@exposify/next 0.0.0-stage → 0.0.2

package/dist/index.js

@@ -0,0 +1,1186 @@
+import {
+  HTTP_METHODS
+} from "./chunk-D5TQF5DY.js";
+
+// src/index.ts
+import {
+  applyDescriptions,
+  applyOpenApi,
+  buildMcpServer,
+  buildRequest,
+  countTools,
+  createBrokerGate,
+  createOAuthGate,
+  publicRequestUrl,
+  createWebMcpHandler,
+  cookieChanges,
+  describeAuth,
+  errorMessageOf,
+  fieldKind,
+  handleLoginPage,
+  hostedResolverInfo,
+  loginResultFromResponse,
+  reportAppLogin,
+  samePath,
+  setCookieLines,
+  SIGNED_OUT_HEADER,
+  matchesPathGlob,
+  formatFailed,
+  formatReady,
+  formatWarning,
+  getMarker,
+  KnowledgeBase,
+  parseMethodEntry,
+  resolveOptions,
+  routeToolsPhrase,
+  startupLogEnabled
+} from "@exposify/core";
+import { z } from "zod";
+
+// src/actions.ts
+var AUTH_LIKE = /^(log_?in|log_?out|sign_?in|sign_?out|sign_?up|register|authenticate)(_|$)/;
+var looksLikeAuth = (action) => Boolean(action.setsCookies) || AUTH_LIKE.test(action.key);
+function inputProblem(action) {
+  if (action.unresolved && action.unresolved.length > 0) return `its input couldn't all be worked out from its code (${action.unresolved.join("; ")})`;
+  if (action.readsAll && !action.forms?.length) return "it reads the whole form (Object.fromEntries or a loop over it) and no form that submits to it was found, so nothing says which fields exist";
+  const files = action.fields.filter((f) => f.type === "file").map((f) => f.name);
+  if (files.length > 0) return `it takes a file (${files.join(", ")}), which agents can't send yet`;
+  return void 0;
+}
+var ACTION_SECRET_HEADER = "x-exposify-action";
+var SECRET_KEY = /* @__PURE__ */ Symbol.for("exposify.next.actionSecret");
+var RENDERED_UI = "[rendered UI omitted]";
+function env() {
+  return globalThis.process?.env ?? {};
+}
+var hex = (bytes) => [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+async function actionSecret() {
+  const e = env();
+  if (e.EXPOSIFY_ACTION_SECRET) return e.EXPOSIFY_ACTION_SECRET;
+  if (e.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY) {
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(e.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode("exposify-action")));
+  }
+  if (e.NODE_ENV === "production") return null;
+  const g = globalThis;
+  g[SECRET_KEY] ??= hex(crypto.getRandomValues(new Uint8Array(32)).buffer);
+  return g[SECRET_KEY];
+}
+async function secretMatches(given, secret) {
+  if (!given) return false;
+  const [a, b] = await Promise.all([given, secret].map((s) => crypto.subtle.digest("SHA-256", new TextEncoder().encode(s))));
+  const x = new Uint8Array(a);
+  const y = new Uint8Array(b);
+  let diff = 0;
+  for (let i = 0; i < x.length; i++) diff |= x[i] ^ y[i];
+  return diff === 0;
+}
+function toFormData(fields, json = /* @__PURE__ */ new Set()) {
+  const form = new FormData();
+  const add = (name, value) => {
+    if (value === void 0 || value === null || value === false) return;
+    if (value === true) form.append(name, "on");
+    else if (typeof value === "object") form.append(name, JSON.stringify(value));
+    else form.append(name, String(value));
+  };
+  for (const [name, value] of Object.entries(fields)) {
+    if (json.has(name) && value !== null && value !== void 0) form.append(name, typeof value === "string" ? value : JSON.stringify(value));
+    else if (Array.isArray(value)) for (const v of value) add(name, v);
+    else add(name, value);
+  }
+  return form;
+}
+function actionArguments(params, args, json) {
+  const fields = { ...args };
+  for (const p of params) if (p.role === "input") delete fields[p.name];
+  return params.map((p) => {
+    if (p.role === "prev") return void 0;
+    if (p.role === "input") return args[p.name];
+    if (p.role === "formData") return toFormData(fields, json);
+    return fields;
+  });
+}
+function serializeResult(value) {
+  if (value === void 0) return JSON.stringify({ ok: true });
+  return JSON.stringify(value, (_key, v) => {
+    if (typeof v === "bigint") return v.toString();
+    if (v instanceof Map) return Object.fromEntries(v);
+    if (v instanceof Set) return [...v];
+    if (v && typeof v === "object" && typeof v.$$typeof === "symbol") return RENDERED_UI;
+    return v;
+  });
+}
+function nextControlFlow(err) {
+  const digest = err?.digest;
+  if (typeof digest !== "string") return null;
+  const parts = digest.split(";");
+  if (parts[0] === "NEXT_REDIRECT" && parts.length >= 4) return { redirect: parts.slice(2, -2).join(";") };
+  if (parts[0] === "NEXT_HTTP_ERROR_FALLBACK") {
+    const status = Number(parts[1]);
+    if (Number.isInteger(status)) return { status };
+  }
+  return null;
+}
+var ERRORS = { 401: "unauthorized", 403: "forbidden", 404: "not found" };
+var jsonFieldsOf = (action) => new Set([...action.fields ?? [], ...action.proposed ?? []].filter((f) => f.type === "json").map((f) => f.name));
+async function runAction(fn, action, args) {
+  const json = (body, status = 200) => new Response(body, { status, headers: { "content-type": "application/json" } });
+  try {
+    return json(serializeResult(await fn(...actionArguments(action.params, args, jsonFieldsOf(action)))));
+  } catch (err) {
+    const flow = nextControlFlow(err);
+    if (flow && "redirect" in flow) return json(JSON.stringify({ ok: true, redirectedTo: flow.redirect }));
+    if (flow) return json(JSON.stringify({ error: ERRORS[flow.status] ?? `HTTP ${flow.status}` }), flow.status);
+    console.error(`[agentready] server action ${action.export} threw:`, err);
+    return json(JSON.stringify({ error: "the action threw an error" }), 500);
+  }
+}
+function hostPath(pattern) {
+  const path = pattern.split("/").filter((seg) => !/^:[A-Za-z0-9_]+\*\?$/.test(seg)).map((seg) => seg.startsWith(":") ? "_" : seg).join("/");
+  return path.startsWith("/") ? path : `/${path}`;
+}
+var replyString = (s) => s.startsWith("$") ? `$${s}` : s;
+function encodeReply(args) {
+  const body = new FormData();
+  let nextPart = 1;
+  const model = (value, depth) => {
+    if (value === void 0) return "$undefined";
+    if (value === null || typeof value === "boolean") return value;
+    if (typeof value === "string") return replyString(value);
+    if (typeof value === "bigint") return `$n${value.toString()}`;
+    if (typeof value === "number") {
+      if (Number.isNaN(value)) return "$NaN";
+      if (value === Infinity) return "$Infinity";
