@valbuild/next 0.122.0 → 0.123.0

package/server/dist/valbuild-next-server.cjs.prod.js

@@ -9,8 +9,7 @@ var objectSpread2 = require('../../dist/objectSpread2-13f847a9.cjs.prod.js');
 var core = require('@valbuild/core');
 var server = require('@valbuild/server');
 var server$1 = require('next/server');
-var _typeof = require('../../dist/typeof-16428c61.cjs.prod.js');
-var node_crypto = require('node:crypto');
+var mcp = require('@valbuild/mcp');
 require('../../dist/unsupportedIterableToArray-0d2087a2.cjs.prod.js');
 require('../../dist/defineProperty-8951f469.cjs.prod.js');
 
@@ -123,1042 +122,28 @@ function initValServer(valModules, config, nextConfig) {
 }
 
 /**
- * Verifying an OAuth access token, which is the whole of what makes this app a
- * resource server rather than a relay.
+ * Val's tools over MCP, bound to Next.
  *
- * The token is issued by Val's authorization server and presented by an MCP
- * client. This app holds no signing key for it and cannot mint one — it fetches
- * the issuer's *public* keys and checks a signature. That asymmetry is the
- * point: a verified `sub` is a fact about the token rather than a claim by
- * whoever sent it, which is what lets the tools attribute a patch to that
- * profile at all.
+ * The MCP endpoint itself — the tools, the request guards, the access-token
+ * verification — lives in `@valbuild/mcp`, which knows nothing about Next. All
+ * that is left here is the one thing this package can answer and that one
+ * cannot: which version of `@valbuild/next` is running, which
+ * `initHandlerOptions` insists on before it will build a proxy-mode config.
  *
- * ## Why this is not `jose`
- *
- * `jose` was the first choice and was rejected on a fact rather than a
- * preference: version 6 is ESM-only (`"type": "module"`, no CJS export). This
- * package is built by preconstruct and `require`d by Next.js server code, so an
- * ESM-only dependency here is a runtime failure in consumers' apps, not a build
- * inconvenience. Adding it would also put a dependency in every install of
- * `@valbuild/next` for one function.
- *
- * The actual cryptography is still not hand-rolled — `node:crypto` does the
- * ECDSA and the JWK import. What is written here is the JWS envelope and the
- * claim checks, and the rules that keep that safe are worth stating because
- * this repository has already shipped the counterexample (`decodeJwt`: `exp`
- * never checked, a non-constant-time compare, verification skippable):
- *
- * - **`alg` is pinned**, not read from the token. The header is only consulted
- *   for `kid`. A verifier that honours the token's own `alg` can be handed
- *   `HS256` and will treat the *published* public key as a shared secret.
- * - **Nothing is read from the payload before the signature verifies.** Claims
- *   from an unverified token are attacker input.
- * - **Keys come only from the configured issuer's JWKS**, never from the token.
- *   The key set is cached, but a token naming a `kid` the cache does not hold
- *   provokes one rate-limited refetch rather than a refusal — see
- *   {@link UNKNOWN_KID_REFETCH_INTERVAL_MS}. Without that, this server's own
- *   cache turns any key rotation into an outage lasting the rest of the TTL.
- * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
- *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
- *   is rejected — or worse, a future change makes it accept the wrong thing.
- */
-
-var DEFAULT_CLOCK_TOLERANCE_SECONDS = 60;
-/** How long a fetched key set is reused before it is fetched again. */
-var JWKS_TTL_MS = 5 * 60 * 1000;
-/**
- * How long to wait before re-fetching after a failure.
- *
- * Shorter than the success TTL so a key rotation recovers quickly, but not zero:
- * an unreachable issuer must not turn every tool call into another request to
- * it.
- */
-var JWKS_ERROR_TTL_MS = 30 * 1000;
-/**
- * The floor between two refetches provoked by an unknown `kid`.
- *
- * A token naming a key this process has not seen is the one case where the TTL
- * is the wrong answer: the issuer may have just rotated, and refusing for the
- * rest of the five minutes turns a rotation into an outage. So an unknown `kid`
- * bypasses the TTL — but only this often, because the `kid` comes from the
- * token and the token comes from whoever is calling. Without a floor, a stream
- * of random `kid`s would be a way to make this server hammer its own issuer.
- *
- * Note what the floor costs when it bites: a refusal, for a token that would
- * have verified, for at most this long. That is the same failure the TTL used
- * to guarantee for five minutes, so the trade only ever improves.
- */
-var UNKNOWN_KID_REFETCH_INTERVAL_MS = 30 * 1000;
-/**
- * One cache per issuer, and it has to outlive the request or it is not a cache:
- * a fetch per tool call would put a network round trip in front of every read.
- */
-var jwksCache = new Map();
-/** Concurrent misses share one fetch rather than starting several. */
-var inFlight = new Map();
-/**
- * When an unknown `kid` last made us go back to the issuer, per issuer.
