@exposify/next 0.0.2 → 0.0.4

package/dist/exposify-next.js

@@ -6,8 +6,8 @@ import { runCli } from "@exposify/cli";
 
 // src/codegen.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync6, readdirSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join6, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync7, readdirSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join7, relative as relative2, sep as sep2 } from "path";
 import { DESCRIPTIONS_FILE, authStacksOf, dependencyNames, parseDescriptions } from "@exposify/core";
 import { globSync } from "tinyglobby";
 
@@ -336,8 +336,8 @@ function readsOf(fn, formNames, st, depth) {
       st.readsAll = true;
       const decl = [...parents].reverse().find((p) => !["TSAsExpression", "TSSatisfiesExpression", "ParenthesizedExpression"].includes(p.type));
       if (decl?.type === "VariableDeclarator" && decl.id.type === "ObjectPattern") {
-        for (const prop of decl.id.properties) {
-          const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+        for (const prop2 of decl.id.properties) {
+          const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
           if (key) addField(st, key, {}, false);
         }
       }
@@ -379,19 +379,19 @@ function analyzeFields(fn, roles, ctx) {
     if (literal?.type === "TSTypeLiteral") {
       for (const m of literal.members) if (m.type === "TSPropertySignature" && keyName(m.key)) members.set(keyName(m.key), m);
     }
-    for (const prop of id.properties) {
-      const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+    for (const prop2 of id.properties) {
+      const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
       if (!key) {
-        st.unresolved.push(`line ${lineOf(prop)}: a rest element in parameter ${role.name}`);
+        st.unresolved.push(`line ${lineOf(prop2)}: a rest element in parameter ${role.name}`);
         continue;
       }
       const member = members.get(key);
       const hint = annotated(member?.typeAnnotation?.typeAnnotation);
       if (!hint) {
-        st.unresolved.push(`line ${lineOf(prop)}: ${key} has no type it can read (string, number, boolean or a union of strings)`);
+        st.unresolved.push(`line ${lineOf(prop2)}: ${key} has no type it can read (string, number, boolean or a union of strings)`);
         continue;
       }
-      st.fields.set(key, { name: key, type: hint.type, ...hint.enum ? { enum: hint.enum } : {}, ...member?.optional || prop.value.type === "AssignmentPattern" ? {} : { required: true } });
+      st.fields.set(key, { name: key, type: hint.type, ...hint.enum ? { enum: hint.enum } : {}, ...member?.optional || prop2.value.type === "AssignmentPattern" ? {} : { required: true } });
     }
   });
   return { fields: [...st.fields.values()], readsAll: st.readsAll, unresolved: st.unresolved };
@@ -469,20 +469,20 @@ function renderedAttributes(el, fn, use, mod) {
     for (const p of pattern.properties) {
       if (p.type === "RestElement" && p.argument.type === "Identifier") restName = p.argument.name;
       if (p.type !== "ObjectProperty") continue;
-      const prop = keyName(p.key);
+      const prop2 = keyName(p.key);
       const value = p.value.type === "AssignmentPattern" ? p.value.left : p.value;
-      if (!prop || value.type !== "Identifier") continue;
+      if (!prop2 || value.type !== "Identifier") continue;
       const fallback = p.value.type === "AssignmentPattern" ? attrValue({ type: "JSXAttribute", value: { type: "JSXExpressionContainer", expression: p.value.right } }, [], mod.scope) : void 0;
-      locals.set(value.name, { prop, ...fallback ? { fallback } : {} });
+      locals.set(value.name, { prop: prop2, ...fallback ? { fallback } : {} });
     }
   }
-  const named2 = new Set([...locals.values()].map((l) => l.prop));
+  const named = new Set([...locals.values()].map((l) => l.prop));
   const out = /* @__PURE__ */ new Map();
   for (const a of el.openingElement.attributes) {
     if (a.type === "JSXSpreadAttribute") {
       const arg = unwrapTs(a.argument);
       if (arg?.type === "Identifier" && (arg.name === restName || arg.name === propsName)) {
-        for (const [k, v] of use) if (arg.name === propsName || !named2.has(k)) out.set(k, v);
+        for (const [k, v] of use) if (arg.name === propsName || !named.has(k)) out.set(k, v);
       }
       continue;
     }
@@ -490,14 +490,14 @@ function renderedAttributes(el, fn, use, mod) {
     if (!key) continue;
     const expr = a.value?.type === "JSXExpressionContainer" ? unwrapTs(a.value.expression) : void 0;
     if (expr?.type === "Identifier" && locals.has(expr.name)) {
-      const { prop, fallback } = locals.get(expr.name);
-      const v = use.has(prop) ? use.get(prop) : fallback;
+      const { prop: prop2, fallback } = locals.get(expr.name);
+      const v = use.has(prop2) ? use.get(prop2) : fallback;
       if (v !== void 0) out.set(key, v);
       continue;
     }
     if (expr?.type === "MemberExpression" && unwrapTs(expr.object)?.type === "Identifier" && unwrapTs(expr.object).name === propsName) {
-      const prop = keyName(expr.property);
-      if (prop && use.has(prop)) out.set(key, use.get(prop));
+      const prop2 = keyName(expr.property);
+      if (prop2 && use.has(prop2)) out.set(key, use.get(prop2));
       continue;
     }
     out.set(key, attrValue(a, [], mod.scope));
@@ -893,8 +893,8 @@ function actionHosts(pages, graph, actionExports) {
 // src/login.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
-import { LOGIN_NAME, NOT_A_LOGIN, loginFields } from "@exposify/core";
-var SESSION_CODE = /cookies\(\)\s*\.set|\.cookies\.set\(|cookieStore\.set|set-cookie|setCookie|\bjwt\.sign\(|new\s+SignJWT|\bsign\(|createSession|session\.(save|create)|\.login\(/i;
+import { LOGIN_NAME, NOT_A_LOGIN, NOT_A_VERIFY, START_NAME, VERIFY_NAME, loginFields, startFields, verifyFields } from "@exposify/core";
+var SESSION_CODE = /cookies\(\)\)?\s*\.set|\.cookies\.set\(|cookieStore\.set|set-cookie|setCookie|\bjwt\.sign\(|new\s+SignJWT|\bsign\(|createSession|session\.(save|create)|\.login\(/i;
 function routeBodyFields(source) {
   const names = /* @__PURE__ */ new Set();
   let body = null;
@@ -915,16 +915,27 @@ function routeBodyFields(source) {
   }
   return names.size && body ? { fields: [...names], body } : null;
 }
-function actionCandidate(a) {
-  if (NOT_A_LOGIN.test(a.key) || NOT_A_LOGIN.test(a.action.name)) return null;
+var LOGIN_RULE = { not: NOT_A_LOGIN, name: LOGIN_NAME, mustBeNamed: false, fields: (n) => loginFields(n), session: true };
+var VERIFY_RULE = { not: NOT_A_VERIFY, name: VERIFY_NAME, mustBeNamed: true, fields: (n, named) => verifyFields(n, named), session: true };
+var START_RULE = { not: NOT_A_LOGIN, name: new RegExp(`${LOGIN_NAME.source}|${START_NAME.source}`, "i"), mustBeNamed: true, fields: (n) => startFields(n), session: false };
+var knownKey = (l) => l.kind === "action" ? `${l.file}#${l.export}` : l.file;
+function actionCandidate(a, rule, known) {
+  if (rule.not.test(a.key) || rule.not.test(a.action.name)) return null;
