@exposify/cli 0.0.1 → 0.1.0

package/README.md

@@ -1,6 +1,6 @@
 # @exposify/cli
 
-The framework-neutral engine behind `exposify-express` and `exposify-next`:
+The framework-neutral engine behind `@exposify/express` and `@exposify/next`:
 the endpoint checklist, the startup-log question, config + clipboard + verify,
 tool descriptions (`describe`), and `inspect` snapshots. You don't use it
 directly: install an adapter (`@exposify/express`, `@exposify/nestjs`,

package/dist/index.d.ts

@@ -132,6 +132,22 @@ interface ScanResult {
         fields: string[];
         others?: string[];
     };
+    /**
+     * Supabase Auth with `@supabase/ssr` (Next.js): which sign-ins Connect
+     * makes on Supabase directly, and where the app signs in (plan
+     * `2026-10-24-supabase-connect.md` Part 2).
+     */
+    supabase?: {
+        direct: Array<"password" | "email-code" | "social">;
+        /** The sign-in calls found, one line each; empty: none found. */
+        found: string[];
+        /** Server sign-ins the form can't run. */
+        unusable?: string[];
+        /** Routes that finish a sign-in; Connect's sign-ins skip them. */
+        callbacks?: string[];
+        /** `@supabase/auth-helpers-nextjs`: an older cookie format, not supported. */
+        authHelpers?: boolean;
+    };
 }
 interface ScanFailure {
     ok: false;
@@ -278,7 +294,7 @@ interface ConfigStepInput<R extends ScanResult = ScanResult> {
     readLine: (site: CallSite) => string | undefined;
 }
 interface CliAdapter<R extends ScanResult = ScanResult> {
-    /** The command name, e.g. "exposify-express". */
+    /** The command as users type it in hints, e.g. "npx @exposify/next". */
     bin: string;
     /** An example for "pass it explicitly", e.g. "src/server.ts". */
     entryExample: string;