- *
- * Separate from the cache because it is a rate limit rather than a cache: it
- * records an *attempt*, so a refetch that found nothing new still spends the
- * window. Keyed by issuer, not by `kid`, or an attacker would simply use a new
- * one each time.
- */
-var unknownKidRefetchAtMs = new Map();
-function jwksUrl(issuer) {
-  // Not discovered from the issuer's metadata document, deliberately:
-  // discovery would mean one more request on the hot path and one more thing
-  // that can be pointed elsewhere. The location is fixed by convention and by
-  // Val's own authorization server.
-  return new URL("/.well-known/jwks.json", issuer).toString();
-}
-function loadJwks(_x, _x2) {
-  return _loadJwks.apply(this, arguments);
-}
-/**
- * Go back to the issuer because the token named a key we do not have.
- *
- * Rate-limited, and the limit is the whole reason this is not just a call to
- * {@link fetchJwks}: the `kid` that triggers it is attacker-controlled. Returns
- * `null` when the window has not elapsed, which the caller reads as "nothing
- * new to try" rather than as a failure.
- *
- * The limit is on *starting* a fetch, not on benefiting from one. A fetch
- * already in flight is joined whatever the window says, because joining it
- * costs the issuer nothing — and the case that matters is precisely a burst:
- * at a rotation, many requests arrive at once carrying the same new `kid`, and
- * refusing all but the first would be the outage this whole path exists to
- * prevent, merely shortened from five minutes to thirty seconds.
- *
- * Only ever called with a successfully-fetched key set in hand. An error entry
- * has its own, shorter TTL and its own recovery, and letting an unknown `kid`
- * shortcut it would hand an unreachable issuer a retry storm.
- */
-function _loadJwks() {
-  _loadJwks = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee(config, nowMs) {
-    var url, cached, age, ttl, _t;
-    return version._regenerator().w(function (_context) {
-      while (1) switch (_context.n) {
-        case 0:
-          url = jwksUrl(config.issuer);
-          cached = jwksCache.get(url);
-          if (!cached) {
-            _context.n = 1;
-            break;
-          }
-          age = cached.status === "keys" ? nowMs - cached.fetchedAtMs : nowMs - cached.failedAtMs;
-          ttl = cached.status === "keys" ? JWKS_TTL_MS : JWKS_ERROR_TTL_MS;
-          if (!(age < ttl)) {
-            _context.n = 1;
-            break;
-          }
-          return _context.a(2, {
-            entry: cached,
-            fromCache: true
-          });
-        case 1:
-          _context.n = 2;
-          return fetchJwks(config, nowMs);
-        case 2:
-          _t = _context.v;
-          return _context.a(2, {
-            entry: _t,
-            fromCache: false
-          });
-      }
-    }, _callee);
-  }));
-  return _loadJwks.apply(this, arguments);
-}
-function refetchForUnknownKid(_x3, _x4) {
-  return _refetchForUnknownKid.apply(this, arguments);
-}
-/**
- * Fetch the key set, ignoring whatever is cached, and cache the result.
- *
- * Shares {@link inFlight} with every other caller, so a forced refetch that
- * lands during an ordinary miss joins it rather than opening a second request.
- * Only the caller that *starts* a fetch writes the cache — a joiner returns the
- * shared promise above — so `keepCacheOnError` is a property of the fetch, not a
- * race between callers.
- */
-function _refetchForUnknownKid() {
-  _refetchForUnknownKid = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2(config, nowMs) {
-    var url, existing, lastAttemptMs;
-    return version._regenerator().w(function (_context2) {
-      while (1) switch (_context2.n) {
-        case 0:
-          url = jwksUrl(config.issuer);
-          existing = inFlight.get(url);
-          if (!existing) {
-            _context2.n = 1;
-            break;
-          }
-          return _context2.a(2, existing);
-        case 1:
-          lastAttemptMs = unknownKidRefetchAtMs.get(url);
-          if (!(lastAttemptMs !== undefined && nowMs - lastAttemptMs < UNKNOWN_KID_REFETCH_INTERVAL_MS)) {
-            _context2.n = 2;
-            break;
-          }
-          return _context2.a(2, null);
-        case 2:
-          // Recorded before the await, so that once this fetch has finished the window
-          // is already closed against the next unknown `kid`.
