@valbuild/tanstack 0.124.0

package/server/dist/valbuild-tanstack-server.esm.js

@@ -0,0 +1,1005 @@
+import { _ as _objectSpread2, a as _slicedToArray, d as _defineProperty } from '../../dist/createForOfIteratorHelper-485c2ce1.esm.js';
+import { Internal } from '@valbuild/core';
+import { createValApiRouter, createValServer } from '@valbuild/server';
+import { _ as _asyncToGenerator, a as _regenerator, V as VERSION } from '../../dist/version-ac8df696.esm.js';
+import { b as initValRouteFromVal, g as getJsonEntryStegaRoot, i as isJsonValuesRecordSchema, a as getValRouteUrlFromVal, _ as _typeof } from '../../dist/routeFromVal-728295a0.esm.js';
+import { stegaEncode, SET_AUTO_TAG_JSX_ENABLED } from '@valbuild/react/stega';
+import { VAL_SESSION_COOKIE } from '@valbuild/shared/internal';
+import { initValMcp as initValMcp$1 } from '@valbuild/mcp';
+import '@valbuild/shared/client';
+
+/**
+ * The cookie that says a request is previewing unpublished content.
+ *
+ * Next has `draftMode()` for this; TanStack Start has no such notion, so Val
+ * brings its own. Deliberately NOT the thing that grants access: every draft
+ * read also carries the Val session cookie, which is a signed JWT the server
+ * verifies, and a request with this cookie and no session gets published
+ * content and a 401 in the log. So this is a mode switch, not a credential —
+ * which is why an ordinary cookie is enough.
+ */
+var VAL_DRAFT_MODE_COOKIE = "val_draft_mode";
+var ENABLED = "1";
+
+/**
+ * Reading and writing the draft-mode flag for the current request.
+ *
+ * Handed to `createValServer` as its callbacks, and exported so an app can ask
+ * the same question its loaders ask.
+ */
+
+/**
+ * The draft-mode flag, read from and written to the current request.
+ *
+ * TanStack's request helpers resolve the current request out of async local
+ * storage, so this only works where there IS one: a server route handler, a
+ * server function, or an SSR render. Everywhere else — a client navigation, a
+ * build-time render — it answers "off", which is the right answer: there is no
+ * session to authorize a draft read either.
+ *
+ * The import is dynamic for the same reason it is in `isValEnabled`: this
+ * module is reachable from the package's server entry, and pulling TanStack's
+ * server half in eagerly would put it in front of anything that merely
+ * type-imports from here.
+ */
+function valDraftMode() {
+  return {
+    isEnabled: function isEnabled() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+        var _yield$import, getCookie;
+        return _regenerator().w(function (_context) {
+          while (1) switch (_context.p = _context.n) {
+            case 0:
+              _context.p = 0;
+              _context.n = 1;
+              return import('@tanstack/react-start/server');
+            case 1:
+              _yield$import = _context.v;
+              getCookie = _yield$import.getCookie;
+              return _context.a(2, getCookie(VAL_DRAFT_MODE_COOKIE) === ENABLED);
+            case 2:
+              _context.p = 2;
+              _context.v;
+              return _context.a(2, false);
+          }
+        }, _callee, null, [[0, 2]]);
+      }))();
+    },
+    enable: function enable() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
+        var _yield$import2, setCookie, getRequest;
+        return _regenerator().w(function (_context2) {
+          while (1) switch (_context2.n) {
+            case 0:
+              _context2.n = 1;
+              return import('@tanstack/react-start/server');
+            case 1:
+              _yield$import2 = _context2.v;
+              setCookie = _yield$import2.setCookie;
+              getRequest = _yield$import2.getRequest;
+              setCookie(VAL_DRAFT_MODE_COOKIE, ENABLED, {
+                httpOnly: true,
+                sameSite: "lax",
+                path: "/",
+                // Not `secure` unconditionally: the Studio is used over http on
+                // localhost, and a Secure cookie is silently dropped there — which
+                // looks exactly like draft mode refusing to turn on.
+                secure: isSecureRequest(getRequest)
+              });
+            case 2:
+              return _context2.a(2);
+          }
+        }, _callee2);
+      }))();
+    },
+    disable: function disable() {
+      return _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3() {
+        var _yield$import3, deleteCookie;
+        return _regenerator().w(function (_context3) {
+          while (1) switch (_context3.n) {
+            case 0:
+              _context3.n = 1;
+              return import('@tanstack/react-start/server');
+            case 1:
+              _yield$import3 = _context3.v;
+              deleteCookie = _yield$import3.deleteCookie;
+              deleteCookie(VAL_DRAFT_MODE_COOKIE, {
+                path: "/"
+              });
+            case 2:
+              return _context3.a(2);
+          }
+        }, _callee3);
+      }))();
+    }
+  };
+}
+function isSecureRequest(getRequest) {
+  try {
+    return new URL(getRequest().url).protocol === "https:";
+  } catch (_unused2) {
+    return false;
+  }
+}
+
+/**
+ * The Val Enable cookie, as seen by the current request.