   if (!a.action.params.some((p) => p.role === "formData" || p.role === "object")) return null;
-  const fields = loginFields(a.action.fields.map((f) => f.name));
+  const isNamed = rule.name.test(a.action.name);
+  if (rule.mustBeNamed && !isNamed) return null;
+  const fields = rule.fields(
+    a.action.fields.map((f) => f.name),
+    isNamed
+  );
   if (!fields) return null;
-  if (!a.action.setsCookies && !LOGIN_NAME.test(a.action.name)) return null;
+  if (rule.session && !a.action.setsCookies && !LOGIN_NAME.test(a.action.name) && !(rule === LOGIN_RULE && known.has(`${a.file}#${a.action.name}`))) return null;
   return { kind: "action", key: a.key, export: a.action.name, file: a.file, fields, ...a.host ? { host: a.host } : {} };
 }
-function routeCandidate(root, r) {
-  if (r.router !== "app" || !r.module.methods.includes("POST") || r.params.length > 0 || NOT_A_LOGIN.test(r.path)) return null;
+function routeCandidate(root, r, rule, known) {
+  if (r.router !== "app" || !r.module.methods.includes("POST") || r.params.length > 0 || rule.not.test(r.path)) return null;
+  const isNamed = rule.name.test(r.path);
+  if (rule.mustBeNamed && !isNamed) return null;
   let source;
   try {
     source = readFileSync2(join2(root, r.file), "utf8");
@@ -932,29 +943,47 @@ function routeCandidate(root, r) {
     return null;
   }
   const read2 = routeBodyFields(source);
-  const fields = read2 ? loginFields(read2.fields) : null;
+  const fields = read2 ? rule.fields(read2.fields, isNamed) : null;
   if (!read2 || !fields) return null;
-  if (!LOGIN_NAME.test(r.path) && !SESSION_CODE.test(source)) return null;
+  if (rule.session && !LOGIN_NAME.test(r.path) && !SESSION_CODE.test(source) && !(rule === LOGIN_RULE && known.has(r.file))) return null;
   return { kind: "route", path: r.path, file: r.file, fields, body: read2.body };
 }
-var named = (l) => LOGIN_NAME.test(l.kind === "action" ? l.export : l.path);
-function findLogin(d) {
-  const candidates = [];
+var nameOf = (l) => l.kind === "action" ? l.export : l.path;
+function candidates(d, rule, known) {
+  const out = [];
   for (const a of d.actions) {
-    const c = actionCandidate(a);
-    if (c) candidates.push(c);
+    const c = actionCandidate(a, rule, known);
+    if (c) out.push(c);
   }
   for (const r of d.routes) {
-    const c = routeCandidate(d.root, r);
-    if (c) candidates.push(c);
-  }
-  if (candidates.length === 0) return null;
-  const score = (l) => (named(l) ? 0 : 4) + (l.kind === "action" && l.host ? 0 : 2) + l.fields.length / 100;
-  candidates.sort((a, b) => score(a) - score(b));
-  return { login: candidates[0], others: candidates.slice(1) };
+    const c = routeCandidate(d.root, r, rule, known);
+    if (c) out.push(c);
+  }
+  const score = (l) => (rule === LOGIN_RULE && known.has(knownKey(l)) ? 0 : 8) + (rule.name.test(nameOf(l)) ? 0 : 4) + (l.kind === "action" && l.host ? 0 : 2) + l.fields.length / 100;
+  return out.sort((a, b) => score(a) - score(b));
+}
+function findLogin(d, known = /* @__PURE__ */ new Set()) {
+  const verifies = candidates(d, VERIFY_RULE, known);
+  const logins = candidates(d, LOGIN_RULE, known);
+  if (logins.length > 0) {
+    const [first2, ...others2] = logins;
+    return { login: { ...first2, ...verifies[0] ? { verify: verifies[0] } : {} }, others: others2 };
+  }
+  const pairs = [];
+  for (const start of candidates(d, START_RULE, known)) {
+    const who = new Set(start.fields.filter((f) => f.kind === "identity").map((f) => f.name));
+    const verify = verifies.find((v) => v.fields.some((f) => who.has(f.name))) ?? verifies.find((v) => !v.fields.some((f) => f.kind === "identity"));
+    if (verify) pairs.push({ ...start, passwordless: true, verify });
+  }
+  if (pairs.length === 0) return null;
+  const [first, ...others] = pairs;
+  return { login: first, others };
+}
+function stepLabel(l) {
+  return l.kind === "action" ? `server action ${l.export} (${l.file})` : `POST ${l.path} (${l.file})`;
 }
 function loginLabel(l) {
-  return l.kind === "action" ? `server action ${l.export} (${l.file})` : `POST ${l.path} (${l.file})`;
+  return l.verify ? `${stepLabel(l)}, then a code: ${stepLabel(l.verify)}` : stepLabel(l);
 }
 
 // src/guards.ts
@@ -1136,9 +1165,9 @@ function pageSearchParams(program) {
     if (!FUNCTION_TYPES.has(fn.type)) return;
     const param = fn.params?.[0];
     if (param?.type === "ObjectPattern") {
-      for (const prop of param.properties) {
-        if (prop.type !== "ObjectProperty" || keyName(prop.key) !== "searchParams") continue;
-        const value = prop.value.type === "AssignmentPattern" ? prop.value.left : prop.value;
+      for (const prop2 of param.properties) {
+        if (prop2.type !== "ObjectProperty" || keyName(prop2.key) !== "searchParams") continue;
+        const value = prop2.value.type === "AssignmentPattern" ? prop2.value.left : prop2.value;
         if (value.type === "Identifier") sources.add(value.name);
         for (const k of patternKeys(value)) names.add(k);
       }
@@ -1205,10 +1234,10 @@ function staticMetadata(program) {
       const init = unwrapTs(d.init);
       if (d.id?.type !== "Identifier" || d.id.name !== "metadata" || init?.type !== "ObjectExpression") continue;
       const out = {};
-      for (const prop of init.properties) {
-        if (prop.type !== "ObjectProperty") continue;
-        const key = keyName(prop.key);
-        const value = unwrapTs(prop.value);
+      for (const prop2 of init.properties) {
+        if (prop2.type !== "ObjectProperty") continue;
+        const key = keyName(prop2.key);
+        const value = unwrapTs(prop2.value);
         if (key === "description") {
           const s = stringValue(value);
           if (s) out.description = s;
@@ -1311,15 +1340,15 @@ function readTsconfig(root) {
   }
 }
 function asFile(path) {
-  const candidates = [path, ...EXTENSIONS.map((e) => path + e), ...EXTENSIONS.map((e) => join5(path, `index${e}`))];
-  if (/\.[mc]?jsx?$/.test(path)) candidates.push(...EXTENSIONS.map((e) => path.replace(/\.[mc]?jsx?$/, e)));
-  return candidates.find((c) => existsSync(c) && statSync(c).isFile());
+  const candidates2 = [path, ...EXTENSIONS.map((e) => path + e), ...EXTENSIONS.map((e) => join5(path, `index${e}`))];
+  if (/\.[mc]?jsx?$/.test(path)) candidates2.push(...EXTENSIONS.map((e) => path.replace(/\.[mc]?jsx?$/, e)));
+  return candidates2.find((c) => existsSync(c) && statSync(c).isFile());
 }
 function moduleLoader(root) {
   const { baseUrl, paths } = readTsconfig(root);
   const base = join5(root, baseUrl ?? ".");
   const cache = /* @__PURE__ */ new Map();
-  const candidates = (specifier2, fromFile) => {
+  const candidates2 = (specifier2, fromFile) => {
     if (specifier2.startsWith(".")) return [resolve(root, dirname(fromFile), specifier2)];
     for (const [pattern, targets] of Object.entries(paths ?? {})) {
       const star = pattern.indexOf("*");
@@ -1336,7 +1365,7 @@ function moduleLoader(root) {
     const key = `${fromFile}\0${specifier2}`;
     if (cache.has(key)) return cache.get(key);
     let found;
