@exposify/cli 0.0.2 → 0.0.4

package/README.md

@@ -1,6 +1,6 @@
 # @exposify/cli
 
-The framework-neutral engine behind `exposify-express` and `exposify-next`:
+The framework-neutral engine behind `@exposify/express` and `@exposify/next`:
 the endpoint checklist, the startup-log question, config + clipboard + verify,
 tool descriptions (`describe`), and `inspect` snapshots. You don't use it
 directly: install an adapter (`@exposify/express`, `@exposify/nestjs`,

package/dist/index.d.ts

@@ -23,6 +23,8 @@ interface ScannedRoute {
     exposed: boolean;
     /** Exposed only when listed in `expose`, even a read (core's RouteInfo.optIn), e.g. a Pages Router method detected in code. */
     optIn?: boolean;
+    /** Not a tool unless listed in `expose`, so setup leaves it unticked though it's a read: a page that's just a form, a route that finishes a sign-in. */
+    offByDefault?: boolean;
     /** "page": an App Router page read as a tool (its HTML, like a browser), not a route handler. */
     kind?: "page";
     reason: string;
@@ -132,6 +134,22 @@ interface ScanResult {
         fields: string[];
         others?: string[];
     };
+    /**
+     * Supabase Auth with `@supabase/ssr` (Next.js): which sign-ins Connect
+     * makes on Supabase directly, and where the app signs in (plan
+     * `2026-10-24-supabase-connect.md` Part 2).
+     */
+    supabase?: {
+        direct: Array<"password" | "email-code" | "social">;
+        /** The sign-in calls found, one line each; empty: none found. */
+        found: string[];
+        /** Server sign-ins the form can't run. */
+        unusable?: string[];
+        /** Routes that finish a sign-in; Connect's sign-ins skip them. */
+        callbacks?: string[];
+        /** `@supabase/auth-helpers-nextjs`: an older cookie format, not supported. */
+        authHelpers?: boolean;
+    };
 }
 interface ScanFailure {
     ok: false;
@@ -199,8 +217,13 @@ interface ApplyPlan {
     after: string;
 }
 /** Either a plan, or why this one can't be applied safely (setup then prints the paste instructions). */
+/** `also`: edits to other files that go with the plan, each with what to do by hand when it isn't written. */
 type ApplyOutcome = {
     plan: ApplyPlan;
+    also?: Array<{
+        plan: ApplyPlan;
+        manual: string;
+    }>;
 } | {
     blocked: string;
 };
@@ -278,12 +301,14 @@ interface ConfigStepInput<R extends ScanResult = ScanResult> {
     readLine: (site: CallSite) => string | undefined;
 }
 interface CliAdapter<R extends ScanResult = ScanResult> {
-    /** The command name, e.g. "exposify-express". */
+    /** The command as users type it in hints, e.g. "npx @exposify/next". */
     bin: string;
     /** An example for "pass it explicitly", e.g. "src/server.ts". */
     entryExample: string;
     /** What `--entry` names, for the usage text, e.g. "The file that creates your Express app". */
     entryHelp: string;
+    /** The adapter's own commands, for the usage text: ["generate", "Writes …"]. Its bin runs them, not runCli. */
+    commands?: Array<[name: string, help: string]>;
     locate(cwd: string, entryFlag?: string): AppLocation | undefined;
     scan(location: AppLocation, env: Record<string, string>): Promise<AdapterScanOutcome<R>>;
     /**