+ *
+ * Separate from draft mode: enabling Val is what makes the Studio overlay mount
+ * at all, and draft mode is what makes the content it shows be the unpublished
+ * one. The Studio turns the first on for the browser and the second on per
+ * preview.
+ */
+function hasValEnableCookieOnServer() {
+  return _hasValEnableCookieOnServer.apply(this, arguments);
+}
+function _hasValEnableCookieOnServer() {
+  _hasValEnableCookieOnServer = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4() {
+    var _yield$import4, getCookie;
+    return _regenerator().w(function (_context4) {
+      while (1) switch (_context4.p = _context4.n) {
+        case 0:
+          _context4.p = 0;
+          _context4.n = 1;
+          return import('@tanstack/react-start/server');
+        case 1:
+          _yield$import4 = _context4.v;
+          getCookie = _yield$import4.getCookie;
+          return _context4.a(2, getCookie(Internal.VAL_ENABLE_COOKIE_NAME) === "true");
+        case 2:
+          _context4.p = 2;
+          _context4.v;
+          return _context4.a(2, false);
+      }
+    }, _callee4, null, [[0, 2]]);
+  }));
+  return _hasValEnableCookieOnServer.apply(this, arguments);
+}
+
+/**
+ * The Val API, as a handler you can mount on a TanStack Start server route.
+ *
+ * `createValApiRouter` already speaks the platform's own vocabulary — it takes
+ * a `Request` and hands back a `ValServerGenericResult` — so all this adds is
+ * the conversion to a `Response`, which for Next needed `NextResponse` and here
+ * does not need anything.
+ */
+var initValApiHandler = function initValApiHandler(valModules, config, draftMode, formatter) {
+  var route = "/api/val"; // TODO: get from config
+  var coreVersion = Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var tanstackVersion = VERSION;
+  if (!tanstackVersion) {
+    throw new Error("Could not get @valbuild/tanstack package version");
+  }
+  return createValApiRouter(route, createValServer(valModules, route, _objectSpread2({
+    versions: {
+      /*
+       * Reported as `next` because that is the field the wire contract has.
+       *
+       * `Versions` in `@valbuild/server` names the framework half of the
+       * pair `next`, and admin.val.build reads it. Renaming it is a change
+       * to a published contract with a server on the other end, so the
+       * TanStack package fills the same field rather than adding one
+       * nothing reads.
+       */
+      next: tanstackVersion,
+      core: coreVersion
+    }
+  }, config), config, {
+    isEnabled: function isEnabled() {
+      return draftMode.isEnabled();
+    },
+    onEnable: function onEnable() {
+      return draftMode.enable();
+    },
+    onDisable: function onDisable() {
+      return draftMode.disable();
+    }
+  }, formatter), function (valRes) {
+    var headers = new Headers();
+    var valResHeaders = "headers" in valRes && valRes.headers || {};
+    for (var key in valResHeaders) {
+      var value = valResHeaders[key];
+      if (typeof value === "string") {
+        headers.set(key, value);
+      }
+    }
+    if ("cookies" in valRes && valRes.cookies) {
+      for (var _i = 0, _Object$entries = Object.entries(valRes.cookies); _i < _Object$entries.length; _i++) {
+        var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
+          cookieName = _Object$entries$_i[0],
+          cookie = _Object$entries$_i[1];
+        headers.append("Set-Cookie", serializeCookie(cookieName, cookie));
+      }
+    }
+    if ("json" in valRes) {
+      headers.set("Content-Type", "application/json");
+      return new Response(JSON.stringify(valRes.json), {
+        headers: headers,
+        status: valRes.status
+      });
+    }
+    if (valRes.status === 302) {
+      headers.set("Location", valRes.redirectTo);
+      /*
+       * Built by hand rather than with `Response.redirect`.
+       *
+       * `Response.redirect` produces an immutable response whose headers
+       * cannot be added to, and the redirect that enables Val is precisely
+       * the one that has to set cookies on its way out.
+       */
+      return new Response(null, {
+        status: valRes.status,
+        headers: headers
+      });
+    }
+    return new Response("body" in valRes ? valRes.body : null, {
+      headers: headers,
+      status: valRes.status
+    });
+  });
+};
+
+/**
+ * One `Set-Cookie` header value.
