@leed-ai/cli 0.0.0 → 6.19.0

package/dist/static/customer-site-worker/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "customer-site-worker",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "hono": "4.12.12"
+  }
+}

package/dist/static/customer-site-worker/src/assetsHydration.ts

@@ -0,0 +1,55 @@
+import type { Context } from "hono";
+import type { DocResource, Env } from "./types";
+
+/**
+ * Shared ASSETS content-hydration helper (#284, #294).
+ *
+ * "path present + content absent" in a `resources[]` envelope is the hydration
+ * contract: customer-functions emits the path + canonical url and leaves
+ * `content` absent, and the edge fills it from the per-company ASSETS bundle —
+ * no origin hop. This is the SINGLE implementation used by BOTH:
+ *   - `mcp-proxy.ts` (Docs MCP #284), which unwraps the JSON-RPC tool result and
+ *     hydrates the inner `{ resources }` envelope, and
+ *   - `proxy.ts proxyToFunctions` (core-site agent surface #294), which hydrates
+ *     the plain `{ resources }` JSON body the `/api/agent/pages-*` endpoints
+ *     return.
+ * Both surfaces share the one `X-Fetch-Result: page-resources` marker and THIS
+ * one hydrator (documentation, api, and posts are all just pages), so they can
+ * never drift.
+ *
+ * Fetches run in parallel (`Promise.allSettled`), preserve input order, and
+ * tolerate partial failure (per-item `error`).
+ */
+
+/** Fetch each resource's content from ASSETS in parallel, preserving order. */
+export async function hydrateResources(
+  c: Context<{ Bindings: Env }>,
+  resources: DocResource[],
+): Promise<DocResource[]> {
+  const settled = await Promise.allSettled(resources.map((r) => hydrateOne(c, r)));
+  return settled.map((outcome, i) =>
+    outcome.status === "fulfilled"
+      ? outcome.value
+      : { ...resources[i], error: `hydration failed: ${String(outcome.reason)}` },
+  );
+}
+
+/**
+ * Resolve the ASSETS file for a resource. A path ending in `/` is a page
+ * directory → `index.md`; a file path (e.g. `.../openapi.yaml`) is fetched
+ * directly. A resource that already carries an `error` (a per-item marker — e.g.
+ * `not_found` / `protected_resource`) or no `path` is passed through untouched, so
+ * markers are never hydrated. Paths come from the trusted resource envelope
+ * (never raw client input), so no client-controlled traversal is possible.
+ */
+async function hydrateOne(c: Context<{ Bindings: Env }>, resource: DocResource): Promise<DocResource> {
+  if (resource.error || !resource.path) return resource;
+
+  const filePath = resource.path.endsWith("/") ? `${resource.path}index.md` : resource.path;
+  const assetUrl = new URL(filePath, c.req.url).toString();
+  const res = await c.env.ASSETS.fetch(new Request(assetUrl));
+  if (!res.ok) {
+    return { ...resource, error: `not found: ${filePath}` };
+  }
+  return { ...resource, content: await res.text() };
+}

package/dist/static/customer-site-worker/src/constants.ts

@@ -0,0 +1,20 @@
+/**
+ * Single source of truth for the agent-surface asset layout (#294).
+ *
+ * Lives in the worker because the worker is the constrained side: it is a
+ * standalone hono-only bundle (the build copies its `src/` + an isolated
+ * package.json with only `hono` into the customer site repo) and so CANNOT import
+ * `@leed/*` or anything from site-management `src/`. The build side has no such
+ * limit, so `src/utils/agentManifests.ts` imports these same constants from here
+ * (site-management's tsconfig lists this one file) — the build writes
+ * `<site>/_services/{webmcp,agent}.json` and the edge hydrates the exact same
+ * paths from ASSETS, with no risk of drift.