package/dist/index.js

@@ -47,6 +47,7 @@ import { DESCRIPTIONS_FILE, parseDescriptions } from "@exposify/core";
 // src/checklist.ts
 var routeKey = (r) => `${r.method} ${r.path}`;
 var isRead = (r) => r.method === "GET" || r.method === "HEAD";
+var readByDefault = (r) => isRead(r) && !r.offByDefault;
 function isLocked(r) {
   return r.marker !== void 0;
 }
@@ -55,10 +56,10 @@ function initialState(routes, opts) {
   const listed = new Set(opts.listedActions ?? []);
   const selected = /* @__PURE__ */ new Set();
   for (const r of routes) {
-    const ticked = opts.hasConfig || isLocked(r) ? r.exposed : isRead(r);
+    const ticked = opts.hasConfig || isLocked(r) ? r.exposed : readByDefault(r);
     if (ticked) selected.add(routeKey(r));
   }
-  const readsOnly = new Set(routes.filter((r) => isLocked(r) ? r.exposed : isRead(r)).map(routeKey));
+  const readsOnly = new Set(routes.filter((r) => isLocked(r) ? r.exposed : readByDefault(r)).map(routeKey));
   return {
     routes,
     selected,
@@ -130,7 +131,7 @@ function reduce(state, action) {
     case "none":
       return setTicks(state, () => false, true);
     case "readsOnly":
-      return setTicks(state, isRead, true);
+      return setTicks(state, readByDefault, true);
     case "filter":
       return { ...state, filter: action.text, cursor: 0 };
     case "enterNuclear": {
@@ -1345,14 +1346,18 @@ function openInBrowser(url) {
 }
 
 // src/run.ts
-var usage = (bin, entryHelp) => `Usage: ${bin} <command> [options]
+var usage = ({ bin, entryHelp, commands: commands2 = [] }) => `Usage: ${bin} <command> [options]
 
