jsxRuntime = require('react/jsx-runtime');
 require('./unsupportedIterableToArray-c8ab77c9.cjs.dev.js');
 require('@valbuild/shared/internal');

package/dist/{ValNextProvider-f206d2ea.cjs.dev.js → ValNextProvider-016a494b.cjs.dev.js}

@@ -13,7 +13,7 @@ var React = require('react');
 var ValOverlayContext = require('./ValOverlayContext-5bd7628b.cjs.dev.js');
 var stega = require('@valbuild/react/stega');
 var internal = require('@valbuild/shared/internal');
-var fallbackColors = require('./fallbackColors-9a2ac53a.cjs.dev.js');
+var fallbackColors = require('./fallbackColors-a491e700.cjs.dev.js');
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-0445603c.cjs.dev.js');
 var ValCanvasBridge = require('./ValCanvasBridge-9d148bdd.cjs.dev.js');
 var jsxRuntime = require('react/jsx-runtime');

package/dist/{ValNextProvider-588f2ff0.esm.js → ValNextProvider-32156acd.esm.js}

@@ -9,7 +9,7 @@ import React, { useEffect } from 'react';
 import { ValExternalStore, ValOverlayProvider } from './ValOverlayContext-e42a2e14.esm.js';
 import { SET_AUTO_TAG_JSX_ENABLED } from '@valbuild/react/stega';
 import { VAL_THEME_SESSION_STORAGE_KEY, createValClient, isValCanvasFrame } from '@valbuild/shared/internal';
-import { p as prefixStyles, u as useConfigStorageSave, f as floatDarkBg, d as floatLightBg, v as valPrefixedClass, c as cn } from './fallbackColors-5ead2c26.esm.js';
+import { p as prefixStyles, u as useConfigStorageSave, f as floatDarkBg, d as floatLightBg, v as valPrefixedClass, c as cn } from './fallbackColors-77aeedf8.esm.js';
 import { _ as _createForOfIteratorHelper } from './createForOfIteratorHelper-5758a730.esm.js';
 import { ValCanvasBridge } from './ValCanvasBridge-d9948526.esm.js';
 import { jsxs, jsx } from 'react/jsx-runtime';

package/dist/ValNextProvider-72d3561b.cjs.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === "production") {
+  module.exports = require("./ValNextProvider-72d3561b.cjs.prod.js");
+} else {
+  module.exports = require("./ValNextProvider-72d3561b.cjs.dev.js");
+}

package/dist/{ValNextProvider-bd3f89d3.cjs.prod.js → ValNextProvider-72d3561b.cjs.prod.js}

@@ -13,7 +13,7 @@ var React = require('react');
 var ValOverlayContext = require('./ValOverlayContext-d690744f.cjs.prod.js');
 var stega = require('@valbuild/react/stega');
 var internal = require('@valbuild/shared/internal');
-var fallbackColors = require('./fallbackColors-d4a5b0da.cjs.prod.js');
+var fallbackColors = require('./fallbackColors-8842243c.cjs.prod.js');
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-d4afcad8.cjs.prod.js');
 var ValCanvasBridge = require('./ValCanvasBridge-e62125f8.cjs.prod.js');
 var jsxRuntime = require('react/jsx-runtime');

package/dist/declarations/src/server/initValMcp.d.ts

@@ -52,11 +52,11 @@ export declare function initValMcp(valModules: ValModules, config: ValConfig, op
     /**
      * Where to authorize, and what audience to expect.
      *
-     * Omit it and nothing changes: the endpoint behaves exactly as it did
-     * before OAuth existed, which keeps local development a one-liner and keeps
-     * an app that has not been reconfigured working. Provide it and every call
-     * needs a verified access token — including in fs mode, where a token is
-     * refused rather than ignored, because a host that thinks it is
+     * Required for proxy mode, and only omittable in local filesystem mode —
+     * where there is no authorization server to talk to and no backend to
+     * authenticate to, so local development stays a one-liner. Provide it and
+     * every call needs a verified access token, including in fs mode, where a
+     * token is refused rather than ignored: a host that thinks it is
      * authenticating should never silently get unauthenticated local access.
      */
     oauth?: ValOAuthConfig;

package/dist/{fallbackColors-5ead2c26.esm.js → fallbackColors-77aeedf8.esm.js}

@@ -48,11 +48,11 @@ var cn = function cn(className) {
 /** `--bg-canvas`, dark. The studio's own background. */
 var canvasDarkBg = "#08080a";
 /** `--bg-canvas`, light. */
-var canvasLightBg = "#fafafa";
+var canvasLightBg = "#f4f4f5";
 