+ */
+export const AGENT_SERVICES_DIR = "_services";
+export const WEBMCP_FILE = "webmcp.json";
+export const AGENT_CARD_FILE = "agent.json";
+
+/** ASSETS path the edge fetches the WebMCP manifest from. */
+export const WEBMCP_ASSET_PATH = `/${AGENT_SERVICES_DIR}/${WEBMCP_FILE}`;
+/** ASSETS path the edge fetches the A2A AgentCard from. */
+export const AGENT_CARD_ASSET_PATH = `/${AGENT_SERVICES_DIR}/${AGENT_CARD_FILE}`;

package/dist/static/customer-site-worker/src/cors.ts

@@ -0,0 +1,120 @@
+import { Context, Next } from "hono";
+import { isMcpProxyPath } from "./mcp-proxy";
+import type { Env } from "./types";
+
+/**
+ * The core-site agent surfaces (#294): `/.well-known/webmcp` (WebMCP manifest)
+ * and `/.well-known/agent.json` (A2A AgentCard). Served by the edge for
+ * cross-origin in-browser + remote agents, so — like the Docs MCP surface — they
+ * need the public `Access-Control-Allow-Origin: *` policy, NOT the credentialed
+ * origin-locked one. Read-only public metadata, so `*` is safe.
+ */
+function isAgentWellKnownPath(pathname: string): boolean {
+  return pathname === "/.well-known/webmcp" || pathname === "/.well-known/agent.json";
+}
+
+function parseOrigins(value: string): string[] {
+  try {
+    return Array.isArray(value) ? value : JSON.parse(value);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Public CORS for the Docs MCP surface (#284), owned ENTIRELY at the edge so
+ * customer-functions is never hit for a preflight. `/mcp/*` + the OAuth
+ * `.well-known` paths serve cross-origin MCP clients with bearer/PKCE (NO
+ * cookies), so the correct, safe policy is `Access-Control-Allow-Origin: *` —
+ * NOT the origin-locked credentialed policy below. OPTIONS preflights are
+ * answered here (204) and short-circuited before the proxy, and CORS headers are
+ * stamped onto every proxied response. WWW-Authenticate is exposed so clients can
+ * walk discovery from the 401 challenge.
+ *
+ * Methods cover the stateless Streamable-HTTP surface: POST (JSON-RPC), GET
+ * (discovery + 401 challenge), OPTIONS (preflight). DELETE is intentionally
+ * absent — this MCP transport is stateless (no session id, no
+ * session-termination DELETE), so advertising it would be inaccurate. Allowed
+ * headers cover the MCP transport headers plus the OAuth bearer / JSON body.
+ *
+ * The header list matches the `allowHeaders` of `mcpCors()` in the CMS repo's
+ * `libs/mcp/src/cors.ts` exactly: protocol revision `2026-07-28` makes
+ * `mcp-method`/`mcp-name` required, so a preflight that omitted them would fail
+ * every browser Docs MCP client. `mcp-session-id` is absent because this
+ * transport is stateless — no session id is ever read, minted, or echoed.
+ *
+ * This worker ships baked into each customer site at *site-build* time, not with
+ * the customer-functions deploy, so a site built before this release fronts the
+ * new server with an allow-list that lacks `mcp-method`/`mcp-name`, and every
+ * browser Docs MCP client on it fails preflight until that site is rebuilt.
+ */
+async function mcpCors(c: Context<{ Bindings: Env }>, next: Next): Promise<Response | undefined> {
+  if (c.req.method === "OPTIONS") {
+    return c.body(null, 204, {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+      "Access-Control-Allow-Headers": "Authorization, Content-Type, mcp-protocol-version, mcp-method, mcp-name",
+      "Access-Control-Max-Age": "86400",
+    });
+  }
+  await next();
+  c.res = new Response(c.res.body, c.res);
+  c.res.headers.set("Access-Control-Allow-Origin", "*");
+  c.res.headers.append("Access-Control-Expose-Headers", "WWW-Authenticate");
+}
+
+/**
+ * Public `*` CORS for the read-only agent `.well-known` documents (#294). These
+ * are plain GETs (no auth, no MCP transport headers), so the preflight advertises
+ * only GET/OPTIONS and the response is stamped with `Access-Control-Allow-Origin: *`.