+      if (value === -Infinity) return "$-Infinity";
+      return Object.is(value, -0) ? "$-0" : value;
+    }
+    if (value instanceof Date) return `$D${value.toISOString()}`;
+    if (value instanceof FormData) {
+      const id = nextPart++;
+      for (const [name, v] of value.entries()) {
+        body.append(`_${id}_${name}`, v);
+        body.append(`${id}_${name}`, v);
+      }
+      return `$K${id.toString(16)}`;
+    }
+    if (depth > 32) return null;
+    if (Array.isArray(value)) return value.map((v) => model(v, depth + 1));
+    if (typeof value === "object") return Object.fromEntries(Object.entries(value).filter(([, v]) => typeof v !== "function").map(([k, v]) => [k, model(v, depth + 1)]));
+    return null;
+  };
+  body.set("0", JSON.stringify(model(args, 0)));
+  return body;
+}
+var LENGTH_PREFIXED = /* @__PURE__ */ new Set(["T", "A", "O", "o", "U", "S", "s", "L", "l", "G", "g", "M", "m", "V", "b"]);
+function flightRows(bytes) {
+  const rows = /* @__PURE__ */ new Map();
+  const decoder = new TextDecoder();
+  let i = 0;
+  while (i < bytes.length) {
+    const colon = bytes.indexOf(58, i);
+    if (colon < 0) break;
+    const id = decoder.decode(bytes.subarray(i, colon));
+    let j = colon + 1;
+    const first = String.fromCharCode(bytes[j] ?? 0);
+    let tag = "";
+    let text;
+    const comma = bytes.indexOf(44, j + 1);
+    const lengthHex = comma > j + 1 ? decoder.decode(bytes.subarray(j + 1, comma)) : "";
+    if (LENGTH_PREFIXED.has(first) && /^[0-9a-f]+$/.test(lengthHex)) {
+      tag = first;
+      const start = comma + 1;
+      const end = start + parseInt(lengthHex, 16);
+      text = decoder.decode(bytes.subarray(start, end));
+      i = end;
+    } else {
+      const newline = bytes.indexOf(10, j);
+      const end = newline < 0 ? bytes.length : newline;
+      if (/[A-Z]/.test(first)) {
+        tag = first;
+        j++;
+      }
+      text = decoder.decode(bytes.subarray(j, end));
+      i = end + 1;
+    }
+    if (/^\s*$/.test(id)) continue;
+    if (["D", "W", "N", "H", "J", "P", "C", "R", "r", "X", "x"].includes(tag)) continue;
+    rows.set(id.trim(), { tag, text });
+  }
+  return rows;
+}
+var FlightError = class extends Error {
+  constructor(digest, message) {
+    super(message);
+    this.digest = digest;
+  }
+  digest;
+};
+function decodeFlight(bytes, root = "0") {
+  return flightReviver(flightRows(bytes)).row(root);
+}
+function flightReviver(rows) {
+  const resolving = /* @__PURE__ */ new Set();
+  const row = (id, depth) => {
+    const r = rows.get(id);
+    if (!r || resolving.has(id) || depth > 64) return null;
+    if (r.tag === "T") return r.text;
+    if (r.tag === "E") {
+      let info = {};
+      try {
+        info = JSON.parse(r.text);
+      } catch {
+      }
+      throw new FlightError(info.digest, info.message ?? "the action threw an error");
+    }
+    if (r.tag === "I") return "[module reference]";
+    if (r.tag !== "") return null;
+    resolving.add(id);
+    try {
+      return revive(JSON.parse(r.text), depth + 1);
+    } finally {
+      resolving.delete(id);
+    }
+  };
+  const revive = (v, depth) => {
+    if (typeof v === "string") {
+      if (!v.startsWith("$")) return v;
+      if (v === "$") return "$";
+      const rest = v.slice(1);
+      if (rest.startsWith("$")) return rest;
+      if (rest === "undefined") return void 0;
+      if (rest === "NaN" || rest === "Infinity" || rest === "-Infinity" || rest === "-0") return Number(rest);
+      const kind = rest[0];
+      const ref = rest.slice(1);
+      switch (kind) {
+        case "D":
+          return ref;
+        // a Date, already as its ISO string
+        case "n":
+          return ref;
+        // a BigInt, as its digits
+        case "@":
+          return row(ref, depth);
+        case "Q": {
+          const entries = row(ref, depth);
+          return Array.isArray(entries) ? Object.fromEntries(entries.map((e) => Array.isArray(e) ? [String(e[0]), e[1]] : [String(e), null])) : {};
+        }
+        case "W":
+          return row(ref, depth);
+        case "L":
+          return RENDERED_UI;
+        case "K":
+          return "[FormData]";
+        case "S":
+          return `Symbol(${ref})`;
+        case "F":
+        case "h":
+          return "[function]";
+        default:
+          return /^[0-9a-f]+$/.test(rest) ? row(rest, depth) : v;
+      }
+    }
+    if (Array.isArray(v)) {
+      if (v[0] === "$") return RENDERED_UI;
+      return v.map((x) => revive(x, depth + 1));
+    }
+    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, revive(x, depth + 1)]));
+    return v;
+  };
+  return { row: (id) => row(id, 0), revive: (v) => revive(v, 0) };
+}
+var actionNotFound = (res) => res.status === 409 && res.headers.has("x-nextjs-action-not-found");
+async function readActionResponse(res, exportName) {
+  const json = (body, status = 200) => new Response(body, { status, headers: { "content-type": "application/json" } });
+  const redirect = res.headers.get("x-action-redirect");
+  if (redirect) {
+    void res.body?.cancel();
+    return json(JSON.stringify({ ok: true, redirectedTo: redirect.split(";")[0] }));
+  }
+  if (!(res.headers.get("content-type") ?? "").startsWith("text/x-component")) return res;
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  try {
+    const rootValue = decodeFlight(bytes);
+    return json(serializeResult(rootValue && typeof rootValue === "object" ? rootValue.a : void 0));
+  } catch (err) {
+    if (!(err instanceof FlightError)) throw err;
+    const flow = nextControlFlow({ digest: err.digest });
+    if (flow && "redirect" in flow) return json(JSON.stringify({ ok: true, redirectedTo: flow.redirect }));
+    if (flow) return json(JSON.stringify({ error: ERRORS[flow.status] ?? `HTTP ${flow.status}` }), flow.status);
+    console.error(`[agentready] server action ${exportName} threw: ${err.message}`);
+    return json(JSON.stringify({ error: "the action threw an error" }), 500);
+  }
+}
+
+// src/page-read.ts
+var TEXT_BUDGET = 4e4;
+var DATA_BUDGET = 16e3;
+function pageOutcome(html, payload) {
+  const redirect = /NEXT_REDIRECT;(?:push|replace);([^;"\\]+);30[1278];/.exec(payload);
+  if (redirect) return { redirect: redirect[1] };
+  const fallback = /NEXT_HTTP_ERROR_FALLBACK;(40[134])/.exec(payload);
+  if (fallback) return { status: Number(fallback[1]) };
+  const refresh = /<meta[^>]+id="__next-page-redirect"[^>]*content="[^"]*url=([^"]+)"/i.exec(html);