 /** `--bg-float`, dark. Val's chrome, floating over the customer's page. */
 var floatDarkBg = "#131316";
 /** `--bg-float`, light. */
-var floatLightBg = "#ffffff";
+var floatLightBg = "#fcfcfc";
 
 export { canvasDarkBg as a, canvasLightBg as b, cn as c, floatLightBg as d, floatDarkBg as f, prefixStyles as p, useConfigStorageSave as u, valPrefixedClass as v };

package/dist/{fallbackColors-d4a5b0da.cjs.prod.js → fallbackColors-8842243c.cjs.prod.js}

@@ -54,12 +54,12 @@ var cn = function cn(className) {
 /** `--bg-canvas`, dark. The studio's own background. */
 var canvasDarkBg = "#08080a";
 /** `--bg-canvas`, light. */
-var canvasLightBg = "#fafafa";
+var canvasLightBg = "#f4f4f5";
 
 /** `--bg-float`, dark. Val's chrome, floating over the customer's page. */
 var floatDarkBg = "#131316";
 /** `--bg-float`, light. */
-var floatLightBg = "#ffffff";
+var floatLightBg = "#fcfcfc";
 
 exports.canvasDarkBg = canvasDarkBg;
 exports.canvasLightBg = canvasLightBg;

package/dist/{fallbackColors-9a2ac53a.cjs.dev.js → fallbackColors-a491e700.cjs.dev.js}

@@ -54,12 +54,12 @@ var cn = function cn(className) {
 /** `--bg-canvas`, dark. The studio's own background. */
 var canvasDarkBg = "#08080a";
 /** `--bg-canvas`, light. */
-var canvasLightBg = "#fafafa";
+var canvasLightBg = "#f4f4f5";
 
 /** `--bg-float`, dark. Val's chrome, floating over the customer's page. */
 var floatDarkBg = "#131316";
 /** `--bg-float`, light. */
-var floatLightBg = "#ffffff";
+var floatLightBg = "#fcfcfc";
 
 exports.canvasDarkBg = canvasDarkBg;
 exports.canvasLightBg = canvasLightBg;

package/dist/valbuild-next.cjs.dev.js

@@ -7,10 +7,10 @@ var objectSpread2 = require('./objectSpread2-58024783.cjs.dev.js');
 var core = require('@valbuild/core');
 var stega = require('@valbuild/react/stega');
 var internal = require('@valbuild/react/internal');
-var ValNextProvider = require('./ValNextProvider-f206d2ea.cjs.dev.js');
+var ValNextProvider = require('./ValNextProvider-016a494b.cjs.dev.js');
 var NextImage = require('next/image');
 var jsxRuntime = require('react/jsx-runtime');
-var ValApp = require('./ValApp-c1c3ef55.cjs.dev.js');
+var ValApp = require('./ValApp-2bdb460a.cjs.dev.js');
 var ValModulesClient = require('./ValModulesClient-4ecabf99.cjs.dev.js');
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-0445603c.cjs.dev.js');
 require('./defineProperty-f90345d7.cjs.dev.js');

package/dist/valbuild-next.cjs.prod.js

@@ -7,10 +7,10 @@ var objectSpread2 = require('./objectSpread2-13f847a9.cjs.prod.js');
 var core = require('@valbuild/core');
 var stega = require('@valbuild/react/stega');
 var internal = require('@valbuild/react/internal');
-var ValNextProvider = require('./ValNextProvider-bd3f89d3.cjs.prod.js');
+var ValNextProvider = require('./ValNextProvider-72d3561b.cjs.prod.js');
 var NextImage = require('next/image');
 var jsxRuntime = require('react/jsx-runtime');
-var ValApp = require('./ValApp-90c4171d.cjs.prod.js');
+var ValApp = require('./ValApp-17eb6e93.cjs.prod.js');
 var ValModulesClient = require('./ValModulesClient-10c0721c.cjs.prod.js');
 var createForOfIteratorHelper = require('./createForOfIteratorHelper-d4afcad8.cjs.prod.js');
 require('./defineProperty-8951f469.cjs.prod.js');