-          unknownKidRefetchAtMs.set(url, nowMs);
-          return _context2.a(2, fetchJwks(config, nowMs, {
-            keepCacheOnError: true
-          }));
-      }
-    }, _callee2);
-  }));
-  return _refetchForUnknownKid.apply(this, arguments);
-}
-function fetchJwks(_x5, _x6) {
-  return _fetchJwks.apply(this, arguments);
-}
-function _fetchJwks() {
-  _fetchJwks = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee4(config, nowMs) {
-    var _config$fetchImpl;
-    var _ref,
-      _ref$keepCacheOnError,
-      keepCacheOnError,
-      url,
-      existing,
-      fetchImpl,
-      pending,
-      entry,
-      cached,
-      _args4 = arguments;
-    return version._regenerator().w(function (_context4) {
-      while (1) switch (_context4.p = _context4.n) {
-        case 0:
-          _ref = _args4.length > 2 && _args4[2] !== undefined ? _args4[2] : {}, _ref$keepCacheOnError = _ref.keepCacheOnError, keepCacheOnError = _ref$keepCacheOnError === void 0 ? false : _ref$keepCacheOnError;
-          url = jwksUrl(config.issuer);
-          existing = inFlight.get(url);
-          if (!existing) {
-            _context4.n = 1;
-            break;
-          }
-          return _context4.a(2, existing);
-        case 1:
-          fetchImpl = (_config$fetchImpl = config.fetchImpl) !== null && _config$fetchImpl !== void 0 ? _config$fetchImpl : fetch;
-          pending = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
-            var res, body, keys;
-            return version._regenerator().w(function (_context3) {
-              while (1) switch (_context3.p = _context3.n) {
-                case 0:
-                  _context3.p = 0;
-                  _context3.n = 1;
-                  return fetchImpl(url, {
-                    headers: {
-                      accept: "application/json"
-                    }
-                  });
-                case 1:
-                  res = _context3.v;
-                  if (res.ok) {
-                    _context3.n = 2;
-                    break;
-                  }
-                  return _context3.a(2, {
-                    status: "error",
-                    failedAtMs: nowMs
-                  });
-                case 2:
-                  _context3.n = 3;
-                  return res.json();
-                case 3:
-                  body = _context3.v;
-                  keys = readKeys(body);
-                  if (!(keys === null)) {
-                    _context3.n = 4;
-                    break;
-                  }
-                  return _context3.a(2, {
-                    status: "error",
-                    failedAtMs: nowMs
-                  });
-                case 4:
-                  return _context3.a(2, {
-                    status: "keys",
-                    keys: keys,
-                    fetchedAtMs: nowMs
-                  });
-                case 5:
-                  _context3.p = 5;
-                  _context3.v;
-                  return _context3.a(2, {
-                    status: "error",
-                    failedAtMs: nowMs
-                  });
-              }
-            }, _callee3, null, [[0, 5]]);
-          }))();
-          inFlight.set(url, pending);
-          _context4.p = 2;
-          _context4.n = 3;
-          return pending;
-        case 3:
-          entry = _context4.v;
-          cached = jwksCache.get(url);
-          if (!(entry.status === "error" && keepCacheOnError && (cached === null || cached === void 0 ? void 0 : cached.status) === "keys")) {
-            _context4.n = 4;
-            break;
-          }
-          return _context4.a(2, entry);
-        case 4:
-          jwksCache.set(url, entry);
-          return _context4.a(2, entry);
-        case 5:
-          _context4.p = 5;
-          inFlight["delete"](url);
-          return _context4.f(5);
-        case 6:
-          return _context4.a(2);
-      }
-    }, _callee4, null, [[2,, 5, 6]]);
-  }));
-  return _fetchJwks.apply(this, arguments);
-}
-function readKeys(body) {
-  if (_typeof._typeof(body) !== "object" || body === null || !("keys" in body)) {
-    return null;
-  }
-  // `in` narrows the property into the type, so no assertion is needed to read
-  // it — and the `Array.isArray` below is what actually establishes the shape.
-  var keys = body.keys;
-  if (!Array.isArray(keys)) {
-    return null;
-  }
-  return keys.filter(function (key) {
-    return _typeof._typeof(key) === "object" && key !== null;
-  });
-}
-
-/**
- * Read `Authorization: Bearer …`.
- *
- * Exported because the refusal needs to know whether a token was presented at
- * all: RFC 6750 distinguishes "no credential" — a bare `401`, which is an
- * invitation to authenticate — from "a bad credential", and a client that gets
- * the second when it deserved the first will not start the authorization flow.
- */
-function readBearerToken(request) {
-  var _match$;
-  var header = request.headers.get("authorization");
-  if (!header) {
-    return null;
-  }
-  var match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
-  return token ? token : null;
-}
-function verifyValAccessToken(_x7, _x8) {
-  return _verifyValAccessToken.apply(this, arguments);
-}
-function _verifyValAccessToken() {
-  _verifyValAccessToken = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee5(request, config) {
-    var _config$clockToleranc;
-    var token, parts, _parts, encodedHeader, encodedPayload, encodedSignature, header, kid, nowMs, loaded, candidates, refetched, signature, signedData, verified, payload, tolerance, nowSeconds, subject, scopes;
-    return version._regenerator().w(function (_context5) {
-      while (1) switch (_context5.n) {
-        case 0:
-          token = readBearerToken(request);
-          if (!(token === null)) {
-            _context5.n = 1;
-            break;
-          }
-          return _context5.a(2, {
-            status: "refused",
-            error: "invalid_request",
-            description: "This Val MCP endpoint needs an access token. Authorize with the Val authorization server and present it as `Authorization: Bearer`."