+ *
+ * `value` is nullable because clearing a cookie is expressed as a null value
+ * rather than a separate op — which is also why a falsy value gets `Max-Age=0`
+ * below when no explicit expiry was given.
+ */
+
+function serializeCookie(name, cookie) {
+  var _options$path;
+  var options = cookie.options;
+  /*
+   * `Path=/` unless told otherwise — the default is not "the whole site".
+   *
+   * A `Set-Cookie` with no `Path` defaults to the DIRECTORY of the request
+   * that set it, and every cookie Val sets is set by a response from
+   * `/api/val/...`. So `val_enable` — which the page reads from
+   * `document.cookie` to decide whether to mount the Studio overlay — was
+   * scoped to `/api/val` and invisible on the site itself: enabling Val
+   * appeared to do nothing at all. Next's `NextResponse` normalises this for
+   * the Next package; a plain `Response` does not.
+   */
+  var path = (_options$path = options === null || options === void 0 ? void 0 : options.path) !== null && _options$path !== void 0 ? _options$path : "/";
+  return "".concat(name, "=").concat(encodeURIComponent(cookie.value || "")) + "".concat(options !== null && options !== void 0 && options.httpOnly ? "; HttpOnly" : "") + "".concat(options !== null && options !== void 0 && options.secure ? "; Secure" : "") + "".concat(options !== null && options !== void 0 && options.sameSite ? "; SameSite=".concat(options.sameSite) : "") + "; Path=".concat(path) + "".concat(options !== null && options !== void 0 && options.expires ? "; Expires=".concat(options.expires.toISOString()) : "".concat(!cookie.value ? "; Max-Age=0" : ""));
+}
+function initValServer(valModules, config, opts) {
+  var _opts$draftMode;
+  var draftMode = (_opts$draftMode = opts === null || opts === void 0 ? void 0 : opts.draftMode) !== null && _opts$draftMode !== void 0 ? _opts$draftMode : valDraftMode();
+  return {
+    valApiHandler: initValApiHandler(valModules, config, draftMode, opts === null || opts === void 0 ? void 0 : opts.formatter),
+    draftMode: draftMode
+  };
+}
+
+/*
+ * NOTE: no `SET_RSC(true)` here, unlike the Next package.
+ *
+ * That flag marks elements as having been rendered by a React Server Component
+ * — a tree the browser cannot re-render, only re-request. A TanStack Start page
+ * is server-RENDERED and then hydrated, so every element it produces is a
+ * normal client element and the distinction does not exist.
+ */
+var initFetchValStega = function initFetchValStega(config, valApiEndpoints, valServerPromise, isEnabled, getHeaders, getCookies) {
+  return function (selector) {
+    var exec = /*#__PURE__*/function () {
+      var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+        var enabled, headers, cookies, host, _cookies, valServer, treeRes, modules, _t, _t2, _t3;
+        return _regenerator().w(function (_context) {
+          while (1) switch (_context.p = _context.n) {
+            case 0:
+              enabled = false;
+              _context.p = 1;
+              _context.n = 2;
+              return isEnabled();
+            case 2:
+              enabled = _context.v;
+              _context.n = 4;
+              break;
+            case 3:
+              _context.p = 3;
+              _t = _context.v;
+              console.error("Val: could not check if Val is enabled! This might be due to an error reading draft mode. fetchVal can only be used server-side (in a loader, a server function, or a server route). Use useVal in components.", _t);
+            case 4:
+              if (!enabled) {
+                _context.n = 17;
+                break;
+              }
+              SET_AUTO_TAG_JSX_ENABLED(true);
+              _context.p = 5;
+              _context.n = 6;
+              return getHeaders();
+            case 6:
+              headers = _context.v;
+              if (!(typeof headers.get !== "function")) {
+                _context.n = 7;
+                break;
+              }
+              throw new Error("Invalid headers");
+            case 7:
+              _context.n = 9;
+              break;
+            case 8:
+              _context.p = 8;
+              _t2 = _context.v;
+              console.error("Val: could not read headers! fetchVal can only be used server-side (in a loader, a server function, or a server route). Use useVal in components.", _t2);
+              headers = null;
+            case 9:
+              _context.p = 9;
+              _context.n = 10;
+              return getCookies();
+            case 10:
+              cookies = _context.v;
+              _context.n = 12;
+              break;
+            case 11:
+              _context.p = 11;
+              _t3 = _context.v;
+              console.error("Val: could not read cookies! fetchVal can only be used server-side (in a loader, a server function, or a server route). Use useVal in components.", _t3);
+              cookies = null;
+            case 12:
+              host = headers && getHost(headers);
+              if (!(host && cookies)) {
+                _context.n = 17;
+                break;
+              }
+              _context.n = 13;
+              return valServerPromise;
+            case 13:
+              valServer = _context.v;
+              _context.n = 14;
+              return valServer["/sources/~"]["PUT"]({
+                path: "/",
+                query: {
+                  validate_sources: true,
+                  validate_binary_files: false,
+                  exclude_patches: false,
+                  // The server-side read uses the legacy "server applies patches"
+                  // path, same as the Next package's.