+ */
+async function agentCors(c: Context<{ Bindings: Env }>, next: Next): Promise<Response | undefined> {
+  if (c.req.method === "OPTIONS") {
+    return c.body(null, 204, {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": "GET, OPTIONS",
+      "Access-Control-Allow-Headers": "Content-Type",
+      "Access-Control-Max-Age": "86400",
+    });
+  }
+  await next();
+  c.res = new Response(c.res.body, c.res);
+  c.res.headers.set("Access-Control-Allow-Origin", "*");
+}
+
+export async function corsMiddleware(c: Context<{ Bindings: Env }>, next: Next): Promise<Response | undefined> {
+  const pathname = new URL(c.req.url).pathname;
+  if (isMcpProxyPath(pathname)) {
+    return mcpCors(c, next);
+  }
+  if (isAgentWellKnownPath(pathname)) {
+    return agentCors(c, next);
+  }
+
+  const origin = c.req.header("Origin") ?? "";
+
+  if (origin === "" || origin === "null") {
+    await next();
+    // `@font-face` requests from a CSP-sandboxed iframe (page-proxy preview)
+    // carry `Origin: null`. Without ACAO the browser rejects the response and
+    // icon fonts fail to render. /static/* assets are public, so `*` is safe.
+    if (origin === "null" && new URL(c.req.url).pathname.startsWith("/static/")) {
+      c.res = new Response(c.res.body, c.res);
+      c.res.headers.set("Access-Control-Allow-Origin", "*");
+    }
+    return;
+  }
+
+  const validOrigins = parseOrigins(c.env.VALID_ORIGINS);
+  const matched = validOrigins.find((o) => o.includes(origin));
+
+  if (!matched) {
+    return c.text(`Access Forbidden (CORS): '${origin}'`, 403, {
+      "Access-Control-Allow-Origin": validOrigins[0] ?? "",
+    });
+  }
+
+  await next();
+  c.res = new Response(c.res.body, c.res);
+  c.res.headers.append("Access-Control-Allow-Origin", origin);
+}

package/dist/static/customer-site-worker/src/index.ts

@@ -0,0 +1,242 @@
+/**
+ * Customer Site Worker — replaces Cloudflare Pages Functions routing.
+ *
+ * Routes API, file, shortcode, and email requests to the customer-functions
+ * service binding. Serves static assets via the ASSETS binding for all
+ * other paths.
+ */
+import { Hono } from "hono";
+import { AGENT_CARD_ASSET_PATH, WEBMCP_ASSET_PATH } from "./constants";
+import { corsMiddleware } from "./cors";
+import { proxyMcp } from "./mcp-proxy";
+import { proxyToFunctions } from "./proxy";
+import { DOCS_LIVE_SEARCH_MIN_TIER, meetsTier } from "./tier";
+import type { Env } from "./types";
+
+const app = new Hono<{ Bindings: Env }>();
+
+/**
+ * Host-scoped redirect on the workers.dev URL (#266).
+ *
+ * When `REDIRECT_TO_PRIMARY_DOMAIN` is "true" — emitted on public builds
+ * once the custom domain becomes active — any request that hits the Worker
+ * via its `*.workers.dev` hostname is 301'd to `PRIMARY_DOMAIN`, except
+ * CMS page-proxy traffic identified by the
+ * `X-Leed-Proxy-Request: <COMPANY_ID>` header.
+ *
+ * Why workers.dev stays on at all: the CMS page-proxy fetches the
+ * workers.dev hostname directly so a leed.ai-zone Worker can reach the
+ * customer site without triggering Cloudflare's same-zone loop detection
+ * (522). The header is the gate that distinguishes proxy traffic from
+ * casual workers.dev hits. The companyId match gives weak per-tenant
+ * scoping (defense-in-depth against CMS routing bugs); the protected
+ * content is already public on the canonical domain, so a stronger
+ * shared-secret rotation pipeline would be overkill.