package/dist/valbuild-next.esm.js

@@ -6,10 +6,10 @@ export { core as expr };
 export { GenericSelector, Schema, VAL_EXTENSION, derefPatch, modules } from '@valbuild/core';
 import { stegaEncode, stegaDecodeStrings, attrs, raw, autoTagJSX } from '@valbuild/react/stega';
 export { ValRichText } from '@valbuild/react/internal';
-import { ValNextProvider } from './ValNextProvider-588f2ff0.esm.js';
+import { ValNextProvider } from './ValNextProvider-32156acd.esm.js';
 import NextImage from 'next/image';
 import { jsx } from 'react/jsx-runtime';
-export { ValApp } from './ValApp-e17eb734.esm.js';
+export { ValApp } from './ValApp-074c8289.esm.js';
 export { ValModulesClient, useRegisterValModules } from './ValModulesClient-0dd601a1.esm.js';
 import { _ as _createForOfIteratorHelper } from './createForOfIteratorHelper-5758a730.esm.js';
 import './defineProperty-cca5affa.esm.js';

package/package.json

@@ -12,7 +12,7 @@
     "next",
     "react"
   ],
-  "version": "0.121.0",
+  "version": "0.122.0",
   "main": "dist/valbuild-next.cjs.js",
   "module": "dist/valbuild-next.esm.js",
   "exports": {
@@ -47,12 +47,12 @@
   "dependencies": {
     "client-only": "^0.0.1",
     "server-only": "^0.0.1",
-    "@valbuild/react": "0.121.0",
-    "@valbuild/shared": "0.121.0",
-    "@valbuild/server": "0.121.0",
-    "@valbuild/ui": "0.121.0",
     "@valbuild/core": "0.121.0",
-    "@valbuild/language-server": "0.121.0"
+    "@valbuild/react": "0.122.0",
+    "@valbuild/server": "0.122.0",
+    "@valbuild/shared": "0.122.0",
+    "@valbuild/language-server": "0.122.0",
+    "@valbuild/ui": "0.122.0"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.3",