+  if (refresh) return { redirect: decodeEntities(refresh[1]) };
+  return null;
+}
+function embeddedPayload(html) {
+  const parts = [];
+  for (const m of html.matchAll(/self\.__next_f\.push\((\[[\s\S]*?\])\)<\/script>/g)) {
+    try {
+      const v = JSON.parse(m[1]);
+      if (v[0] === 1 && typeof v[1] === "string") parts.push(v[1]);
+    } catch {
+    }
+  }
+  return parts.join("");
+}
+var NOT_DATA = /* @__PURE__ */ new Set(["children", "className", "style", "key", "ref"]);
+var isElement = (v) => Array.isArray(v) && v[0] === "$";
+var isReference = (v) => typeof v === "string" && /^\$(undefined|L|F|h|S|K|E|Z|Y|T|P)/.test(v);
+function meaningful(v, depth = 0) {
+  if (v === null || v === void 0 || v === RENDERED_UI || isElement(v) || isReference(v) || depth > 40) return false;
+  if (typeof v === "string") return v.length > 0;
+  if (typeof v === "number" || typeof v === "boolean") return true;
+  if (Array.isArray(v)) return v.some((x) => meaningful(x, depth + 1));
+  if (typeof v === "object") return Object.values(v).some((x) => meaningful(x, depth + 1));
+  return false;
+}
+var holdsData = (v) => Boolean(v) && typeof v === "object" && meaningful(v);
+function pageData(payload) {
+  if (!payload) return [];
+  let rows;
+  try {
+    rows = flightRows(new TextEncoder().encode(payload));
+  } catch {
+    return [];
+  }
+  const names = /* @__PURE__ */ new Map();
+  for (const [id, r] of rows) {
+    if (r.tag !== "I") continue;
+    try {
+      const v = JSON.parse(r.text);
+      const name = typeof v[2] === "string" ? v[2] : "";
+      if (name && name !== "default" && name !== "*") names.set(id, name);
+    } catch {
+    }
+  }
+  const { revive } = flightReviver(rows);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (v, depth) => {
+    if (depth > 80) return;
+    if (Array.isArray(v)) {
+      if (v[0] === "$" && typeof v[1] === "string" && v[1].startsWith("$L") && v[3] && typeof v[3] === "object") {
+        const props = {};
+        for (const [k, raw] of Object.entries(v[3])) {
+          if (NOT_DATA.has(k) || isElement(raw) || isReference(raw)) continue;
+          let value;
+          try {
+            value = revive(raw);
+          } catch {
+            continue;
+          }
+          if (holdsData(value)) props[k] = value;
+        }
+        if (Object.keys(props).length > 0) {
+          const component = names.get(v[1].slice(2));
+          const key = JSON.stringify([component, props]);
+          if (!seen.has(key)) {
+            seen.add(key);
+            out.push({ ...component ? { component } : {}, props });
+          }
+        }
+      }
+      for (const x of v) visit(x, depth + 1);
+    } else if (v && typeof v === "object") {
+      for (const x of Object.values(v)) visit(x, depth + 1);
+    }
+  };
+  for (const r of rows.values()) {
+    if (r.tag !== "") continue;
+    try {
+      visit(JSON.parse(r.text), 0);
+    } catch {
+    }
+  }
+  return out;
+}
+var ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", ndash: "\u2013", mdash: "\u2014", hellip: "\u2026", rsquo: "\u2019", lsquo: "\u2018", rdquo: "\u201D", ldquo: "\u201C", copy: "\xA9", reg: "\xAE", trade: "\u2122", times: "\xD7", euro: "\u20AC", pound: "\xA3" };
+function decodeEntities(s) {
+  return s.replace(/&(#x[0-9a-f]+|#[0-9]+|[a-z]+);/gi, (m, e) => {
+    if (e[0] === "#") {
+      const code = e[1] === "x" || e[1] === "X" ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10);
+      return Number.isFinite(code) && code > 0 && code < 1114112 ? String.fromCodePoint(code) : m;
+    }
+    return ENTITIES[e.toLowerCase()] ?? m;
+  });
+}
+var VOID = /* @__PURE__ */ new Set(["area", "base", "br", "col", "embed", "hr", "img", "input", "link", "meta", "param", "source", "track", "wbr"]);
+var SKIP = /* @__PURE__ */ new Set(["script", "style", "template", "noscript", "svg", "head", "iframe", "object", "canvas", "audio", "video"]);
+var CHROME = /* @__PURE__ */ new Set(["header", "nav", "footer", "aside"]);
+var BLOCK = /* @__PURE__ */ new Set(["p", "div", "section", "article", "main", "ul", "ol", "li", "table", "tr", "thead", "tbody", "tfoot", "form", "fieldset", "dl", "dt", "dd", "blockquote", "pre", "figure", "figcaption", "details", "summary", "h1", "h2", "h3", "h4", "h5", "h6", "header", "footer", "nav", "aside", "label", "address", "hr"]);
+function parseAttrs(src) {
+  const attrs = {};
+  for (const m of src.matchAll(/([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g)) {
+    attrs[m[1].toLowerCase()] = decodeEntities(m[2] ?? m[3] ?? m[4] ?? "");
+  }
+  return attrs;
+}
+function tokenize(html) {
+  const out = [];
+  const re = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<![^>]*>|<\/?([a-zA-Z][\w:-]*)((?:[^>"']|"[^"]*"|'[^']*')*)>/g;
+  let last = 0;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    if (m.index > last) out.push(html.slice(last, m.index));
+    last = re.lastIndex;
+    if (!m[1]) continue;
+    const name = m[1].toLowerCase();
+    const raw = m[2] ?? "";
+    out.push({ name, attrs: parseAttrs(raw), close: m[0][1] === "/", selfClosing: /\/\s*$/.test(raw) || VOID.has(name) });
+    if (!m[0].startsWith("</") && (name === "script" || name === "style")) {
+      const end = html.toLowerCase().indexOf(`</${name}`, last);
+      last = end < 0 ? html.length : end;
+      re.lastIndex = last;
+    }
+  }
+  if (last < html.length) out.push(html.slice(last));
+  return out;
+}
+var hidden = (t) => "hidden" in t.attrs || t.attrs["aria-hidden"] === "true" || /display\s*:\s*none|visibility\s*:\s*hidden/i.test(t.attrs.style ?? "") || t.name === "input" && t.attrs.type === "hidden";
+function htmlToText(html) {
+  const tokens = tokenize(html);
+  const hasMain = tokens.some((t) => typeof t !== "string" && t.name === "main" && !t.close);
+  const lines = [];
+  let line = "";
+  const flush = (blank = true) => {
+    const l = line.replace(/[ \t]+/g, " ").trim();
+    if (l) lines.push(l);
+    else if (blank && lines.length > 0 && lines[lines.length - 1] !== "") lines.push("");
+    line = "";
+  };
+  const emit = (s) => {
+    line += s;
+  };
+  const stack = [];
+  let skipDepth = -1;
+  let inMain = !hasMain;
+  let mainDepth = -1;
+  let inBody = false;
+  const listCounters = [];
+  let link = null;
+  let select = null;
+  for (const tok of tokens) {
+    if (typeof tok === "string") {
