@exposify/cli 0.0.0-stage → 0.0.1

package/dist/index.js

@@ -0,0 +1,2215 @@
+// src/run.ts
+import { existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { join as join4, relative } from "path";
+
+// src/io.ts
+import { spawnSync } from "child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { createInterface } from "readline/promises";
+async function ask(question, prefill) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  rl.on("SIGINT", () => {
+    rl.close();
+    console.log("\nCancelled.");
+    process.exit(130);
+  });
+  try {
+    const answer = rl.question(question);
+    if (prefill) rl.write(prefill);
+    return (await answer).trim();
+  } finally {
+    rl.close();
+  }
+}
+function editInEditor(text) {
+  const editor = process.env.VISUAL || process.env.EDITOR;
+  if (!editor) return null;
+  const dir = mkdtempSync(join(tmpdir(), "exposify-"));
+  const file = join(dir, "description.txt");
+  try {
+    writeFileSync(file, `${text}
+`);
+    const result = spawnSync(editor, [file], { stdio: "inherit", shell: true });
+    if (result.status !== 0) return null;
+    return readFileSync(file, "utf8").replace(/\s+/g, " ").trim();
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// src/describe/file.ts
+import { createHash } from "crypto";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { DESCRIPTIONS_FILE, parseDescriptions } from "@exposify/core";
+
+// src/checklist.ts
+var routeKey = (r) => `${r.method} ${r.path}`;
+var isRead = (r) => r.method === "GET" || r.method === "HEAD";
+function isLocked(r) {
+  return r.marker !== void 0;
+}
+function initialState(routes, opts) {
+  const actions = opts.actions ?? [];
+  const listed = new Set(opts.listedActions ?? []);
+  const selected = /* @__PURE__ */ new Set();
+  for (const r of routes) {
+    const ticked = opts.hasConfig || isLocked(r) ? r.exposed : isRead(r);
+    if (ticked) selected.add(routeKey(r));
+  }
+  const readsOnly = new Set(routes.filter((r) => isLocked(r) ? r.exposed : isRead(r)).map(routeKey));
+  return {
+    routes,
+    selected,
+    actions,
+    // Actions are never ticked by default: the ones listed in config now.
+    selectedActions: new Set(actions.filter((a) => !isLocked(a) && listed.has(a.configKey)).map((a) => a.configKey)),
+    nuclear: opts.nuclear,
+    ...opts.nuclear ? { beforeNuclear: readsOnly } : {},
+    cursor: 0,
+    filter: ""
+  };
+}
+function visible(state) {
+  const f = state.filter.trim().toLowerCase();
+  if (!f) return state.routes;
+  return state.routes.filter((r) => routeKey(r).toLowerCase().includes(f) || r.tool.includes(f));
+}
+function visibleActions(state) {
+  const f = state.filter.trim().toLowerCase();
+  if (!f) return state.actions;
+  return state.actions.filter((a) => `${a.export} ${a.file} ${a.tool}`.toLowerCase().includes(f));
+}
+function focused(state) {
+  const routes = visible(state);
+  if (state.cursor < routes.length) return { route: routes[state.cursor] };
+  const action = visibleActions(state)[state.cursor - routes.length];
+  return action ? { action } : void 0;
+}
+function setTicks(state, pick, untickActions = false) {
+  const selected = new Set(state.selected);
+  for (const r of visible(state)) {
+    if (isLocked(r)) continue;
+    if (pick(r)) selected.add(routeKey(r));
+    else selected.delete(routeKey(r));
+  }
+  if (!untickActions) return { ...state, selected };
+  const selectedActions = new Set(state.selectedActions);
+  for (const a of visibleActions(state)) selectedActions.delete(a.configKey);
+  return { ...state, selected, selectedActions };
+}
+function reduce(state, action) {
+  switch (action.type) {
+    case "move": {
+      const n = visible(state).length + visibleActions(state).length;
+      if (n === 0) return { ...state, cursor: 0 };
+      return { ...state, cursor: Math.max(0, Math.min(n - 1, state.cursor + action.by)) };
+    }
+    case "toggle": {
+      const row = focused(state);
+      if (row && "action" in row) {
+        if (isLocked(row.action)) return state;
+        const selectedActions = new Set(state.selectedActions);
+        if (selectedActions.has(row.action.configKey)) selectedActions.delete(row.action.configKey);
+        else selectedActions.add(row.action.configKey);
+        return { ...state, selectedActions };
+      }
+      if (!row || isLocked(row.route)) return state;
+      const route = row.route;
+      const selected = new Set(state.selected);
+      const key = routeKey(route);
+      if (selected.has(key)) selected.delete(key);
+      else selected.add(key);
+      return { ...state, selected };
+    }
+    // "all" ticks every row but stays an explicit list; only the nuclear
+    // option produces expose: "*".
+    case "all":
+      return setTicks(state, () => true);
+    case "none":
+      return setTicks(state, () => false, true);
+    case "readsOnly":
+      return setTicks(state, isRead, true);
+    case "filter":
+      return { ...state, filter: action.text, cursor: 0 };
+    case "enterNuclear": {
+      if (state.nuclear) return state;
+      const selected = new Set(state.selected);
+      for (const r of state.routes) if (!isLocked(r)) selected.add(routeKey(r));
+      return { ...state, nuclear: true, beforeNuclear: state.selected, selected };
+    }
+    case "leaveNuclear": {
+      if (!state.nuclear) return state;
+      const { beforeNuclear, ...rest } = state;
+      return { ...rest, nuclear: false, selected: new Set(beforeNuclear ?? state.selected) };
+    }
+  }
+}
+function nuclearWrites(routes) {
+  const order = (m) => m === "DELETE" ? 0 : m === "PUT" || m === "PATCH" ? 1 : 2;
+  return routes.filter((r) => !isRead(r) && !isLocked(r)).sort((a, b) => order(a.method) - order(b.method));
+}
+var NUCLEAR_PHRASE = "expose all";
+
+// src/describe/file.ts
+function signatureFor(route) {
+  const input = JSON.stringify([route.method, route.path, route.params, route.source ?? ""]);
+  return createHash("sha256").update(input).digest("hex").slice(0, 16);
+}
+var emptyFile = () => ({ version: 1, descriptions: {} });
+function readDescriptionsFile(path) {
+  let text;
+  try {
+    text = readFileSync2(path, "utf8");
+  } catch {
+    return emptyFile();
+  }
+  return parseDescriptions(text);
+}
+function renderDescriptionsFile(file) {
+  const sorted = {};
+  for (const key of Object.keys(file.descriptions).sort()) {
+    const e = file.descriptions[key];
+    sorted[key] = {
+      text: e.text,
+      source: e.source,
+      signature: e.signature,
+      ...e.model ? { model: e.model } : {},
+      ...e.generatedAt ? { generatedAt: e.generatedAt } : {}
+    };
+  }
+  const inputs = {};
+  for (const key of Object.keys(file.inputs ?? {}).sort()) {
+    const e = file.inputs[key];
+    inputs[key] = {
+      fields: e.fields,
+      ...e.unknown?.length ? { unknown: e.unknown } : {},
+      source: e.source,
+      signature: e.signature,
+      ...e.model ? { model: e.model } : {},
+      ...e.generatedAt ? { generatedAt: e.generatedAt } : {}
+    };
+  }
+  return `${JSON.stringify({ version: 1, descriptions: sorted, ...Object.keys(inputs).length > 0 ? { inputs } : {} }, null, 2)}
+`;
+}
+function writeDescriptionsFile(path, file) {
+  writeFileSync2(path, renderDescriptionsFile(file));
+}
+function statusOf(route, file) {
+  if (route.describedText || route.openApiText) return { kind: "in-code" };
+  const entry = file.descriptions[routeKey(route)];
+  if (!entry) return { kind: "missing" };
+  return entry.signature === signatureFor(route) ? { kind: "current", entry } : { kind: "stale", entry };
+}
+function needingDescriptions(routes, file, opts = {}) {
+  return routes.filter((r) => {
+    if (!r.exposed) return false;
+    const s = statusOf(r, file);
+    if (s.kind === "missing") return true;
+    if (s.kind === "stale") return s.entry.source === "generated";
+    if (s.kind === "current") return Boolean(opts.regenerate) && s.entry.source === "generated";
+    return false;
+  });
+}
+function entryFor(route, text, source, model) {
+  return {
+    text: text.trim(),
+    source,
+    signature: signatureFor(route),
+    ...model ? { model, generatedAt: (/* @__PURE__ */ new Date()).toISOString() } : {}
+  };
+}
+
+// src/checklist-tty.ts
+var color = !process.env.NO_COLOR && Boolean(process.stdout.isTTY);
+function disableColor() {
+  color = false;
+}
+var paint = (code) => (s) => color ? `\x1B[${code}m${s}\x1B[0m` : s;
+var dim = paint("2");
+var bold = paint("1");
+var red = paint("31");
+var green = paint("32");
+var yellow = paint("33");
+var cyan = paint("36");
+function groupOf(path) {
+  const literal = [];
+  for (const seg of path.split("/").filter(Boolean)) {
+    if (seg.startsWith(":") || literal.length === 2) break;
+    literal.push(seg);
+  }
+  return `/${literal.join("/")}`;
+}
+function rowText(r, state, focused2) {
+  const ticked = state.selected.has(routeKey(r));
+  const box = isLocked(r) ? "[\xB7]" : ticked ? green("[x]") : "[ ]";
+  const method = r.method.padEnd(6);
+  const path = r.path.padEnd(36);
+  let note;
+  if (r.marker) note = dim(`(${r.marker === "described" ? "describe()" : `${r.marker}()`} in code)`);
+  else note = dim(r.derived ?? "");
+  const write = !isRead(r) && !isLocked(r) ? yellow(" <- write") : "";
+  const line = `  ${box} ${isRead(r) ? method : yellow(method)} ${path} ${note}${write}`;
+  return focused2 ? `${cyan(">")}${line.slice(1)}` : line;
+}
+var ACTION_STATUS = { complete: "input known", partial: "input partly unknown", flagged: "flagged" };
+function actionText(a, state, focused2) {
+  const box = isLocked(a) ? "[\xB7]" : state.selectedActions.has(a.configKey) ? green("[x]") : "[ ]";
+  const where = dim(`${a.file}:${a.line}`.padEnd(36));
+  const note = isLocked(a) ? dim(`(${a.marker === "described" ? "describe()" : `${a.marker}()`} in code)`) : a.status === "complete" ? dim(ACTION_STATUS[a.status]) : yellow(ACTION_STATUS[a.status]);
+  const line = `  ${box} ${yellow(a.export.padEnd(24))} ${where} ${note}`;
+  return focused2 ? `${cyan(">")}${line.slice(1)}` : line;
+}
+function render(state, height, filtering) {
+  const out = [];
+  out.push(bold("Step 1/5 \xB7 Which endpoints should agents be able to call?"));
+  if (state.nuclear) {
+    out.push(red(bold('  expose: "*" -- every write route is exposed, including ones added later.')));
+    out.push(dim("  Un-tick rows to exclude them \xB7 x back to an explicit list \xB7 enter confirm"));
+  } else {
+    out.push(dim("  Reads are pre-selected. space toggle \xB7 a all \xB7 n none \xB7 r reads only \xB7 / filter"));
+    out.push(dim('  ! expose everything (expose: "*"), asks for confirmation \xB7 enter confirm \xB7 ctrl-c quit'));
+  }
+  out.push(filtering || state.filter ? `  filter: ${state.filter}${filtering ? "\u258F" : ""}` : "");
+  const rows = visible(state);
+  const lines = [];
+  let group = "";
+  rows.forEach((r, i) => {
+    const g = groupOf(r.path);
+    if (g !== group) {
+      group = g;
+      lines.push({ text: bold(`  ${g}`) });
+    }
+    lines.push({ text: rowText(r, state, i === state.cursor), rowIndex: i });
+  });
+  const actions = visibleActions(state);
+  if (actions.length > 0) {
+    lines.push({ text: `${bold("  Server Actions")} ${dim("(writes: space picks each one; a and ! leave them alone)")}` });
+    actions.forEach((a, j) => {
+      const i = rows.length + j;
+      lines.push({ text: actionText(a, state, i === state.cursor), rowIndex: i });
+      if (i === state.cursor) for (const note of a.notes) lines.push({ text: dim(`        ${note}`) });
+    });
+  }
+  const viewport = Math.max(5, height - out.length - 3);
+  const cursorLine = lines.findIndex((l) => l.rowIndex === state.cursor);
+  const start = Math.max(0, Math.min(cursorLine - Math.floor(viewport / 2), lines.length - viewport));
+  const shown = lines.slice(start, start + viewport);
+  out.push(...shown.map((l) => l.text));
+  if (rows.length === 0 && actions.length === 0) out.push(dim("  (no endpoints match the filter)"));
+  const configurable = state.routes.filter((r) => !isLocked(r));
+  const picked = configurable.filter((r) => state.selected.has(routeKey(r)));
+  const writes = picked.filter((r) => !isRead(r)).length;
+  const more = lines.length > viewport ? dim(`  \xB7 ${start + 1}-${start + shown.length} of ${lines.length} lines`) : "";
+  const counts = [
+    ...state.routes.length > 0 ? [`${picked.length} of ${configurable.length} selected, ${writes} write${writes === 1 ? "" : "s"}`] : [],
+    ...state.actions.length > 0 ? [`${state.selectedActions.size} of ${state.actions.filter((a) => !isLocked(a)).length} Server Actions`] : []
+  ];
+  out.push("", `  ${counts.join(", ")}${more}`);
+  return out.join("\n");
+}
+function renderNuclearConfirm(state, typed, height) {
+  const writes = nuclearWrites(state.routes);
+  const out = [
+    red(bold('Expose everything (expose: "*")?')),
+    "",
+    `  Agents will be able to call all ${writes.length} write route${writes.length === 1 ? "" : "s"}:`
+  ];
+  const room = Math.max(3, height - 10);
+  for (const r of writes.slice(0, room)) out.push(`    ${r.method === "DELETE" ? red(r.method.padEnd(6)) : yellow(r.method.padEnd(6))} ${r.path}`);
+  if (writes.length > room) out.push(dim(`    \u2026 and ${writes.length - room} more`));
+  out.push(
+    "",
+    red("  Write routes added to your app later are exposed automatically, with no review."),
+    "",
+    `  Type ${bold(NUCLEAR_PHRASE)} to confirm, or Esc to go back: ${typed}\u258F`
+  );
+  return out.join("\n");
+}
+function splitKeys(chunk) {
+  const keys = [];
+  for (let i = 0; i < chunk.length; ) {
+    if (chunk[i] === "\x1B" && chunk[i + 1] === "[") {
+      let j = i + 2;
+      while (j < chunk.length && !/[@-~]/.test(chunk[j])) j++;
+      keys.push(chunk.slice(i, j + 1));
+      i = j + 1;
+    } else {
+      const cp = chunk.codePointAt(i);
+      const ch = String.fromCodePoint(cp);
+      keys.push(ch);
+      i += ch.length;
+    }
+  }
+  return keys;
+}
+function runChecklist(initial) {
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  return new Promise((resolve) => {
+    let state = initial;
+    let filtering = false;
+    let confirming = null;
+    const draw = () => {
+      const height = stdout.rows || 30;