package/server/dist/valbuild-next-server.cjs.dev.js

@@ -924,7 +924,7 @@ function initValMcp(valModules, config, opts) {
     },
     valMcpAuthorize: function valMcpAuthorize(request) {
       return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
-        var setup, refusal, sessionId, verified, status, pat, _t;
+        var setup, refusal, sessionId, verified, status, _t;
         return version._regenerator().w(function (_context3) {
           while (1) switch (_context3.p = _context3.n) {
             case 0:
@@ -967,20 +967,51 @@ function initValMcp(valModules, config, opts) {
                 response: refusal
               });
             case 5:
-              // Not the MCP session id, in either branch below. Val's patch `sessionId`
+              // Not the MCP session id, in any branch below. Val's patch `sessionId`
               // names a Val AI session, and putting an unrelated id in it would claim a
               // relationship that does not exist.
               sessionId = null;
-              if (!oauth) {
+              if (oauth) {
                 _context3.n = 8;
                 break;
               }
-              _context3.n = 6;
-              return verifyValAccessToken(request, oauth);
+              if (!(setup.mode !== "fs")) {
+                _context3.n = 6;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: this MCP endpoint has no `oauth` config, and this project is configured to talk to the Val content backend. Pass `oauth` to `initValMcp` with the authorization server's URL and this endpoint's own URL, so callers authorize as themselves."
+                })
+              });
             case 6:
+              if (!(readBearerToken(request) !== null)) {
+                _context3.n = 7;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(400, {
+                  error: "Val: this project is running in local filesystem mode, where there is nothing to authenticate against — the tools read and write this working tree directly. Remove the credential from this MCP client's configuration: a token sent here is checked by nothing."
+                })
+              });
+            case 7:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: null,
+                  sessionId: sessionId
+                }
+              });
+            case 8:
+              _context3.n = 9;
+              return verifyValAccessToken(request, oauth);
+            case 9:
               verified = _context3.v;
               if (!(verified.status === "refused")) {
-                _context3.n = 7;
+                _context3.n = 10;
                 break;
               }
               // 401 for a missing or bad token, 403 once the token is good but does
@@ -1003,7 +1034,7 @@ function initValMcp(valModules, config, opts) {
                   }
                 })
               });
-            case 7:
+            case 10:
               return _context3.a(2, {
                 status: "ok",
                 tools: setup.tools,
@@ -1012,23 +1043,6 @@ function initValMcp(valModules, config, opts) {
                   sessionId: sessionId
                 }
               });
-            case 8:
-              pat = readBearerToken(request);
-              return _context3.a(2, {
-                status: "ok",
-                tools: setup.tools,
-                ctx: {
-                  // Passed through unverified, deliberately: without an `oauth` config
-                  // this app has no key to check anything against, so it is not the
-                  // authority on what the token may do and the registry sends it to the
-                  // backend that is. See `docs/plans/mcp.md` D.2.
-                  auth: pat === null ? null : {
-                    type: "pat",
-                    pat: pat
-                  },
-                  sessionId: sessionId
-                }
-              });
           }
         }, _callee3, null, [[0, 2]]);
       }))();
@@ -1046,7 +1060,8 @@ function initValMcp(valModules, config, opts) {
  *    that is unauthenticated write access to the site's content for anyone who
  *    can reach the port. There is no configuration that makes it safe, so there
  *    is no flag to turn this off — a project that wants MCP in production wants
- *    proxy mode, where every call carries its caller's own token.
+ *    proxy mode with an `oauth` config, where every call carries an access
+ *    token this app verified itself.
  *
  * 2. **A browser driving the local server.** A page on any origin can `fetch`
  *    `http://localhost:3000/api/mcp` while a developer has the app running, and
@@ -1103,9 +1118,9 @@ var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
  *
  * The cost is that behind a proxy that rewrites `Host`, a *browser* request
  * whose `Origin` is the public name no longer matches. That is acceptable: such
- * a request carries no personal access token, so proxy mode refuses it anyway,
- * and a non-browser MCP client sends no `Origin` and never reaches the
- * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * a request carries no access token, so proxy mode refuses it anyway, and a
+ * non-browser MCP client sends no `Origin` and never reaches the comparison.
+ * Trusting the forwarded header would need an explicit trusted-proxy
  * configuration, which is a bigger thing than this needs.
  */
 function requestHost(request) {