-    for (const candidate of candidates(specifier2, fromFile)) {
+    for (const candidate of candidates2(specifier2, fromFile)) {
       const path = asFile(candidate);
       const rel = path && relative(root, path);
       if (!path || !rel || rel.startsWith("..") || rel.split(sep).includes("node_modules")) continue;
@@ -1368,11 +1397,11 @@ function writtenInput(n) {
   n = unwrapTs(n);
   if (n?.type !== "ObjectExpression") return "opaque";
   const out = {};
-  for (const prop of n.properties) {
-    const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+  for (const prop2 of n.properties) {
+    const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
     if (!key) continue;
     let values;
-    walk(prop.value, (c) => {
+    walk(prop2.value, (c) => {
       if (values || c.type !== "CallExpression" || keyName(c.callee?.property) !== "enum") return;
       const list = unwrapTs(c.arguments[0]);
       const items = list?.type === "ArrayExpression" ? list.elements.map((e) => stringValue(e)) : [];
@@ -1392,13 +1421,13 @@ function markerOf(init, imports) {
   const meta = call.arguments[1];
   const marker = { kind: "described" };
   if (meta?.type === "ObjectExpression") {
-    for (const prop of meta.properties) {
-      if (prop.type !== "ObjectProperty") continue;
-      const key = keyName(prop.key);
-      const value = stringValue(prop.value);
+    for (const prop2 of meta.properties) {
+      if (prop2.type !== "ObjectProperty") continue;
+      const key = keyName(prop2.key);
+      const value = stringValue(prop2.value);
       if (key === "name" && value) marker.name = value;
       if (key === "description" && value) marker.description = value;
-      if (key === "input") marker.input = writtenInput(prop.value);
+      if (key === "input") marker.input = writtenInput(prop2.value);
     }
   }
   return { marker, handler };
@@ -1669,13 +1698,13 @@ function findInlineActions(source, file) {
   const program = parseModule(source, file);
   if (!program) return [];
   const out = [];
-  const named2 = /* @__PURE__ */ new Map();
+  const named = /* @__PURE__ */ new Map();
   walk(program, (n) => {
-    if (n.type === "VariableDeclarator" && n.id.type === "Identifier" && n.init) named2.set(unwrapTs(n.init), n.id.name);
+    if (n.type === "VariableDeclarator" && n.id.type === "Identifier" && n.init) named.set(unwrapTs(n.init), n.id.name);
     if (!FUNCTION_TYPES.has(n.type) || n.body?.type !== "BlockStatement") return;
     if (!n.body.directives.some((d) => d.value?.value === "use server")) return;
     if (isActionModule(program) && program.body.some((s) => s === n || s.declaration === n || s.declaration?.declarations?.some((d) => unwrapTs(d.init) === n))) return;
-    const name = n.id?.name ?? named2.get(n);
+    const name = n.id?.name ?? named.get(n);
     out.push({ ...name ? { name } : {}, line: n.loc?.start.line ?? 1 });
   });
   return out;
@@ -1696,13 +1725,13 @@ function findAiReadyCall(source, file) {
     const call = { line: n.loc?.start.line ?? 1, otherKeys: [] };
     const options = unwrapTs(n.arguments[1]);
     if (options && options.type !== "ObjectExpression") call.otherKeys.push("(options variable)");
-    for (const prop of options?.type === "ObjectExpression" ? options.properties : []) {
-      const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+    for (const prop2 of options?.type === "ObjectExpression" ? options.properties : []) {
+      const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
       if (!key) {
         call.otherKeys.push("(spread)");
         continue;
       }
-      const value = unwrapTs(prop.value);
+      const value = unwrapTs(prop2.value);
       if (key === "expose" && stringValue(value) === "*") call.expose = "*";
       else if ((key === "expose" || key === "exclude") && value?.type === "ArrayExpression") {
         call[key] = value.elements.map((e) => stringValue(e)).filter((s) => s !== void 0);
@@ -1733,6 +1762,229 @@ function findAiReadyCall(source, file) {
   return found;
 }
 
+// src/supabase.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
+var AUTH_CALLS = {
+  signInWithPassword: "password",
+  signInWithOtp: "email-code",
+  verifyOtp: "email-code",
+  signInWithOAuth: "social",
+  signInWithIdToken: "other",
+  signInWithSSO: "other",
+  signInAnonymously: "other",
+  signInWithWeb3: "other"
+};
+var MFA_CALLS = /* @__PURE__ */ new Set(["challenge", "verify", "challengeAndVerify"]);
+var APP_SERVER_FILE = /^(page|layout|template|route|default|loading|not-found|forbidden|unauthorized|error|global-error)\.[^.]+$/;
+var MIDDLEWARE_FILE = /^(src\/)?(middleware|proxy|instrumentation)\.[^./]+$/;
+var directive2 = (program) => program.directives?.[0]?.value?.value;
+var baseName = (f) => f.slice(f.lastIndexOf("/") + 1);
+function isAuthObject(n) {
+  n = unwrapTs(n);
+  if (n?.type === "Identifier") return n.name === "auth";
+  return (n?.type === "MemberExpression" || n?.type === "OptionalMemberExpression") && keyName(n.property) === "auth" && !n.computed;
+}
+var propertyOf = (n) => n.computed ? stringValue(n.property) : keyName(n.property);
+function prop(obj, name) {
+  obj = unwrapTs(obj);
+  if (obj?.type !== "ObjectExpression") return void 0;
+  return obj.properties.find((p) => p.type === "ObjectProperty" && keyName(p.key) === name)?.value;
+}
+function findSupabase(root, files, graph, dependencies, dirs) {
+  const ssr = dependencies.includes("@supabase/ssr");
+  if (!ssr) return dependencies.includes("@supabase/auth-helpers-nextjs") ? { authHelpers: true, signIns: [], callbacks: [] } : null;
+  const facts = /* @__PURE__ */ new Map();
+  const factsOf = (file) => {
+    if (facts.has(file)) return facts.get(file);
+    let found = null;
+    try {
+      const source = readFileSync6(join6(root, file), "utf8");
+      const program = parseModule(source, file);
+      if (program) {
+        const d = directive2(program);
+        found = {
+          program,
+          ...d ? { directive: d } : {},
+          serverClient: /\bcreateServerClient\s*\(|from\s+["']next\/headers["']/.test(source),
+          browserClient: /\bcreateBrowserClient\s*\(/.test(source)
+        };
+      }
+    } catch {
+      found = null;
+    }
+    facts.set(file, found);
+    return found;
+  };
+  const isPagesPage = (f) => Boolean(dirs.pagesDir && f.startsWith(`${dirs.pagesDir}/`) && !f.startsWith(`${dirs.pagesDir}/api/`));
+  const isPagesApi = (f) => Boolean(dirs.pagesDir && f.startsWith(`${dirs.pagesDir}/api/`));
+  const isAppRoute = (f) => Boolean(dirs.appDir && f.startsWith(`${dirs.appDir}/`) && /^route\./.test(baseName(f)));
+  const candidates2 = files.filter((f) => {
+    try {
+      return /\b(signIn\w*|verifyOtp|exchangeCodeForSession|mfa|auth-ui-react|storageKey|cookieOptions)\b/.test(readFileSync6(join6(root, f), "utf8"));
+    } catch {
+      return false;
+    }
+  });
+  const clientRoots = [];
+  const serverRoots = [];
+  for (const f of files) {
+    if (isPagesPage(f)) {
+      clientRoots.push(f);
+      continue;
+    }