+      const body = confirming !== null ? renderNuclearConfirm(state, confirming, height) : render(state, height, filtering);
+      stdout.write(`\x1B[H\x1B[2J${body}`);
+    };
+    const finish = (result) => {
+      stdin.off("data", onData);
+      stdin.setRawMode?.(false);
+      stdin.pause();
+      stdout.write("\x1B[?25h\x1B[?1049l");
+      resolve(result);
+    };
+    const act = (a) => {
+      state = reduce(state, a);
+    };
+    const onData = (buf) => {
+      for (const key of splitKeys(buf.toString("utf8"))) {
+        if (onKey(key) === "done") return;
+      }
+      draw();
+    };
+    const onKey = (key) => {
+      if (key === "") {
+        finish(null);
+        return "done";
+      }
+      if (confirming !== null) {
+        if (key === "\x1B") confirming = null;
+        else if (key === "\r") {
+          if (confirming.trim() === NUCLEAR_PHRASE) act({ type: "enterNuclear" });
+          confirming = confirming.trim() === NUCLEAR_PHRASE ? null : confirming;
+        } else if (key === "\x7F") confirming = confirming.slice(0, -1);
+        else if (key.length === 1 && key >= " ") confirming += key;
+        return;
+      }
+      if (filtering) {
+        if (key === "\r" || key === "\x1B") filtering = false;
+        else if (key === "\x7F") act({ type: "filter", text: state.filter.slice(0, -1) });
+        else if (key.length === 1 && key >= " ") act({ type: "filter", text: state.filter + key });
+        return;
+      }
+      const page = Math.max(5, (stdout.rows || 30) - 10);
+      switch (key) {
+        case "\x1B[A":
+        case "k":
+          act({ type: "move", by: -1 });
+          break;
+        case "\x1B[B":
+        case "j":
+          act({ type: "move", by: 1 });
+          break;
+        case "\x1B[5~":
+          act({ type: "move", by: -page });
+          break;
+        case "\x1B[6~":
+          act({ type: "move", by: page });
+          break;
+        case " ":
+          act({ type: "toggle" });
+          break;
+        case "a":
+          act({ type: "all" });
+          break;
+        case "n":
+          act({ type: "none" });
+          break;
+        case "r":
+          act({ type: "readsOnly" });
+          break;
+        case "/":
+          filtering = true;
+          break;
+        case "\x1B":
+          if (state.filter) act({ type: "filter", text: "" });
+          break;
+        case "!":
+          if (!state.nuclear) confirming = "";
+          break;
+        case "x":
+          act({ type: "leaveNuclear" });
+          break;
+        case "\r":
+          finish(state);
+          return "done";
+      }
+    };
+    stdout.write("\x1B[?1049h\x1B[?25l");
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.on("data", onData);
+    draw();
+  });
+}
+
+// src/describe/credentials.ts
+import { chmodSync, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir } from "os";
+import { dirname, join as join2 } from "path";
+var LICENSE_KEY_ENV = "EXPOSIFY_KEY";
+function credentialsPath(env = process.env) {
+  const base = process.platform === "win32" && env.APPDATA ? env.APPDATA : env.XDG_CONFIG_HOME || join2(homedir(), ".config");
+  return join2(base, "exposify", "credentials.json");
+}
+function resolveLicenseKey(flag, env = process.env) {
+  if (flag) return { key: flag, from: "--license-key" };
+  if (env[LICENSE_KEY_ENV]) return { key: env[LICENSE_KEY_ENV], from: LICENSE_KEY_ENV };
+  try {
+    const saved = JSON.parse(readFileSync3(credentialsPath(env), "utf8"));
+    if (typeof saved.licenseKey === "string" && saved.licenseKey) return { key: saved.licenseKey, from: credentialsPath(env) };
+  } catch {
+  }
+  return void 0;
+}
+function saveLicenseKey(key, env = process.env) {
+  const path = credentialsPath(env);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync3(path, `${JSON.stringify({ licenseKey: key }, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+  return path;
+}
+
+// src/describe/prompt.ts
+function redact(source) {
+  return source.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "<redacted private key>").replace(/\b(sk|pk|rk)[-_](live|test|ant|proj)?[-_]?[A-Za-z0-9_-]{16,}/g, "<redacted key>").replace(/\b(xox[abpr]-[A-Za-z0-9-]{10,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,})/g, "<redacted key>").replace(/(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{16,}/g, "$1 <redacted>").replace(
+    /(["'`])([A-Za-z0-9+/_=-]{32,})\1/g,
+    (match, quote, body) => (
+      // Long single-token literals with mixed character classes look like secrets; identifiers and paths don't.
+      /[0-9]/.test(body) && /[A-Za-z]/.test(body) && !body.includes("/") ? `${quote}<redacted>${quote}` : match
+    )
+  );
+}
+
+// src/describe/service.ts
+var DEFAULT_API_URL = "https://infra.agemno.com";
+var API_URL_ENV = "EXPOSIFY_API_URL";
+var MAX_ROUTES_PER_REQUEST = 25;
+var REQUEST_TIMEOUT_MS = 18e4;
+var ServiceError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+  }
+  kind;
+};
+function validateApiUrl(url) {
+  try {
+    const u = new URL(url);
+    const local = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+    if (u.protocol === "https:" || u.protocol === "http:" && local) return url.replace(/\/+$/, "");
+  } catch {
+  }
+  return null;
+}
+function payloadFor(route, includeSource) {
+  return {
+    method: route.method,
+    path: route.path,
+    params: route.params,
+    ...route.middleware?.length ? { middleware: route.middleware } : {},
+    ...route.derived ? { derived: route.derived } : {},
+    ...includeSource && route.source ? { source: redact(route.source) } : {}
+  };
+}
+function serviceClient(cfg, includeSource, fetchImpl = fetch) {
+  return async (routes) => {
+    const merged = { model: "", tier: "anonymous", results: /* @__PURE__ */ new Map() };
+    for (let i = 0; i < routes.length; i += MAX_ROUTES_PER_REQUEST) {
+      const chunk = routes.slice(i, i + MAX_ROUTES_PER_REQUEST);
+      let res;
+      try {
+        res = await fetchImpl(`${cfg.apiUrl}/api/v1/describe`, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            ...cfg.licenseKey ? { authorization: `Bearer ${cfg.licenseKey}` } : {}
+          },
+          body: JSON.stringify({ routes: chunk.map((r) => payloadFor(r, includeSource)) }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        });
+      } catch (err) {
+        throw new ServiceError("unreachable", `couldn't reach the description service at ${cfg.apiUrl} (${err.message})`);
+      }
+      if (res.status === 401) throw new ServiceError("invalid_key", "that secret key isn't an active project key");
+      if (res.status === 429) throw new ServiceError("rate_limited", "too many requests to the description service; wait a bit and retry");
+      if (res.status === 503) throw new ServiceError("unavailable", "the description service is unavailable right now");
+      if (!res.ok) throw new ServiceError("bad_response", `the description service answered HTTP ${res.status}`);
+      let body;
+      try {
+        body = await res.json();
+      } catch {
+        throw new ServiceError("bad_response", "the description service sent something that isn't JSON");
+      }
+      if (!Array.isArray(body.results)) throw new ServiceError("bad_response", "the description service's reply has no results");
+      merged.model = body.model ?? merged.model;
+      merged.tier = body.tier === "project" ? "project" : "anonymous";
+      if (body.signupUrl) merged.signupUrl = body.signupUrl;
+      if (typeof body.storedForDays === "number") merged.storedForDays = body.storedForDays;
+      const wanted = new Set(chunk.map(routeKey));
+      for (const r of body.results) {
+        if (!wanted.has(r.route)) continue;
+        if (typeof r.text === "string" && r.text.trim()) merged.results.set(r.route, { text: r.text.trim() });
+        else {
+          const error = r.error === "quota" || r.error === "declined" ? r.error : "failed";
+          merged.results.set(r.route, { error, message: r.message ?? "no description" });
+        }
+      }
+      if ([...merged.results.values()].some((o) => "error" in o && o.error === "quota")) {
+        for (const r of routes.slice(i + MAX_ROUTES_PER_REQUEST)) {
+          merged.results.set(routeKey(r), { error: "quota", message: "allowance used up" });
+        }
+        break;
+      }
+    }
+    return merged;
+  };
+}
+function proposeClient(cfg, includeSource, fetchImpl = fetch) {
+  return async (actions) => {
+    const merged = { model: "", tier: "anonymous", results: /* @__PURE__ */ new Map() };
+    for (let i = 0; i < actions.length; i += MAX_ROUTES_PER_REQUEST) {
+      const chunk = actions.slice(i, i + MAX_ROUTES_PER_REQUEST).map((a) => ({
+        name: a.name,
+        file: a.file,
+        fields: a.fields,
+        unresolved: a.unresolved,
+        ...includeSource && a.source ? { source: redact(a.source) } : {},
+        ...includeSource && a.forms?.length ? { forms: a.forms.map(redact) } : {}
+      }));
+      let res;
+      try {
+        res = await fetchImpl(`${cfg.apiUrl}/api/v1/propose-input`, {
+          method: "POST",
+          headers: { "content-type": "application/json", ...cfg.licenseKey ? { authorization: `Bearer ${cfg.licenseKey}` } : {} },
+          body: JSON.stringify({ actions: chunk }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        });
+      } catch (err) {
+        throw new ServiceError("unreachable", `couldn't reach the description service at ${cfg.apiUrl} (${err.message})`);
+      }
+      if (res.status === 401) throw new ServiceError("invalid_key", "that license key isn't an active project key");
+      if (res.status === 429) throw new ServiceError("rate_limited", "too many requests to the description service; wait a bit and retry");
+      if (res.status === 503) throw new ServiceError("unavailable", "the description service is unavailable right now");
+      if (res.status === 404) throw new ServiceError("unavailable", "the description service doesn't propose inputs yet");
+      if (!res.ok) throw new ServiceError("bad_response", `the description service answered HTTP ${res.status}`);
+      let body;
+      try {
+        body = await res.json();
+      } catch {
+        throw new ServiceError("bad_response", "the description service sent something that isn't JSON");
+      }
+      if (!Array.isArray(body.results)) throw new ServiceError("bad_response", "the description service's reply has no results");
+      merged.model = body.model ?? merged.model;
+      merged.tier = body.tier === "project" ? "project" : "anonymous";
+      if (body.signupUrl) merged.signupUrl = body.signupUrl;
+      if (typeof body.storedForDays === "number") merged.storedForDays = body.storedForDays;
+      for (const r of body.results) {
+        if (Array.isArray(r.fields)) merged.results.set(r.action, { fields: r.fields, unknown: Array.isArray(r.unknown) ? r.unknown : [] });
+        else merged.results.set(r.action, { error: r.error === "quota" || r.error === "declined" ? r.error : "failed", message: r.message ?? "no proposal" });
+      }
+    }
+    return merged;
+  };
+}
+
+// src/describe/flow.ts
+async function propose(client, routes) {
+  const reply = await client(routes);
+  const byRoute = /* @__PURE__ */ new Map();
+  for (const r of routes) {
+    const o = reply.results.get(routeKey(r));
+    byRoute.set(routeKey(r), o ?? { error: "failed", message: "the service returned nothing for this route" });
+  }
+  return {
+    byRoute,
+    model: reply.model,
+    tier: reply.tier,
+    ...reply.signupUrl ? { signupUrl: reply.signupUrl } : {},
+    ...reply.storedForDays !== void 0 ? { storedForDays: reply.storedForDays } : {}
+  };
+}
+var quotaRoutes = (p, routes) => routes.filter((r) => {
+  const x = p.byRoute.get(routeKey(r));
+  return x && "error" in x && x.error === "quota";
+});
+async function upgradeWithLicenseKey(opts, proposals) {
+  const missed = quotaRoutes(proposals, opts.routes);
+  const got = opts.routes.length - missed.length;
+  console.log(
+    yellow(
+      got === 0 ? "\n  This service describes routes for projects only (or today's free allowance is used up)." : `
+  Described ${got} of ${opts.routes.length}: that's the free allowance without an account.`
+    )
+  );
+  console.log(`  Create a free project to describe the rest: ${bold(proposals.signupUrl ?? "the Exposify dashboard")}`);
+  for (; ; ) {
+    const key = await ask(`  Paste its secret key ${dim("(enter to stop here)")}: `);
+    if (!key) return proposals;
+    const service = { ...opts.service, licenseKey: key };
+    const client = opts.client ?? serviceClient(service, opts.includeSource);
+    let more;
+    try {
+      more = await propose(client, missed);
+    } catch (err) {
+      if (err instanceof ServiceError && err.kind === "invalid_key") {
+        console.log(red("  That key isn't an active project key. Check you copied all of it."));
+        continue;
+      }
+      console.log(red(`  ${err.message}`));
+      return proposals;
+    }
+    opts.service.licenseKey = key;
+    const save = (await ask(`  Save it to ${credentialsPath()} for next time? (Y/n) `)).toLowerCase();
+    if (save !== "n" && save !== "no") {
+      const path = saveLicenseKey(key);
+      console.log(dim(`  Saved to ${path} (only you can read it). EXPOSIFY_KEY or --license-key override it.`));
+    }
+    for (const [k, v] of more.byRoute) proposals.byRoute.set(k, v);
+    return { ...proposals, model: more.model || proposals.model, tier: "project" };
+  }
+}
+function header(route, i, n) {
+  const kind = isRead(route) ? dim("read") : yellow("write");
+  console.log(`
+  ${dim(`[${i}/${n}]`)} ${bold(`${route.method} ${route.path}`)}  ${kind}`);
+  if (route.derived) console.log(`  ${dim("now:     ")} ${route.derived}`);
+}
+function proposalConsent(actions, host, includeSource) {
+  if (!includeSource) {
+    return [
+      `  This sends only each action's name, file path and the fields the scan found (--no-source) to Exposify's description service (${host}), which proposes inputs with an LLM.`,
+      dim("  Without the code, it can rarely add anything: run without --no-source for useful proposals."),
+      dim("  The service may log each request, with your IP address, for debugging.")