+      if (skipDepth >= 0 || !inMain || !inBody) continue;
+      const text = decodeEntities(tok).replace(/\s+/g, " ");
+      if (select?.current) select.current.text += text;
+      else if (!select) emit(text);
+      continue;
+    }
+    const t = tok;
+    if (t.name === "body") {
+      inBody = !t.close;
+      continue;
+    }
+    if (t.close) {
+      const at = stack.lastIndexOf(t.name);
+      if (at < 0) continue;
+      stack.length = at;
+      if (skipDepth >= 0 && stack.length <= skipDepth) {
+        skipDepth = -1;
+        continue;
+      }
+      if (skipDepth >= 0) continue;
+      if (hasMain && t.name === "main" && stack.length <= mainDepth) {
+        flush();
+        inMain = false;
+        mainDepth = -1;
+        continue;
+      }
+      if (!inMain) continue;
+      if (t.name === "a" && link) {
+        if (lines.length > link.lines) {
+          flush();
+          if (link.href) lines.push(`\u2192 ${link.href}`);
+        } else {
+          const text = line.slice(link.start).trim();
+          if (link.href && text && text !== link.href) line = `${line.slice(0, link.start)}[${text}](${link.href})`;
+          else if (link.href && !text) emit(` [link](${link.href})`);
+        }
+        link = null;
+      } else if (t.name === "option" && select?.current) {
+        const o = select.current;
+        const label = o.text.trim() || o.value;
+        select.options.push(o.value && o.value !== label ? `${label} (${o.value})` : label);
+        if (o.selected) select.selected.push(label);
+        select.current = void 0;
+      } else if (t.name === "select" && select) {
+        emit(` [select ${select.name}: ${select.options.join(" | ")}${select.selected.length ? `; selected: ${select.selected.join(", ")}` : ""}]`);
+        select = null;
+      } else if (t.name === "ul" || t.name === "ol") {
+        listCounters.pop();
+        flush();
+      } else if (t.name === "td" || t.name === "th") {
+        emit(" |");
+      } else if (t.name === "tr") {
+        line = `|${line}`;
+        flush(false);
+      } else if (t.name === "textarea" || t.name === "button") {
+        emit("] ");
+      } else if (BLOCK.has(t.name)) {
+        flush();
+      }
+      continue;
+    }
+    if (!t.selfClosing) stack.push(t.name);
+    if (skipDepth >= 0) continue;
+    if (SKIP.has(t.name) || hidden(t) || !hasMain && CHROME.has(t.name)) {
+      if (!t.selfClosing) skipDepth = stack.length - 1;
+      continue;
+    }
+    if (hasMain && t.name === "main" && !inMain) {
+      inMain = true;
+      mainDepth = stack.length - 1;
+      continue;
+    }
+    if (!inMain || !inBody) continue;
+    const heading = /^h([1-6])$/.exec(t.name);
+    if (heading) {
+      flush();
+      emit(`${"#".repeat(Number(heading[1]))} `);
+    } else if (t.name === "br") {
+      flush();
+    } else if (t.name === "hr") {
+      flush();
+      lines.push("---");
+    } else if (t.name === "ul" || t.name === "ol") {
+      flush();
+      listCounters.push(t.name === "ol" ? 0 : -1);
+    } else if (t.name === "li") {
+      flush();
+      const top = listCounters.length - 1;
+      if (top >= 0 && listCounters[top] >= 0) emit(`${++listCounters[top]}. `);
+      else emit("- ");
+    } else if (t.name === "tr") {
+      flush(false);
+    } else if (t.name === "td" || t.name === "th") {
+      emit(" ");
+    } else if (t.name === "a") {
+      const href = t.attrs.href ?? "";
+      link = { href: /^(#|javascript:)/i.test(href) ? "" : href, start: line.length, lines: lines.length };
+    } else if (t.name === "img") {
+      if (t.attrs.alt) emit(` [image: ${t.attrs.alt}] `);
+    } else if (t.name === "input") {
+      const type = t.attrs.type ?? "text";
+      if (type === "submit" || type === "button") emit(` [button: ${t.attrs.value ?? type}] `);
+      else {
+        const parts = [`input ${t.attrs.name ?? ""}`.trim(), type !== "text" ? `type=${type}` : "", t.attrs.value ? `value=${t.attrs.value}` : "", t.attrs.placeholder ? `placeholder=${t.attrs.placeholder}` : "", "checked" in t.attrs ? "checked" : "", "required" in t.attrs ? "required" : ""];
+        emit(` [${parts.filter(Boolean).join(" ")}] `);
+      }
+    } else if (t.name === "textarea") {
+      emit(` [textarea ${t.attrs.name ?? ""}: `);
+    } else if (t.name === "select") {
+      select = { name: t.attrs.name ?? "", options: [], selected: [] };
+    } else if (t.name === "option" && select) {
+      select.current = { value: t.attrs.value ?? "", text: "", selected: "selected" in t.attrs };
+    } else if (t.name === "button") {
+      emit(" [button: ");
+    } else if (BLOCK.has(t.name)) {
+      flush();
+    }
+  }
+  flush();
+  return lines.join("\n").replace(/\[(button|textarea [^:\]]*): +/g, "[$1: ").replace(/ +\]/g, "]").replace(/\n{3,}/g, "\n\n").trim();
+}
+var title = (html) => {
+  const m = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html);
+  return m ? decodeEntities(m[1]).trim() || void 0 : void 0;
+};
+function fitData(data) {
+  const kept = [];
+  let size = 2;
+  for (const d of data) {
+    const n = JSON.stringify(d).length + 1;
+    if (size + n > DATA_BUDGET) return { data: kept, truncated: true };
+    kept.push(d);
+    size += n;
+  }
+  return { data: kept, truncated: false };
+}
+async function readPageResponse(res, url) {
+  if (!res.ok || !(res.headers.get("content-type") ?? "").includes("text/html")) return res;
+  const html = await res.text();
+  const payload = embeddedPayload(html);
+  const outcome = pageOutcome(html, payload);
+  if (outcome && "redirect" in outcome) return new Response(null, { status: 307, headers: { location: outcome.redirect } });
+  if (outcome) return Response.json({ error: outcome.status === 404 ? "not found" : outcome.status === 403 ? "forbidden" : "unauthorized" }, { status: outcome.status });
+  let text = htmlToText(html);
+  let textTruncated = false;
+  if (text.length > TEXT_BUDGET) {
+    text = text.slice(0, TEXT_BUDGET);
+    textTruncated = true;
+  }
+  let data = [];
+  let dataTruncated = false;
+  try {
+    ({ data, truncated: dataTruncated } = fitData(pageData(payload)));
+  } catch {
+    data = [];
+  }
+  const body = {
+    url,
+    ...title(html) ? { title: title(html) } : {},
+    text,
+    ...textTruncated ? { textTruncated: true } : {},
+    ...data.length > 0 ? { data } : {},
+    ...dataTruncated ? { dataTruncated: true } : {}
+  };