+ *
+ * If `REDIRECT_TO_PRIMARY_DOMAIN !== "true"` the gate is inert — covers
+ * the pre-custom-domain window when workers.dev is the customer's only
+ * public face, and preview builds (which disable workers.dev outright).
+ */
+app.use(async (c, next) => {
+  if (c.env.REDIRECT_TO_PRIMARY_DOMAIN === "true") {
+    const url = new URL(c.req.url);
+    if (url.hostname.endsWith(".workers.dev")) {
+      if (c.req.header("X-Leed-Proxy-Request") !== c.env.COMPANY_ID) {
+        return c.redirect(`https://${c.env.PRIMARY_DOMAIN}${url.pathname}${url.search}`, 301);
+      }
+    }
+  }
+  await next();
+});
+
+app.use(corsMiddleware);
+
+/**
+ * Stamp X-Site-Version and X-Preview on every response — assets, API,
+ * and errors alike. Re-wraps c.res because Responses returned from fetch
+ * (ASSETS and FUNCTIONS service bindings) have immutable headers.
+ */
+app.use(async (c, next) => {
+  await next();
+  c.res = new Response(c.res.body, c.res);
+  c.res.headers.append("X-Site-Version", c.env.SITE_VERSION);
+  c.res.headers.append("X-Preview", String(c.env.PREVIEW_SITE));
+});
+
+/**
+ * Global error handler — logs and returns a JSON error. The middleware
+ * above stamps site headers on the error response too.
+ */
+app.onError((err, c) => {
+  console.error(`Worker error: ${err.message}`);
+  return c.json({ error: err.message }, 500);
+});
+
+/**
+ * Preview guard: block event tracking and form fills on preview sites.
+ * Log the request body for debugging, then return 204.
+ */
+app.post("/api/event", async (c) => {
+  if (c.env.PREVIEW_SITE) {
+    const body = await c.req.text();
+    console.log(`Preview event request: ${body}`);
+    return c.body(null, 204);
+  }
+  return proxyToFunctions(c);
+});
+
+app.post("/api/clerk", async (c) => {
+  if (c.env.PREVIEW_SITE) {
+    const contentType = c.req.header("content-type") ?? "";
+    let body: string;
+    if (contentType.includes("form-data")) {
+      const form = await c.req.formData();
+      body = JSON.stringify(Object.fromEntries(form.entries()));
+    } else {
+      body = await c.req.text();
+    }
+    console.log(`Preview clerk request (${contentType}): ${body}`);
+    return c.body(null, 204);
+  }
+  return proxyToFunctions(c);
+});
+
+/**
+ * Docs MCP (#284): proxy `/mcp/*` and the OAuth `.well-known` discovery paths to
+ * customer-functions (which owns the protocol, auth, and logging), then hydrate
+ * content-bearing tool responses from ASSETS. Disabled on preview sites —
+ * the visitor MCP is a published-site feature, consistent with the event/clerk
+ * preview guards above.
+ *
+ * Per-customer entitlement is enforced HERE at the edge: when `MCP_ENABLED` is
+ * false (baked from the company's `entitlements.mcp` by the wrangler
+ * generator) the surface short-circuits with a 403 and never proxies to
+ * customer-functions. customer-functions keeps its own `entitlements.mcp` gate
+ * as defense-in-depth.