+    const isEntry = isPagesApi(f) || MIDDLEWARE_FILE.test(f) || Boolean(dirs.appDir && f.startsWith(`${dirs.appDir}/`) && APP_SERVER_FILE.test(baseName(f)));
+    let text2;
+    try {
+      text2 = readFileSync6(join6(root, f), "utf8");
+    } catch {
+      continue;
+    }
+    const head = /^\s*(?:\/\/[^\n]*\n|\/\*[\s\S]*?\*\/\s*)*\s*["']use (client|server)["']/.exec(text2)?.[1];
+    if (head === "client") clientRoots.push(f);
+    else if (head === "server" || isEntry) serverRoots.push(f);
+  }
+  const browserSet = graph.reachable(clientRoots);
+  const serverSet = /* @__PURE__ */ new Set();
+  const queue = [...serverRoots];
+  while (queue.length > 0 && serverSet.size < 2e3) {
+    const f = queue.shift();
+    if (serverSet.has(f)) continue;
+    if (!serverRoots.includes(f) && factsOf(f)?.directive === "use client") continue;
+    serverSet.add(f);
+    for (const e of graph.edges(f)) if (!serverSet.has(e.file)) queue.push(e.file);
+  }
+  const sideOf = (file, inServerFn) => {
+    const f = factsOf(file);
+    if (inServerFn || f?.directive === "use server") return { side: "server", why: "a Server Action" };
+    if (isAppRoute(file) || isPagesApi(file)) return { side: "server", why: "a route handler" };
+    if (f?.directive === "use client") return { side: "browser", why: '"use client"' };
+    if (isPagesPage(file)) return { side: "browser", why: "a Pages Router page" };
+    let server = f?.serverClient ?? false;
+    let browser = f?.browserClient ?? false;
+    let helper;
+    if (!server && !browser) {
+      for (const e of graph.edges(file)) {
+        const g = factsOf(e.file);
+        if (g?.serverClient && !g.browserClient) {
+          server = true;
+          helper = e.file;
+        }
+        if (g?.browserClient && !g.serverClient) {
+          browser = true;
+          helper = e.file;
+        }
+      }
+    }
+    if (server !== browser) return { side: server ? "server" : "browser", why: `uses the ${server ? "server" : "browser"} client${helper ? ` from ${helper}` : ""}` };
+    const inBrowser = browserSet.has(file);
+    const inServer = serverSet.has(file);
+    if (inBrowser && !inServer) return { side: "browser", why: "imported by browser code" };
+    if (inServer && !inBrowser) return { side: "server", why: "imported by server code" };
+    return { side: "unknown", why: inBrowser ? "imported by both browser and server code" : "not imported by a page or route we could follow" };
+  };
+  const out = { signIns: [], callbacks: [] };
+  for (const file of candidates2) {
+    const f = factsOf(file);
+    if (!f) continue;
+    const top = f.program;
+    const topName = (n) => {
+      const d = n.type === "ExportNamedDeclaration" ? n.declaration : n.type === "ExportDefaultDeclaration" ? n.declaration : n;
+      if (n.type === "ExportDefaultDeclaration") return "default";
+      if (d?.type === "FunctionDeclaration") return d.id?.name;
+      if (d?.type === "VariableDeclaration") return keyName(d.declarations?.[0]?.id);
+      return void 0;
+    };
+    let authUi;
+    walk(top, (n, parents) => {
+      if (n.type === "ImportDeclaration" && n.source?.value === "@supabase/auth-ui-react") {
+        authUi = n.specifiers.find((s) => s.type === "ImportSpecifier" && keyName(s.imported) === "Auth")?.local?.name;
+      }
+      if (n.type === "ObjectProperty" && !out.cookieName) {
+        const key = keyName(n.key);
+        const value = stringValue(unwrapTs(n.value));
+        const parentProp = parents.at(-2);
+        if (key === "storageKey" && value) out.cookieName = value;
+        if (key === "name" && value && parentProp?.type === "ObjectProperty" && keyName(parentProp.key) === "cookieOptions") out.cookieName = value;
+      }
+      const push = (call, method2, extra = {}) => {
+        const inServerFn = parents.some((p) => FUNCTION_TYPES.has(p.type) && p.body?.directives?.some((d) => d.value?.value === "use server"));
+        const { side, why } = sideOf(file, inServerFn);
+        const holder = parents.find((p) => top.body.includes(p));
+        const name2 = holder ? topName(holder) : void 0;
+        out.signIns.push({
+          method: method2,
+          call,
+          ...extra,
+          file,
+          line: n.loc?.start.line ?? 1,
+          side,
+          why,
+          ...side === "server" && name2 && (isActionModule(top) || inServerFn) ? { action: `${file}#${name2}` } : {},
+          ...side === "server" && (isAppRoute(file) || isPagesApi(file)) ? { route: file } : {}
+        });
+      };
+      if (n.type === "JSXOpeningElement" && authUi && n.name?.type === "JSXIdentifier" && n.name.name === authUi) {
+        push("<Auth />", "password");
+        return;
+      }
+      if (n.type !== "CallExpression" && n.type !== "OptionalCallExpression") return;
+      const callee = unwrapTs(n.callee);
+      if (callee?.type !== "MemberExpression" && callee?.type !== "OptionalMemberExpression") return;
+      const name = propertyOf(callee);
+      if (!name) return;
+      const object = unwrapTs(callee.object);
+      if (MFA_CALLS.has(name) && (object?.type === "MemberExpression" || object?.type === "OptionalMemberExpression") && propertyOf(object) === "mfa" && isAuthObject(object.object)) {
+        push(`mfa.${name}`, "totp");
+        return;
+      }
+      if (!isAuthObject(object)) return;
+      const arg = n.arguments?.[0];
+      if (name === "exchangeCodeForSession" || name === "verifyOtp" && prop(arg, "token_hash")) {
+        if (!out.callbacks.includes(file)) out.callbacks.push(file);
+        return;
+      }
+      const method = Object.hasOwn(AUTH_CALLS, name) ? AUTH_CALLS[name] : void 0;
+      if (!method) return;
+      const provider = name === "signInWithOAuth" ? stringValue(unwrapTs(prop(arg, "provider"))) : void 0;
+      push(name, method, provider ? { provider } : {});
+    });
+  }
+  return out;
+}
+function signInLabel(s) {
+  const side = s.side === "unknown" ? "side unclear, counted as server" : s.side;
+  return `${s.call}${s.provider ? ` (${s.provider})` : ""} in ${s.file}:${s.line} (${side}: ${s.why})`;
+}
+function supabaseChoice(found, login, loginPages2 = []) {
+  const onServer = (method) => found.signIns.filter((s) => s.method === method && s.side !== "browser");
+  const direct = [];
+  const unusable = [];
+  for (const method of ["password", "email-code"]) {
+    const server = onServer(method);
+    if (server.length === 0) direct.push(method);
+    else if (!login) unusable.push(...server.map(signInLabel));
+  }
+  direct.push("social");
+  return {
+    ...found.cookieName ? { cookieName: found.cookieName } : {},
+    direct,
+    found: found.signIns.map(signInLabel),
+    ...unusable.length ? { unusable } : {},
+    ...found.callbacks.length ? { callbacks: found.callbacks } : {},
+    ...loginPages2.length ? { loginPages: loginPages2 } : {}
+  };
+}
+function knownLogins(found) {
+  const out = /* @__PURE__ */ new Set();
+  for (const s of found?.signIns ?? []) {
+    if (s.method !== "password" || s.side === "browser") continue;
+    if (s.action) out.add(s.action);