+  return Response.json(body);
+}
+
+// src/index.ts
+import {
+  exposed,
+  hidden as hidden2,
+  describe,
+  completeMcpLogin,
+  createHostedAuthResolver,
+  hostedBroker
+} from "@exposify/core";
+var DISPATCH_HEADER = "x-exposify-dispatch";
+var PRM_SUFFIX = "/.well-known/oauth-protected-resource";
+var LOG_PREFIX = "[agentready]";
+var ACTION_NOTE = "It returns the action's result, or { ok: true, redirectedTo } when the action redirects; a redirect to a sign-in page means the call wasn't authorised.";
+var LEFT_BLANK = "A field you leave out is as if left blank on the form.";
+var PAGE_NOTE = "Returns the page's main content as text, with links, and the data it was rendered with when the page passes any to its components. An error naming a sign-in page means signing in first.";
+function env2() {
+  return globalThis.process?.env ?? {};
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function routesFrom(manifest, cfg, warnings) {
+  const listed = Array.isArray(cfg.expose) ? cfg.expose.map(parseMethodEntry).filter((e) => e !== null) : [];
+  const perEntry = await Promise.all(
+    manifest.routes.map(async (entry) => {
+      const base = { path: entry.path, params: entry.params };
+      if (entry.router === "pages") {
+        return listed.filter((e) => e.path === entry.path).map((e) => ({ ...base, method: e.method, optIn: true }));
+      }
+      let mod;
+      if (entry.load) {
+        try {
+          mod = await entry.load();
+        } catch (err) {
+          warnings.push(`couldn't load ${entry.file} to read exposed()/describe() on it (${errorMessage(err)}); its methods follow your config only`);
+        }
+      }
+      const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
+      return methods.filter((m) => m !== "OPTIONS").map((method) => {
+        const marker = mod ? getMarker(mod[method]) : void 0;
+        return { ...base, method, ...marker ? { marker } : {} };
+      });
+    })
+  );
+  return perEntry.flat();
+}
+function fieldSchema(f) {
+  let base;
+  if (f.enum && f.enum.length > 0) base = z.enum(f.enum);
+  else if (f.type === "number") {
+    let n = z.number();
+    if (f.min !== void 0) n = n.min(f.min);
+    if (f.max !== void 0) n = n.max(f.max);
+    base = n;
+  } else if (f.type === "boolean") base = z.boolean();
+  else if (f.type === "json") base = z.unknown().describe("JSON: an object or array (sent as JSON text)");
+  else {
+    let s = z.string();
+    if (f.minLength !== void 0) s = s.min(f.minLength);
+    if (f.maxLength !== void 0) s = s.max(f.maxLength);
+    if (f.pattern !== void 0) {
+      try {
+        s = s.regex(new RegExp(`^(?:${f.pattern})$`));
+      } catch {
+      }
+    }
+    base = s;
+  }
+  let schema = f.array ? z.array(base) : base;
+  if (f.description) schema = schema.describe(f.description);
+  return f.required ? schema : schema.optional();
+}
+function derivedInput(action) {
+  const reason = inputProblem(action);
+  if (reason && action.proposed && !action.fields.some((f) => f.type === "file")) {
+    const fields = action.proposed.map((p) => ({ name: p.name, type: p.type, ...p.required ? { required: true } : {}, ...p.enum ? { enum: p.enum } : {}, ...p.description ? { description: p.description } : {} }));
+    return { input: Object.fromEntries(fields.map((f) => [f.name, fieldSchema(f)])) };
+  }
+  if (reason) return { reason: action.fields.some((f) => f.type === "file") ? reason : `${reason}; \`exposify-next describe\` can propose it for you to review` };
+  return { input: Object.fromEntries(action.fields.map((f) => [f.name, fieldSchema(f)])) };
+}
+var sentence = (s) => /[.!?]$/.test(s.trim()) ? s.trim() : `${s.trim()}.`;
+var GUARD_CACHE_MS = 6e4;
+var GUARD_CACHE_MAX = 500;
+var GUARD_PROBE_TIMEOUT_MS = 5e3;
+var dispatched = (live) => Boolean(live.id && live.action.host);
+async function actionsFrom(manifest, config, warnings) {
+  const routes = [];
+  const live = /* @__PURE__ */ new Map();
+  let hidden3 = 0;
+  const list = manifest.actions ?? [];
+  const exportCounts = /* @__PURE__ */ new Map();
+  for (const a of list) exportCounts.set(a.export, (exportCounts.get(a.export) ?? 0) + 1);
+  const base = (manifest.mcpPath ?? "").replace(/\/$/, "");
+  for (const action of list) {
+    const where = `${action.export} (${action.file})`;
+    const conf = config[action.key] ?? (exportCounts.get(action.export) === 1 ? config[action.export] : void 0);
+    let mod;
+    try {
+      mod = await action.load();
+    } catch (err) {
+      warnings.push(`couldn't load ${action.file} to read the ${action.export} server action (${errorMessage(err)}); it's hidden`);
+      hidden3++;
+      continue;
+    }
+    const fn = mod[action.export];
+    const marker = getMarker(fn);
+    if (typeof fn !== "function" || marker?.kind === "hidden" || !conf && !marker) {
+      hidden3++;
+      continue;
+    }
+    const opts = conf === true || !conf ? {} : conf;
+    const described = marker?.kind === "described" ? marker : void 0;
+    let input = opts.input ?? described?.input;
+    let derived = false;
+    if (!input && (action.params.some((p) => p.role !== "prev") || (action.unresolved?.length ?? 0) > 0)) {
+      const found = derivedInput(action);
+      if ("reason" in found) {
+        warnings.push(`server action ${where} is opted in but stays hidden: ${found.reason}. Write its input: aiReady(exposify, { actions: { ${action.export}: { input: { ... } } } })`);
+        hidden3++;
+        continue;
+      }
+      input = found.input;
+      derived = true;
+    }
+    if (manifest.mcpPath === void 0) {
+      warnings.push(`server action ${where} can't be served: the MCP route isn't a catch-all (app/mcp/[[...transport]]/route.ts)`);
+      hidden3++;
+      continue;
+    }
+    if (looksLikeAuth(action)) {
+      warnings.push(`server action ${where} looks like it signs people in or out: a cookie it sets lands on exposify's internal call, not on the agent's client`);
+    }
+    const id = fn.$$id;
+    live.set(action.key, { action, fn, ...typeof id === "string" && id ? { id } : {} });
+    routes.push({
+      method: "POST",
+      path: `${base}/actions/${action.key}`,
+      params: [],
+      bodyArgs: true,
+      marker: {
+        kind: "described",
+        name: opts.name ?? described?.name ?? action.key,
+        // config, then describe(), then exposify.descriptions.json (`describe` writes it, keyed by the tool's URL).