+    ];
+  }
+  const lines = [`  This sends the following code to Exposify's description service (${host}), which proposes inputs with an LLM:`];
+  for (const a of actions) {
+    lines.push(`    ${a.export}: ${a.file} ${dim("(the action's function)")}`);
+    for (const f of a.proposal?.formFiles ?? []) lines.push(`    ${" ".repeat(a.export.length)}  ${f} ${dim("(the whole file, up to 6,000 characters: it has a form that submits to it)")}`);
+  }
+  lines.push(dim("  Strings that look like secrets are masked first. Pass --no-source to send names and fields only."));
+  lines.push(dim("  The service may log each request, with your IP address, for debugging."));
+  return lines;
+}
+async function describeInteractively(opts) {
+  const file = { version: 1, descriptions: { ...opts.file.descriptions } };
+  let changed = 0;
+  const n = opts.routes.length;
+  console.log(`
+${bold(opts.title)} \xB7 Tool descriptions ${dim("(what agents read to pick a tool)")}`);
+  if (n === 0) {
+    console.log(green("  \u2713 Every tool has a description."));
+    return { file, changed };
+  }
+  console.log(`  ${n} tool${n === 1 ? " has" : "s have"} only an auto-derived description, like "${opts.routes[0].derived ?? `${opts.routes[0].method} ${opts.routes[0].path}`}".`);
+  for (; ; ) {
+    const choice = (await ask(`  ${cyan("a")} generate with AI and review \xB7 ${cyan("w")} write them myself \xB7 ${cyan("s")} skip ${dim("(a)")} `)).toLowerCase();
+    if (choice === "s") {
+      console.log(dim(`  Skipped: agents get the auto-derived descriptions. Run \`${opts.bin ?? "exposify"} describe\` any time.`));
+      return { file, changed };
+    }
+    if (choice === "w") {
+      changed += await writeByHand(opts.routes, file);
+      return { file, changed };
+    }
+    if (choice !== "" && choice !== "a") continue;
+    const host = new URL(opts.service.apiUrl).host;
+    const what = opts.includeSource ? "each route's handler source (strings that look like secrets are masked first)" : "only each route's method, path, parameters and middleware names (--no-source)";
+    console.log(`  This sends ${what} to Exposify's description service (${host}), which writes them with an LLM.`);
+    console.log(dim("  The service may log each request, with your IP address, for debugging."));
+    const go = (await ask("  Send? (Y/n) ")).toLowerCase();
+    if (go === "n" || go === "no") continue;
+    const client = opts.client ?? serviceClient(opts.service, opts.includeSource);
+    let proposals;
+    process.stdout.write(dim(`  Generating ${n} description${n === 1 ? "" : "s"} \u2026`));
+    try {
+      proposals = await propose(client, opts.routes);
+      process.stdout.write("\n");
+    } catch (err) {
+      process.stdout.write("\n");
+      console.log(red(`  ${err.message}`));
+      if (err instanceof ServiceError && err.kind === "invalid_key") {
+        console.log(dim(`  (key from ${resolveLicenseKey(void 0)?.from ?? "--license-key"}; fix or remove it)`));
+      }
+      continue;
+    }
+    if (proposals.storedForDays !== void 0) {
+      const days = proposals.storedForDays;
+      console.log(dim(`  (The service keeps these requests${days === 0 ? "" : ` for ${days} day${days === 1 ? "" : "s"}`}.)`));
+    }
+    if (proposals.tier === "anonymous" && quotaRoutes(proposals, opts.routes).length > 0) {
+      proposals = await upgradeWithLicenseKey(opts, proposals);
+    }
+    changed += await review(opts, proposals, file);
+    return { file, changed };
+  }
+}
+async function review(opts, proposals, file) {
+  let changed = 0;
+  let acceptReads = false;
+  const n = opts.routes.length;
+  const regenerate = async (route) => {
+    try {
+      const client = opts.client ?? serviceClient(opts.service, opts.includeSource);
+      return (await propose(client, [route])).byRoute.get(routeKey(route));
+    } catch (err) {
+      return { error: "failed", message: err.message };
+    }
+  };
+  for (const [i, route] of opts.routes.entries()) {
+    const key = routeKey(route);
+    let proposal = proposals.byRoute.get(key);
+    if (acceptReads && isRead(route) && "text" in proposal) {
+      file.descriptions[key] = entryFor(route, proposal.text, "generated", proposals.model);
+      changed++;
+      console.log(`  ${dim(`[${i + 1}/${n}]`)} ${route.method} ${route.path}: ${green("accepted")}`);
+      continue;
+    }
+    header(route, i + 1, n);
+    for (; ; ) {
+      if ("error" in proposal) {
+        if (proposal.error === "quota") {
+          console.log(`  ${dim("no proposal: free allowance used up")}`);
+          const a3 = (await ask(`  ${cyan("w")} write it \xB7 ${cyan("s")} skip ${dim("(s)")} `)).toLowerCase();
+          if (a3 === "w") changed += await writeOne(route, file);
+          break;
+        }
+        console.log(`  ${red("couldn't generate:")} ${proposal.message}`);
+        const a2 = (await ask(`  ${cyan("r")} retry \xB7 ${cyan("w")} write it \xB7 ${cyan("s")} skip ${dim("(s)")} `)).toLowerCase();
+        if (a2 === "r") {
+          proposal = await regenerate(route);
+          continue;
+        }
+        if (a2 === "w") changed += await writeOne(route, file);
+        break;
+      }
+      console.log(`  ${dim("proposed:")} ${proposal.text}`);
+      const bulk = isRead(route) ? ` \xB7 ${cyan("A")} accept this and the remaining reads` : "";
+      const a = await ask(`  ${cyan("enter")} accept \xB7 ${cyan("e")} edit \xB7 ${cyan("r")} regenerate \xB7 ${cyan("s")} skip${bulk} `);
+      if (a === "" || a.toLowerCase() === "a" || a === "A" && isRead(route)) {
+        file.descriptions[key] = entryFor(route, proposal.text, "generated", proposals.model);
+        changed++;
+        if (a === "A") acceptReads = true;
+        break;
+      }
+      if (a.toLowerCase() === "e") {
+        const edited = (await ask("  edit: ", proposal.text)).trim();
+        if (edited) {
+          const unchanged = edited === proposal.text;
+          file.descriptions[key] = entryFor(route, edited, unchanged ? "generated" : "edited", unchanged ? proposals.model : void 0);
+          changed++;
+        }
+        break;
+      }
+      if (a.toLowerCase() === "r") {
+        proposal = await regenerate(route);
+        continue;
+      }
+      if (a.toLowerCase() === "s") break;
+    }
+  }
+  return changed;
+}
+async function writeOne(route, file) {
+  let text = await ask(`  ${dim("yours (enter skips, e opens $EDITOR):")} `);
+  if (text.toLowerCase() === "e") text = editInEditor(route.derived ?? "") ?? await ask("  (no $EDITOR set) yours: ");
+  if (!text.trim()) return 0;
+  file.descriptions[routeKey(route)] = entryFor(route, text, "edited");
+  return 1;
+}
+async function writeByHand(routes, file) {
+  let changed = 0;
+  for (const [i, route] of routes.entries()) {
+    header(route, i + 1, routes.length);
+    changed += await writeOne(route, file);
+  }
+  return changed;
+}
+async function describeUnattended(opts) {
+  const file = { version: 1, descriptions: { ...opts.file.descriptions } };
+  const reads = opts.routes.filter(isRead);
+  const skippedWrites = opts.routes.filter((r) => !isRead(r));
+  const failed = [];
+  let changed = 0;
+  let quotaExhausted = false;
+  if (reads.length > 0) {
+    const proposals = await propose(opts.client ?? serviceClient(opts.service, opts.includeSource), reads);
+    for (const route of reads) {
+      const p = proposals.byRoute.get(routeKey(route));
+      if ("text" in p) {
+        file.descriptions[routeKey(route)] = entryFor(route, p.text, "generated", proposals.model);
+        changed++;
+      } else {
+        if (p.error === "quota") quotaExhausted = true;
+        failed.push({ route, error: p.message });
+      }
+    }
+  }
+  return { file, changed, skippedWrites, failed, quotaExhausted };
+}
+
+// src/snapshot.ts
+var SNAPSHOT_FILE = "exposify.tools.json";
+function snapshotOf(routes) {
+  const tools = {};
+  for (const r of [...routes].filter((x) => x.exposed).sort((a, b) => routeKey(a).localeCompare(routeKey(b)))) {
+    tools[routeKey(r)] = r.tool;
+  }
+  return { version: 1, tools };
+}
+function renderSnapshot(snapshot) {
+  return `${JSON.stringify(snapshot, null, 2)}
+`;
+}
+function parseSnapshot(text) {
+  try {
+    const data = JSON.parse(text);
+    if (data.version !== 1 || typeof data.tools !== "object" || data.tools === null) return "not an exposify tools snapshot (version 1)";
+    return data;
+  } catch (err) {
+    return `invalid JSON: ${err.message}`;
+  }
+}
+function diffSnapshot(snapshot, routes) {
+  const now = snapshotOf(routes).tools;
+  const byKey = new Map(routes.map((r) => [routeKey(r), r]));
+  const diff = { added: [], removed: [], renamed: [] };
+  for (const [route, tool] of Object.entries(now)) {
+    const before = snapshot.tools[route];
+    if (before === void 0) diff.added.push({ route, tool, write: !isRead(byKey.get(route)) });
+    else if (before !== tool) diff.renamed.push({ route, from: before, to: tool });
+  }
+  for (const [route, tool] of Object.entries(snapshot.tools)) {
+    if (!(route in now)) diff.removed.push({ route, tool });
+  }
+  diff.added.sort((a, b) => Number(b.write) - Number(a.write) || a.route.localeCompare(b.route));
+  return diff;
+}
+function isEmptyDiff(d) {
+  return d.added.length + d.removed.length + d.renamed.length === 0;
+}
+
+// src/run.ts
+import { toolNames } from "@exposify/core";
+
+// src/env-file.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { parseEnv } from "util";
+function readEnvFile(path) {
+  let text;
+  try {
+    text = readFileSync4(path, "utf8");
+  } catch (err) {
+    return err.code === "ENOENT" ? "no such file" : err.message;
+  }
+  return parseEnv(text);
+}
+function envForScan(fileVars, env) {
+  const out = {};
+  for (const [key, value] of Object.entries(fileVars)) if (env[key] === void 0) out[key] = value;
+  return out;
+}
+
+// src/config.ts
+import { decideExposure, matchesPathGlob, parseMethodEntry, resolveOptions } from "@exposify/core";
+function buildConfig(routes, selected, opts) {
+  const configurable = routes.filter((r) => !isLocked(r));
+  const ticked = (r) => selected.has(routeKey(r));
+  const globs = (opts.current?.exclude ?? []).filter((e) => !parseMethodEntry(e));
+  const keptGlobs = [];
+  const droppedGlobs = [];
+  for (const glob of globs) {
+    if (configurable.some((r) => ticked(r) && matchesPathGlob(r.path, glob))) droppedGlobs.push(glob);
+    else keptGlobs.push(glob);
+  }
+  const coveredByGlob = (r) => keptGlobs.length > 0 && matchesPathGlob(r.path, keptGlobs);
+  const config = {};
+  if (opts.nuclear) {
+    config.expose = "*";
+  } else {
+    const writes = configurable.filter((r) => (r.optIn || !isRead(r)) && ticked(r)).map(routeKey);
+    if (writes.length > 0) config.expose = writes;
+  }
+  const exclude = [
+    ...keptGlobs,
+    ...configurable.filter((r) => !r.optIn && !ticked(r) && !coveredByGlob(r) && (opts.nuclear || isRead(r))).map(routeKey)
+  ];