+    if (s.route) out.add(s.route);
+  }
+  return out;
+}
+
 // src/codegen.ts
 var DEFAULT_DOCS = ["README.md", "docs/**/*.md"];
 var actionRoute = (mcpPath, key) => `POST ${(mcpPath ?? "/mcp").replace(/\/$/, "")}/actions/${key}`;
@@ -1742,14 +1994,14 @@ function actionSignature(route, source) {
 }
 var posix = (p) => p.split(sep2).join("/");
 function firstDir(root, names) {
-  return names.find((n) => existsSync2(join6(root, n)));
+  return names.find((n) => existsSync2(join7(root, n)));
 }
 function filesUnder(root, dir) {
   const out = [];
   const visit = (rel) => {
     let entries;
     try {
-      entries = readdirSync(join6(root, rel), { withFileTypes: true });
+      entries = readdirSync(join7(root, rel), { withFileTypes: true });
     } catch {
       return;
     }
@@ -1776,7 +2028,7 @@ function discover(root, opts = {}) {
       const dirSegs = file.slice(appDir.length + 1).split("/").slice(0, -1);
       const route = appRoute(dirSegs);
       if (!route) continue;
-      const source = readFileSync6(join6(root, file), "utf8");
+      const source = readFileSync7(join7(root, file), "utf8");
       const module = analyzeRouteModule(source, file);
       if (module.mcpRoute) {
         out.mcpRoute ??= { file, source };
@@ -1792,7 +2044,7 @@ function discover(root, opts = {}) {
       const segs = file.slice(pagesDir.length + 1).replace(extPattern, "").split("/");
       const route = pagesApiRoute(segs);
       if (!route) continue;
-      const source = readFileSync6(join6(root, file), "utf8");
+      const source = readFileSync7(join7(root, file), "utf8");
       const src = defaultExportSource(source, file);
       out.routes.push({ router: "pages", file, ...route, detected: detectPagesMethods(source, file), ...src ? { source: src } : {} });
     }
@@ -1804,14 +2056,22 @@ function discover(root, opts = {}) {
     const catchAll = route ? /^(.*)\/:[A-Za-z0-9_]+\*\??$/.exec(route.path) : null;
     if (catchAll) out.mcpPath = catchAll[1] || "/";
   }
-  discoverActions(root, out, exts);
-  const found = findLogin(out);
+  const { files, graph, pages } = discoverActions(root, out, exts);
+  const supabase = findSupabase(root, files, graph, dependencyNames(readJson(join7(root, "package.json"))), out);
+  const found = findLogin(out, knownLogins(supabase));
   if (found) {
     out.login = found.login;
     out.loginOthers = found.others;
   }
+  if (supabase && !supabase.authHelpers) out.supabase = { found: supabase, choice: supabaseChoice(supabase, out.login, loginPages(supabase, pages, graph)) };
+  else if (supabase) out.supabase = { found: supabase, choice: { direct: [], found: [] } };
   return out;
 }
+function loginPages(found, pages, graph) {
+  const files = new Set(found.signIns.filter((s) => s.method === "password" || s.method === "email-code").map((s) => s.file));
+  if (files.size === 0) return [];
+  return pages.filter((p) => p.params.length === 0 && [...graph.reachable(p.roots)].some((f) => files.has(f))).map((p) => p.path);
+}
 var SOURCE_GLOB = "**/*.{ts,tsx,js,jsx,mjs,cjs}";
 var NOT_SOURCE = ["**/node_modules/**", ".next/**", "out/**", "build/**", "dist/**", "coverage/**", "**/*.d.ts"];
 function snakeCase(name) {
@@ -1825,7 +2085,7 @@ function discoverActions(root, out, exts) {
   for (const file of files) {
     let source;
     try {
-      source = readFileSync6(join6(root, file), "utf8");
+      source = readFileSync7(join7(root, file), "utf8");
     } catch {
       continue;
     }
@@ -1882,24 +2142,25 @@ function discoverActions(root, out, exts) {
     const found2 = guards.action(a.file, a.action.name);
     if (found2.length > 0) a.guards = found2;
   }
+  return { files, graph, pages };
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function readProposedInputs(root) {
-  const path = join6(root, DESCRIPTIONS_FILE);
+  const path = join7(root, DESCRIPTIONS_FILE);
   if (!existsSync2(path)) return {};
-  const parsed = parseDescriptions(readFileSync6(path, "utf8"));
+  const parsed = parseDescriptions(readFileSync7(path, "utf8"));
   return typeof parsed === "string" ? {} : parsed.inputs ?? {};
 }
 function readDescriptions(root, warn) {
-  const path = join6(root, DESCRIPTIONS_FILE);
+  const path = join7(root, DESCRIPTIONS_FILE);
   if (!existsSync2(path)) return {};
-  const parsed = parseDescriptions(readFileSync6(path, "utf8"));
+  const parsed = parseDescriptions(readFileSync7(path, "utf8"));
   if (typeof parsed === "string") {
     warn(`ignoring ${DESCRIPTIONS_FILE}: ${parsed}`);
     return {};
@@ -1911,22 +2172,28 @@ function readDocs(root, globs) {
   const docs = [];
   for (const path of paths) {
     try {
-      docs.push({ path, content: readFileSync6(join6(root, path), "utf8") });
+      docs.push({ path, content: readFileSync7(join7(root, path), "utf8") });
     } catch {
     }
   }
   return docs;
 }
 function defaultOutFile(root) {
-  return existsSync2(join6(root, "tsconfig.json")) ? "exposify.generated.ts" : "exposify.generated.js";
+  return existsSync2(join7(root, "tsconfig.json")) ? "exposify.generated.ts" : "exposify.generated.js";
 }
 function specifier(outFile, file) {
   const rel = posix(relative2(dirname2(outFile), file)).replace(/\.[^./]+$/, "");
   return rel.startsWith(".") ? rel : `./${rel}`;
 }
 function manifestLogin(l) {
-  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {}, where: `${l.export} in ${l.file}` } : { kind: "route", path: l.path, fields: l.fields, body: l.body, where: `POST ${l.path} in ${l.file}` };
+  const verify = l.verify ? manifestStep(l.verify) : void 0;
+  const where = l.verify ? `${whereOf(l)}, then a code: ${whereOf(l.verify)}` : whereOf(l);
+  return { ...manifestStep(l), where, ...l.passwordless ? { passwordless: true } : {}, ...verify ? { verify } : {} };
+}
+function manifestStep(l) {
+  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {} } : { kind: "route", path: l.path, fields: l.fields, body: l.body };
 }
+var whereOf = (l) => l.kind === "action" ? `${l.export} in ${l.file}` : `POST ${l.path} in ${l.file}`;
 function renderManifest(d, opts) {
   const ts = opts.outFile.endsWith(".ts");
   const j = (v) => JSON.stringify(v);
@@ -1961,22 +2228,23 @@ function renderManifest(d, opts) {
     return `    { name: ${j(p.name)}, path: ${j(p.path)}, params: ${j(p.params)}, file: ${j(p.file)}${extra} },`;
   });
   const lines = [
-    "// Generated by exposify-next from your route files. Don't edit: withExposify()",
+    "// Generated by @exposify/next from your route files. Don't edit: withExposify()",
     "// in next.config regenerates it on `next dev` and `next build`, or run",
-    "// `npx exposify-next generate`.",
+    "// `npx @exposify/next generate`.",
     "/* eslint-disable */",
     ...ts ? ['import type { ExposifyManifest } from "@exposify/next";', ""] : ["", '/** @type {import("@exposify/next").ExposifyManifest} */'],
     `export const exposify${ts ? ": ExposifyManifest" : ""} = {`,
     `  info: ${j(opts.info)},`,
     ...opts.basePath ? [`  basePath: ${j(opts.basePath)},`] : [],