+        description: [sentence(opts.description ?? described?.description ?? manifest.descriptions?.[`POST ${base}/actions/${action.key}`] ?? `Runs the ${action.export} server action`), derived && action.fields.length > 0 ? LEFT_BLANK : "", ACTION_NOTE].filter(Boolean).join(" "),
+        input: input ?? {}
+      }
+    });
+  }
+  return { routes, live, hidden: hidden3 };
+}
+function excludedPage(page, exclude) {
+  const globs = [];
+  for (const entry of exclude) {
+    const qualified = parseMethodEntry(entry);
+    if (!qualified) globs.push(entry);
+    else if (qualified.method === "GET" && qualified.path === page.path) return true;
+  }
+  return globs.length > 0 && matchesPathGlob(page.path, globs);
+}
+function pagesFrom(manifest, cfg, config) {
+  if (config === false) return { routes: [], hidden: manifest.pages?.length ?? 0, forms: 0 };
+  const routes = [];
+  let hidden3 = 0;
+  let forms = 0;
+  for (const page of manifest.pages ?? []) {
+    const conf = config?.[page.path];
+    const listed = conf !== void 0 || Array.isArray(cfg.expose) && cfg.expose.some((e) => parseMethodEntry(e)?.method === "GET" && parseMethodEntry(e)?.path === page.path);
+    if (conf === false || excludedPage(page, cfg.exclude) || page.formOnly && !listed) {
+      hidden3++;
+      if (page.formOnly && !listed) forms++;
+      continue;
+    }
+    const opts = typeof conf === "object" ? conf : {};
+    const input = {};
+    for (const p of page.params) {
+      const optional = new RegExp(`:${p}\\*\\?(/|$)`).test(page.path);
+      const catchAll = new RegExp(`:${p}\\*`).test(page.path);
+      const schema = z.string().describe(catchAll ? `${p}: one or more path segments, as "a/b/c"` : p);
+      input[p] = optional ? schema.optional() : schema;
+    }
+    for (const q of page.search ?? []) input[q] = z.string().optional().describe(`?${q}= in the page's URL`);
+    const what = page.description ? sentence(page.description) : page.title ? `Reads the "${page.title}" page (${page.path}).` : `Reads the ${page.path} page.`;
+    routes.push({
+      method: "GET",
+      path: page.path,
+      params: page.params,
+      queryArgs: page.search ?? [],
+      marker: {
+        kind: "described",
+        name: opts.name ?? page.name,
+        description: [sentence(opts.description ?? manifest.descriptions?.[`GET ${page.path}`] ?? what), PAGE_NOTE].join(" "),
+        input
+      }
+    });
+  }
+  return { routes, hidden: hidden3, forms };
+}
+function loginSpec(manifest, config, warnings) {
+  if (config === false) return null;
+  if (config === void 0) return manifest.login ?? null;
+  if (typeof config === "object") {
+    const fields2 = config.fields.map((name) => ({ name, kind: fieldKind(name) }));
+    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json", where: `POST ${config.path}` };
+  }
+  const action = (manifest.actions ?? []).find((a) => a.key === config || a.export === config);
+  if (!action) {
+    warnings.push(`aiReady({ login: "${config}" }): no server action by that name, so AI assistants can't sign in with your app's login`);
+    return null;
+  }
+  const fields = action.fields.map((f) => ({ name: f.name, kind: fieldKind(f.name) }));
+  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {}, where: `${action.export} in ${action.file}` };
+}
+async function actionLoginResult(raw, exportName) {
+  if (actionNotFound(raw)) return { ok: false, message: "The app's sign-in page didn't run its login. Its developer needs to rebuild the app." };
+  const cookies = cookieChanges(raw).filter((c) => !c.deleted && c.value !== "");
+  const out = await readActionResponse(raw, exportName);
+  const body = await out.json().catch(() => void 0);
+  const message = errorMessageOf(body);
+  if (out.status >= 400 || message && !body?.redirectedTo) return { ok: false, message };
+  return cookies.length > 0 ? { ok: true, session: { cookies } } : { ok: false, message };
+}
+var clientIp = (headers) => headers.get("x-forwarded-for")?.split(",")[0]?.trim() || headers.get("x-real-ip") || void 0;
+function aiReady(manifest, options = {}) {
+  const cfg = resolveOptions({ ...options, docs: [] });
+  const gate = cfg.oauth ? createOAuthGate(cfg.oauth, { metadataUrl: `${cfg.oauth.resource}${PRM_SUFFIX}` }) : null;
+  const brokerGate = !gate && cfg.docsAuth === "required" ? createBrokerGate(cfg.auth) : null;
+  const logReady = startupLogEnabled(options.startupLog);
+  const authContexts = /* @__PURE__ */ new WeakMap();
+  const pageRoutes = /* @__PURE__ */ new WeakSet();
+  const actionsBase = (manifest.mcpPath ?? "").replace(/\/$/, "");
+  const actionUrl = manifest.mcpPath === void 0 ? null : new RegExp(`${actionsBase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/actions/([^/]+)/?$`);
+  const loginWarnings = [];
+  const login = hostedResolverInfo(cfg.auth) ? loginSpec(manifest, options.login, loginWarnings) : null;
+  const loginPagePath = `${(manifest.mcpPath ?? "/mcp").replace(/\/$/, "")}/login`;
+  if (login) cfg.signedOutPaths = [login.kind === "action" ? login.host : login.path].filter((p) => Boolean(p)).map((p) => `${manifest.basePath ?? ""}${hostPath(p)}`);
+  let built = null;
+  const build = async (endpoint) => {
+    const warnings = [...loginWarnings];
+    let routes = await routesFrom(manifest, cfg, warnings);
+    if (options.openapi) routes = applyOpenApi(routes, options.openapi);
+    routes = applyDescriptions(routes, new Map(Object.entries(manifest.descriptions ?? {})));
+    const pages = pagesFrom(manifest, cfg, options.pages);
+    let actions = await actionsFrom(manifest, options.actions ?? {}, warnings);
+    const inProcess = [...actions.live.values()].filter((l) => !dispatched(l));
+    for (const l of inProcess) {
+      warnings.push(
+        `server action ${l.action.export} (${l.action.file}) isn't used by any page, so it runs inside the MCP route, where Next refuses updateTag() and refresh(); use it from a page's form to have it run as a real Server Action`
+      );
+    }
+    if (inProcess.length > 0 && !await actionSecret()) {
+      warnings.push(
+        `${inProcess.length} server action${inProcess.length === 1 ? " is" : "s are"} off: ${inProcess.length === 1 ? "it isn't" : "they aren't"} used by any page, and in production calling ${inProcess.length === 1 ? "it" : "them"} in-process needs EXPOSIFY_ACTION_SECRET (or NEXT_SERVER_ACTIONS_ENCRYPTION_KEY) set to the same value on every instance`
+      );
+      const off = new Set(inProcess.map((l) => l.action.key));
+      const offPaths = new Set(inProcess.map((l) => `${actionsBase}/actions/${l.action.key}`));
+      actions = {
+        routes: actions.routes.filter((r) => !offPaths.has(r.path)),
+        live: new Map([...actions.live].filter(([k]) => !off.has(k))),
+        hidden: actions.hidden + inProcess.length
+      };
+    }
+    const kb = KnowledgeBase.build(manifest.docs);
+    try {
+      for (const w of warnings) console.warn(formatWarning(LOG_PREFIX, w));
+      logSurface(endpoint, [...routes, ...pages.routes, ...actions.routes], actions.routes.length, actions.hidden, pages);
+    } catch {
+    }
+    for (const r of pages.routes) pageRoutes.add(r);
+    return { routes: [...routes, ...pages.routes, ...actions.routes], kb, actions: actions.live, guards: guardsFor(pages.routes, actions.routes) };
+  };