 Commands:
   setup     Pick which endpoints agents can call, then get the aiReady() config to paste
   inspect   Show what agents see: every route, whether it's a tool, and why
   describe  Give tools real descriptions (AI-proposed and reviewed, or your own) in
             ${DESCRIPTIONS_FILE}, which aiReady() loads
-
+${commands2.map(([name, help]) => name.length > 8 ? `  ${name}
+            ${help}
+` : `  ${name.padEnd(8)}  ${help}
+`).join("")}${commands2.length ? `            (${bin} <command> --help for its options)
+` : ""}
 Options:
   --entry <path>        ${entryHelp} (default: detected)
   --env-vars <path>     Load these variables into the scan (setup asks about .env otherwise)
@@ -1561,7 +1566,38 @@ function inspect(result, cwd) {
   if (result.actions && result.actions.length > 0) inspectActions(result, cwd);
   inspectLogin(result);
 }
+function supabaseSignIn(s, login) {
+  if (s.authHelpers) return { row: "none: @supabase/auth-helpers-nextjs isn't supported", why: ["It keeps the session in an older cookie format. Move to @supabase/ssr, Supabase's replacement for it."] };
+  const passwordDirect = s.direct.includes("password");
+  const why = [];
+  let row;
+  if (s.found.length === 0) {
+    row = "your Supabase Auth, directly";
+    why.push("Couldn't find where your users sign in, so AI assistants sign in to Supabase directly: a password on /mcp/login, social and email codes on Exposify's page.");
+  } else if (!passwordDirect && login) {
+    row = `your app's own login for passwords (${login.what}); your Supabase Auth, directly, for social and email codes`;
+    why.push('Your password sign-in runs on your server, which may hold your own checks, so the form runs it. Switch to "Sign in with Supabase" on the dashboard to skip it.');
+  } else if (!passwordDirect) {
+    row = "your Supabase Auth, directly, for social and email codes; no password sign-in";
+    why.push(`Your app signs in on the server where the form can't run it: ${(s.unusable ?? []).join("; ")}.`);
+    why.push('Switch on "Sign in with Supabase" on the dashboard to have passwords go to Supabase directly (it skips what that code checks).');
+  } else {
+    row = "your Supabase Auth, directly";
+    why.push(`Your sign-in runs in the browser (${s.found[0]}), so there's no server check to skip.`);
+  }
+  if (s.callbacks?.length) why.push(`Connect's sign-ins don't go through ${s.callbacks.join(", ")}; anything those check is skipped.`);
+  return { row, why };
+}
 function inspectLogin(result) {
+  if (result.supabase) {
+    const { row, why } = supabaseSignIn(result.supabase, result.login);
+    console.log(`
+  Sign-in for AI assistants: ${row}.`);
+    for (const line of why) console.log(dim(`  ${line}`));
+    if (result.supabase.found.length > 1) for (const f of result.supabase.found) console.log(dim(`    found ${f}`));
+    if (result.supabase.direct.length && !result.supabase.authHelpers) console.log(dim("  Check it on a running app: npx @exposify/next test-sign-in"));
+    return;
+  }
   if (!result.login) return;
   console.log(`
   Sign-in for AI assistants: your app's own login, ${result.login.what} (${result.login.fields.join(", ")}).`);
@@ -1748,7 +1784,7 @@ ${bold("Step 2/5")} \xB7 Print "[agentready] MCP ready \u2026" when your server
     console.log(`
 ${green("\u2713 Already set up")}: your aiReady() config already matches. Nothing to change.`);
     if (tty && !args.quick) {
-      await signInStep(args, root, cwd, "Step 4/5", result.login);
+      await signInStep(args, root, cwd, "Step 4/5", result.login, result.supabase);
       const code2 = await describeStep(args, toolRows(result.routes, result.actions), root, cwd, "Step 5/5");
       if (code2 !== 0) return code2;
     }
@@ -1764,6 +1800,7 @@ ${bold("Step 3/5")} \xB7 Your aiReady() config${copyNote}
 `);
   console.log(code.replace(/^/gm, "  "));
   let applied = false;
+  let manual = apply && "plan" in apply ? (apply.also ?? []).map((a) => a.manual) : [];
   if (args.apply !== false && (args.apply || tty && !args.quick)) {
     if (!apply) {
       if (args.apply) console.log(yellow("\n  Can't apply automatically here: paste it as described below."));
@@ -1772,20 +1809,31 @@ ${bold("Step 3/5")} \xB7 Your aiReady() config${copyNote}
   Can't apply automatically: ${apply.blocked}. Paste it as described below.`));
     } else {
       const { summary } = apply.plan;
+      const also = apply.also ?? [];
+      const all = [summary, ...also.map((a) => a.plan.summary.replace(/^./, (c) => c.toLowerCase()))];
       const yes = args.apply === true || ["y", "yes"].includes((await ask(`
-  Apply this: ${summary}? ${dim("(y/N)")} `)).toLowerCase());
+  Apply this: ${all.join(", and ")}? ${dim("(y/N)")} `)).toLowerCase());
       if (yes) {
         const written = writePlan(apply.plan);
         if (written.ok) {
           applied = true;
           console.log(green(`  \u2713 Applied: ${summary}.`) + dim(apply.plan.before === null ? "" : " Review it with git diff."));
+          manual = [];
+          for (const a of also) {
+            const done = writePlan(a.plan);
+            if (done.ok) console.log(green(`  \u2713 Applied: ${a.plan.summary}.`) + dim(" Review it with git diff."));
+            else {
+              console.log(yellow(`  Couldn't apply: ${a.plan.summary} (${done.error}).`));
+              manual.push(a.manual);
+            }
+          }
         } else console.log(yellow(`  Couldn't apply: ${written.error}. Paste it as described below.`));
       }
     }
   }