package/server/dist/valbuild-next-server.cjs.prod.js

@@ -924,7 +924,7 @@ function initValMcp(valModules, config, opts) {
     },
     valMcpAuthorize: function valMcpAuthorize(request) {
       return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
-        var setup, refusal, sessionId, verified, status, pat, _t;
+        var setup, refusal, sessionId, verified, status, _t;
         return version._regenerator().w(function (_context3) {
           while (1) switch (_context3.p = _context3.n) {
             case 0:
@@ -967,20 +967,51 @@ function initValMcp(valModules, config, opts) {
                 response: refusal
               });
             case 5:
-              // Not the MCP session id, in either branch below. Val's patch `sessionId`
+              // Not the MCP session id, in any branch below. Val's patch `sessionId`
               // names a Val AI session, and putting an unrelated id in it would claim a
               // relationship that does not exist.
               sessionId = null;
-              if (!oauth) {
+              if (oauth) {
                 _context3.n = 8;
                 break;
               }
-              _context3.n = 6;
-              return verifyValAccessToken(request, oauth);
+              if (!(setup.mode !== "fs")) {
+                _context3.n = 6;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: this MCP endpoint has no `oauth` config, and this project is configured to talk to the Val content backend. Pass `oauth` to `initValMcp` with the authorization server's URL and this endpoint's own URL, so callers authorize as themselves."
+                })
+              });
             case 6:
+              if (!(readBearerToken(request) !== null)) {
+                _context3.n = 7;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(400, {
+                  error: "Val: this project is running in local filesystem mode, where there is nothing to authenticate against — the tools read and write this working tree directly. Remove the credential from this MCP client's configuration: a token sent here is checked by nothing."
+                })
+              });
+            case 7:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: null,
+                  sessionId: sessionId
+                }
+              });
+            case 8:
+              _context3.n = 9;
+              return verifyValAccessToken(request, oauth);
+            case 9:
               verified = _context3.v;
               if (!(verified.status === "refused")) {
-                _context3.n = 7;
+                _context3.n = 10;
                 break;
               }
               // 401 for a missing or bad token, 403 once the token is good but does
@@ -1003,7 +1034,7 @@ function initValMcp(valModules, config, opts) {
                   }
                 })
               });
-            case 7:
+            case 10:
               return _context3.a(2, {
                 status: "ok",
                 tools: setup.tools,
@@ -1012,23 +1043,6 @@ function initValMcp(valModules, config, opts) {
                   sessionId: sessionId
                 }
               });
-            case 8:
-              pat = readBearerToken(request);
-              return _context3.a(2, {
-                status: "ok",
-                tools: setup.tools,
-                ctx: {
-                  // Passed through unverified, deliberately: without an `oauth` config
-                  // this app has no key to check anything against, so it is not the
-                  // authority on what the token may do and the registry sends it to the
-                  // backend that is. See `docs/plans/mcp.md` D.2.
-                  auth: pat === null ? null : {
-                    type: "pat",
-                    pat: pat
-                  },
-                  sessionId: sessionId
-                }
-              });
           }
         }, _callee3, null, [[0, 2]]);
       }))();
@@ -1046,7 +1060,8 @@ function initValMcp(valModules, config, opts) {
  *    that is unauthenticated write access to the site's content for anyone who
  *    can reach the port. There is no configuration that makes it safe, so there
  *    is no flag to turn this off — a project that wants MCP in production wants
- *    proxy mode, where every call carries its caller's own token.
+ *    proxy mode with an `oauth` config, where every call carries an access
+ *    token this app verified itself.
  *
  * 2. **A browser driving the local server.** A page on any origin can `fetch`
  *    `http://localhost:3000/api/mcp` while a developer has the app running, and
@@ -1103,9 +1118,9 @@ var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
  *
  * The cost is that behind a proxy that rewrites `Host`, a *browser* request
  * whose `Origin` is the public name no longer matches. That is acceptable: such
- * a request carries no personal access token, so proxy mode refuses it anyway,
- * and a non-browser MCP client sends no `Origin` and never reaches the
- * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * a request carries no access token, so proxy mode refuses it anyway, and a
+ * non-browser MCP client sends no `Origin` and never reaches the comparison.
+ * Trusting the forwarded header would need an explicit trusted-proxy
  * configuration, which is a bigger thing than this needs.
  */
 function requestHost(request) {