+ */
+const mcpHandler = (c: Parameters<typeof proxyMcp>[0]) => {
+  if (c.env.PREVIEW_SITE) return c.body(null, 404);
+  if (!c.env.MCP_ENABLED) {
+    return c.json({ error: "mcp_not_enabled", message: "MCP not enabled, upgrade service" }, 403);
+  }
+  return proxyMcp(c);
+};
+app.all("/mcp", mcpHandler);
+app.all("/mcp/*", mcpHandler);
+app.get("/.well-known/oauth-protected-resource", mcpHandler);
+// RFC 9728 §3.1 path-inserted location for the `/mcp` resource identifier — the
+// URL an MCP client derives and requests FIRST. Routing only the bare path above
+// is the defect that made Operator MCP unusable (#348): with no
+// protected-resource metadata the client omits the RFC 8707 `resource`
+// indicator, the AS mints an audience-less token, and every request is rejected
+// in an authorize-retry loop. `isMcpProxyPath` (used by CORS) knows this path
+// too, but the predicate is not the router — this registration is what forwards
+// it (#349).
+app.get("/.well-known/oauth-protected-resource/mcp", mcpHandler);
+app.get("/.well-known/oauth-authorization-server", mcpHandler);
+
+/**
+ * Core-site agent surfaces (#294): serve the pre-rendered WebMCP manifest and
+ * A2A AgentCard. site-management renders them at build time from the shared
+ * capability definition (single source of truth) and writes them into the
+ * static asset bundle under `_services/`. They are fetched from the ASSETS
+ * binding rather than baked into wrangler vars because the WebMCP manifest
+ * exceeds the 5.1 kB text-binding limit (a 10 kB manifest fails the version
+ * upload). Read-only / ungated content (it describes already-public pages),
+ * but still per-site opt-in: disabled on preview sites and 404 when
+ * `MCP_ENABLED` is false (the same gate as the Docs MCP surface). CORS (`*`)
+ * is applied by the edge `corsMiddleware` for these `.well-known` paths.
+ *
+ * The discovery path stays gated by `MCP_ENABLED`, and the `_services/*` files
+ * are only written when the entitlement is on — so a disabled build has nothing
+ * to serve at either path. The raw `_services/*` files are an implementation
+ * detail; they only ever mirror content that is already public.
+ */
+async function serveAgentDocument(c: Parameters<typeof proxyMcp>[0], assetPath: string): Promise<Response> {
+  if (c.env.PREVIEW_SITE) return c.body(null, 404);
+  if (!c.env.MCP_ENABLED) return c.body(null, 404);
+  const res = await c.env.ASSETS.fetch(new Request(new URL(assetPath, c.req.url)));
+  if (!res.ok) return c.body(null, 404);
+  return c.body(await res.text(), 200, { "content-type": "application/json" });
+}
+app.get("/.well-known/webmcp", (c) => serveAgentDocument(c, WEBMCP_ASSET_PATH));
+app.get("/.well-known/agent.json", (c) => serveAgentDocument(c, AGENT_CARD_ASSET_PATH));
+
+/**
+ * Remaining API routes proxied to customer-functions via service binding.
+ * /api/lid     — POST session initialization (fingerprint, screen size)
+ * /api/abby/*  — GET page recommendations (vectorize similarity)
+ * /api/sway/*  — GET call-to-action suggestions (vectorize similarity)
+ * /api/poirot  — GET known user lookup (lead identification)
+ * /api/agent/* — GET core-site agent surfaces (#294): the read-only tools
+ *                (search_site, get_site_overview, get_pages_by_id,
+ *                get_pages_by_path, list_recent_posts) that back the WebMCP
+ *                manifest + A2A AgentCard. No dedicated edge route — they fall
+ *                through to this catch-all proxy, then customer-functions enforces
+ *                the `entitlements.mcp` gate and the posts-only scope guard. The
+ *                two batch content endpoints return `X-Fetch-Result: page-resources`,
+ *                which `proxyToFunctions` honors to hydrate each post's `content`
+ *                from ASSETS (shared `assetsHydration` helper). CORS (`*`) is
+ *                applied by the edge `corsMiddleware` above.
+ */
+/**
+ * Live docs search (#329): reject an unentitled site's search traffic AT THE
+ * EDGE, the same shape as the `MCP_ENABLED` gate above, so it never crosses the
+ * service binding and never costs customer-functions a KV company read.