+  const guardsFor = (pageTools, actionTools) => {
+    const of = /* @__PURE__ */ new Map();
+    for (const r of pageTools) {
+      const g = manifest.pages?.find((p) => p.path === r.path)?.guards;
+      if (g?.length) of.set(r, g);
+    }
+    for (const r of actionTools) {
+      const key = decodeURIComponent(r.path.slice(r.path.lastIndexOf("/") + 1));
+      const g = manifest.actions?.find((a) => a.key === key)?.guards;
+      if (g?.length) of.set(r, g);
+    }
+    const probes = /* @__PURE__ */ new Map();
+    for (const guard of new Set([...of.values()].flat())) {
+      const page = (manifest.pages ?? []).filter((p) => p.params.length === 0 && p.guards?.includes(guard)).sort((a, b) => a.guards.length - b.guards.length || a.path.length - b.path.length)[0];
+      if (!page) continue;
+      const route = { method: "GET", path: page.path, params: [] };
+      pageRoutes.add(route);
+      probes.set(guard, route);
+    }
+    return { of, probes, seen: /* @__PURE__ */ new Map() };
+  };
+  const visibleRoutes = async (routes, guards, req) => {
+    if (guards.probes.size === 0) return routes;
+    const who = req.headers.get("authorization") ?? req.headers.get("cookie") ?? "";
+    let entry = guards.seen.get(who);
+    if (!entry || entry.at < Date.now() - GUARD_CACHE_MS) {
+      const failed2 = /* @__PURE__ */ new Set();
+      await Promise.all(
+        [...guards.probes].map(async ([guard, route]) => {
+          try {
+            const request = await buildRequest(route, {}, req.headers, cfg, authContexts.get(req) ?? {});
+            const res = await Promise.race([selfFetch(request, req, route), new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), GUARD_PROBE_TIMEOUT_MS))]);
+            void res.body?.cancel();
+            if (res.status < 200 || res.status >= 300) failed2.add(guard);
+          } catch {
+          }
+        })
+      );
+      entry = { at: Date.now(), failed: failed2 };
+      if (guards.seen.size >= GUARD_CACHE_MAX) guards.seen.delete(guards.seen.keys().next().value);
+      guards.seen.set(who, entry);
+    }
+    const failed = entry.failed;
+    if (failed.size === 0) return routes;
+    return routes.filter((r) => !(guards.of.get(r) ?? []).some((g) => failed.has(g)));
+  };
+  const ensureBuilt = (endpoint) => built ??= build(endpoint).catch((err) => {
+    built = null;
+    console.error(formatFailed(LOG_PREFIX, errorMessage(err), "the MCP route answers 503 and retries on the next request"), err);
+    throw err;
+  });
+  const logSurface = (endpoint, routes, exposedActions, hiddenActions, pages) => {
+    const counts = countTools(routes, cfg);
+    if (counts.reads + counts.writes === 0) {
+      console.warn(
+        formatWarning(
+          LOG_PREFIX,
+          `MCP is up at ${endpoint} but exposes no route tools`,
+          "check that exposify.generated.ts is current (withExposify() in next.config, or `npx exposify-next generate`)"
+        )
+      );
+      return;
+    }
+    if (!logReady) return;
+    const details = [];
+    if (cfg.expose === "*") details.push('all write routes exposed (expose: "*")');
+    if (counts.hiddenWrites > 0) details.push(`${counts.hiddenWrites} write route${counts.hiddenWrites === 1 ? "" : "s"} hidden (opt in with exposed())`);
+    if (pages.routes.length > 0) details.push(`${pages.routes.length} page${pages.routes.length === 1 ? "" : "s"} readable`);
+    if (login) details.push(`AI assistants sign in with your app's own login (${login.kind === "action" ? `server action ${login.key}` : `POST ${login.path}`}) at ${loginPagePath}`);
+    if (pages.forms > 0) details.push(`${pages.forms} page${pages.forms === 1 ? "" : "s"} left out as just a form (list in aiReady({ pages }) to include)`);
+    if (exposedActions > 0) details.push(`${exposedActions} server action${exposedActions === 1 ? "" : "s"} exposed, each checking auth itself`);
+    if (hiddenActions > 0) details.push(`${hiddenActions} server action${hiddenActions === 1 ? "" : "s"} hidden (opt in with aiReady({ actions }))`);
+    const e = env2();
+    if (e.VERCEL && e.VERCEL_ENV !== "production" && !e.VERCEL_AUTOMATION_BYPASS_SECRET) {
+      details.push("on a protected Vercel preview, tool calls need VERCEL_AUTOMATION_BYPASS_SECRET");
+    }
+    const auth = describeAuth(cfg.auth, cfg.oauth);
+    console.log(formatReady(LOG_PREFIX, { endpoint, tools: routeToolsPhrase(counts, manifest.docs.length), details, docs: manifest.docs.length, auth }));
+  };
+  const selfFetch = async (request, mcpReq, route) => {
+    const target = new URL(request.url);
+    const incoming = new URL(mcpReq.url);
+    const origin = options.baseUrl ?? env2().EXPOSIFY_BASE_URL ?? incoming.origin;
+    let path = `${manifest.basePath ?? ""}${target.pathname}`;
+    if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
+    const headers = new Headers(request.headers);
+    headers.set(DISPATCH_HEADER, "1");
+    for (const name of ["x-forwarded-for", "x-real-ip", "user-agent"]) {
+      const value = mcpReq.headers.get(name);
+      if (value) headers.set(name, value);
+    }
+    headers.set("x-forwarded-proto", mcpReq.headers.get("x-forwarded-proto") ?? incoming.protocol.slice(0, -1));
+    headers.set("x-forwarded-host", mcpReq.headers.get("x-forwarded-host") ?? mcpReq.headers.get("host") ?? incoming.host);
+    const bypass = env2().VERCEL_AUTOMATION_BYPASS_SECRET;
+    if (bypass) headers.set("x-vercel-protection-bypass", bypass);
+    const body = request.body ? await request.text() : void 0;
+    const actionKey = actionUrl?.exec(target.pathname)?.[1];
+    if (actionKey !== void 0) {
+      const live = (await ensureBuilt(actionsBase || "/")).actions.get(decodeURIComponent(actionKey));
+      if (live && dispatched(live)) {
+        const res = await dispatchAction(live, body, headers, origin);
+        if (!actionNotFound(res)) return carrySession(res, await readActionResponse(res, live.action.export));
+        warnOnce(
+          `server action ${live.action.export}: ${live.action.host} doesn't run it (Next answered "action not found"), so it's called in-process instead; regenerate exposify.generated.ts if the page changed`
+        );
+      }
+      const secret = await actionSecret();
+      if (secret) headers.set(ACTION_SECRET_HEADER, secret);
+    }
+    const url = new URL(`${path}${target.search}`, origin);
+    if (route && pageRoutes.has(route)) {
+      headers.set("accept", "text/html,application/xhtml+xml");
+      const res = await fetch(url, { method: "GET", headers, redirect: "manual", cache: "no-store" });
+      return carrySession(res, await readPageResponse(res, `${path}${target.search}`));
+    }
+    return fetch(url, { method: request.method, headers, body, redirect: "manual", cache: "no-store" });
+  };
+  const dispatchAction = async (live, body, headers, origin) => {
+    let args;
+    try {
+      args = body ? JSON.parse(body) : {};
+    } catch {
+      args = {};
+    }
+    const fields = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+    const out = new Headers(headers);
+    out.delete("content-type");
+    out.delete("content-length");
+    out.set("next-action", live.id);
+    out.set("x-action-forwarded", "1");
+    out.set("accept", "text/x-component");
+    out.set("origin", `${out.get("x-forwarded-proto") ?? "http"}://${out.get("x-forwarded-host")}`);