     ...opts.trailingSlash ? ["  trailingSlash: true,"] : [],
-    ...d.mcpPath && (actions.length > 0 || d.login) ? [`  mcpPath: ${j(d.mcpPath)},`] : [],
+    ...d.mcpPath && (actions.length > 0 || d.login || d.supabase) ? [`  mcpPath: ${j(d.mcpPath)},`] : [],
     "  routes: [",
     ...routes,
     "  ],",
     ...actions.length > 0 ? ["  actions: [", ...actions, "  ],"] : [],
     ...pages.length > 0 ? ["  pages: [", ...pages, "  ],"] : [],
     ...d.login ? [`  login: ${j(manifestLogin(d.login))},`] : [],
+    ...d.supabase && !d.supabase.found.authHelpers ? [`  supabase: ${j(d.supabase.choice)},`] : [],
     ...opts.authStacks?.length ? [`  authStacks: ${j(opts.authStacks)},`] : [],
     `  docs: ${j(opts.docs)},`,
     ...Object.keys(opts.descriptions).length > 0 ? [`  descriptions: ${JSON.stringify(opts.descriptions, null, 2).replace(/\n/g, "\n  ")},`] : [],
@@ -1988,7 +2256,7 @@ function renderManifest(d, opts) {
 function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)) {
   const outFile = opts.out ?? defaultOutFile(root);
   const discovery = discover(root, opts);
-  const pkg = readJson(join6(root, "package.json"));
+  const pkg = readJson(join7(root, "package.json"));
   const info = { name: typeof pkg?.name === "string" ? pkg.name : "next-app", version: typeof pkg?.version === "string" ? pkg.version : "0.0.0" };
   const content = renderManifest(discovery, {
     outFile,
@@ -1999,18 +2267,24 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     ...opts.trailingSlash ? { trailingSlash: true } : {},
     authStacks: authStacksOf(dependencyNames(pkg)).map((s) => s.pkg)
   });
+  if (discovery.supabase?.found.authHelpers) {
+    warn("@supabase/auth-helpers-nextjs keeps its session in an older cookie format AI assistants can't sign in with; move to @supabase/ssr (Supabase's replacement for it) to use Connect");
+  }
+  for (const s of discovery.supabase?.choice.unusable ?? []) {
+    warn(`your app signs users in to Supabase on the server (${s}), but not in a Server Action or route the sign-in form can run, so AI assistants can't sign in with a password; switch on "Sign in with Supabase" on the dashboard to have them sign in to Supabase directly`);
+  }
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
-    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);
+    warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`@exposify/next describe\` reviews it again`);
   }
   if (discovery.actions.length > 0 && !discovery.mcpPath) {
     warn(
-      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx exposify-next setup)`
+      discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx @exposify/next setup)`
     );
   }
-  const file = join6(root, outFile);
+  const file = join7(root, outFile);
   let current;
   try {
-    current = readFileSync6(file, "utf8");
+    current = readFileSync7(file, "utf8");
   } catch {
     current = void 0;
   }
@@ -2018,14 +2292,17 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
   return { file, changed: current !== content, discovery };
 }
 
+// bin/exposify-next.ts
+import { createInterface } from "readline";
+
 // bin/adapter.ts
-import { existsSync as existsSync4, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname4, join as join8, relative as relative3, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname4, join as join9, relative as relative3, resolve as resolve2 } from "path";
 import { decideExposure, deriveDescription, resolveOptions, toolNames } from "@exposify/core";
 import { renderConfig, replaceAiReadyOptions } from "@exposify/cli";
 
 // bin/actions.ts
-import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync8 } from "fs";
 
 // src/inline.ts
 import { dirname as dirname3 } from "path";
@@ -2034,7 +2311,7 @@ function patternNames(p, out = []) {
   if (p.type === "Identifier") out.push(p.name);
   else if (p.type === "AssignmentPattern") patternNames(p.left, out);
   else if (p.type === "RestElement") patternNames(p.argument, out);
-  else if (p.type === "ObjectPattern") for (const prop of p.properties) patternNames(prop.type === "RestElement" ? prop : prop.value, out);
+  else if (p.type === "ObjectPattern") for (const prop2 of p.properties) patternNames(prop2.type === "RestElement" ? prop2 : prop2.value, out);
   else if (p.type === "ArrayPattern") for (const el of p.elements) patternNames(el ?? void 0, out);
   else if (p.type === "TSParameterProperty") patternNames(p.parameter, out);
   return out;
@@ -2095,10 +2372,10 @@ function suggestInlineMove(source, file, line) {
     if (stmt.type === "ImportDeclaration") {
       const used = stmt.specifiers.filter((s) => reads.includes(s.local.name));
       if (used.length === 0) continue;
-      const named2 = used.filter((s) => s.type === "ImportSpecifier").map((s) => s.imported.name === s.local.name ? s.local.name : `${s.imported.name} as ${s.local.name}`);
+      const named = used.filter((s) => s.type === "ImportSpecifier").map((s) => s.imported.name === s.local.name ? s.local.name : `${s.imported.name} as ${s.local.name}`);
       const def = used.find((s) => s.type === "ImportDefaultSpecifier")?.local.name;
       const ns = used.find((s) => s.type === "ImportNamespaceSpecifier")?.local.name;
-      const parts = [def, ns ? `* as ${ns}` : void 0, named2.length ? `{ ${named2.join(", ")} }` : void 0].filter(Boolean);
+      const parts = [def, ns ? `* as ${ns}` : void 0, named.length ? `{ ${named.join(", ")} }` : void 0].filter(Boolean);
       imports.push(`import ${parts.join(", ")} from ${JSON.stringify(stmt.source.value)};`);
     } else {
       const decl = stmt.type === "ExportNamedDeclaration" ? stmt.declaration : stmt;
@@ -2110,8 +2387,8 @@ function suggestInlineMove(source, file, line) {
   const dir = dirname3(file);
   const newFile = `${dir === "." ? "" : `${dir}/`}actions.${ext}`;
   const ownParams = target.params.map((p) => text(source, p) ?? paramName(p) ?? "arg");
-  const directive2 = target.body.directives.find((d) => d.value?.value === "use server");
-  const bodyText = source.slice(directive2.end, target.body.end - 1).replace(/^\s*\n/, "").replace(/\s+$/, "");
+  const directive3 = target.body.directives.find((d) => d.value?.value === "use server");
+  const bodyText = source.slice(directive3.end, target.body.end - 1).replace(/^\s*\n/, "").replace(/\s+$/, "");
   const bodyLines = bodyText.split("\n");
   const indent = Math.min(...bodyLines.filter((l) => l.trim()).map((l) => l.length - l.trimStart().length), 99);
   const body = bodyLines.map((l) => `  ${l.slice(Math.min(indent, l.length - l.trimStart().length))}`.trimEnd()).join("\n");
@@ -2168,7 +2445,7 @@ function suggestInlineMove(source, file, line) {
 }
 
 // bin/actions.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/actions.ts
 var AUTH_LIKE = /^(log_?in|log_?out|sign_?in|sign_?out|sign_?up|register|authenticate)(_|$)/;
@@ -2243,7 +2520,7 @@ function formSources(root, forms) {
   const sources = [];
   for (const file of [...new Set(forms.map((f) => f.file))].slice(0, 2)) {
     try {
-      const text2 = readFileSync7(join7(root, file), "utf8");