-          });
-        case 1:
-          parts = token.split(".");
-          if (!(parts.length !== 3)) {
-            _context5.n = 2;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token is not a JWS."));
-        case 2:
-          _parts = slicedToArray._slicedToArray(parts, 3), encodedHeader = _parts[0], encodedPayload = _parts[1], encodedSignature = _parts[2];
-          header = decodeJsonSegment(encodedHeader);
-          if (!(header === null)) {
-            _context5.n = 3;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token's header could not be read."));
-        case 3:
-          if (!(header.alg !== "ES256")) {
-            _context5.n = 4;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token is not signed with ES256, which is the only algorithm this server accepts."));
-        case 4:
-          kid = typeof header.kid === "string" ? header.kid : null;
-          nowMs = Date.now();
-          _context5.n = 5;
-          return loadJwks(config, nowMs);
-        case 5:
-          loaded = _context5.v;
-          if (!(loaded.entry.status === "error")) {
-            _context5.n = 6;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
-        case 6:
-          candidates = loaded.entry.keys.filter(function (key) {
-            return isVerifyingP256Key(key, kid);
-          });
-          if (!(candidates.length === 0 && kid !== null && loaded.fromCache)) {
-            _context5.n = 9;
-            break;
-          }
-          _context5.n = 7;
-          return refetchForUnknownKid(config, nowMs);
-        case 7:
-          refetched = _context5.v;
-          if (!(refetched !== null)) {
-            _context5.n = 9;
-            break;
-          }
-          if (!(refetched.status === "error")) {
-            _context5.n = 8;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
-        case 8:
-          candidates = refetched.keys.filter(function (key) {
-            return isVerifyingP256Key(key, kid);
-          });
-        case 9:
-          if (!(candidates.length === 0)) {
-            _context5.n = 10;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token was signed with a key the Val authorization server does not publish."));
-        case 10:
-          signature = decodeBase64Url(encodedSignature);
-          if (!(signature === null)) {
-            _context5.n = 11;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token's signature could not be read."));
-        case 11:
-          signedData = Buffer.from("".concat(encodedHeader, ".").concat(encodedPayload), "ascii"); // Every published key is tried when the token names no `kid`, so a rotation
-          // that has not yet propagated to clients still verifies. With a `kid` the
-          // filter above leaves one — or, if this process had not yet seen that key,
-          // the one the refetch just found.
-          verified = candidates.some(function (key) {
-            return verifyWithJwk(key, signedData, signature);
-          });
-          if (verified) {
-            _context5.n = 12;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token's signature could not be verified."));
-        case 12:
-          // Only now: everything below reads the payload, and before this line it was
-          // attacker input.
-          payload = decodeJsonSegment(encodedPayload);
-          if (!(payload === null)) {
-            _context5.n = 13;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token's payload could not be read."));
-        case 13:
-          tolerance = (_config$clockToleranc = config.clockToleranceSeconds) !== null && _config$clockToleranc !== void 0 ? _config$clockToleranc : DEFAULT_CLOCK_TOLERANCE_SECONDS;
-          nowSeconds = Math.floor(nowMs / 1000);
-          if (!(typeof payload.exp !== "number")) {
-            _context5.n = 14;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token has no expiry."));
-        case 14:
-          if (!(payload.exp + tolerance <= nowSeconds)) {
-            _context5.n = 15;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token has expired. Refresh it and try again."));
-        case 15:
-          if (!(typeof payload.nbf === "number" && payload.nbf - tolerance > nowSeconds)) {
-            _context5.n = 16;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token is not valid yet."));
-        case 16:
-          if (!(payload.iss !== config.issuer)) {
-            _context5.n = 17;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token was not issued by this server's authorization server (iss claim)."));
-        case 17:
-          if (audienceMatches(payload.aud, config.resource)) {
-            _context5.n = 18;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token is not valid for this server (aud claim)."));
-        case 18:
-          subject = payload.sub;
-          if (!(typeof subject !== "string" || subject.length === 0)) {
-            _context5.n = 19;
-            break;
-          }
-          return _context5.a(2, invalidToken("The access token has no subject."));
-        case 19:
-          scopes = readScopes(payload.scope);
-          if (scopes.includes(server.VAL_SCOPE_READ)) {
-            _context5.n = 20;
-            break;
-          }
-          return _context5.a(2, {
-            status: "refused",
-            error: "insufficient_scope",
-            description: "The access token does not have the ".concat(server.VAL_SCOPE_READ, " scope, so it cannot read any content.")
-          });
-        case 20:
-          return _context5.a(2, {
-            status: "ok",
-            auth: {
-              type: "verified-profile",
-              profileId: server.authorIdFromVerifiedSubject(subject),
-              scopes: scopes
-            }
-          });
-      }
-    }, _callee5);
-  }));
-  return _verifyValAccessToken.apply(this, arguments);
-}
-function invalidToken(description) {
-  // Described by class, never by echoing the token or a raw error: a
-  // verification failure message is a place credentials leak into logs.