+                  apply_patches: undefined,
+                  /*
+                   * The caller's own staged work, and nobody else's.
+                   *
+                   * A draft render cannot name its group ids — it has no client
+                   * state — so it asks for "mine" and the server resolves them from
+                   * the session. Without this a preview shows base + every pending
+                   * patch on the branch, so one person's half-finished edit appears
+                   * in another person's draft.
+                   *
+                   * `patch_id` stays `undefined`: naming an explicit list is for a
+                   * caller that already knows what it wants, and it would override
+                   * the resolution rather than intersect with it.
+                   */
+                  patch_id: undefined,
+                  own_patch_groups_only: true
+                },
+                cookies: _defineProperty({}, VAL_SESSION_COOKIE, (_cookies = cookies) === null || _cookies === void 0 || (_cookies = _cookies.get(VAL_SESSION_COOKIE)) === null || _cookies === void 0 ? void 0 : _cookies.value)
+              });
+            case 14:
+              treeRes = _context.v;
+              if (!(treeRes.status === 200)) {
+                _context.n = 15;
+                break;
+              }
+              modules = treeRes.json.modules;
+              return _context.a(2, stegaEncode(selector, {
+                disabled: !enabled,
+                getModule: function getModule(path) {
+                  var module = modules[path];
+                  if (module) {
+                    return module.source;
+                  }
+                }
+              }));
+            case 15:
+              if (!(treeRes.status === 401)) {
+                _context.n = 16;
+                break;
+              }
+              console.warn("Val: authentication error: ", treeRes.json.message);
+              _context.n = 17;
+              break;
+            case 16:
+              throw Error(JSON.stringify(treeRes.json, null, 2));
+            case 17:
+              return _context.a(2, stegaEncode(selector, {
+                disabled: !enabled
+              }));
+          }
+        }, _callee, null, [[9, 11], [5, 8], [1, 3]]);
+      }));
+      return function exec() {
+        return _ref.apply(this, arguments);
+      };
+    }();
+    return exec()["catch"](function (err) {
+      console.error("Val: failed to fetch ", err);
+      return stegaEncode(selector, {});
+    });
+  };
+};
+function getHost(headers) {
+  var _headers$get;
+  var host = headers === null || headers === void 0 ? void 0 : headers.get("host");
+  var proto = "https";
+  if ((headers === null || headers === void 0 ? void 0 : headers.get("x-forwarded-proto")) === "http") {
+    proto = "http";
+  } else if (headers !== null && headers !== void 0 && (_headers$get = headers.get("referer")) !== null && _headers$get !== void 0 && _headers$get.startsWith("http://")) {
+    proto = "http";
+  } else if (host !== null && host !== void 0 && host.startsWith("localhost")) {
+    proto = "http";
+  }
+  if (host && proto) {
+    return "".concat(proto, "://").concat(host);
+  }
+  return null;
+}
+
+// TODO: remove
+// function getValAuthHeaders(cookies: {
+//   get(name: string): { name: string; value: string } | undefined;
+// }): Record<string, string> {
+//   try {
+//     const session = cookies.get(Internal.VAL_SESSION_COOKIE);
+//     if (session) {
+//       return {
+//         Cookie: `${Internal.VAL_SESSION_COOKIE}=${encodeURIComponent(
+//           session.value
+//         )}`,
+//       };
+//     }
+//     return {};
+//   } catch (err) {
+//     console.error(
+//       "Val: could not read cookies! fetchVal can only be used server-side (in a loader, a server function, or a server route). Use useVal in components.",
+//       err
+//     );
+//     return {};
+//   }
+// }
+
+var initFetchValRouteStega = function initFetchValRouteStega(config, valApiEndpoints, valServerPromise, isEnabled, getHeaders, getCookies) {
+  return /*#__PURE__*/function () {
+    var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(selector, params) {
+      var resolvedParams, path, schema, source, url, enabled, draft, content, fetchVal, val, route, _t5;
+      return _regenerator().w(function (_context2) {
+        while (1) switch (_context2.p = _context2.n) {
+          case 0:
+            _context2.n = 1;
+            return Promise.resolve(params);
+          case 1:
+            resolvedParams = _context2.v;
+            path = selector && Internal.getValPath(selector);
+            schema = selector && Internal.getSchema(selector); // `.jsonValues()` router: map params → the entry key and load ONLY that
+            // entry's backing `*.val.json`, instead of eagerly resolving the whole
+            // record via `fetchVal`.