+  if (exclude.length > 0) config.exclude = exclude;
+  if (!opts.startupLog) config.startupLog = false;
+  return { config, droppedGlobs };
+}
+function exposedUnder(routes, config) {
+  const cfg = resolveOptions({ expose: config.expose, exclude: config.exclude });
+  const out = /* @__PURE__ */ new Set();
+  for (const r of routes) {
+    const marker = r.marker === "described" ? { kind: "described" } : r.marker ? { kind: r.marker } : void 0;
+    if (decideExposure({ method: r.method, path: r.path, params: r.params, marker, ...r.optIn ? { optIn: true } : {} }, cfg).exposed) out.add(routeKey(r));
+  }
+  return out;
+}
+var NUCLEAR_COMMENT = '// expose: "*" exposes every write route, including ones added later.';
+function renderConfig(config, opts) {
+  const lines = [];
+  if (opts.importFrom) lines.push(`import { aiReady } from "${opts.importFrom}";`, "");
+  const body = [];
+  if (opts.otherKeys && opts.otherKeys.length > 0) {
+    body.push(`  // keep your existing options here: ${opts.otherKeys.join(", ")}`);
+  }
+  body.push(...renderProps(config));
+  if (body.length === 0) lines.push("app.use(aiReady());");
+  else lines.push("app.use(aiReady({", ...body, "}));");
+  return lines.join("\n");
+}
+function renderProps(config) {
+  const body = [];
+  if (config.expose === "*") body.push(`  ${NUCLEAR_COMMENT}`, '  expose: "*",');
+  else if (config.expose) body.push(...list("expose", config.expose));
+  if (config.exclude) body.push(...list("exclude", config.exclude));
+  if (config.startupLog === false) body.push("  startupLog: false,");
+  return body;
+}
+function list(key, values) {
+  const inline = `  ${key}: [${values.map((v) => JSON.stringify(v)).join(", ")}],`;
+  if (inline.length <= 80) return [inline];
+  return [`  ${key}: [`, ...values.map((v) => `    ${JSON.stringify(v)},`), "  ],"];
+}
+
+// src/apply.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname2 } from "path";
+import { parse } from "@babel/parser";
+function parseSource(source, file) {
+  const plugins = /\.tsx$/.test(file) ? ["typescript", "jsx"] : /\.[mc]?ts$/.test(file) ? ["typescript"] : ["jsx"];
+  try {
+    const ast = parse(source, { sourceType: "module", plugins, errorRecovery: true });
+    if (ast.errors?.length) return { blocked: "the file has syntax errors" };
+    return { program: ast.program };
+  } catch {
+    return { blocked: "couldn't parse the file" };
+  }
+}
+function walk(node, visit, parents = []) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk(child, visit, parents);
+    return;
+  }
+  const n = node;
+  if (typeof n.type !== "string") return;
+  visit(n, parents);
+  parents.push(n);
+  for (const key of Object.keys(n)) {
+    if (key === "loc" || key.endsWith("Comments")) continue;
+    const value = n[key];
+    if (value && typeof value === "object") walk(value, visit, parents);
+  }
+  parents.pop();
+}
+var unwrap = (n) => {
+  while (n && (n.type === "TSAsExpression" || n.type === "TSSatisfiesExpression" || n.type === "TSNonNullExpression" || n.type === "ParenthesizedExpression")) n = n.expression;
+  return n;
+};
+var keyName = (n) => n?.type === "Identifier" ? n.name : n?.type === "StringLiteral" ? n.value : void 0;
+var lineStart = (source, at) => source.lastIndexOf("\n", at - 1) + 1;
+var indentAt = (source, at) => /^[ \t]*/.exec(source.slice(lineStart(source, at)))[0];
+function applyEdits(source, edits) {
+  let out = source;
+  for (const e of [...edits].sort((a, b) => b.start - a.start)) out = out.slice(0, e.start) + e.text + out.slice(e.end);
+  return out;
+}
+function propertyRange(source, prop) {
+  let start = prop.start;
+  let end = prop.end;
+  while (source[end] === " " || source[end] === "	") end++;
+  if (source[end] === ",") end++;
+  const ownsLine = /^[ \t]*$/.test(source.slice(lineStart(source, start), start));
+  if (!ownsLine) return { start, end };
+  start = lineStart(source, start);
+  while (source[end] === " " || source[end] === "	") end++;
+  if (source[end] === "\r") end++;
+  if (source[end] === "\n") end++;
+  const prevLineStart = lineStart(source, start - 1);
+  if (start > 0 && source.slice(prevLineStart, start).trim() === NUCLEAR_COMMENT) start = prevLineStart;
+  return { start, end };
+}
+var withIndent = (lines, indent) => lines.map((l) => l.length > 0 ? indent + l : l).join("\n");
+function importEdit(source, program, spec) {
+  const body = program.body;
+  const has = body.some(
+    (s) => s.type === "ImportDeclaration" && s.source.value === spec.from && s.specifiers.some((x) => x.imported?.name === spec.name || x.local?.name === spec.name)
+  );
+  if (has) return null;
+  const imports = body.filter((s) => s.type === "ImportDeclaration");
+  if (imports.length > 0) {
+    const at = imports[imports.length - 1].end;
+    return { start: at, end: at, text: `
+import { ${spec.name} } from "${spec.from}";` };
+  }
+  const requires = body.filter((s) => s.type === "VariableDeclaration" && source.slice(s.start, s.end).includes("require("));
+  if (requires.length > 0) {
+    const at = requires[requires.length - 1].end;
+    return { start: at, end: at, text: `
+const { ${spec.name} } = require("${spec.from}");` };
+  }
+  return { blocked: `couldn't find where to import ${spec.name}` };
+}
+function replaceAiReadyOptions(input) {
+  const { source, file, config } = input;
+  const parsed = parseSource(source, file);
+  if ("blocked" in parsed) return parsed;
+  const calls = [];
+  walk(parsed.program, (n) => {
+    if (n.type === "CallExpression" && n.callee.type === "Identifier" && input.callNames.includes(n.callee.name)) calls.push(n);
+  });
+  const call = calls.find((c) => c.loc?.start.line === input.line) ?? (calls.length === 1 ? calls[0] : void 0);
+  if (!call) return { blocked: `couldn't find the ${input.callNames[0]}() call at line ${input.line}` };
+  const args = call.arguments;
+  if (args.length < input.optionsArg) return { blocked: `the ${input.callNames[0]}() call doesn't have the arguments setup expects` };
+  const options = unwrap(args[input.optionsArg]);
+  if (options && options.type !== "ObjectExpression") return { blocked: "the options passed to aiReady() are a variable, not an object written in place" };
+  const managed = /* @__PURE__ */ new Set(["expose", "exclude", "startupLog", ...input.actionEntries ? ["actions"] : []]);
+  const propIndent = indentAt(source, call.start) + "  ";
+  const edits = [];
+  const props = (options?.properties ?? []).filter((p) => p.type !== "ObjectProperty" || !managed.has(keyName(p.key) ?? ""));
+  const managedProps = (options?.properties ?? []).filter((p) => p.type === "ObjectProperty" && managed.has(keyName(p.key) ?? ""));
+  const odd = managedProps.find((p) => p.computed);
+  if (odd) return { blocked: "an option is written with a computed key" };
+  const newLines = renderProps(config);
+  let actionsProp;
+  if (input.actionEntries) {
+    const picked = new Set(config.actions ?? []);
+    actionsProp = managedProps.find((p) => keyName(p.key) === "actions");
+    const existing = unwrap(actionsProp?.value);
+    if (actionsProp && existing?.type !== "ObjectExpression") return { blocked: "`actions` isn't an object written in place" };
+    if (picked.size > 0 && !actionsProp) {
+      newLines.push("  actions: {", ...[...picked].flatMap((k) => (input.actionEntries[k] ?? `${k}: true,`).split("\n").map((l) => `    ${l}`)), "  },");
+    } else if (picked.size > 0) {
+      const entries = existing.properties.filter((e) => e.type === "ObjectProperty");
+      const have = /* @__PURE__ */ new Set();
+      for (const e of entries) {
+        const name = keyName(e.key);
+        if (name !== void 0 && picked.has(name)) have.add(name);
+        else {
+          const r = propertyRange(source, e);
+          edits.push({ start: r.start, end: r.end, text: "" });
+        }
+      }
+      const missing = [...picked].filter((k) => !have.has(k));
+      if (missing.length > 0) {
+        const outer = indentAt(source, actionsProp.start);
+        const inner = outer + "  ";
+        const text = withIndent(missing.flatMap((k) => (input.actionEntries[k] ?? `${k}: true,`).split("\n")), inner);
+        edits.push({ start: existing.start + 1, end: existing.start + 1, text: `
+${text}${/^\s*\n/.test(source.slice(existing.start + 1)) ? "" : `
+${outer}`}` });
+      }
+    }
+  }
+  if (actionsProp && (config.actions?.length ?? 0) > 0) managedProps.splice(managedProps.indexOf(actionsProp), 1);
+  for (const p of managedProps) {
+    const r = propertyRange(source, p);
+    edits.push({ start: r.start, end: r.end, text: "" });
+  }
+  const hadActions = actionsProp !== void 0 && (config.actions?.length ?? 0) > 0;
+  const remaining = props.length + (hadActions ? 1 : 0);
+  if (newLines.length > 0) {
+    const text = withIndent(newLines.map((l) => l.replace(/^ {2}/, "")), propIndent);
+    if (options) {
+      const closeIndent = indentAt(source, call.start);
+      if (remaining === 0) {
+        edits.length = 0;
+        edits.push({ start: options.start, end: options.end, text: `{
+${text}
+${closeIndent}}` });
+      } else {
+        const next = source.slice(options.start + 1);
+        edits.push({ start: options.start + 1, end: options.start + 1, text: `
+${text}${/^[ \t]*\r?\n/.test(next) ? "" : `
+${propIndent}`}` });
+      }
+    } else {
+      const last = args[args.length - 1];
+      const at = last ? last.end : call.end - 1;
+      edits.push({ start: at, end: at, text: `${last ? ", " : ""}{
+${text}
+${indentAt(source, call.start)}}` });
+    }
+  } else if (options && remaining === 0 && managedProps.length > 0) {
+    edits.length = 0;
+    const prev = args[input.optionsArg - 1];
+    edits.push({ start: prev ? prev.end : options.start, end: options.end, text: "" });
+  }
+  const imp = input.needsImport && !new RegExp(`from\\s+["']${input.needsImport.from}["']`).test(source) ? importEdit(source, parsed.program, input.needsImport) : null;
+  if (imp && "blocked" in imp) return imp;
+  if (imp) edits.push(imp);
+  return { after: applyEdits(source, edits) };
+}
+function insertAiReadyCall(input) {
+  const { source, file } = input;
+  const parsed = parseSource(source, file);
+  if ("blocked" in parsed) return parsed;
+  const statements = [];
+  walk(parsed.program, (n, parents) => {
+    const parent = parents[parents.length - 1];
+    if (parent && (parent.type === "Program" || parent.type === "BlockStatement") && (n.type.endsWith("Statement") || n.type.endsWith("Declaration"))) statements.push({ node: n, parent });
+  });
+  const startingAt = (line) => statements.find((s) => s.node.loc?.start.line === line)?.node;
+  let appVar;
+  walk(parsed.program, (n) => {
+    if (appVar || n.type !== "VariableDeclarator" || n.id?.type !== "Identifier" || n.init?.type !== "CallExpression") return;
+    if (input.createdLine ? n.loc?.start.line === input.createdLine : n.init.callee?.name === "express") appVar = n.id.name;
+  });