+ *
+ * 404, not the MCP surface's 403: this endpoint is reached from a reader's
+ * browser, so it stays indistinguishable from "does not exist" rather than
+ * advertising a paid feature to scanners — and it matches what
+ * customer-functions itself returns, so the two gates are not tellable apart.
+ *
+ * An OPTIMIZATION, never the authority. customer-functions re-reads the tier
+ * from KV on every request, which is what makes "404s for a downgraded site
+ * WITHOUT a rebuild" hold. Hence `=== false`, never falsiness: a worker
+ * generated before this var existed must DEFER to that authority instead of
+ * 404ing its own search.
+ */
+const searchHandler = (c: Parameters<typeof proxyToFunctions>[0]) => {
+  // Absent tier (a worker generated before ENTITLEMENT_TIER existed) defers to
+  // customer-functions rather than 404ing its own search. Present-but-below
+  // fails closed, matching `hasFeature`.
+  const tier = c.env.ENTITLEMENT_TIER;
+  if (tier !== undefined && !meetsTier(tier, DOCS_LIVE_SEARCH_MIN_TIER)) {
+    return c.json({ error: "not_found" }, 404);
+  }
+  return proxyToFunctions(c);
+};
+app.all("/api/search", searchHandler);
+app.all("/api/search/*", searchHandler);
+
+app.all("/api/*", proxyToFunctions);
+
+/** /f/:assetId/:fileName — GET file/document downloads from R2 */
+app.all("/f/*", proxyToFunctions);
+
+/** /s/:code — GET shortcode redirect (URL shortener) */
+app.all("/s/*", proxyToFunctions);
+
+/**
+ * /e/i/:batchId/:hash.dest — GET email open tracking (1x1 pixel)
+ * /e/u/:batchId/:hash.dest — GET email URL click tracking (redirect)
+ * /e/f/:batchId/:hash.dest — GET email file click tracking (redirect)
+ * /e/o/:batchId/:hash.dest — GET email opt-out (unsubscribe form or process)
+ */
+app.all("/e/*", proxyToFunctions);
+
+/**
+ * Asset fallback for paths the asset binding routes through the Worker via
+ * `run_worker_first` (the homepage and any URL ending in `/`, see
+ * wranglerGenerator). Without this, those page navigations would hit Hono's
+ * default 404 instead of being served from the static asset bundle.
+ *
+ * Uses `app.notFound` rather than `app.all("*", …)` because the wildcard
+ * form competes with the `/api/*`, `/f/*`, `/s/*`, `/e/*` proxy routes:
+ * non-GET requests would land on the asset binding, which only supports
+ * GET/HEAD and returns 405 for everything else (POST /api/event, etc.).
+ * `notFound` only fires when no other route matches, preserving the proxy
+ * routes above. (#266)
+ */
+app.notFound((c) => c.env.ASSETS.fetch(c.req.raw));
+
+export default app;

package/dist/static/customer-site-worker/src/mcp-proxy.ts

@@ -0,0 +1,98 @@
+import type { Context } from "hono";
+import { hydrateResources } from "./assetsHydration";
+import { buildProxyHeaders, fetchFunctions } from "./proxyHeaders";
+import type { DocResourcesPayload, Env } from "./types";
+
+/**
+ * Docs MCP proxy + hydration layer (#284).
+ *
+ * Proxies `/mcp/*` and the OAuth `.well-known` paths to customer-functions,
+ * injecting the trusted `companyId` header. Auth/protocol responses pass through
+ * untouched. On content-bearing JSON-RPC responses (marked
+ * `X-Fetch-Result: page-resources`), the referenced `.md`/`.yml` files are
+ * fetched directly from the ASSETS binding — no origin hop — and filled into each
+ * `DocResource.content` via the shared `assetsHydration` helper (the SAME helper
+ * `proxy.ts proxyToFunctions` uses for the core-site agent surface #294, sharing
+ * the one `page-resources` marker so the two never drift).