-  return {
-    status: "refused",
-    error: "invalid_token",
-    description: description
-  };
-}
-
-/**
- * `aud` is a string or an array of strings (RFC 7519 section 4.1.3).
- *
- * A match on any member is a match, which is the spec's own rule — a token may
- * legitimately be addressed to several resources.
- */
-function audienceMatches(claim, resource) {
-  if (typeof claim === "string") {
-    return claim === resource;
-  }
-  if (Array.isArray(claim)) {
-    return claim.some(function (entry) {
-      return entry === resource;
-    });
-  }
-  return false;
-}
-
-/**
- * `scope` is a space-delimited string (RFC 6749 section 3.3).
- *
- * Anything else is read as no scopes rather than coerced. A token whose scope
- * claim is the wrong shape is a token we do not understand, and understanding
- * it generously is how a write gets authorized by an array someone sent.
- */
-function readScopes(claim) {
-  if (typeof claim !== "string") {
-    return [];
-  }
-  return claim.split(" ").filter(function (scope) {
-    return scope.length > 0;
-  });
-}
-function isVerifyingP256Key(key, kid) {
-  if (key.kty !== "EC" || key.crv !== "P-256") {
-    return false;
-  }
-  if (typeof key.x !== "string" || typeof key.y !== "string") {
-    return false;
-  }
-  // A key published for encryption is not a key to verify signatures with, and
-  // an `alg` that disagrees with what we verify is a key meant for something
-  // else.
-  if (key.use !== undefined && key.use !== "sig") {
-    return false;
-  }
-  if (key.alg !== undefined && key.alg !== "ES256") {
-    return false;
-  }
-  if (kid !== null && typeof key.kid === "string" && key.kid !== kid) {
-    return false;
-  }
-  return true;
-}
-function verifyWithJwk(key, signedData, signature) {
-  try {
-    var publicKey = node_crypto.createPublicKey({
-      key: {
-        kty: "EC",
-        crv: "P-256",
-        x: String(key.x),
-        y: String(key.y)
-      },
-      format: "jwk"
-    });
-    return node_crypto.verify("sha256", signedData,
-    // `ieee-p1363` because a JWS ECDSA signature is the raw `r||s` pair, while
-    // node defaults to DER for EC keys. Getting this wrong rejects every
-    // valid signature.
-    {
-      key: publicKey,
-      dsaEncoding: "ieee-p1363"
-    }, signature);
-  } catch (_unused) {
-    // A malformed key in an otherwise good key set should not take down
-    // verification against the other keys.
-    return false;
-  }
-}
-function decodeBase64Url(segment) {
-  if (segment === undefined || !/^[A-Za-z0-9_-]*$/.test(segment)) {
-    return null;
-  }
-  try {
-    return Buffer.from(segment, "base64url");
-  } catch (_unused2) {
-    return null;
-  }
-}
-function decodeJsonSegment(segment) {
-  var decoded = decodeBase64Url(segment);
-  if (decoded === null) {
-    return null;
-  }
-  try {
-    var parsed = JSON.parse(decoded.toString("utf8"));
-    if (_typeof._typeof(parsed) !== "object" || parsed === null || Array.isArray(parsed)) {
-      return null;
-    }
-    return objectSpread2._objectSpread2({}, parsed);
-  } catch (_unused3) {
-    return null;
-  }
-}
-
-/**
- * The one document an MCP client needs before it can authorize: RFC 9728
- * Protected Resource Metadata, served by the *resource* server.
- *
- * This is how a client discovers where to authorize. It asks the resource — this
- * app — and the resource names its authorization server. Which is why this
- * belongs here and the RFC 8414 *authorization server* metadata does not: that
- * document lives at the issuer, describes the issuer's own endpoints, and is
- * served by the issuer. An app serving a copy would be asserting the issuer's
- * configuration on its behalf, and would be wrong the moment the issuer changed
- * anything.
- *
- * The flow, so the split reads as a whole:
- *
- * 1. client → `{app}/api/mcp` with no token → `401` naming this document
- * 2. client → `{app}/.well-known/oauth-protected-resource` → the issuer
- * 3. client → `{issuer}/.well-known/oauth-authorization-server` → endpoints
- * 4. client → issuer's `/authorize`, then `/token`
- * 5. client → `{app}/api/mcp` with the token
+ * Kept exported from `@valbuild/next/server` because that is where it has
+ * always been. New code can import `initValMcp` from `@valbuild/mcp` directly
+ * and pass `versions: { next }` itself; there is no difference in behaviour.
  */
-
-var CORS_HEADERS = {
-  // The document is public and contains no secrets — it exists to be read by
-  // clients whose origin we cannot know in advance, so `*` is the correct value
-  // rather than a lazy one. Note there is no `Access-Control-Allow-Credentials`:
-  // with it, `*` would be rejected by browsers, and this document is never
-  // fetched with credentials.