package/dist/index.js

@@ -1234,36 +1234,14 @@ import { spawn } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { join as join3 } from "path";
 import { parseEnv as parseEnv2 } from "util";
+import { authStacksOf, dependencyNames } from "@exposify/core";
 var KEY_ENV = "EXPOSIFY_KEY";
-var KNOWN = [
-  { test: (p) => p.startsWith("@auth0/") || p === "auth0" || p === "express-openid-connect", label: "Auth0", path: "oauth" },
-  { test: (p) => p.startsWith("@clerk/"), label: "Clerk", path: "oauth" },
-  { test: (p) => p.startsWith("@workos-inc/"), label: "WorkOS", path: "oauth" },
-  { test: (p) => p.startsWith("@kinde-oss/"), label: "Kinde", path: "oauth" },
-  { test: (p) => p === "@supabase/supabase-js" || p === "@supabase/ssr", label: "Supabase Auth", path: "broker" },
-  { test: (p) => p === "firebase" || p === "firebase-admin", label: "Firebase Auth", path: "broker" },
-  { test: (p) => p === "next-auth" || p === "@auth/core", label: "Auth.js (NextAuth)", path: "broker" },
-  { test: (p) => p === "better-auth", label: "Better Auth", path: "broker" },
-  { test: (p) => p === "lucia", label: "Lucia", path: "broker" },
-  { test: (p) => p === "passport", label: "Passport", path: "broker" },
-  { test: (p) => p === "iron-session", label: "iron-session", path: "broker" },
-  { test: (p) => p === "express-session" || p === "cookie-session", label: "server sessions", path: "broker" },
-  { test: (p) => p === "jsonwebtoken" || p === "jose" || p === "@nestjs/jwt", label: "your own JWTs", path: "broker" }
-];
 function detectAuthStacks(root) {
-  let pkg;
   try {
-    pkg = JSON.parse(readFileSync6(join3(root, "package.json"), "utf8"));
+    return authStacksOf(dependencyNames(JSON.parse(readFileSync6(join3(root, "package.json"), "utf8"))));
   } catch {
     return [];
   }
-  const names = Object.keys({ ...pkg.devDependencies, ...pkg.dependencies });
-  const found = [];
-  for (const known of KNOWN) {
-    const hit = names.find(known.test);
-    if (hit && !found.some((f) => f.label === known.label)) found.push({ label: known.label, pkg: hit, path: known.path });
-  }
-  return found;
 }
 function appNameOf(root) {
   try {
@@ -1583,7 +1561,38 @@ function inspect(result, cwd) {
   if (result.actions && result.actions.length > 0) inspectActions(result, cwd);
   inspectLogin(result);
 }
+function supabaseSignIn(s, login) {
+  if (s.authHelpers) return { row: "none: @supabase/auth-helpers-nextjs isn't supported", why: ["It keeps the session in an older cookie format. Move to @supabase/ssr, Supabase's replacement for it."] };
+  const passwordDirect = s.direct.includes("password");
+  const why = [];
+  let row;
+  if (s.found.length === 0) {
+    row = "your Supabase Auth, directly";
+    why.push("Couldn't find where your users sign in, so AI assistants sign in to Supabase directly: a password on /mcp/login, social and email codes on Exposify's page.");
+  } else if (!passwordDirect && login) {
+    row = `your app's own login for passwords (${login.what}); your Supabase Auth, directly, for social and email codes`;
+    why.push('Your password sign-in runs on your server, which may hold your own checks, so the form runs it. Switch to "Sign in with Supabase" on the dashboard to skip it.');
+  } else if (!passwordDirect) {
+    row = "your Supabase Auth, directly, for social and email codes; no password sign-in";
+    why.push(`Your app signs in on the server where the form can't run it: ${(s.unusable ?? []).join("; ")}.`);
+    why.push('Switch on "Sign in with Supabase" on the dashboard to have passwords go to Supabase directly (it skips what that code checks).');
+  } else {
+    row = "your Supabase Auth, directly";
+    why.push(`Your sign-in runs in the browser (${s.found[0]}), so there's no server check to skip.`);
+  }
+  if (s.callbacks?.length) why.push(`Connect's sign-ins don't go through ${s.callbacks.join(", ")}; anything those check is skipped.`);
+  return { row, why };
+}
 function inspectLogin(result) {
+  if (result.supabase) {
+    const { row, why } = supabaseSignIn(result.supabase, result.login);
+    console.log(`
+  Sign-in for AI assistants: ${row}.`);
+    for (const line of why) console.log(dim(`  ${line}`));
+    if (result.supabase.found.length > 1) for (const f of result.supabase.found) console.log(dim(`    found ${f}`));
+    if (result.supabase.direct.length && !result.supabase.authHelpers) console.log(dim("  Check it on a running app: npx @exposify/next test-sign-in"));
+    return;
+  }
   if (!result.login) return;
   console.log(`
   Sign-in for AI assistants: your app's own login, ${result.login.what} (${result.login.fields.join(", ")}).`);
@@ -1770,7 +1779,7 @@ ${bold("Step 2/5")} \xB7 Print "[agentready] MCP ready \u2026" when your server
     console.log(`
 ${green("\u2713 Already set up")}: your aiReady() config already matches. Nothing to change.`);