+  appVar ??= /\b(?:const|let|var)\s+app\b/.test(source) ? "app" : void 0;
+  if (!appVar) return { blocked: "couldn't tell what your Express app variable is called" };
+  const code = input.code.replace(/^app\./, `${appVar}.`);
+  const edits = [];
+  const before = input.beforeLine === void 0 ? void 0 : startingAt(input.beforeLine);
+  const after = input.afterLine === void 0 ? void 0 : startingAt(input.afterLine);
+  if (before) {
+    const indent = indentAt(source, before.start);
+    edits.push({ start: lineStart(source, before.start), end: lineStart(source, before.start), text: `${withIndent(code.split("\n"), indent)}
+` });
+  } else if (after) {
+    const indent = indentAt(source, after.start);
+    edits.push({ start: after.end, end: after.end, text: `
+${withIndent(code.split("\n"), indent)}` });
+  } else return { blocked: "couldn't find a statement to place it next to" };
+  const imp = importEdit(source, parsed.program, { from: input.importFrom, name: "aiReady" });
+  if (imp && "blocked" in imp) return imp;
+  if (imp) edits.push(imp);
+  return { after: applyEdits(source, edits) };
+}
+function writePlan(plan) {
+  try {
+    if (plan.before === null) {
+      if (existsSync(plan.file)) return { ok: false, error: `${plan.file} already exists` };
+      mkdirSync2(dirname2(plan.file), { recursive: true });
+    } else if (readFileSync5(plan.file, "utf8") !== plan.before) {
+      return { ok: false, error: "the file changed since it was scanned" };
+    }
+    writeFileSync4(plan.file, plan.after);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+
+// src/clipboard.ts
+import { spawnSync as spawnSync2 } from "child_process";
+function commands(platform, env) {
+  if (platform === "darwin") return [["pbcopy", []]];
+  if (platform === "win32") return [["clip.exe", []], ["clip", []]];
+  const out = [];
+  if (env.WAYLAND_DISPLAY) out.push(["wl-copy", []]);
+  if (env.DISPLAY) out.push(["xclip", ["-selection", "clipboard"]], ["xsel", ["--clipboard", "--input"]]);
+  out.push(["clip.exe", []]);
+  return out;
+}
+function copyToClipboard(text, deps = {}) {
+  const env = deps.env ?? process.env;
+  const run = deps.run ?? ((cmd, args, input) => {
+    const r = spawnSync2(cmd, args, { input, stdio: ["pipe", "ignore", "ignore"], timeout: 3e3 });
+    return r.status === 0 && !r.error;
+  });
+  if (!env.SSH_TTY && !env.SSH_CONNECTION) {
+    for (const [cmd, args] of commands(deps.platform ?? process.platform, env)) {
+      if (run(cmd, args, text)) return { method: cmd, certain: true };
+    }
+  }
+  if (deps.isTty ?? process.stdout.isTTY) {
+    const write = deps.writeTty ?? ((s) => process.stdout.write(s));
+    write(`\x1B]52;c;${Buffer.from(text).toString("base64")}\x07`);
+    return { method: "osc52", certain: false };
+  }
+  return null;
+}
+
+// src/sign-in.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { join as join3 } from "path";
+import { parseEnv as parseEnv2 } from "util";
+var KEY_ENV = "EXPOSIFY_KEY";
+var KNOWN = [
+  { test: (p) => p.startsWith("@auth0/") || p === "auth0" || p === "express-openid-connect", label: "Auth0", path: "oauth" },
+  { test: (p) => p.startsWith("@clerk/"), label: "Clerk", path: "oauth" },
+  { test: (p) => p.startsWith("@workos-inc/"), label: "WorkOS", path: "oauth" },
+  { test: (p) => p.startsWith("@kinde-oss/"), label: "Kinde", path: "oauth" },
+  { test: (p) => p === "@supabase/supabase-js" || p === "@supabase/ssr", label: "Supabase Auth", path: "broker" },
+  { test: (p) => p === "firebase" || p === "firebase-admin", label: "Firebase Auth", path: "broker" },
+  { test: (p) => p === "next-auth" || p === "@auth/core", label: "Auth.js (NextAuth)", path: "broker" },
+  { test: (p) => p === "better-auth", label: "Better Auth", path: "broker" },
+  { test: (p) => p === "lucia", label: "Lucia", path: "broker" },
+  { test: (p) => p === "passport", label: "Passport", path: "broker" },
+  { test: (p) => p === "iron-session", label: "iron-session", path: "broker" },
+  { test: (p) => p === "express-session" || p === "cookie-session", label: "server sessions", path: "broker" },
+  { test: (p) => p === "jsonwebtoken" || p === "jose" || p === "@nestjs/jwt", label: "your own JWTs", path: "broker" }
+];
+function detectAuthStacks(root) {
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync6(join3(root, "package.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  const names = Object.keys({ ...pkg.devDependencies, ...pkg.dependencies });
+  const found = [];
+  for (const known of KNOWN) {
+    const hit = names.find(known.test);
+    if (hit && !found.some((f) => f.label === known.label)) found.push({ label: known.label, pkg: hit, path: known.path });
+  }
+  return found;
+}
+function appNameOf(root) {
+  try {
+    const name = JSON.parse(readFileSync6(join3(root, "package.json"), "utf8")).name;
+    if (typeof name === "string" && name.trim()) return name.trim();
+  } catch {
+  }
+  return "My app";
+}
+function existingKey(root, env) {
+  if (env[KEY_ENV]?.trim()) return { from: "your shell" };
+  try {
+    const vars = parseEnv2(readFileSync6(join3(root, ".env"), "utf8"));
+    if (vars[KEY_ENV]?.trim()) return { from: ".env" };
+  } catch {
+  }
+  return null;
+}
+function writeKeyToEnv(root, key) {
+  const path = join3(root, ".env");
+  const line = `${KEY_ENV}=${key}`;
+  let created = false;
+  if (existsSync2(path)) {
+    const text = readFileSync6(path, "utf8");
+    const re = new RegExp(`^\\s*(export\\s+)?${KEY_ENV}\\s*=.*$`, "m");
+    const next = re.test(text) ? text.replace(re, line) : `${text}${text === "" || text.endsWith("\n") ? "" : "\n"}${line}
+`;
+    writeFileSync5(path, next);
+  } else {
+    writeFileSync5(path, `${line}
+`, { mode: 384 });
+    created = true;
+  }
+  let ignored = false;
+  try {
+    ignored = readFileSync6(join3(root, ".gitignore"), "utf8").split("\n").map((l) => l.trim()).some((l) => [".env", "/.env", ".env*", "/.env*", "*.env"].includes(l));
+  } catch {
+  }
+  return { path, created, ignored };
+}
+async function signInToExposify(deps) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let started;
+  try {
+    const res = await fetchImpl(`${deps.apiUrl}/api/v1/cli/logins`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ appName: deps.appName }),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      return { ok: false, reason: "unreachable", message: body.error ?? `Exposify answered HTTP ${res.status}` };
+    }
+    started = await res.json();
+  } catch (err) {
+    return { ok: false, reason: "unreachable", message: `couldn't reach ${deps.apiUrl} (${err.message})` };
+  }
+  const opened = (deps.openUrl ?? openInBrowser)(started.verifyUrl);
+  deps.show({ userCode: started.userCode, verifyUrl: started.verifyUrl, opened });
+  const deadline = Date.now() + started.expiresIn * 1e3;
+  let failures = 0;
+  while (Date.now() < deadline) {
+    await sleep(Math.max(1, started.interval) * 1e3);
+    let res;
+    try {
+      res = await fetchImpl(`${deps.apiUrl}/api/v1/cli/logins/poll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceCode: started.deviceCode }),
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch (err) {
+      if (++failures >= 5) return { ok: false, reason: "unreachable", message: `lost contact with ${deps.apiUrl} (${err.message})` };
+      continue;
+    }
+    failures = 0;
+    if (res.status === 202) continue;
+    const body = await res.json().catch(() => ({}));
+    if (res.ok && body.status === "approved" && body.key && body.projectId) {
+      return { ok: true, key: body.key, projectId: body.projectId, projectName: body.projectName ?? "" };
+    }
+    if (body.status === "denied") return { ok: false, reason: "denied", message: "cancelled in the browser" };
+    return { ok: false, reason: "expired", message: "the sign-in link expired" };
+  }
+  return { ok: false, reason: "expired", message: "the sign-in link expired" };
+}
+function openInBrowser(url) {
+  if (process.env.EXPOSIFY_NO_BROWSER === "1") return false;
+  const [cmd, ...args] = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", "", url] : ["xdg-open", url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/run.ts
+var usage = (bin, entryHelp) => `Usage: ${bin} <command> [options]
+
+Commands:
+  setup     Pick which endpoints agents can call, then get the aiReady() config to paste
+  inspect   Show what agents see: every route, whether it's a tool, and why
+  describe  Give tools real descriptions (AI-proposed and reviewed, or your own) in
+            ${DESCRIPTIONS_FILE}, which aiReady() loads
+
+Options:
+  --entry <path>        ${entryHelp} (default: detected)
+  --env-vars <path>     Load these variables into the scan (setup asks about .env otherwise)
+  --no-env-vars         Don't load any .env file (your shell's variables still apply)
+
+setup:
+  --quick               Skip the questions (reads, or your current config; log unchanged),
+                        still copy the config and verify the paste
+  --ci                  No prompts, no clipboard, no colors; fails instead of asking.
+                        On automatically when the CI environment variable is set.
+  --expose "POST /x"    Also expose this write route (repeatable); skips the checklist
+  --expose-all          Expose every write route (expose: "*"), including future ones
+  --action <name>       Also expose this Server Action (repeatable); skips the question
+  --startup-log on|off  Show or hide the "[agentready] MCP ready" line
+  --copy / --no-copy    Copy the config to the clipboard (default: copy unless --ci)
+  --apply / --no-apply  Make the change in your code instead of leaving it to paste (asked in a
+                        terminal otherwise; --quick and --ci only apply with --apply). Check it with git diff.
+  --no-verify           Skip the re-scan after you paste
+  --snapshot            Also save ${SNAPSHOT_FILE} (asked at the end otherwise; default no)
+  --no-sign-in          Skip "How your users sign in" (in a terminal, setup otherwise asks, and
+                        can fetch EXPOSIFY_KEY with a browser sign-in and write it to .env)
+
+setup and describe (descriptions come from Exposify's service, not a provider key of yours):
+  --no-source           Send only method, path and middleware names, not handler source
+  --license-key <key>   A project secret key (else ${LICENSE_KEY_ENV}, else a saved one);
+                        without one you get a small free allowance
+  --api-url <url>       The description service (else ${API_URL_ENV}, else ${DEFAULT_API_URL})
+
+describe:
+  --check               Exit 1 if a tool has no description or one is out of date (for CI)
+  --regenerate          Also redo AI descriptions that are still current (never your own)
+  --ci                  AI descriptions for read routes only, no prompts; writes need a person
+
+inspect:
+  --json                Print the full scan as JSON
+  --snapshot            Write ${SNAPSHOT_FILE}: the routes agents can call. Commit it.