   if (!applied) console.log(`
   ${hint.lines[0]}`);
-  for (const line of hint.lines.slice(1)) console.log(`    ${line}`);
+  for (const line of [...hint.lines.slice(1), ...manual]) console.log(`    ${line}`);
   if (hint.warning) console.log(yellow(`  ! ${hint.warning}`));
   if (droppedGlobs.length > 0) {
     console.log(yellow(`  ! Dropped exclude ${droppedGlobs.map((g) => `"${g}"`).join(", ")}: it would hide endpoints you ticked.`));
@@ -1834,7 +1882,7 @@ ${bold("Step 3/5")} \xB7 Your aiReady() config${copyNote}
   }
   const finalRoutes = verified ?? toolRows(routesAsSelected(registered, selected), actionRows.map((a) => ({ ...a, exposed: a.marker ? a.exposed : pickedActions.has(a.configKey) })));
   if (tty && !args.quick) {
-    await signInStep(args, root, cwd, "Step 4/5", result.login);
+    await signInStep(args, root, cwd, "Step 4/5", result.login, result.supabase);
     const code2 = await describeStep(args, finalRoutes, root, cwd, "Step 5/5");
     if (code2 !== 0) return code2;
     const proposed = await proposeStep(args, verifiedActions, root, cwd);
@@ -1879,7 +1927,7 @@ ${bold("Optional")} \xB7 Save the tools agents get to ${shown}?`);
   }
   if (save) writeSnapshot(routes, file, cwd);
 }
-async function signInStep(args, root, cwd, title, login) {
+async function signInStep(args, root, cwd, title, login, supabase) {
   if (!args.signIn) return;
   const stacks = detectAuthStacks(root);
   const oauth = stacks.find((s) => s.path === "oauth");
@@ -1892,13 +1940,17 @@ ${bold(title)} \xB7 How your users sign in`);
     console.log(dim("  The README's OAuth section lists the settings to turn on in the provider's dashboard."));
     return;
   }
-  const own = login ? `your app's own login, ${login.what} (${login.fields.join(", ")})` : null;
-  if (own) console.log(`  Found ${own}. AI assistants sign in with it on a form your app serves at /mcp/login, so there's nothing to set up for it.`);
+  const sb = supabase && !supabase.authHelpers ? supabaseSignIn(supabase, login) : null;
+  const own = sb ? sb.row : login ? `your app's own login, ${login.what} (${login.fields.join(", ")})` : null;
+  if (sb) {
+    console.log(`  AI assistants sign in with ${sb.row}. Nothing to set up for it.`);
+    for (const line of sb.why) console.log(dim(`  ${line}`));
+  } else if (own) console.log(`  Found ${own}. AI assistants sign in with it on a form your app serves at /mcp/login, so there's nothing to set up for it.`);
   const signedOut = "agents use your app signed out, and your own checks decide what they can do";
   const have = existingKey(root, process.env);
   if (have) {
     console.log(
-      green(`  \u2713 ${KEY_ENV} is set (${have.from}):`) + (own ? " agents sign in with your app's login, through Exposify's broker." : ` until you add a sign-in method in the dashboard, ${signedOut}.`)
+      green(`  \u2713 ${KEY_ENV} is set (${have.from}):`) + (sb ? ` agents sign in with ${sb.row}, through Exposify's broker.` : own ? " agents sign in with your app's login, through Exposify's broker." : ` until you add a sign-in method in the dashboard, ${signedOut}.`)
     );
     return;
   }
@@ -1931,7 +1983,7 @@ ${bold(title)} \xB7 How your users sign in`);
   process.env[KEY_ENV] = outcome.key;
   console.log(green(`  \u2713 ${written.created ? "Created" : "Updated"} ${relative(cwd, written.path) || written.path} with ${KEY_ENV}`) + ` (project "${outcome.projectName}").`);
   if (!written.ignored) console.log(yellow(`  ! Add .env to .gitignore: it now holds a secret.`));
-  if (own) console.log(`  Your app tells Exposify about its login when it starts with ${KEY_ENV}: nothing to add in the dashboard.`);
+  if (own) console.log(`  Your app tells Exposify about its ${sb ? "Supabase Auth" : "login"} when it starts with ${KEY_ENV}: nothing to add in the dashboard.`);
   else {
     console.log(`  No login form was found, so ${signedOut}.`);
     console.log(`  To have agents act as a signed-in user, add a sign-in method in the dashboard (presets for GitHub, Google, Supabase, \u2026).`);
@@ -2155,11 +2207,11 @@ async function runCli(argv, forAdapter, cwd = process.cwd()) {
     args = parseArgs(argv);
   } catch (err) {
     console.error(red(err.message));
-    console.error(usage(adapter.bin, adapter.entryHelp));
+    console.error(usage(adapter));
     return 2;
   }
   if (args.help || !args.command) {
-    console.log(usage(adapter.bin, adapter.entryHelp));
+    console.log(usage(adapter));
     return args.help ? 0 : 2;
   }
   if (args.ci) disableColor();
@@ -2180,7 +2232,7 @@ async function runCli(argv, forAdapter, cwd = process.cwd()) {
   if (args.command === "setup") return setup(args, cwd);
   if (args.command === "describe") return describeCommand(args, cwd);
   console.error(red(`unknown command: ${args.command}`));
-  console.error(usage(adapter.bin, adapter.entryHelp));
+  console.error(usage(adapter));
   return 2;
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/cli",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/core": "0.3.14"
+    "@exposify/core": "0.3.16"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -33,7 +33,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "description": "The framework-neutral engine behind exposify-express and exposify-next: guided setup, inspect and describe for Exposify adapters.",
+  "description": "The framework-neutral engine behind @exposify/express and @exposify/next: guided setup, inspect and describe for Exposify adapters.",
   "author": "Exposify",
   "keywords": [
     "mcp",