+            if (!isJsonValuesRecordSchema(schema)) {
+              _context2.n = 11;
+              break;
+            }
+            source = selector && Internal.getSource(selector);
+            url = getValRouteUrlFromVal(resolvedParams, "fetchValRoute", path, schema, source);
+            if (url) {
+              _context2.n = 2;
+              break;
+            }
+            return _context2.a(2, null);
+          case 2:
+            enabled = false;
+            _context2.p = 3;
+            _context2.n = 4;
+            return isEnabled();
+          case 4:
+            enabled = _context2.v;
+            _context2.n = 6;
+            break;
+          case 5:
+            _context2.p = 5;
+            _context2.v;
+          case 6:
+            draft = {
+              status: "unavailable"
+            };
+            if (!(enabled && path)) {
+              _context2.n = 8;
+              break;
+            }
+            SET_AUTO_TAG_JSX_ENABLED(true);
+            _context2.n = 7;
+            return loadDraftJsonEntry(valServerPromise, getCookies, path, url);
+          case 7:
+            draft = _context2.v;
+          case 8:
+            _context2.n = 9;
+            return resolveDraftOrCommittedEntry(draft, function () {
+              return loadJsonEntryContent(source, url);
+            });
+          case 9:
+            content = _context2.v;
+            if (!(content === undefined)) {
+              _context2.n = 10;
+              break;
+            }
+            return _context2.a(2, null);
+          case 10:
+            return _context2.a(2, stegaEncode(content, {
+              disabled: !enabled,
+              root: getJsonEntryStegaRoot(selector, url)
+            }));
+          case 11:
+            fetchVal = initFetchValStega(config, valApiEndpoints, valServerPromise, isEnabled, getHeaders, getCookies);
+            _t5 = selector;
+            if (!_t5) {
+              _context2.n = 13;
+              break;
+            }
+            _context2.n = 12;
+            return fetchVal(selector);
+          case 12:
+            _t5 = _context2.v;
+          case 13:
+            val = _t5;
+            route = initValRouteFromVal(resolvedParams, "fetchValRoute", path, schema, val);
+            return _context2.a(2, route);
+        }
+      }, _callee2, null, [[3, 5]]);
+    }));
+    return function (_x, _x2) {
+      return _ref2.apply(this, arguments);
+    };
+  }();
+};
+
+/**
+ * Resolves a single `.jsonValues()` entry's content by key from a module's local
+ * source markers (one dynamic import). Returns `undefined` when the key is
+ * missing or its marker has no runtime thunk (transport marker / draft entry).
+ */
+function loadJsonEntryContent(_x3, _x4) {
+  return _loadJsonEntryContent.apply(this, arguments);
+}
+/**
+ * Loads a single `.jsonValues()` entry's DRAFT content via the in-process
+ * `/json` endpoint (which replays pending patches). Returns `undefined` when the
+ * entry has no draft content to serve — the caller then falls back to the
+ * locally-bundled committed content.
+ */
+/**
+ * What the draft state says about an entry.
+ *
+ * The three cases have to stay distinct: `absent` is an ANSWER — the entry is not
+ * there in the draft state, e.g. a pending patch removed it — while `unavailable`
+ * means we could not ask. Collapsing them into `undefined` is what made a
+ * draft-deleted entry keep rendering its committed content: the caller could not
+ * tell "it is gone" from "ask the committed source instead".
+ */
+/**
+ * The slice of `ValServer` the single-entry readers actually use. Narrower than
+ * `ValServer` on purpose: it says what the dependency IS, and it lets a test
+ * drive these readers with a one-route fake instead of casting a partial object
+ * to the whole server type.
+ */
+function _loadJsonEntryContent() {
+  _loadJsonEntryContent = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(source, key) {
+    var marker, thunk;
+    return _regenerator().w(function (_context5) {
+      while (1) switch (_context5.n) {
+        case 0:
+          if (!(!source || _typeof(source) !== "object")) {
+            _context5.n = 1;
+            break;
+          }
+          return _context5.a(2, undefined);
+        case 1:
+          marker = source[key];
+          if (Internal.isJson(marker)) {
+            _context5.n = 2;
+            break;
+          }
+          return _context5.a(2, undefined);
+        case 2:
+          thunk = Internal.getJsonImport(marker);
+          if (thunk) {
+            _context5.n = 3;
+            break;
+          }
+          return _context5.a(2, undefined);
+        case 3:
+          _context5.n = 4;
+          return thunk();
+        case 4:
+          return _context5.a(2, _context5.v["default"]);
+      }
+    }, _callee5);
+  }));
+  return _loadJsonEntryContent.apply(this, arguments);
+}
+/**
+ * Picks the content a draft-aware single-entry read should render.