+  --check               Exit 1 if the app's tools no longer match ${SNAPSHOT_FILE}, or a
+                        Server Action's written input no longer matches its code (for CI)
+  --file <path>         Snapshot path (default: ${SNAPSHOT_FILE} in the project root)
+`;
+function parseArgs(argv) {
+  const args = {
+    json: false,
+    quick: false,
+    ci: isCiEnv(process.env),
+    snapshot: false,
+    check: false,
+    expose: [],
+    exposeAll: false,
+    actions: [],
+    verify: true,
+    signIn: true,
+    help: false,
+    noEnvFile: false,
+    noSource: false,
+    regenerate: false
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const value = () => {
+      const v = argv[++i];
+      if (v === void 0) throw new UsageError(`${a} needs a value`);
+      return v;
+    };
+    if (a === "--entry") args.entry = value();
+    else if (a === "--json") args.json = true;
+    else if (a === "--quick") args.quick = true;
+    else if (a === "--ci") args.ci = true;
+    else if (a === "--snapshot") args.snapshot = true;
+    else if (a === "--check") args.check = true;
+    else if (a === "--license-key") args.licenseKey = value();
+    else if (a === "--api-url") args.apiUrl = value();
+    else if (a === "--no-source") args.noSource = true;
+    else if (a === "--regenerate") args.regenerate = true;
+    else if (a === "--file") args.file = value();
+    else if (a === "--env-vars") args.envFile = value();
+    else if (a === "--no-env-vars") args.noEnvFile = true;
+    else if (a === "--expose") args.expose.push(value());
+    else if (a === "--expose-all") args.exposeAll = true;
+    else if (a === "--action") args.actions.push(value());
+    else if (a === "--startup-log") {
+      const v = value();
+      if (v !== "on" && v !== "off") throw new UsageError("--startup-log takes on or off");
+      args.startupLog = v === "on";
+    } else if (a === "--copy") args.copy = true;
+    else if (a === "--no-copy") args.copy = false;
+    else if (a === "--apply") args.apply = true;
+    else if (a === "--no-apply") args.apply = false;
+    else if (a === "--no-verify") args.verify = false;
+    else if (a === "--no-sign-in") args.signIn = false;
+    else if (a === "--help" || a === "-h") args.help = true;
+    else if (!a.startsWith("-") && !args.command) args.command = a;
+    else throw new UsageError(`unknown option: ${a}`);
+  }
+  return args;
+}
+var UsageError = class extends Error {
+};
+function isCiEnv(env) {
+  const v = env.CI?.trim().toLowerCase();
+  return v !== void 0 && v !== "" && v !== "false" && v !== "0";
+}
+var interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+function readLineAt(site) {
+  try {
+    return readFileSync7(site.file, "utf8").split("\n")[site.line - 1];
+  } catch {
+    return void 0;
+  }
+}
+function sortRoutes(routes) {
+  const methodOrder = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"];
+  return [...routes].sort(
+    (a, b) => groupOf(a.path).localeCompare(groupOf(b.path)) || a.path.localeCompare(b.path) || methodOrder.indexOf(a.method) - methodOrder.indexOf(b.method)
+  );
+}
+async function envFor(args, root, cwd, offer) {
+  if (args.noEnvFile) return {};
+  const explicit = args.envFile !== void 0;
+  const path = explicit ? join4(cwd, args.envFile) : join4(root, ".env");
+  if (!explicit && (!offer || args.ci || !existsSync3(path))) return {};
+  const vars = readEnvFile(path);
+  const shown = relative(cwd, path) || path;
+  if (typeof vars === "string") {
+    if (!explicit) return {};
+    console.error(red(`Couldn't read ${shown}: ${vars}`));
+    return null;
+  }
+  const count = Object.keys(vars).length;
+  const label = `${shown} (${count} variable${count === 1 ? "" : "s"})`;
+  if (!explicit && !args.quick && interactive()) {
+    console.log(`Found ${label}. Load it into the scan?`);
+    console.log(dim("  Your app gets these as it would from `npm run dev`; nothing leaves this machine."));
+    const answer = (await ask("  (Y/n) ")).toLowerCase();
+    if (answer === "n" || answer === "no") return {};
+  }
+  if (!args.json) console.log(dim(`Loaded ${label}.`));
+  return envForScan(vars, process.env);
+}
+var adapter;
+async function scan(args, cwd, offerEnv = false) {
+  const location = adapter.locate(cwd, args.entry);
+  if (!location) {
+    console.error(red("Couldn't find your app's entry file."));
+    console.error(`  Pass it explicitly: ${adapter.bin} setup --entry ${adapter.entryExample}`);
+    return null;
+  }
+  const root = location.root;
+  const env = await envFor(args, root, cwd, offerEnv);
+  if (!env) return null;
+  if (!args.json) console.log(dim(`Scanning ${relative(cwd, location.entry) || location.entry} \u2026`));
+  const outcome = await adapter.scan(location, env);
+  if (!outcome.ok) {
+    console.error(red(`Scan failed: ${outcome.error}`));
+    if (outcome.fix) console.error(`  fix: ${outcome.fix}`);
+    const tail = (outcome.output ?? "").trim().split("\n").slice(-12).join("\n");
+    if (tail) console.error(dim(`
+  Your app's output${outcome.loader ? ` (run with ${outcome.loader})` : ""}:
+${tail.replace(/^/gm, "    ")}`));
+    return null;
+  }
+  const result = outcome.result;
+  const registered = result.routes;
+  result.routes = sortRoutes(result.routes);
+  if (!args.json) {
+    const pages = result.routes.filter((r) => r.kind === "page").length;
+    const n = result.routes.length - pages;
+    const m = result.actions?.length ?? 0;
+    const extra = [pages > 0 ? `${bold(String(pages))} page${pages === 1 ? "" : "s"}` : "", m > 0 ? `${bold(String(m))} Server Action${m === 1 ? "" : "s"}` : ""].filter(Boolean);
+    const list2 = [`${bold(String(n))} endpoint${n === 1 ? "" : "s"}`, ...extra];
+    console.log(`Found ${list2.length > 1 ? `${list2.slice(0, -1).join(", ")} and ${list2.at(-1)}` : list2[0]}.`);
+    if (result.crashed) console.log(yellow(`  Your app threw while starting (${result.crashed}); showing the routes it registered before that.`));
+    for (const note of result.notes ?? []) console.log(yellow(`  ${note}`));
+  }
+  return { result, root, registered, env, location };
+}
+function inspect(result, cwd) {
+  const opts = result.aiReady?.options;
+  const where = result.aiReady?.site ? `at ${relative(cwd, result.aiReady.site.file)}:${result.aiReady.site.line}` : "";
+  console.log(result.aiReady ? `aiReady() ${where}` : yellow("aiReady() isn't mounted yet: showing the defaults (reads exposed, writes hidden)."));
+  if (opts?.expose === "*") console.log(red('  expose: "*" -- every write route is exposed, including ones added later'));
+  if (opts) console.log(dim(`  startup log: ${opts.startupLog === false ? "off" : "on"}`));
+  console.log("");
+  if (result.routes.length === 0 && result.actions?.length) {
+    console.log(dim("  No route handlers."));
+    inspectActions(result, cwd);
+    inspectLogin(result);
+    return;
+  }
+  const toolWidth = Math.max(4, ...result.routes.map((r) => r.tool.length));
+  const routeWidth = Math.max(5, ...result.routes.map((r) => r.method.length + 1 + r.path.length));
+  console.log(dim(`  ${"TOOL".padEnd(toolWidth)}  ${"ROUTE".padEnd(routeWidth)}  ${"TOOL?".padEnd(5)}  WHY`));
+  for (const r of result.routes) {
+    const mark = r.exposed ? green("yes  ") : dim("no   ");
+    const route = `${r.method} ${r.path}`.padEnd(routeWidth);
+    const tool = r.tool.padEnd(toolWidth);
+    console.log(`  ${r.exposed ? tool : dim(tool)}  ${route}  ${mark}  ${dim(r.reason)}`);
+  }
+  const tools = result.routes.filter((r) => r.exposed);
+  const writes = tools.filter((r) => !isRead(r)).length;
+  const pageTools = tools.filter((r) => r.kind === "page").length;
+  const routeTools = tools.length - pageTools;
+  const counts = [`${routeTools} route tool${routeTools === 1 ? "" : "s"} (${routeTools - writes} read, ${writes} write)`, ...pageTools > 0 ? [`${pageTools} page tool${pageTools === 1 ? "" : "s"}`] : []];
+  console.log(`
+  ${counts.join(", ")}, plus search_docs when docs are found.`);
+  if (result.actions && result.actions.length > 0) inspectActions(result, cwd);
+  inspectLogin(result);
+}
+function inspectLogin(result) {
+  if (!result.login) return;
+  console.log(`
+  Sign-in for AI assistants: your app's own login, ${result.login.what} (${result.login.fields.join(", ")}).`);
+  console.log(dim(`  With ${KEY_ENV} set, they sign in on a form your app serves at /mcp/login; passwords stay on your app.`));
+  if (result.login.others?.length) console.log(dim(`  Also looked like a login: ${result.login.others.join(", ")}. Pick another with aiReady({ login }).`));
+}
+var STATUS_TEXT = { complete: "input known", partial: "input partly unknown", flagged: "flagged" };
+function inspectActions(result, _cwd) {
+  const actions = result.actions;
+  console.log(`
+${bold("Server Actions")}`);
+  const toolWidth = Math.max(4, ...actions.map((a) => a.tool.length));
+  const whereWidth = Math.max(6, ...actions.map((a) => `${a.export} ${a.file}:${a.line}`.length));
+  console.log(dim(`  ${"TOOL".padEnd(toolWidth)}  ${"ACTION".padEnd(whereWidth)}  ${"TOOL?".padEnd(5)}  WHY`));
+  for (const a of actions) {
+    const tool = a.tool.padEnd(toolWidth);
+    const where = `${a.export} ${dim(`${a.file}:${a.line}`)}${" ".repeat(Math.max(0, whereWidth - `${a.export} ${a.file}:${a.line}`.length))}`;
+    const status = a.status === "complete" ? dim(STATUS_TEXT[a.status]) : yellow(STATUS_TEXT[a.status]);
+    console.log(`  ${a.exposed ? tool : dim(tool)}  ${where}  ${a.exposed ? green("yes  ") : dim("no   ")}  ${dim(a.reason)} \xB7 ${status}`);
+    for (const note of a.notes) console.log(dim(`      ${note}`));
+    for (const d of a.drift) console.log(yellow(`      ! ${d}`));
+  }
+  const exposed = actions.filter((a) => a.exposed).length;
+  console.log(`
+  ${exposed} action tool${exposed === 1 ? "" : "s"} (writes).`);
+  if (exposed > 0 && result.actionsNote) console.log(yellow(`  ${result.actionsNote}`));
+}
+function toolRows(routes, actions = []) {
+  return [
+    ...routes,
+    ...actions.map((a) => {
+      const [method, path] = a.route.split(" ");
+      return {
+        method,
+        path,
+        params: [],
+        tool: a.tool,
+        exposed: a.exposed,
+        reason: a.reason,
+        derived: `Runs the ${a.export} server action (${a.file}).`,
+        ...a.source ? { source: a.source } : {},
+        ...a.describedText ? { describedText: a.describedText } : {}
+      };
+    })
+  ];
+}
+function checkDrift(result) {
+  const drifted = (result.actions ?? []).filter((a) => a.drift.length > 0);
+  if (drifted.length === 0) return 0;
+  console.log(red(`\u2717 ${drifted.length} Server Action${drifted.length === 1 ? "'s" : "s'"} written input no longer match${drifted.length === 1 ? "es" : ""} the code:`));
+  for (const a of drifted) for (const d of a.drift) console.log(`  ~ ${a.export} (${a.file}): ${d}`);
+  console.log(dim(`  Update the input in aiReady({ actions }) (or describe()); \`${adapter.bin} setup\` prints what the scan finds.`));
+  return 1;
+}
+function actionsFromFlags(result, args) {
+  const actions = result.actions ?? [];
+  const current = new Set(result.aiReady?.options.actions ?? []);
+  const selected = new Set(actions.filter((a) => !a.marker && current.has(a.configKey)).map((a) => a.configKey));
+  for (const name of args.actions) {
+    const a = actions.find((x) => x.configKey === name || x.export === name || x.tool === name);
+    if (!a) return `--action ${name} doesn't match any Server Action (they're listed by \`${adapter.bin} inspect\`)`;
+    if (a.marker) return `--action ${name}: its exposure is set in code with ${a.marker}()`;
+    selected.add(a.configKey);
+  }
+  return selected;
+}
+function selectionFromFlags(result, args) {
+  const state = initialState(result.routes, { hasConfig: Boolean(result.aiReady), nuclear: false });
+  const selected = new Set(state.selected);
+  for (const entry of args.expose) {
+    const [method, ...rest] = entry.trim().split(/\s+/);
+    const key = `${method?.toUpperCase()} ${rest.join(" ")}`;
+    const route = result.routes.find((r) => routeKey(r) === key);
+    if (!route) return `--expose "${entry}" doesn't match any route (routes are listed by \`${adapter.bin} inspect\`)`;
+    if (isLocked(route)) return `--expose "${entry}": that route's exposure is set in code with ${route.marker}()`;
+    selected.add(key);
+  }
+  if (args.exposeAll) {
+    for (const r of result.routes) if (!isLocked(r)) selected.add(routeKey(r));
+  }
+  return { selected, nuclear: args.exposeAll };
+}
+function differences(routes, want, got) {
+  const out = [];
+  for (const r of routes) {
+    const key = routeKey(r);
+    if (want.has(key) && !got.has(key)) out.push(`${key} is still hidden`);
+    if (!want.has(key) && got.has(key)) out.push(`${key} is still exposed`);
+  }
+  return out;
+}
+async function setup(args, cwd) {
+  const scanned = await scan(args, cwd, true);
+  if (!scanned) return 1;
+  const { result, root, registered, env, location } = scanned;
+  if (result.routes.length === 0 && !result.actions?.length) {
+    console.error(red("No routes found on your app."));
+    console.error(`  If routes are added after an await or in a sub-app, see the README's "Mounted routers" section.`);
+    return 1;
+  }
+  const tty = interactive() && !args.ci;
+  const selectionFromCli = args.ci || args.quick || args.exposeAll || args.expose.length > 0 || args.actions.length > 0;
+  const current = result.aiReady?.options;
+  const currentNuclear = current?.expose === "*";
+  if (!interactive() && !selectionFromCli) {
+    console.error("Not a terminal: pass --ci to accept the defaults (reads only), or --expose / --expose-all.");
+    return 1;
+  }
+  let selected;
+  let nuclear;
+  let checklistActions;
+  if (tty && !selectionFromCli) {
+    const final = await runChecklist(
+      initialState(result.routes, { hasConfig: Boolean(result.aiReady), nuclear: currentNuclear, actions: result.actions ?? [], listedActions: current?.actions ?? [] })
+    );
+    if (!final) {
+      console.log("Cancelled.");
+      return 130;
+    }
+    ({ selected, nuclear } = final);
+    checklistActions = final.selectedActions;
+  } else if (result.routes.length === 0) {
+    selected = /* @__PURE__ */ new Set();
+    nuclear = false;
+  } else {
+    const picked2 = selectionFromFlags(result, args);
+    if (typeof picked2 === "string") {
+      console.error(red(picked2));
+      return 1;
+    }