package/server/dist/valbuild-next-server.esm.js

@@ -920,7 +920,7 @@ function initValMcp(valModules, config, opts) {
     },
     valMcpAuthorize: function valMcpAuthorize(request) {
       return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3() {
-        var setup, refusal, sessionId, verified, status, pat, _t;
+        var setup, refusal, sessionId, verified, status, _t;
         return _regenerator().w(function (_context3) {
           while (1) switch (_context3.p = _context3.n) {
             case 0:
@@ -963,20 +963,51 @@ function initValMcp(valModules, config, opts) {
                 response: refusal
               });
             case 5:
-              // Not the MCP session id, in either branch below. Val's patch `sessionId`
+              // Not the MCP session id, in any branch below. Val's patch `sessionId`
               // names a Val AI session, and putting an unrelated id in it would claim a
               // relationship that does not exist.
               sessionId = null;
-              if (!oauth) {
+              if (oauth) {
                 _context3.n = 8;
                 break;
               }
-              _context3.n = 6;
-              return verifyValAccessToken(request, oauth);
+              if (!(setup.mode !== "fs")) {
+                _context3.n = 6;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(500, {
+                  error: "Val: this MCP endpoint has no `oauth` config, and this project is configured to talk to the Val content backend. Pass `oauth` to `initValMcp` with the authorization server's URL and this endpoint's own URL, so callers authorize as themselves."
+                })
+              });
             case 6:
+              if (!(readBearerToken(request) !== null)) {
+                _context3.n = 7;
+                break;
+              }
+              return _context3.a(2, {
+                status: "refused",
+                response: jsonResponse(400, {
+                  error: "Val: this project is running in local filesystem mode, where there is nothing to authenticate against — the tools read and write this working tree directly. Remove the credential from this MCP client's configuration: a token sent here is checked by nothing."
+                })
+              });
+            case 7:
+              return _context3.a(2, {
+                status: "ok",
+                tools: setup.tools,
+                ctx: {
+                  auth: null,
+                  sessionId: sessionId
+                }
+              });
+            case 8:
+              _context3.n = 9;
+              return verifyValAccessToken(request, oauth);
+            case 9:
               verified = _context3.v;
               if (!(verified.status === "refused")) {
-                _context3.n = 7;
+                _context3.n = 10;
                 break;
               }
               // 401 for a missing or bad token, 403 once the token is good but does
@@ -999,7 +1030,7 @@ function initValMcp(valModules, config, opts) {
                   }
                 })
               });
-            case 7:
+            case 10:
               return _context3.a(2, {
                 status: "ok",
                 tools: setup.tools,
@@ -1008,23 +1039,6 @@ function initValMcp(valModules, config, opts) {
                   sessionId: sessionId
                 }
               });
-            case 8:
-              pat = readBearerToken(request);
-              return _context3.a(2, {
-                status: "ok",
-                tools: setup.tools,
-                ctx: {
-                  // Passed through unverified, deliberately: without an `oauth` config
-                  // this app has no key to check anything against, so it is not the
-                  // authority on what the token may do and the registry sends it to the
-                  // backend that is. See `docs/plans/mcp.md` D.2.
-                  auth: pat === null ? null : {
-                    type: "pat",
-                    pat: pat
-                  },
-                  sessionId: sessionId
-                }
-              });
           }
         }, _callee3, null, [[0, 2]]);
       }))();
@@ -1042,7 +1056,8 @@ function initValMcp(valModules, config, opts) {
  *    that is unauthenticated write access to the site's content for anyone who
  *    can reach the port. There is no configuration that makes it safe, so there
  *    is no flag to turn this off — a project that wants MCP in production wants
- *    proxy mode, where every call carries its caller's own token.
+ *    proxy mode with an `oauth` config, where every call carries an access
+ *    token this app verified itself.
  *
  * 2. **A browser driving the local server.** A page on any origin can `fetch`
  *    `http://localhost:3000/api/mcp` while a developer has the app running, and
@@ -1099,9 +1114,9 @@ var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
  *
  * The cost is that behind a proxy that rewrites `Host`, a *browser* request
  * whose `Origin` is the public name no longer matches. That is acceptable: such
- * a request carries no personal access token, so proxy mode refuses it anyway,
- * and a non-browser MCP client sends no `Origin` and never reaches the
- * comparison. Trusting the forwarded header would need an explicit trusted-proxy
+ * a request carries no access token, so proxy mode refuses it anyway, and a
+ * non-browser MCP client sends no `Origin` and never reaches the comparison.
+ * Trusting the forwarded header would need an explicit trusted-proxy
  * configuration, which is a bigger thing than this needs.
  */
 function requestHost(request) {

package/dist/ValApp-90c4171d.cjs.js

@@ -1,7 +0,0 @@
-'use strict';
-
-if (process.env.NODE_ENV === "production") {
-  module.exports = require("./ValApp-90c4171d.cjs.prod.js");
-} else {
-  module.exports = require("./ValApp-90c4171d.cjs.dev.js");
-}

package/dist/ValNextProvider-bd3f89d3.cjs.js

@@ -1,7 +0,0 @@
-'use strict';
-
-if (process.env.NODE_ENV === "production") {
-  module.exports = require("./ValNextProvider-bd3f89d3.cjs.prod.js");
-} else {
-  module.exports = require("./ValNextProvider-bd3f89d3.cjs.dev.js");
-}