+ *
+ * The rule the two callers share: the draft state WINS when it has an answer —
+ * including the answer "this entry is gone" — and the committed content is used
+ * only when there is no draft answer to be had (Val disabled, or we could not
+ * ask). Returning `undefined` means "render nothing"; both callers turn that into
+ * a null/undefined result.
+ */
+function resolveDraftOrCommittedEntry(_x5, _x6) {
+  return _resolveDraftOrCommittedEntry.apply(this, arguments);
+}
+function _resolveDraftOrCommittedEntry() {
+  _resolveDraftOrCommittedEntry = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee6(draft, loadCommitted) {
+    return _regenerator().w(function (_context6) {
+      while (1) switch (_context6.n) {
+        case 0:
+          if (!(draft.status === "content")) {
+            _context6.n = 1;
+            break;
+          }
+          return _context6.a(2, draft.content);
+        case 1:
+          if (!(draft.status === "absent")) {
+            _context6.n = 2;
+            break;
+          }
+          return _context6.a(2, undefined);
+        case 2:
+          return _context6.a(2, loadCommitted());
+      }
+    }, _callee6);
+  }));
+  return _resolveDraftOrCommittedEntry.apply(this, arguments);
+}
+function loadDraftJsonEntry(_x7, _x8, _x9, _x0) {
+  return _loadDraftJsonEntry.apply(this, arguments);
+} // The (loosened) content type a single `.jsonValues()` entry resolves to.
+function _loadDraftJsonEntry() {
+  _loadDraftJsonEntry = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee7(valServerPromise, getCookies, moduleFilePath, key) {
+    var _cookies3;
+    var cookies, valServer, res;
+    return _regenerator().w(function (_context7) {
+      while (1) switch (_context7.p = _context7.n) {
+        case 0:
+          _context7.p = 0;
+          _context7.n = 1;
+          return getCookies();
+        case 1:
+          cookies = _context7.v;
+          _context7.n = 3;
+          break;
+        case 2:
+          _context7.p = 2;
+          _context7.v;
+          return _context7.a(2, {
+            status: "unavailable"
+          });
+        case 3:
+          _context7.n = 4;
+          return valServerPromise;
+        case 4:
+          valServer = _context7.v;
+          _context7.n = 5;
+          return valServer["/json"]["GET"]({
+            query: {
+              path: moduleFilePath,
+              key: key,
+              keys: undefined,
+              // single-entry shape
+              offset: undefined,
+              limit: undefined,
+              apply_patches: true,
+              /*
+               * Scoped the same way the module content beside it is.
+               *
+               * A draft page renders both, and this call was unscoped — so one page
+               * showed base + the caller's group for its modules and base + EVERY
+               * pending patch on the branch for any `jsonValues` entry, including other
+               * authors' half-finished edits. See the same flag on `/sources/~` above.
+               */
+              own_patch_groups_only: true
+            },
+            cookies: _defineProperty({}, VAL_SESSION_COOKIE, (_cookies3 = cookies) === null || _cookies3 === void 0 || (_cookies3 = _cookies3.get(VAL_SESSION_COOKIE)) === null || _cookies3 === void 0 ? void 0 : _cookies3.value)
+          });
+        case 5:
+          res = _context7.v;
+          if (!(res.status === 200 && "content" in res.json)) {
+            _context7.n = 6;
+            break;
+          }
+          return _context7.a(2, {
+            status: "content",
+            content: res.json.content
+          });
+        case 6:
+          if (!(res.status === 401)) {
+            _context7.n = 7;
+            break;
+          }
+          console.warn("Val: authentication error: ", res.json.message);
+          return _context7.a(2, {
+            status: "unavailable"
+          });
+        case 7:
+          if (!(res.status === 404)) {
+            _context7.n = 8;
+            break;
+          }
+          return _context7.a(2, {
+            status: "absent"
+          });
+        case 8:
+          console.error("Val: could not load draft JSON entry: ", "message" in res.json ? res.json.message : "status ".concat(res.status));
+          return _context7.a(2, {
+            status: "unavailable"
+          });
+      }
+    }, _callee7, null, [[0, 2]]);
+  }));
+  return _loadDraftJsonEntry.apply(this, arguments);
+}
+/**
+ * Resolves ONE `.jsonValues()` entry by key, loading only that entry instead of
+ * the whole record — the runtime-scaling counterpart to the eager `fetchVal`.
+ *
+ * Production (Val disabled): resolves the entry's lazy import thunk from the
+ * locally-bundled module. One dynamic import, no server round-trip.