+    ({ selected, nuclear } = picked2);
+  }
+  const picked = result.routes.filter((r) => selected.has(routeKey(r)));
+  const pickedWrites = picked.filter((r) => !isRead(r)).length;
+  if (result.routes.length > 0) {
+    console.log(
+      `
+${bold("Step 1/5")} \xB7 ${picked.length} tool${picked.length === 1 ? "" : "s"} (${picked.length - pickedWrites} read, ${pickedWrites} write)` + (nuclear ? red(' -- expose: "*": all write routes, including future ones') : "")
+    );
+  } else console.log(`
+${bold("Step 1/5")} \xB7 Server Actions`);
+  if (selectionFromCli && currentNuclear && !nuclear) {
+    console.log(yellow('  Your config has expose: "*". This writes it out as an explicit list, so write routes added later'));
+    console.log(yellow(`  won't be exposed automatically. Pass --expose-all to keep "*".`));
+  }
+  if (nuclear && selectionFromCli) {
+    console.log(red(`  expose: "*" exposes these ${nuclearWrites(result.routes).length} write routes, and any added later:`));
+    for (const r of nuclearWrites(result.routes)) console.log(`    ${r.method.padEnd(6)} ${r.path}`);
+  }
+  const pickedActions = checklistActions ?? actionsFromFlags(result, args);
+  if (typeof pickedActions === "string") {
+    console.error(red(pickedActions));
+    return 1;
+  }
+  const actionRows = result.actions ?? [];
+  const chosenActions = actionRows.filter((a) => pickedActions.has(a.configKey));
+  if (actionRows.length > 0) {
+    const inCode = actionRows.filter((a) => a.marker && a.exposed).length;
+    console.log(`  ${chosenActions.length} Server Action${chosenActions.length === 1 ? "" : "s"} picked${inCode > 0 ? `, ${inCode} exposed in code` : ""}.`);
+    for (const a of chosenActions.filter((x) => x.status !== "complete")) console.log(yellow(`  ! ${a.export}: ${a.notes.filter((n) => !n.startsWith("form: ")).join("; ")}`));
+    if (chosenActions.length + inCode > 0 && result.actionsNote) console.log(yellow(`  ${result.actionsNote}`));
+  }
+  let startupLog = args.startupLog ?? current?.startupLog ?? true;
+  if (tty && !args.quick && args.startupLog === void 0) {
+    console.log(`
+${bold("Step 2/5")} \xB7 Print "[agentready] MCP ready \u2026" when your server starts?`);
+    console.log(dim("  It shows the tool count and auth mode. Failures always print."));
+    const answer = (await ask(`  ${startupLog ? "(Y/n)" : "(y/N)"} `)).toLowerCase();
+    if (answer === "y" || answer === "yes") startupLog = true;
+    else if (answer === "n" || answer === "no") startupLog = false;
+  }
+  const { config, droppedGlobs } = buildConfig(result.routes, selected, { nuclear, startupLog, current });
+  if (pickedActions.size > 0) config.actions = actionRows.filter((a) => pickedActions.has(a.configKey)).map((a) => a.configKey);
+  const sameActions = (listed = []) => listed.length === pickedActions.size && listed.every((k) => pickedActions.has(k));
+  const effective = exposedUnder(result.routes, config);
+  const mismatch = differences(result.routes, selected, effective);
+  if (mismatch.length > 0) {
+    console.error(red(`Internal error: the generated config wouldn't match your selection (${mismatch.join("; ")}). Please report this.`));
+    return 1;
+  }
+  const alreadyExposed = new Set(result.routes.filter((r) => r.exposed).map(routeKey));
+  const unchanged = result.aiReady && differences(result.routes, selected, alreadyExposed).length === 0 && (current?.startupLog ?? true) === startupLog && currentNuclear === nuclear && sameActions(current?.actions);
+  if (unchanged) {
+    console.log(`
+${green("\u2713 Already set up")}: your aiReady() config already matches. Nothing to change.`);
+    if (tty && !args.quick) {
+      await signInStep(args, root, cwd, "Step 4/5", result.login);
+      const code2 = await describeStep(args, toolRows(result.routes, result.actions), root, cwd, "Step 5/5");
+      if (code2 !== 0) return code2;
+    }
+    await offerSnapshot(args, tty, toolRows(result.routes, result.actions), root, cwd);
+    return 0;
+  }
+  const { code, hint, apply } = adapter.configStep({ result, config, current, root, readLine: readLineAt });
+  const shouldCopy = args.copy ?? tty;
+  const copied = shouldCopy ? copyToClipboard(code) : null;
+  const copyNote = copied?.certain ? green(" (copied to clipboard \u2713)") : copied ? dim(" (sent to your terminal's clipboard, if it supports that)") : "";
+  console.log(`
+${bold("Step 3/5")} \xB7 Your aiReady() config${copyNote}
+`);
+  console.log(code.replace(/^/gm, "  "));
+  let applied = false;
+  if (args.apply !== false && (args.apply || tty && !args.quick)) {
+    if (!apply) {
+      if (args.apply) console.log(yellow("\n  Can't apply automatically here: paste it as described below."));
+    } else if ("blocked" in apply) {
+      console.log(yellow(`
+  Can't apply automatically: ${apply.blocked}. Paste it as described below.`));
+    } else {
+      const { summary } = apply.plan;
+      const yes = args.apply === true || ["y", "yes"].includes((await ask(`
+  Apply this: ${summary}? ${dim("(y/N)")} `)).toLowerCase());
+      if (yes) {
+        const written = writePlan(apply.plan);
+        if (written.ok) {
+          applied = true;
+          console.log(green(`  \u2713 Applied: ${summary}.`) + dim(apply.plan.before === null ? "" : " Review it with git diff."));
+        } else console.log(yellow(`  Couldn't apply: ${written.error}. Paste it as described below.`));
+      }
+    }
+  }
+  if (!applied) console.log(`
+  ${hint.lines[0]}`);
+  for (const line of hint.lines.slice(1)) console.log(`    ${line}`);
+  if (hint.warning) console.log(yellow(`  ! ${hint.warning}`));
+  if (droppedGlobs.length > 0) {
+    console.log(yellow(`  ! Dropped exclude ${droppedGlobs.map((g) => `"${g}"`).join(", ")}: it would hide endpoints you ticked.`));
+  }
+  printSuggestions(result);
+  let verified = null;
+  let verifiedActions = [];
+  if (tty && args.verify) {
+    let firstRound = applied;
+    for (; ; ) {
+      const answer = firstRound ? "" : (await ask(`
+  Press Enter once pasted to verify ${dim("(s to skip)")} `)).toLowerCase();
+      firstRound = false;
+      if (answer === "s") break;
+      const again = await adapter.scan(location, env);
+      if (!again.ok) {
+        console.log(red(`  Couldn't re-scan: ${again.error}`));
+        continue;
+      }
+      const after = again.result;
+      const now = new Set(after.routes.filter((r) => r.exposed).map(routeKey));
+      const diffs = differences(result.routes, selected, now);
+      if (!after.aiReady) diffs.unshift("aiReady() isn't mounted yet");
+      if ((after.aiReady?.options.startupLog ?? true) !== startupLog) diffs.push(`startup log is ${startupLog ? "off" : "on"}`);
+      for (const a of after.actions ?? []) {
+        if (a.marker) continue;
+        const want = pickedActions.has(a.configKey);
+        if (want && !a.exposed) diffs.push(`Server Action ${a.export} is still hidden (${a.reason})`);
+        if (!want && a.exposed) diffs.push(`Server Action ${a.export} is still exposed`);
+      }
+      if (diffs.length === 0) {
+        const writes = after.routes.filter((r) => r.exposed && !isRead(r)).length;
+        const pageTools = after.routes.filter((r) => r.exposed && r.kind === "page").length;
+        const tools = after.routes.filter((r) => r.exposed).length - pageTools;
+        const pages = pageTools > 0 ? ` and ${pageTools} page tool${pageTools === 1 ? "" : "s"}` : "";
+        console.log(green(`  \u2713 Verified: ${tools} route tools (${tools - writes} read, ${writes} write)${pages}, matching your selection.`));
+        verified = toolRows(after.routes, after.actions);
+        verifiedActions = after.actions ?? [];
+        break;
+      }
+      console.log(yellow("  Not yet:"));
+      for (const d of diffs.slice(0, 8)) console.log(`    - ${d}`);
+      if (diffs.length > 8) console.log(dim(`    \u2026 and ${diffs.length - 8} more`));
+      console.log(dim("  Check the paste location above, save the file, and press Enter to re-check."));
+    }
+  }
+  const finalRoutes = verified ?? toolRows(routesAsSelected(registered, selected), actionRows.map((a) => ({ ...a, exposed: a.marker ? a.exposed : pickedActions.has(a.configKey) })));
+  if (tty && !args.quick) {
+    await signInStep(args, root, cwd, "Step 4/5", result.login);
+    const code2 = await describeStep(args, finalRoutes, root, cwd, "Step 5/5");
+    if (code2 !== 0) return code2;
+    const proposed = await proposeStep(args, verifiedActions, root, cwd);
+    if (proposed !== 0) return proposed;
+  } else {
+    console.log(dim(`
+Descriptions: run \`${adapter.bin} describe\` to replace the auto-derived ones.`));
+  }
+  await offerSnapshot(args, tty, finalRoutes, root, cwd);
+  console.log(`
+${dim("Next:")} run ${cyan(`${adapter.bin} inspect`)} any time to see what agents get.`);
+  return 0;
+}
+function printSuggestions(result) {
+  if (!result.suggestions?.length) return;
+  console.log(`
+${bold("Suggested changes")} ${dim("(not applied: read them, then make them yourself if they fit)")}`);
+  for (const s of result.suggestions) {
+    console.log(`
+  ${s.title}
+`);
+    for (const line of s.diff.split("\n")) {
+      const painted = line.startsWith("+++") || line.startsWith("---") ? bold(line) : line.startsWith("+") ? green(line) : line.startsWith("-") ? red(line) : dim(line);
+      console.log(`    ${painted}`);
+    }
+  }
+}
+function routesAsSelected(registered, selected) {
+  const names = toolNames(registered, (r) => selected.has(routeKey(r)));
+  return registered.map((r) => ({ ...r, exposed: selected.has(routeKey(r)), tool: names.get(routeKey(r)) }));
+}
+async function offerSnapshot(args, tty, routes, root, cwd) {
+  const file = args.file ? join4(cwd, args.file) : join4(root, SNAPSHOT_FILE);
+  let save = args.snapshot;
+  if (!save && tty && !args.quick) {
+    const shown = relative(cwd, file) || file;
+    console.log(`
+${bold("Optional")} \xB7 Save the tools agents get to ${shown}?`);
+    console.log(dim(`  Commit it and run \`${adapter.bin} inspect --check\` in CI to catch tool changes.`));
+    const answer = (await ask(`  ${existsSync3(file) ? "Overwrite it? " : ""}(y/N) `)).toLowerCase();
+    save = answer === "y" || answer === "yes";
+  }
+  if (save) writeSnapshot(routes, file, cwd);
+}
+async function signInStep(args, root, cwd, title, login) {
+  if (!args.signIn) return;
+  const stacks = detectAuthStacks(root);
+  const oauth = stacks.find((s) => s.path === "oauth");
+  console.log(`
+${bold(title)} \xB7 How your users sign in`);
+  if (stacks.length > 0) console.log(dim(`  Found ${stacks.map((s) => `${s.label} (${s.pkg})`).join(", ")} in package.json.`));
+  if (oauth) {
+    console.log(`  ${oauth.label} can sign agents in itself: MCP clients log in to it directly, so no Exposify broker is needed.`);
+    console.log(`  Add ${cyan("oauth: { issuer, resource }")} to aiReady(): issuer is your ${oauth.label} domain, resource your /mcp URL.`);
+    console.log(dim("  The README's OAuth section lists the settings to turn on in the provider's dashboard."));
+    return;
+  }
+  const own = login ? `your app's own login, ${login.what} (${login.fields.join(", ")})` : null;
+  if (own) console.log(`  Found ${own}. AI assistants sign in with it on a form your app serves at /mcp/login, so there's nothing to set up for it.`);
+  const have = existingKey(root, process.env);
+  if (have) {
+    console.log(green(`  \u2713 ${KEY_ENV} is set (${have.from}):`) + " agents sign in through Exposify's broker.");
+    return;
+  }
+  const via = stacks[0] ? `With ${stacks[0].label}` : "With your own login";
+  console.log(`  ${via}, agents sign in through Exposify's hosted broker, which keeps each person's login fresh.`);
+  console.log(dim(`  Your app needs one setting, ${KEY_ENV}. Free for up to 25 connected agents.`));
+  const answer = (await ask("  Sign in to Exposify in your browser to get it? (Y/n) ")).toLowerCase();
+  if (answer === "n" || answer === "no") {
+    console.log(dim(`  Later: create a project in the Exposify dashboard and put its secret key in ${KEY_ENV}.`));
+    return;
+  }
+  const service = serviceConfig(args);
+  if (typeof service === "string") {
+    console.error(red(`  ${service}`));
+    return;
+  }
+  const outcome = await signInToExposify({
+    apiUrl: service.apiUrl,
+    appName: appNameOf(root),
+    show: ({ userCode, verifyUrl, opened }) => {
+      console.log(`  ${opened ? "Opened" : "Open"} ${cyan(verifyUrl)}${opened ? "" : " in your browser"}`);
+      console.log(`  and check it shows ${bold(userCode)}. Waiting\u2026 ${dim("(Ctrl-C to stop)")}`);
+    }
+  });
+  if (!outcome.ok) {
+    console.log(yellow(`  Didn't get a key: ${outcome.message}.`) + dim(` Run setup again, or set ${KEY_ENV} by hand.`));
+    return;
+  }
+  const written = writeKeyToEnv(root, outcome.key);
+  process.env[KEY_ENV] = outcome.key;
+  console.log(green(`  \u2713 ${written.created ? "Created" : "Updated"} ${relative(cwd, written.path) || written.path} with ${KEY_ENV}`) + ` (project "${outcome.projectName}").`);
+  if (!written.ignored) console.log(yellow(`  ! Add .env to .gitignore: it now holds a secret.`));
+  if (own) console.log(`  Your app tells Exposify about its login when it starts with ${KEY_ENV}: nothing to add in the dashboard.`);
+  else console.log(`  Next, in the dashboard: add how your users log in (presets for GitHub, Google, Supabase, \u2026).`);
+  console.log(dim(`  Deploying? Set ${KEY_ENV} there too. Restart your server to pick it up.`));
+}
+function serviceConfig(args) {
+  const raw = args.apiUrl ?? process.env[API_URL_ENV] ?? DEFAULT_API_URL;
+  const apiUrl = validateApiUrl(raw);
+  if (!apiUrl) return `${raw} isn't a usable service URL (https, or http on localhost)`;
+  const key = resolveLicenseKey(args.licenseKey);
+  return { apiUrl, ...key ? { licenseKey: key.key } : {} };
+}
+async function describeStep(args, routes, root, cwd, title) {
+  const path = join4(root, DESCRIPTIONS_FILE);
+  const file = readDescriptionsFile(path);
+  if (typeof file === "string") {
+    console.error(red(`${relative(cwd, path)}: ${file}. Fix or delete it, then run \`${adapter.bin} describe\`.`));
+    return 1;
+  }
+  const service = serviceConfig(args);
+  if (typeof service === "string") {
+    console.error(red(service));
+    return 1;
+  }
+  reportStaleEdits(routes, file);
+  const result = await describeInteractively({
+    bin: adapter.bin,
+    // Same order as the checklist.