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
-  "Access-Control-Max-Age": "3600"
-};
-function createValMcpMetadata(oauth, scopesSupported) {
-  var document = {
-    // The resource identifier, which MUST be the value clients send as
-    // `resource` and the value that arrives back in `aud`. Same string as the
-    // audience this app verifies against — one value, so the two cannot drift.
-    resource: oauth.resource,
-    authorization_servers: [oauth.issuer],
-    scopes_supported: scopesSupported,
-    bearer_methods_supported: ["header"]
-  };
-  var body = JSON.stringify(document);
-  return {
-    GET: function GET() {
-      return new Response(body, {
-        status: 200,
-        headers: objectSpread2._objectSpread2({
-          "Content-Type": "application/json",
-          // Cacheable: it changes only when the app is reconfigured, and a
-          // client that re-reads it on every authorization costs a round trip
-          // for nothing.
-          "Cache-Control": "public, max-age=3600"
-        }, CORS_HEADERS)
-      });
-    },
-    OPTIONS: function OPTIONS() {
-      return new Response(null, {
-        status: 204,
-        headers: CORS_HEADERS
-      });
-    }
-  };
-}
-
-/**
- * The `WWW-Authenticate` value for a refusal (RFC 6750 section 3, RFC 9728
- * section 5.1).
- *
- * `resource_metadata` is the load-bearing parameter: it is how a client that has
- * never seen this server learns where to authorize. A `401` without it is a dead
- * end — the client knows it needs a token and has no way to find out from where.
- */
-function wwwAuthenticate(oauth, scopesSupported, refusal) {
-  var metadataUrl = new URL("/.well-known/oauth-protected-resource", oauth.resource).toString();
-  var params = ["resource_metadata=\"".concat(metadataUrl, "\""), "scope=\"".concat(scopesSupported.join(" "), "\"")];
-  if (refusal) {
-    params.push("error=\"".concat(refusal.error, "\""));
-    params.push("error_description=\"".concat(headerSafe(refusal.description), "\""));
-  }
-  return "Bearer ".concat(params.join(", "));
-}
-
-/**
- * Make a string safe to put inside a quoted header parameter.
- *
- * Three classes go, and the third is the one that matters most:
- *
- * - a **quote** would close the parameter early;
- * - a **backslash** would start an escape the rest of the value does not
- *   finish;
- * - a **CR or LF** would end the header line, which is response splitting — an
- *   attacker-influenced description could inject a header of their own, or a
- *   whole second response.
- *
- * The descriptions passed here today are all literals from this package and
- * contain none of it. That is a property of today's callers rather than of the
- * type, and this function exists so it stays true when a future one interpolates
- * something from a request.
- */
-function headerSafe(value) {
-  // eslint-disable-next-line no-control-regex -- the point is to remove them
-  return value.replace(/["\\]/g, "").replace(/[\u0000-\u001f\u007f]/g, " ");
-}
-
-/**
- * Val's tools over MCP, and the two checks that have to happen before a request
- * gets to them.
- *
- * Nothing here imports an MCP SDK. The app owns the transport — which SDK, which
- * route, which framework — and this owns the parts that must not be re-decided
- * per app: whether the request is allowed to reach the tools at all, and whose
- * credential it carries. `docs/plans/mcp.md` Part A has the reasoning; the short
- * version is that the SDK reorganised itself once already, and the security
- * checks should not move when it does again.
- */
-
 function initValMcp(valModules, config, opts) {
-  var route = "/api/val"; // TODO: get from config, as initValServer does
-  var coreVersion = core.Internal.VERSION.core;
-  if (!coreVersion) {
-    throw new Error("Could not get @valbuild/core package version");
-  }
   var nextVersion = version.VERSION;
   if (!nextVersion) {
     throw new Error("Could not get @valbuild/next package version");
   }
-
-  // Resolved once at module-eval time, awaited per request. The no-op catch is
-  // load bearing for the same reason it is in createValApiRouter: a config error
-  // on a promise with no handler attached becomes an unhandledRejection and
-  // takes the dev server down, and the error is reported per request below
-  // anyway.