+ *
+ * Enabled (draft mode): reads the entry through `/json`, which replays pending
+ * patches, so uncommitted Studio edits show up. Falls back to the local thunk if
+ * the draft read yields nothing.
+ */
+var initFetchValKeyStega = function initFetchValKeyStega(valServerPromise, isEnabled, getCookies) {
+  return /*#__PURE__*/function () {
+    var _ref3 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(selector, key) {
+      var enabled, source, moduleFilePath, draft, content;
+      return _regenerator().w(function (_context3) {
+        while (1) switch (_context3.p = _context3.n) {
+          case 0:
+            enabled = false;
+            _context3.p = 1;
+            _context3.n = 2;
+            return isEnabled();
+          case 2:
+            enabled = _context3.v;
+            _context3.n = 4;
+            break;
+          case 3:
+            _context3.p = 3;
+            _context3.v;
+          case 4:
+            source = selector && Internal.getSource(selector);
+            moduleFilePath = selector && Internal.getValPath(selector);
+            draft = {
+              status: "unavailable"
+            };
+            if (!(enabled && moduleFilePath)) {
+              _context3.n = 6;
+              break;
+            }
+            SET_AUTO_TAG_JSX_ENABLED(true);
+            _context3.n = 5;
+            return loadDraftJsonEntry(valServerPromise, getCookies, moduleFilePath, key);
+          case 5:
+            draft = _context3.v;
+          case 6:
+            _context3.n = 7;
+            return resolveDraftOrCommittedEntry(draft, function () {
+              return loadJsonEntryContent(source, key);
+            });
+          case 7:
+            content = _context3.v;
+            if (!(content === undefined)) {
+              _context3.n = 8;
+              break;
+            }
+            return _context3.a(2, undefined);
+          case 8:
+            return _context3.a(2, stegaEncode(content, {
+              disabled: !enabled,
+              root: getJsonEntryStegaRoot(selector, key)
+            }));
+        }
+      }, _callee3, null, [[1, 3]]);
+    }));
+    return function (_x1, _x10) {
+      return _ref3.apply(this, arguments);
+    };
+  }();
+};
+var initFetchValRouteUrl = function initFetchValRouteUrl(config, valApiEndpoints, valServerPromise, isEnabled, getHeaders, getCookies) {
+  return /*#__PURE__*/function () {
+    var _ref4 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(selector, params) {
+      var fetchVal, resolvedParams, path, schema, val, route, _t7, _t8;
+      return _regenerator().w(function (_context4) {
+        while (1) switch (_context4.n) {
+          case 0:
+            fetchVal = initFetchValStega(config, valApiEndpoints, valServerPromise, isEnabled, getHeaders, getCookies);
+            if (!(params === undefined)) {
+              _context4.n = 1;
+              break;
+            }
+            _t7 = undefined;
+            _context4.n = 3;
+            break;
+          case 1:
+            _context4.n = 2;
+            return Promise.resolve(params);
+          case 2:
+            _t7 = _context4.v;
+          case 3:
+            resolvedParams = _t7;
+            path = selector && Internal.getValPath(selector);
+            schema = selector && Internal.getSchema(selector);
+            _t8 = selector;
+            if (!_t8) {
+              _context4.n = 5;
+              break;
+            }
+            _context4.n = 4;
+            return fetchVal(selector);
+          case 4:
+            _t8 = _context4.v;
+          case 5:
+            val = _t8;
+            route = getValRouteUrlFromVal(resolvedParams, "fetchValRouteUrl", path, schema, val);
+            return _context4.a(2, route);
+        }
+      }, _callee4);
+    }));
+    return function (_x11, _x12) {
+      return _ref4.apply(this, arguments);
+    };
+  }();
+};
+var valApiEndpoints = "/api/val";
+
+/**
+ * The request's headers, as the readers above want them.
+ *
+ * TanStack resolves the current request out of async local storage, so there
+ * is nothing to pass in — and nothing to read outside a request, which is what
+ * the throw is: the callers catch it and fall back to published content.
+ */
+function requestHeaders() {
+  return _requestHeaders.apply(this, arguments);
+}
+/** The request's cookies, in the `{ name, value }` shape the readers want. */
+function _requestHeaders() {
+  _requestHeaders = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee8() {
+    var _yield$import, getRequestHeaders, headers;
+    return _regenerator().w(function (_context8) {
+      while (1) switch (_context8.n) {
+        case 0:
+          _context8.n = 1;
+          return import('@tanstack/react-start/server');
+        case 1:
+          _yield$import = _context8.v;
+          getRequestHeaders = _yield$import.getRequestHeaders;
+          headers = getRequestHeaders();
+          return _context8.a(2, {
+            get: function get(name) {
+              var _headers$get2;
+              return (_headers$get2 = headers.get(name)) !== null && _headers$get2 !== void 0 ? _headers$get2 : null;
+            }
+          });
+      }
+    }, _callee8);
+  }));
+  return _requestHeaders.apply(this, arguments);
+}
+function requestCookies() {
+  return _requestCookies.apply(this, arguments);
+}
+/**
+ * Val's content readers for the server side of a TanStack Start app.