     if (tty && !args.quick) {
-      await signInStep(args, root, cwd, "Step 4/5", result.login);
+      await signInStep(args, root, cwd, "Step 4/5", result.login, result.supabase);
       const code2 = await describeStep(args, toolRows(result.routes, result.actions), root, cwd, "Step 5/5");
       if (code2 !== 0) return code2;
     }
@@ -1856,7 +1865,7 @@ ${bold("Step 3/5")} \xB7 Your aiReady() config${copyNote}
   }
   const finalRoutes = verified ?? toolRows(routesAsSelected(registered, selected), actionRows.map((a) => ({ ...a, exposed: a.marker ? a.exposed : pickedActions.has(a.configKey) })));
   if (tty && !args.quick) {
-    await signInStep(args, root, cwd, "Step 4/5", result.login);
+    await signInStep(args, root, cwd, "Step 4/5", result.login, result.supabase);
     const code2 = await describeStep(args, finalRoutes, root, cwd, "Step 5/5");
     if (code2 !== 0) return code2;
     const proposed = await proposeStep(args, verifiedActions, root, cwd);
@@ -1901,7 +1910,7 @@ ${bold("Optional")} \xB7 Save the tools agents get to ${shown}?`);
   }
   if (save) writeSnapshot(routes, file, cwd);
 }
-async function signInStep(args, root, cwd, title, login) {
+async function signInStep(args, root, cwd, title, login, supabase) {
   if (!args.signIn) return;
   const stacks = detectAuthStacks(root);
   const oauth = stacks.find((s) => s.path === "oauth");
@@ -1914,11 +1923,18 @@ ${bold(title)} \xB7 How your users sign in`);
     console.log(dim("  The README's OAuth section lists the settings to turn on in the provider's dashboard."));
     return;
   }
-  const own = login ? `your app's own login, ${login.what} (${login.fields.join(", ")})` : null;
-  if (own) console.log(`  Found ${own}. AI assistants sign in with it on a form your app serves at /mcp/login, so there's nothing to set up for it.`);
+  const sb = supabase && !supabase.authHelpers ? supabaseSignIn(supabase, login) : null;
+  const own = sb ? sb.row : login ? `your app's own login, ${login.what} (${login.fields.join(", ")})` : null;
+  if (sb) {
+    console.log(`  AI assistants sign in with ${sb.row}. Nothing to set up for it.`);
+    for (const line of sb.why) console.log(dim(`  ${line}`));
+  } else if (own) console.log(`  Found ${own}. AI assistants sign in with it on a form your app serves at /mcp/login, so there's nothing to set up for it.`);
+  const signedOut = "agents use your app signed out, and your own checks decide what they can do";
   const have = existingKey(root, process.env);
   if (have) {
-    console.log(green(`  \u2713 ${KEY_ENV} is set (${have.from}):`) + " agents sign in through Exposify's broker.");
+    console.log(
+      green(`  \u2713 ${KEY_ENV} is set (${have.from}):`) + (sb ? ` agents sign in with ${sb.row}, through Exposify's broker.` : own ? " agents sign in with your app's login, through Exposify's broker." : ` until you add a sign-in method in the dashboard, ${signedOut}.`)
+    );
     return;
   }
   const via = stacks[0] ? `With ${stacks[0].label}` : "With your own login";
@@ -1950,8 +1966,11 @@ ${bold(title)} \xB7 How your users sign in`);
   process.env[KEY_ENV] = outcome.key;
   console.log(green(`  \u2713 ${written.created ? "Created" : "Updated"} ${relative(cwd, written.path) || written.path} with ${KEY_ENV}`) + ` (project "${outcome.projectName}").`);
   if (!written.ignored) console.log(yellow(`  ! Add .env to .gitignore: it now holds a secret.`));
-  if (own) console.log(`  Your app tells Exposify about its login when it starts with ${KEY_ENV}: nothing to add in the dashboard.`);
-  else console.log(`  Next, in the dashboard: add how your users log in (presets for GitHub, Google, Supabase, \u2026).`);
+  if (own) console.log(`  Your app tells Exposify about its ${sb ? "Supabase Auth" : "login"} when it starts with ${KEY_ENV}: nothing to add in the dashboard.`);
+  else {
+    console.log(`  No login form was found, so ${signedOut}.`);
+    console.log(`  To have agents act as a signed-in user, add a sign-in method in the dashboard (presets for GitHub, Google, Supabase, \u2026).`);
+  }
   console.log(dim(`  Deploying? Set ${KEY_ENV} there too. Restart your server to pick it up.`));
 }
 function serviceConfig(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/cli",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/core": "0.3.13"
+    "@exposify/core": "0.4.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -33,7 +33,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "description": "The framework-neutral engine behind exposify-express and exposify-next: guided setup, inspect and describe for Exposify adapters.",
+  "description": "The framework-neutral engine behind @exposify/express and @exposify/next: guided setup, inspect and describe for Exposify adapters.",
   "author": "Exposify",
   "keywords": [
     "mcp",