-  var setupPromise = version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee() {
-    var options;
-    return version._regenerator().w(function (_context) {
-      while (1) switch (_context.n) {
-        case 0:
-          _context.n = 1;
-          return server.initHandlerOptions(route, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, config), {}, {
-            versions: {
-              core: coreVersion,
-              next: nextVersion
-            }
-          }), config);
-        case 1:
-          options = _context.v;
-          return _context.a(2, {
-            mode: options.mode,
-            tools: server.createValTools(valModules, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, options), {}, {
-              formatter: opts === null || opts === void 0 ? void 0 : opts.formatter
-            }))
-          });
-      }
-    }, _callee);
-  }))();
-  setupPromise["catch"](function () {
-    // handled per request
-  });
-  var oauth = opts === null || opts === void 0 ? void 0 : opts.oauth;
-  var scopesSupported = [server.VAL_SCOPE_READ, server.VAL_SCOPE_WRITE];
-  return {
-    valMcpMetadata: oauth ? createValMcpMetadata(oauth, scopesSupported) : null,
-    valMcpTools: function valMcpTools() {
-      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee2() {
-        return version._regenerator().w(function (_context2) {
-          while (1) switch (_context2.n) {
-            case 0:
-              _context2.n = 1;
-              return setupPromise;
-            case 1:
-              return _context2.a(2, _context2.v.tools);
-          }
-        }, _callee2);
-      }))();
-    },
-    valMcpAuthorize: function valMcpAuthorize(request) {
-      return version._asyncToGenerator(/*#__PURE__*/version._regenerator().m(function _callee3() {
-        var setup, refusal, sessionId, verified, status, _t;
-        return version._regenerator().w(function (_context3) {
-          while (1) switch (_context3.p = _context3.n) {
-            case 0:
-              _context3.p = 0;
-              _context3.n = 1;
-              return setupPromise;
-            case 1:
-              setup = _context3.v;
-              _context3.n = 3;
-              break;
-            case 2:
-              _context3.p = 2;
-              _t = _context3.v;
-              return _context3.a(2, {
-                status: "refused",
-                response: jsonResponse(500, {
-                  error: "Val: could not start the Val MCP server",
-                  details: _t instanceof Error ? _t.message : String(_t)
-                })
-              });
-            case 3:
-              if (!(request === undefined)) {
-                _context3.n = 4;
-                break;
-              }
-              return _context3.a(2, {
-                status: "refused",
-                response: jsonResponse(401, {
-                  error: "Val: this MCP server needs the HTTP request to authorize a call, and none was available."
-                })
-              });
-            case 4:
-              refusal = refuseUnsafeRequest(request, setup.mode);
-              if (!refusal) {
-                _context3.n = 5;
-                break;
-              }
-              return _context3.a(2, {
-                status: "refused",
-                response: refusal
-              });
-            case 5:
-              // Not the MCP session id, in any branch below. Val's patch `sessionId`
-              // names a Val AI session, and putting an unrelated id in it would claim a
-              // relationship that does not exist.
-              sessionId = null;
-              if (oauth) {
-                _context3.n = 8;
-                break;
-              }
-              if (!(setup.mode !== "fs")) {
-                _context3.n = 6;
-                break;
-              }
-              return _context3.a(2, {
-                status: "refused",
-                response: jsonResponse(500, {
-                  error: "Val: this MCP endpoint has no `oauth` config, and this project is configured to talk to the Val content backend. Pass `oauth` to `initValMcp` with the authorization server's URL and this endpoint's own URL, so callers authorize as themselves."
-                })
-              });
-            case 6:
-              if (!(readBearerToken(request) !== null)) {
-                _context3.n = 7;
-                break;
-              }
-              return _context3.a(2, {
-                status: "refused",
-                response: jsonResponse(400, {
-                  error: "Val: this project is running in local filesystem mode, where there is nothing to authenticate against — the tools read and write this working tree directly. Remove the credential from this MCP client's configuration: a token sent here is checked by nothing."
-                })
-              });
-            case 7:
-              return _context3.a(2, {
-                status: "ok",
-                tools: setup.tools,
-                ctx: {
-                  auth: null,
-                  sessionId: sessionId
-                }
-              });
-            case 8:
-              _context3.n = 9;
-              return verifyValAccessToken(request, oauth);
-            case 9:
-              verified = _context3.v;
-              if (!(verified.status === "refused")) {
-                _context3.n = 10;
-                break;
-              }
-              // 401 for a missing or bad token, 403 once the token is good but does
-              // not carry the scope: RFC 6750 section 3.1, and the distinction is
-              // what tells a client whether to authorize again or to give up.
-              status = verified.error === "insufficient_scope" ? 403 : 401;
-              return _context3.a(2, {
-                status: "refused",
-                response: new Response(JSON.stringify({
-                  error: verified.error,
-                  error_description: verified.description
-                }), {
-                  status: status,
-                  headers: {
-                    "Content-Type": "application/json",
-                    "WWW-Authenticate": wwwAuthenticate(oauth, scopesSupported, {
-                      error: verified.error,
-                      description: verified.description
-                    })
-                  }
-                })
-              });
-            case 10:
-              return _context3.a(2, {
-                status: "ok",
-                tools: setup.tools,
-                ctx: {
-                  auth: verified.auth,
-                  sessionId: sessionId
-                }
-              });
-          }
-        }, _callee3, null, [[0, 2]]);
-      }))();
-    }
-  };
-}
-
-/**
- * The two ways this route is dangerous, both refused here.