+      const text2 = readFileSync8(join8(root, file), "utf8");
       files.push(file);
       sources.push(text2.length > 6e3 ? `${text2.slice(0, 6e3)}
 /* \u2026 truncated */` : text2);
@@ -2253,11 +2530,11 @@ function formSources(root, forms) {
   return { files, sources };
 }
 function crossCheck(root, d) {
-  const path = join7(root, ".next", "server", "server-reference-manifest.json");
+  const path = join8(root, ".next", "server", "server-reference-manifest.json");
   if (!existsSync3(path)) return [];
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync7(path, "utf8"));
+    manifest = JSON.parse(readFileSync8(path, "utf8"));
   } catch {
     return [];
   }
@@ -2351,7 +2628,7 @@ function scanActions(d, call, root, notes, suggestions = []) {
   for (const inline of d.inlineActions) {
     let move;
     try {
-      move = suggestInlineMove(readFileSync7(join7(root, inline.file), "utf8"), inline.file, inline.line);
+      move = suggestInlineMove(readFileSync8(join8(root, inline.file), "utf8"), inline.file, inline.line);
     } catch {
       move = void 0;
     }
@@ -2373,9 +2650,9 @@ function scanActions(d, call, root, notes, suggestions = []) {
 var MCP_ROUTE_DIR = "mcp/[[...transport]]";
 function isNextProject(dir) {
   try {
-    const pkg = JSON.parse(readFileSync8(join8(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync9(join9(dir, "package.json"), "utf8"));
     const hasNext = Boolean(pkg.dependencies?.next ?? pkg.devDependencies?.next);
-    return hasNext && ["app", "src/app", "pages", "src/pages"].some((d) => existsSync4(join8(dir, d)));
+    return hasNext && ["app", "src/app", "pages", "src/pages"].some((d) => existsSync4(join9(dir, d)));
   } catch {
     return false;
   }
@@ -2387,7 +2664,7 @@ function findNextRoot(start) {
   }
 }
 var nextAdapter = {
-  bin: "exposify-next",
+  bin: "npx @exposify/next",
   entryExample: "apps/web",
   entryHelp: "The Next.js project directory",
   locate(cwd, entryFlag) {
@@ -2425,7 +2702,7 @@ ${block}
         'Wrap your next.config export: `export default withExposify(nextConfig)`, imported from "@exposify/next/config". It keeps exposify.generated.ts current on `next dev` and `next build`.'
       );
     }
-    const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join8(root, f)).find((f) => existsSync4(f));
+    const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join9(root, f)).find((f) => existsSync4(f));
     const manifestFile = existing ?? generate(root, {}, () => {
     }).file;
     const generated = relative3(root, manifestFile);
@@ -2439,7 +2716,7 @@ ${block}
       };
     }
     const routeFile = `${d.appDir ?? "app"}/${MCP_ROUTE_DIR}/route.${generated.endsWith(".ts") ? "ts" : "js"}`;
-    const manifestImport = relative3(join8(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
+    const manifestImport = relative3(join9(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
     const code = [
       'import { aiReady } from "@exposify/next";',
       ...usesZod ? ['import { z } from "zod";'] : [],
@@ -2451,7 +2728,7 @@ ${block}
     ].join("\n");
     return {
       code,
-      apply: { plan: { file: join8(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
+      apply: { plan: { file: join9(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
 ` } },
       hint: { lines: [`Create ${routeFile} with this (agents connect to /mcp). It imports ${generated}${existing ? "" : ", written just now"}.`, ...lines] }
     };
@@ -2460,7 +2737,7 @@ ${block}
 function hasWithExposify(root) {
   for (const name of ["next.config.ts", "next.config.mjs", "next.config.js", "next.config.cjs", "next.config.mts"]) {
     try {
-      if (readFileSync8(join8(root, name), "utf8").includes("withExposify")) return true;
+      if (readFileSync9(join9(root, name), "utf8").includes("withExposify")) return true;
     } catch {
     }
   }
@@ -2499,7 +2776,7 @@ function scanProject(root) {
   for (const p of d.pages) {
     let source;
     try {
-      source = readFileSync8(join8(root, p.file), "utf8");
+      source = readFileSync9(join9(root, p.file), "utf8");
     } catch {
       source = void 0;
     }
@@ -2515,14 +2792,14 @@ function scanProject(root) {
     });
   }
   const exposure = new Map(rows.map((row) => [`${row.info.method} ${row.info.path}`, decideExposure(row.info, cfg)]));
-  const named2 = rows.map((row) => ({
+  const named = rows.map((row) => ({
     method: row.info.method,
     path: row.info.path,
     params: row.info.params,
     ...row.info.marker ? { marker: row.info.marker.kind } : {},
     ...row.describedName ? { describedName: row.describedName } : {}
   }));
-  const names = toolNames(named2, (r) => exposure.get(`${r.method} ${r.path}`).exposed);
+  const names = toolNames(named, (r) => exposure.get(`${r.method} ${r.path}`).exposed);
   for (const row of rows) if (row.page && row.describedName) names.set(`GET ${row.info.path}`, row.describedName);
   const suggestions = [];
   const actions = scanActions(d, call, root, notes, suggestions);
@@ -2556,9 +2833,18 @@ function scanProject(root) {
     ...notes.length > 0 ? { notes } : {},
     ...suggestions.length > 0 ? { suggestions } : {},
     ...d.login ? { login: { what: loginLabel(d.login), fields: d.login.fields.map((f) => f.name), ...d.loginOthers?.length ? { others: d.loginOthers.map(loginLabel) } : {} } } : {},
+    ...d.supabase ? {
+      supabase: {
+        direct: d.supabase.choice.direct,
+        found: d.supabase.choice.found,
+        ...d.supabase.choice.unusable ? { unusable: d.supabase.choice.unusable } : {},
+        ...d.supabase.choice.callbacks ? { callbacks: d.supabase.choice.callbacks } : {},
+        ...d.supabase.found.authHelpers ? { authHelpers: true } : {}
+      }
+    } : {},
     ...call && d.mcpRoute ? {
       aiReady: {
-        site: { file: join8(root, d.mcpRoute.file), line: call.line },
+        site: { file: join9(root, d.mcpRoute.file), line: call.line },
         options: {
           ...call.expose ? { expose: call.expose } : {},
           ...call.exclude ? { exclude: call.exclude } : {},
@@ -2572,7 +2858,7 @@ function scanProject(root) {
 }
 function applyReplace(site, config, entries, usesZod, relFile) {
   try {
-    const before = readFileSync8(site.file, "utf8");
+    const before = readFileSync9(site.file, "utf8");
     const edit = replaceAiReadyOptions({
       source: before,
       file: site.file,
@@ -2590,8 +2876,110 @@ function applyReplace(site, config, entries, usesZod, relFile) {
   }
 }
 
+// bin/test-sign-in.ts
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join10 } from "path";
+import { parseEnv } from "util";
+import { supabaseCookieName, supabasePasswordLogin, supabaseSessionCookies } from "@exposify/core";
+var TEST_SIGN_IN_USAGE = `Usage: @exposify/next test-sign-in [options]
+
+Signs in to your app's Supabase Auth as AI assistants will (a password, then
+the authenticator code if you have one), and checks that a page your app
+protects accepts the session cookie Connect sends. Run it with your app up.