+    routes: needingDescriptions(sortRoutes(routes), file, { regenerate: args.regenerate }),
+    file,
+    service,
+    includeSource: !args.noSource,
+    title
+  });
+  if (result.changed > 0) {
+    writeDescriptionsFile(path, result.file);
+    console.log(green(`  \u2713 Wrote ${relative(cwd, path) || path} (${result.changed} description${result.changed === 1 ? "" : "s"}).`) + dim(" aiReady() loads it on startup: restart your server."));
+  }
+  return 0;
+}
+async function proposeStep(args, actions, root, cwd) {
+  const targets = actions.filter((a) => a.proposal && a.proposal.status !== "current");
+  if (targets.length === 0) return 0;
+  console.log(`
+${bold("Server Action inputs")} \xB7 ${targets.length} opted-in action${targets.length === 1 ? " is" : "s are"} hidden because the scan can't tell all of ${targets.length === 1 ? "its" : "their"} input:`);
+  for (const a of targets) console.log(`  ${a.export} ${dim(`${a.file}:${a.line}`)}${a.proposal.status === "stale" ? yellow("  (changed since its input was accepted)") : ""}`);
+  const service = serviceConfig(args);
+  if (typeof service === "string") {
+    console.error(red(service));
+    return 1;
+  }
+  console.log(`  The description service can propose ${targets.length === 1 ? "it" : "them"} from the code, for you to review.`);
+  for (const line of proposalConsent(targets, new URL(service.apiUrl).host, !args.noSource)) console.log(line);
+  const answer = (await ask("  Send? (y/N) ")).toLowerCase();
+  if (answer !== "y" && answer !== "yes") {
+    console.log(dim(`  Nothing sent. Write ${targets.length === 1 ? "its" : "their"} \`input\` by hand in aiReady({ actions }), or run \`${adapter.bin} describe\` later.`));
+    return 0;
+  }
+  let reply;
+  try {
+    reply = await proposeClient(service, !args.noSource)(targets.map((a) => a.proposal.request));
+  } catch (err) {
+    console.error(red(`  Couldn't get proposals: ${err.message}`));
+    return 1;
+  }
+  const path = join4(root, DESCRIPTIONS_FILE);
+  const file = readDescriptionsFile(path);
+  if (typeof file === "string") {
+    console.error(red(`${relative(cwd, path)}: ${file}`));
+    return 1;
+  }
+  let accepted = 0;
+  for (const a of targets) {
+    const outcome = reply.results.get(`${a.file}#${a.export}`);
+    console.log(`
+  ${bold(a.export)} ${dim(`${a.file}:${a.line}`)}`);
+    if (!outcome || "error" in outcome) {
+      console.log(yellow(`    no proposal: ${outcome?.message ?? "the service didn't answer for it"}`));
+      if (outcome && "error" in outcome && outcome.error === "quota" && reply.signupUrl) console.log(dim(`    More with a project license key: ${reply.signupUrl}`));
+      continue;
+    }
+    for (const f of outcome.fields) {
+      const type = f.enum?.length ? f.enum.map((v) => JSON.stringify(v)).join(" | ") : f.type;
+      console.log(`    ${f.name}: ${type}${f.required ? "" : dim(" (optional)")}${f.description ? dim(`  ${f.description}`) : ""}`);
+    }
+    for (const u of outcome.unknown) console.log(yellow(`    ? ${u}`));
+    const choice = (await ask(`    ${outcome.unknown.length ? "Some of it is still unknown. " : ""}(a)ccept \xB7 (s)kip `)).toLowerCase();
+    if (choice !== "a" && choice !== "accept") continue;
+    const [method, routePath] = a.route.split(" ");
+    file.inputs = {
+      ...file.inputs,
+      [a.route]: {
+        fields: outcome.fields,
+        ...outcome.unknown.length ? { unknown: outcome.unknown } : {},
+        source: "generated",
+        signature: signatureFor({ method, path: routePath, params: [], ...a.source ? { source: a.source } : {} }),
+        model: reply.model,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    accepted++;
+  }
+  if (accepted > 0) {
+    writeDescriptionsFile(path, file);
+    console.log(green(`
+  \u2713 Wrote ${accepted} input${accepted === 1 ? "" : "s"} to ${relative(cwd, path) || path}.`) + dim(" The MCP route uses them once exposify.generated.ts is regenerated (next dev / next build)."));
+  }
+  if (typeof reply.storedForDays === "number") console.log(dim(`  The service keeps what it was sent for ${reply.storedForDays} days.`));
+  return 0;
+}
+function reportStaleEdits(routes, file) {
+  const stale = routes.filter((r) => r.exposed && statusOf(r, file).kind === "stale" && file.descriptions[routeKey(r)]?.source === "edited");
+  if (stale.length === 0) return;
+  console.log(yellow(`  These routes changed since you described them; check the text still holds:`));
+  for (const r of stale) console.log(yellow(`    ${routeKey(r)}`));
+}
+async function describeCommand(args, cwd) {
+  const scanned = await scan(args, cwd, !args.check);
+  if (!scanned) return 1;
+  const { result, root } = scanned;
+  const path = join4(root, DESCRIPTIONS_FILE);
+  const shown = relative(cwd, path) || path;
+  const file = readDescriptionsFile(path);
+  if (typeof file === "string") {
+    console.error(red(`${shown}: ${file}`));
+    return 1;
+  }
+  const exposed = toolRows(result.routes, result.actions).filter((r) => r.exposed);
+  if (args.check) {
+    const problems = [];
+    for (const r of exposed) {
+      const s = statusOf(r, file);
+      if (s.kind === "missing") problems.push(`  - ${routeKey(r)} has no description (only the auto-derived one)`);
+      if (s.kind === "stale") problems.push(`  ~ ${routeKey(r)} changed since it was described (${s.entry.source === "edited" ? "written by a person" : "AI"})`);
+    }
+    for (const a of result.actions ?? []) {
+      if (a.proposal?.status === "stale") problems.push(`  ~ ${a.route} (${a.export}) changed since its input was accepted: it's hidden until it's reviewed again`);
+    }
+    if (problems.length === 0) {
+      console.log(green(`\u2713 All ${exposed.length} tools have current descriptions.`));
+      return 0;
+    }
+    console.log(red(`\u2717 ${problems.length} tool${problems.length === 1 ? " needs" : "s need"} a description:`));
+    for (const p of problems) console.log(p);
+    console.log(dim(`  Run \`${adapter.bin} describe\` and commit the result.`));
+    return 1;
+  }
+  const routes = needingDescriptions(exposed, file, { regenerate: args.regenerate });
+  if (args.ci) {
+    const service = serviceConfig(args);
+    if (typeof service === "string") {
+      console.error(red(service));
+      return 1;
+    }
+    let out;
+    try {
+      out = await describeUnattended({ routes, file, service, includeSource: !args.noSource });
+    } catch (err) {
+      console.error(red(`Can't generate descriptions: ${err.message}`));
+      if (err instanceof ServiceError && err.kind === "invalid_key") console.error(`  Check ${LICENSE_KEY_ENV}.`);
+      return 1;
+    }
+    if (out.changed > 0) writeDescriptionsFile(path, out.file);
+    console.log(`Described ${out.changed} read route${out.changed === 1 ? "" : "s"} in ${shown}.`);
+    for (const f of out.failed) console.log(yellow(`  ! ${routeKey(f.route)}: ${f.error}`));
+    if (out.quotaExhausted) console.log(`  The free allowance ran out: set ${LICENSE_KEY_ENV} to a project secret key for CI.`);
+    if (out.skippedWrites.length > 0) {
+      console.log(`  ${out.skippedWrites.length} write route${out.skippedWrites.length === 1 ? "" : "s"} left for a person (AI text for writes is always reviewed):`);
+      for (const r of out.skippedWrites) console.log(`    ${routeKey(r)}`);
+      console.log(dim(`  Run \`${adapter.bin} describe\` in a terminal to review them.`));
+    }
+    return out.failed.length > 0 ? 1 : 0;
+  }
+  if (!interactive()) {
+    console.error("Not a terminal: pass --ci (reads only) or --check.");
+    return 1;
+  }
+  const code = await describeStep(args, exposed, root, cwd, "Describe");
+  if (code !== 0) return code;
+  return proposeStep(args, result.actions ?? [], root, cwd);
+}
+function writeSnapshot(routes, file, cwd) {
+  const snapshot = snapshotOf(routes);
+  writeFileSync6(file, renderSnapshot(snapshot));
+  const n = Object.keys(snapshot.tools).length;
+  console.log(`Wrote ${relative(cwd, file) || file}: ${n} tool${n === 1 ? "" : "s"}. Commit it, and run \`${adapter.bin} inspect --check\` in CI.`);
+  return 0;
+}
+function checkSnapshot(result, file, cwd) {
+  const shown = relative(cwd, file) || file;
+  let text;
+  try {
+    text = readFileSync7(file, "utf8");
+  } catch {
+    console.error(red(`No snapshot at ${shown}.`) + ` Create it with \`${adapter.bin} inspect --snapshot\` and commit it.`);
+    return 1;
+  }
+  const snapshot = parseSnapshot(text);
+  if (typeof snapshot === "string") {
+    console.error(red(`${shown}: ${snapshot}`));
+    return 1;
+  }
+  const diff = diffSnapshot(snapshot, toolRows(result.routes, result.actions));
+  if (isEmptyDiff(diff)) {
+    const n = Object.keys(snapshot.tools).length;
+    console.log(green(`\u2713 ${n} tool${n === 1 ? "" : "s"} match ${shown}.`));
+    return 0;
+  }
+  console.log(red(`\u2717 Your app's tools don't match ${shown}:`));
+  for (const a of diff.added) console.log(`  ${a.write ? red("+") : "+"} ${a.route} is now a tool (${a.tool})${a.write ? red("  <- write") : ""}`);
+  for (const r of diff.removed) console.log(`  - ${r.route} is no longer a tool (was ${r.tool})`);
+  for (const r of diff.renamed) console.log(`  ~ ${r.route}: tool renamed ${r.from} -> ${r.to}`);
+  console.log(dim(`  If this change is intended, run \`${adapter.bin} inspect --snapshot\` and commit the result.`));
+  return 1;
+}
+async function runCli(argv, forAdapter, cwd = process.cwd()) {
+  adapter = forAdapter;
+  let args;
+  try {
+    args = parseArgs(argv);
+  } catch (err) {
+    console.error(red(err.message));
+    console.error(usage(adapter.bin, adapter.entryHelp));
+    return 2;
+  }
+  if (args.help || !args.command) {
+    console.log(usage(adapter.bin, adapter.entryHelp));
+    return args.help ? 0 : 2;
+  }
+  if (args.ci) disableColor();
+  if (args.command === "inspect") {
+    if (args.snapshot && args.check) {
+      console.error(red("--snapshot writes the file and --check compares against it: pass one."));
+      return 2;
+    }
+    const scanned = await scan(args, cwd);
+    if (!scanned) return 1;
+    const file = args.file ? join4(cwd, args.file) : join4(scanned.root, SNAPSHOT_FILE);
+    if (args.snapshot) return writeSnapshot(toolRows(scanned.result.routes, scanned.result.actions), file, cwd);
+    if (args.check) return Math.max(checkSnapshot(scanned.result, file, cwd), checkDrift(scanned.result));
+    if (args.json) console.log(JSON.stringify(scanned.result, null, 2));
+    else inspect(scanned.result, scanned.root);
+    return 0;
+  }
+  if (args.command === "setup") return setup(args, cwd);
+  if (args.command === "describe") return describeCommand(args, cwd);
+  console.error(red(`unknown command: ${args.command}`));
+  console.error(usage(adapter.bin, adapter.entryHelp));
+  return 2;
+}
+export {
+  buildConfig,
+  exposedUnder,
+  insertAiReadyCall,
+  isCiEnv,
+  isLocked,
+  isRead,
+  renderConfig,
+  renderProps,
+  replaceAiReadyOptions,
+  routeKey,
+  runCli,
+  signatureFor
+};