- *
- * 1. **Local filesystem mode outside development.** In fs mode there is no
- *    credential and no backend: the tools read and write the running process's
- *    own working tree, and every permission check Val has lives on the other
- *    side of a backend that is not in this path. Exposed on a deployed host,
- *    that is unauthenticated write access to the site's content for anyone who
- *    can reach the port. There is no configuration that makes it safe, so there
- *    is no flag to turn this off — a project that wants MCP in production wants
- *    proxy mode with an `oauth` config, where every call carries an access
- *    token this app verified itself.
- *
- * 2. **A browser driving the local server.** A page on any origin can `fetch`
- *    `http://localhost:3000/api/mcp` while a developer has the app running, and
- *    with DNS rebinding it can do so with a `Host` of its own choosing. Neither
- *    needs a credential in fs mode. So a cross-origin `Origin` is refused, and
- *    in fs mode the request must actually be addressed to a loopback host.
- *
- * MCP clients are not browsers and send no `Origin`, so the check costs them
- * nothing.
- */
-function refuseUnsafeRequest(request, mode) {
-  if (mode === "fs" &&         "production" !== "development") {
-    return jsonResponse(403, {
-      error: "Val: the MCP endpoint is disabled. This project is running in local filesystem mode, where MCP calls are unauthenticated and write directly to the working tree, so it is only served in development. Configure Val for proxy mode to use MCP on a deployed host."
-    });
-  }
-  var host = requestHost(request);
-  var origin = request.headers.get("origin");
-  if (origin !== null) {
-    // `Origin: null` is refused along with the rest. It is the *opaque* origin —
-    // a sandboxed iframe, a `file://` page, some redirects — so it cannot be
-    // compared to anything, and "cannot be compared" has to mean refuse: a page
-    // that would fail the check can otherwise pass it by arranging to have no
-    // origin at all. Absent entirely is the case that is allowed, and that is
-    // the one MCP clients produce.
-    var originHost = origin === "null" ? null : hostOf(origin);
-    if (originHost === null || host === null || originHost !== host) {
-      return jsonResponse(403, {
-        error: "Val: refusing a cross-origin MCP request from ".concat(JSON.stringify(origin), ". MCP clients do not send an Origin header; a browser does.")
-      });
-    }
-  }
-  if (mode === "fs") {
-    var hostname = host === null ? null : hostnameOf(host);
-    if (hostname === null || !LOOPBACK_HOSTNAMES.has(hostname)) {
-      return jsonResponse(403, {
-        error: "Val: refusing an MCP request addressed to ".concat(JSON.stringify(host !== null && host !== void 0 ? host : "an unknown host"), ". In local filesystem mode this endpoint only answers on localhost, because a name that resolves to 127.0.0.1 is how a web page reaches a developer's own machine.")
-      });
-    }
-  }
-  return null;
-}
-var LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
-
-/**
- * Which host the request was addressed to, as `hostname:port`.
- *
- * `Host` only, and deliberately **not** `X-Forwarded-Host`. The forwarded header
- * is what a client asked for behind a proxy, but nothing stops a client sending
- * it directly — so preferring it hands an attacker the value both checks below
- * are decided on. `Host`, by contrast, a browser sets from the URL and page
- * script cannot override, which is exactly the property the loopback check
- * depends on.
- *
- * The cost is that behind a proxy that rewrites `Host`, a *browser* request
- * whose `Origin` is the public name no longer matches. That is acceptable: such
- * a request carries no access token, so proxy mode refuses it anyway, and a
- * non-browser MCP client sends no `Origin` and never reaches the comparison.
- * Trusting the forwarded header would need an explicit trusted-proxy
- * configuration, which is a bigger thing than this needs.
- */
-function requestHost(request) {
-  var host = request.headers.get("host");
-  if (host) {
-    return host.trim().toLowerCase();
-  }
-  // Last resort: the URL the framework saw.
-  try {
-    return new URL(request.url).host.toLowerCase();
-  } catch (_unused) {
-    return null;
-  }
-}
-function hostOf(origin) {
-  try {
-    return new URL(origin).host.toLowerCase();
-  } catch (_unused2) {
-    return null;
-  }
-}
-
-/** Strips the port, keeping IPv6 brackets — `[::1]:3000` is hostname `[::1]`. */
-function hostnameOf(host) {
-  if (host.startsWith("[")) {
-    var end = host.indexOf("]");
-    return end === -1 ? host : host.slice(0, end + 1);
-  }
-  var colon = host.indexOf(":");
-  return colon === -1 ? host : host.slice(0, colon);
-}
-function jsonResponse(status, body) {
-  return new Response(JSON.stringify(body), {
-    status: status,
-    headers: {
-      "Content-Type": "application/json"
+  return mcp.initValMcp(valModules, config, objectSpread2._objectSpread2(objectSpread2._objectSpread2({}, opts), {}, {
+    versions: {
+      next: nextVersion
     }
-  });
+  }));
 }
 
 exports.initValMcp = initValMcp;