+ */
+
+/** True for the Docs MCP paths this worker proxies. */
+export function isMcpProxyPath(pathname: string): boolean {
+  return (
+    pathname === "/mcp" ||
+    pathname.startsWith("/mcp/") ||
+    pathname === "/.well-known/oauth-protected-resource" ||
+    // RFC 9728 §3.1 path-inserted location for the `/mcp` resource identifier.
+    // Clients request this one FIRST; if the proxy does not forward it, fixing
+    // the origin alone leaves Docs MCP broken from the client's view (#349).
+    pathname === "/.well-known/oauth-protected-resource/mcp" ||
+    pathname === "/.well-known/oauth-authorization-server"
+  );
+}
+
+export async function proxyMcp(c: Context<{ Bindings: Env }>): Promise<Response> {
+  const headers = buildProxyHeaders(c);
+
+  // Buffer the request body ONCE into an ArrayBuffer instead of forwarding the
+  // one-time-use stream (`c.req.raw.body`). MCP/OAuth request payloads are small
+  // JSON/form bodies, so buffering is cheap and makes the body retransmittable.
+  //
+  // `redirect: "manual"` is required: customer-functions answers the OAuth
+  // authorize grant with a 302 to the client `redirect_uri`. Even in manual mode
+  // workerd validates that a streamed (one-time-use) body could be replayed and
+  // throws ("one-time-use body … requiring the body to be retransmitted") on the
+  // 302; a buffered body sidesteps that entirely. Manual mode still returns the
+  // 302 untouched so the BROWSER completes the OAuth handoff.
+  const body = c.req.raw.body ? await c.req.arrayBuffer() : undefined;
+  const response = await fetchFunctions(c, {
+    method: c.req.method,
+    headers,
+    body,
+    redirect: "manual",
+  });
+
+  // Only content-bearing tool responses are hydrated. Redirects (the OAuth 302)
+  // and auth/protocol/discovery responses (no page-resources marker) pass through
+  // untouched, with Location/Set-Cookie intact.
+  if (response.status >= 300 && response.status < 400) return response;
+  if (response.headers.get("X-Fetch-Result") !== "page-resources") return response;
+
+  return hydrateMcpResponse(c, response);
+}
+
+interface RpcItem {
+  result?: { content?: Array<{ type: string; text: string }> };
+}
+
+/**
+ * Hydrate the JSON-RPC response when its tool result's text payload is a
+ * `{ resources }` envelope, then re-serialize. Non-content results are left
+ * as-is. Always a single message — the 2026-07-28 revision forbids batching, so
+ * a batch request is rejected upstream and never reaches hydration.
+ */
+async function hydrateMcpResponse(c: Context<{ Bindings: Env }>, response: Response): Promise<Response> {
+  const payload = (await response.json()) as RpcItem;
+
+  await hydrateRpcItem(c, payload);
+
+  const headers = new Headers(response.headers);
+  headers.delete("X-Fetch-Result");
+  return new Response(JSON.stringify(payload), { status: response.status, headers });
+}
+
+/** Hydrate one JSON-RPC result in place, if it carries a page-resources envelope. */
+async function hydrateRpcItem(c: Context<{ Bindings: Env }>, item: RpcItem): Promise<void> {
+  const block = item?.result?.content?.[0];
+  if (block?.type !== "text" || typeof block.text !== "string") return;
+
+  let parsed: DocResourcesPayload;
+  try {
+    parsed = JSON.parse(block.text);
+  } catch {
+    return;
+  }
+  if (!Array.isArray(parsed.resources)) return;
+
+  parsed.resources = await hydrateResources(c, parsed.resources);
+  block.text = JSON.stringify(parsed);
+}

package/dist/static/customer-site-worker/src/proxy.ts

@@ -0,0 +1,92 @@
+import { Context } from "hono";
+import { hydrateResources } from "./assetsHydration";
+import { buildProxyHeaders, fetchFunctions } from "./proxyHeaders";
+import type { DocResourcesPayload, Env } from "./types";
+
+/**
+ * Forwards the request to customer-functions (the `FUNCTIONS` service binding,
+ * or the `FUNCTIONS_ORIGIN` dev override) with context headers injected
+ * (companyId, preview, etc.). Handles two `X-Fetch-Result` response patterns:
+ * `html` (the page-proxy combine) and `page-resources` (the core-site agent
+ * surface #294 — fill each post's `content` from ASSETS via the shared hydrator).