+    let path = `${manifest.basePath ?? ""}${hostPath(live.action.host)}`;
+    if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
+    const reply = encodeReply(actionArguments(live.action.params, fields, jsonFieldsOf(live.action)));
+    return fetch(new URL(path, origin), { method: "POST", headers: out, body: reply, redirect: "manual", cache: "no-store" });
+  };
+  const appLoginFor = (req, spec) => ({
+    label: spec.kind === "action" ? `server action ${spec.key}` : `POST ${spec.path}`,
+    fields: spec.fields,
+    signedOutPaths: cfg.signedOutPaths ?? [],
+    attempt: async (values, ctx) => {
+      const target = options.baseUrl ?? env2().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
+      const pub = new URL(ctx.origin);
+      const headers = new Headers({ origin: pub.origin, "x-forwarded-proto": pub.protocol.slice(0, -1), "x-forwarded-host": pub.host });
+      if (ctx.ip) headers.set("x-forwarded-for", ctx.ip);
+      const ua = req.headers.get("user-agent");
+      if (ua) headers.set("user-agent", ua);
+      const bypass = env2().VERCEL_AUTOMATION_BYPASS_SECRET;
+      if (bypass) headers.set("x-vercel-protection-bypass", bypass);
+      const pathOf = (p) => {
+        let path = `${manifest.basePath ?? ""}${p}`;
+        if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
+        return path;
+      };
+      if (spec.kind === "route") {
+        headers.set("content-type", spec.body === "form" ? "application/x-www-form-urlencoded" : "application/json");
+        const body = spec.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
+        return loginResultFromResponse(await fetch(new URL(pathOf(spec.path), target), { method: "POST", headers, body, redirect: "manual", cache: "no-store" }));
+      }
+      const action = (manifest.actions ?? []).find((a) => a.key === spec.key);
+      const fn = action ? (await action.load())[action.export] : void 0;
+      const id = fn?.$$id;
+      if (!action?.host || typeof id !== "string") {
+        warnOnce(`server action ${spec.key} is your app's login, but no page uses it, so the sign-in form can't run it; use it from a page's form`);
+        return { ok: false, message: "This app's sign-in can't be used by AI assistants yet." };
+      }
+      headers.set("next-action", id);
+      headers.set("x-action-forwarded", "1");
+      headers.set("accept", "text/x-component");
+      const reply = encodeReply(actionArguments(action.params, values, jsonFieldsOf(action)));
+      const raw = await fetch(new URL(pathOf(hostPath(action.host)), target), { method: "POST", headers, body: reply, redirect: "manual", cache: "no-store" });
+      return actionLoginResult(raw, action.export);
+    }
+  });
+  const carrySession = (raw, out) => {
+    const lines = setCookieLines(raw);
+    const redirect = raw.headers.get("x-action-redirect")?.split(";")[0];
+    const signedOut = redirect !== void 0 && samePath(redirect, cfg.signedOutPaths ?? []);
+    if (lines.length === 0 && !signedOut) return out;
+    const headers = new Headers(out.headers);
+    for (const line of lines) headers.append("set-cookie", line);
+    if (signedOut) headers.set(SIGNED_OUT_HEADER, "1");
+    return new Response(out.body, { status: out.status, headers });
+  };
+  const warned = /* @__PURE__ */ new Set();
+  const warnOnce = (message) => {
+    if (warned.has(message)) return;
+    warned.add(message);
+    console.warn(formatWarning(LOG_PREFIX, message));
+  };
+  const core = createWebMcpHandler({
+    getServer: async (req) => {
+      const { routes: all, kb, guards } = await ensureBuilt(new URL(req.url).pathname);
+      const routes = await visibleRoutes(all, guards, req);
+      const surface = { info: manifest.info, routes, docs: manifest.docs, dispatch: (request, route) => selfFetch(request, req, route) };
+      return buildMcpServer({ surface, kb, cfg, incoming: req.headers, authContext: authContexts.get(req) ?? {} });
+    }
+  }, { ...options.rateLimit !== void 0 ? { rateLimit: options.rateLimit } : {}, ...options.rateWindowMs !== void 0 ? { rateWindowMs: options.rateWindowMs } : {} });
+  const serveAction = async (req, key) => {
+    const secret = await actionSecret();
+    if (!secret || !await secretMatches(req.headers.get(ACTION_SECRET_HEADER), secret)) {
+      return Response.json({ error: "server actions are only callable through the MCP endpoint" }, { status: 403 });
+    }
+    if (req.method !== "POST") return Response.json({ error: "method not allowed" }, { status: 405, headers: { allow: "POST" } });
+    const { actions } = await ensureBuilt(actionsBase || "/");
+    const live = actions.get(key);
+    if (!live) return Response.json({ error: `no exposed server action ${key}` }, { status: 404 });
+    let args;
+    try {
+      args = await req.json();
+    } catch {
+      args = void 0;
+    }
+    if (!args || typeof args !== "object" || Array.isArray(args)) return Response.json({ error: "expected a JSON object of arguments" }, { status: 400 });
+    return runAction(live.fn, live.action, args);
+  };
+  return async (req) => {
+    const pathname = new URL(req.url).pathname;
+    if (login && samePath(pathname, [loginPagePath, `${manifest.basePath ?? ""}${loginPagePath}`])) {
+      const pub = new URL(publicRequestUrl(req.url, req.headers));
+      return handleLoginPage(req, appLoginFor(req, login), hostedResolverInfo(cfg.auth), {
+        path: pub.pathname,
+        secure: pub.protocol === "https:",
+        origin: pub.origin,
+        ...clientIp(req.headers) ? { ip: clientIp(req.headers) } : {}
+      });
+    }
+    const actionKey = actionUrl?.exec(pathname)?.[1];
+    if (actionKey !== void 0) return serveAction(req, decodeURIComponent(actionKey));
+    if (req.headers.has(DISPATCH_HEADER)) {
+      return Response.json({ error: "a tool call can't call the MCP endpoint itself" }, { status: 508 });
+    }
+    if (gate) {
+      if (new URL(req.url).pathname.endsWith(PRM_SUFFIX)) return gate.metadataResponse(req.method);
+      try {
+        const result = await gate.check(req.headers);
+        if (!result.ok) return result.response;
+        authContexts.set(req, { claims: result.claims });
+      } catch (err) {
+        console.warn(`${LOG_PREFIX} oauth gate failed:`, err);
+        return new Response("authorization check failed", { status: 503 });
+      }
+    }
+    if (brokerGate) {
+      const url = publicRequestUrl(req.url, req.headers);
+      const isPrm = url.endsWith(PRM_SUFFIX);
+      const resource = brokerGate.resourceFor(isPrm ? url.slice(0, -PRM_SUFFIX.length) : url);
+      const verdict = await reportAppLogin(cfg.auth, resource, login, { where: login?.where, stacks: manifest.authStacks, log: logReady });
+      if (verdict === "open") {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        try {
+          const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+          if (!result.ok) return result.response;
+        } catch (err) {
+          console.warn(`${LOG_PREFIX} broker check failed:`, err);
+          return new Response("authorization check failed", { status: 503 });
+        }
+      }
+    }
+    return core(req);
+  };
+}
+export {
+  DISPATCH_HEADER,
+  aiReady,
+  completeMcpLogin,
+  createHostedAuthResolver,
+  describe,
+  exposed,
+  hidden2 as hidden,
+  hostedBroker
+};