+ *
+ * Use them where the server runs: a route `loader` during SSR, a
+ * `createServerFn`, or a server route handler. In the browser — a client
+ * navigation re-running a loader, say — there is no request to read draft
+ * state from, so they resolve the published content, which is the same answer
+ * the visitor would get.
+ *
+ * @example
+ * // src/val/server.ts
+ * import { initValContent } from "@valbuild/tanstack/server";
+ * import { config } from "../val.config";
+ * import valModules from "../val.modules";
+ *
+ * export const {
+ *   fetchValStega: fetchVal,
+ *   fetchValRouteStega: fetchValRoute,
+ * } = initValContent(config, valModules);
+ */
+function _requestCookies() {
+  _requestCookies = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee9() {
+    var _yield$import2, getCookie;
+    return _regenerator().w(function (_context9) {
+      while (1) switch (_context9.n) {
+        case 0:
+          _context9.n = 1;
+          return import('@tanstack/react-start/server');
+        case 1:
+          _yield$import2 = _context9.v;
+          getCookie = _yield$import2.getCookie;
+          return _context9.a(2, {
+            get: function get(name) {
+              var value = getCookie(name);
+              return value === undefined ? undefined : {
+                name: name,
+                value: value
+              };
+            }
+          });
+      }
+    }, _callee9);
+  }));
+  return _requestCookies.apply(this, arguments);
+}
+function initValContent(config, valModules, opts) {
+  var _opts$draftMode;
+  var coreVersion = Internal.VERSION.core;
+  if (!coreVersion) {
+    throw new Error("Could not get @valbuild/core package version");
+  }
+  var tanstackVersion = VERSION;
+  if (!tanstackVersion) {
+    throw new Error("Could not get @valbuild/tanstack package version");
+  }
+  var draftMode = (_opts$draftMode = opts === null || opts === void 0 ? void 0 : opts.draftMode) !== null && _opts$draftMode !== void 0 ? _opts$draftMode : valDraftMode();
+  var isEnabled = function isEnabled() {
+    return draftMode.isEnabled();
+  };
+  var valServerPromise = createValServer(valModules, valApiEndpoints, _objectSpread2({
+    versions: {
+      // `next` is the field name in the wire contract; see initValServer.
+      next: tanstackVersion,
+      core: coreVersion
+    }
+  }, config), config, {
+    isEnabled: isEnabled,
+    onEnable: function onEnable() {
+      return draftMode.enable();
+    },
+    onDisable: function onDisable() {
+      return draftMode.disable();
+    }
+  });
+  return {
+    fetchValStega: initFetchValStega(config, valApiEndpoints,
+    // TODO: get from config
+    valServerPromise, isEnabled, requestHeaders, requestCookies),
+    fetchValKeyStega: initFetchValKeyStega(valServerPromise, isEnabled, requestCookies),
+    fetchValRouteStega: initFetchValRouteStega(config, valApiEndpoints, valServerPromise, isEnabled, requestHeaders, requestCookies),
+    fetchValRouteUrl: initFetchValRouteUrl(config, valApiEndpoints, valServerPromise, isEnabled, requestHeaders, requestCookies)
+  };
+}
+
+/**
+ * Val's tools over MCP, bound to this package.
+ *
+ * The MCP endpoint itself — the tools, the request guards, the access-token
+ * verification — lives in `@valbuild/mcp`, which knows nothing about any
+ * framework. All that is left here is the one thing this package can answer and
+ * that one cannot: which version of `@valbuild/tanstack` is running, which
+ * `initHandlerOptions` insists on before it will build a proxy-mode config.
+ *
+ * The version goes in the `next` field because that is the field name in the
+ * wire contract; see `initValServer`.
+ */
+function initValMcp(valModules, config, opts) {
+  var tanstackVersion = VERSION;
+  if (!tanstackVersion) {
+    throw new Error("Could not get @valbuild/tanstack package version");
+  }
+  return initValMcp$1(valModules, config, _objectSpread2(_objectSpread2({}, opts), {}, {
+    versions: {
+      next: tanstackVersion
+    }
+  }));
+}
+
+export { VAL_DRAFT_MODE_COOKIE, hasValEnableCookieOnServer, initValContent, initValMcp, initValServer, valDraftMode };