+ */
+export async function proxyToFunctions(c: Context<{ Bindings: Env }>): Promise<Response> {
+  const headers = buildProxyHeaders(c);
+
+  // Buffer the request body ONCE (small JSON/form payloads) so it is
+  // retransmittable. Forwarding the one-time-use stream (`c.req.raw.body`) makes
+  // workerd throw on any redirect because the consumed body cannot be replayed.
+  //
+  // `redirect: "manual"`: never follow a 3xx from the origin. Following would
+  // try to replay the request body and throw; instead the redirect is returned
+  // to the browser with its Location header intact.
+  const body = c.req.raw.body ? await c.req.arrayBuffer() : undefined;
+  const response = await fetchFunctions(c, {
+    method: c.req.method,
+    headers,
+    body,
+    redirect: "manual",
+  });
+  return handleFetchResult(c, response);
+}
+
+/**
+ * Dispatch the response's `X-Fetch-Result` content pattern:
+ *  - `page-resources`: a `{ resources }` JSON envelope whose `content` fields are
+ *    hydrated from ASSETS (the core-site agent surface #294 — the same
+ *    `page-resources` contract the Docs MCP uses, via the shared `assetsHydration`
+ *    helper).
+ *  - `html`: a JSON array of URLs whose HTML fragments are fetched + combined.
+ * Anything else passes through untouched.
+ */
+async function handleFetchResult(c: Context<{ Bindings: Env }>, response: Response): Promise<Response> {
+  const fetchResult = response.headers.get("X-Fetch-Result");
+  const contentType = response.headers.get("content-type") ?? "";
+
+  if (fetchResult === "page-resources" && contentType.includes("application/json")) {
+    return hydratePageResources(c, response);
+  }
+  if (fetchResult !== "html" || !contentType.includes("application/json")) {
+    return response;
+  }
+
+  const urls: string[] = await response.json();
+  console.log(`Fetching ${urls.length} HTML fragments: ${urls.join(", ")}`);
+
+  const fragments = await Promise.all(
+    urls.map(async (url) => {
+      try {
+        const res = await c.env.ASSETS.fetch(new Request(url));
+        return res.ok ? await res.text() : "";
+      } catch {
+        return "";
+      }
+    }),
+  );
+
+  const body = fragments.filter((f) => f !== "").join("");
+  return new Response(body, {
+    status: 200,
+    headers: { "content-type": "text/html" },
+  });
+}
+
+/**
+ * Hydrate a core-site agent `{ resources }` JSON envelope (#294). Unlike the Docs
+ * MCP (a nested JSON-RPC tool result, unwrapped in `mcp-proxy.ts`), these
+ * `/api/agent/pages-*` responses are a plain top-level `{ resources }` body — each
+ * resource's `content` is filled from ASSETS by the shared hydrator, then the
+ * envelope is re-serialized. The `X-Fetch-Result` marker is stripped from the
+ * re-emitted response. A non-`{ resources }` body passes through untouched.
+ */
+async function hydratePageResources(c: Context<{ Bindings: Env }>, response: Response): Promise<Response> {
+  const payload = (await response.json()) as DocResourcesPayload;
+  const headers = new Headers(response.headers);
+  headers.delete("X-Fetch-Result");
+
+  if (!Array.isArray(payload?.resources)) {
+    return new Response(JSON.stringify(payload), { status: response.status, headers });
+  }
+  payload.resources = await hydrateResources(c, payload.resources);
+  return new Response(JSON.stringify(payload), { status: response.status, headers });
+}