+
+Options:
+  --url <origin>   Where the app runs (default: http://localhost:3000)
+  --page <path>    A page that redirects signed-out visitors (default: found)
+  --entry <path>   The Next.js project directory (default: detected)
+
+Reads NEXT_PUBLIC_SUPABASE_URL and the publishable (or anon) key from the
+environment, .env.local or .env. Signs the test session out afterwards.`;
+function supabaseEnv(root, env) {
+  const files = [".env.local", ".env"].map((f) => {
+    try {
+      return parseEnv(readFileSync10(join10(root, f), "utf8"));
+    } catch {
+      return {};
+    }
+  });
+  const read2 = (name) => env[name] || files.find((f) => f[name])?.[name];
+  const url = read2("NEXT_PUBLIC_SUPABASE_URL");
+  const key = read2("NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY") ?? read2("NEXT_PUBLIC_SUPABASE_ANON_KEY") ?? read2("NEXT_PUBLIC_SUPABASE_PUBLISHABLE_OR_ANON_KEY");
+  return url && key ? { url, key } : null;
+}
+var redirected = (res) => res.status >= 300 && res.status < 400 || res.status === 401 || res.status === 403;
+async function testSignIn(root, opts, deps) {
+  const d = discover(root);
+  if (!d.supabase || d.supabase.found.authHelpers) {
+    deps.log(d.supabase ? "Your app uses @supabase/auth-helpers-nextjs, whose cookie format isn't supported: move to @supabase/ssr." : "This app doesn't use Supabase Auth with @supabase/ssr, so there's nothing to test here.");
+    return 1;
+  }
+  const project = supabaseEnv(root, opts.env);
+  if (!project) {
+    deps.log("Set NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY (or _ANON_KEY), in your shell or .env.local.");
+    return 1;
+  }
+  const origin = opts.url.replace(/\/+$/, "");
+  const get = (path, cookie) => deps.fetch(`${origin}${path}`, { headers: cookie ? { cookie } : {}, redirect: "manual" }).catch(() => null);
+  let page = opts.page;
+  if (!page) {
+    const skip = new Set(d.supabase.choice.loginPages ?? []);
+    const candidates2 = d.pages.filter((p) => p.params.length === 0 && !skip.has(p.path) && !p.path.startsWith(d.mcpPath ?? "/mcp")).slice(0, 15);
+    for (const p of candidates2) {
+      const res2 = await get(p.path);
+      if (res2 === null) {
+        deps.log(`Couldn't reach ${origin}. Start your app (next dev), or pass --url.`);
+        return 1;
+      }
+      if (redirected(res2)) {
+        page = p.path;
+        break;
+      }
+    }
+    if (!page) {
+      deps.log("No page turned a signed-out request away, so there's nothing to check the session against. Pass --page with one that does.");
+      return 1;
+    }
+  } else {
+    const res2 = await get(page);
+    if (res2 === null) {
+      deps.log(`Couldn't reach ${origin}. Start your app (next dev), or pass --url.`);
+      return 1;
+    }
+    if (!redirected(res2)) {
+      deps.log(`${page} answered ${res2.status} without signing in, so it can't tell whether the session works. Pass --page with a page that redirects signed-out visitors.`);
+      return 1;
+    }
+  }
+  const login = supabasePasswordLogin({ ...project, fetch: deps.fetch });
+  const ctx = { origin };
+  const email = (await deps.ask("Email: ")).trim();
+  const password = await deps.askSecret("Password: ");
+  let result = await login.attempt({ email, password }, ctx);
+  if (result.ok === "next") {
+    const code = await deps.ask(`${result.message ?? "Code"} `);
+    result = await login.verify.attempt({ code }, { ...ctx, carry: result.carry });
+  }
+  if (result.ok !== true || !("supabase" in result.session)) {
+    deps.log(`Supabase didn't sign you in: ${result.ok === false ? result.message ?? "no reason given" : "no session came back"}`);
+    return 1;
+  }
+  const session = result.session.supabase;
+  const name = d.supabase.choice.cookieName ?? supabaseCookieName(project.url);
+  const cookies = supabaseSessionCookies(name, session);
+  const res = await get(page, cookies.map((c) => `${c.name}=${c.value}`).join("; "));
+  await deps.fetch(`${project.url.replace(/\/+$/, "")}/auth/v1/logout?scope=local`, { method: "POST", headers: { apikey: project.key, authorization: `Bearer ${session.accessToken}` } }).catch(() => null);
+  if (res && res.status >= 200 && res.status < 300) {
+    deps.log(`\u2713 ${page} answered ${res.status} with the session cookie Connect sends (${cookies.length === 1 ? name : `${name}.0\u2013.${cookies.length - 1}`}), and turned you away without it.`);
+    return 0;
+  }
+  deps.log(`\u2717 ${page} answered ${res?.status ?? "nothing"} with the session cookie${res?.headers.get("location") ? ` (to ${res.headers.get("location")})` : ""}: your app didn't accept it.`);
+  if (d.supabase.choice.cookieName === void 0) deps.log(`  It was named ${name}. If your app sets another cookie name, the generator didn't see it.`);
+  return 1;
+}
+
 // bin/exposify-next.ts
-var GENERATE_USAGE = `Usage: exposify-next generate [options]
+var GENERATE_USAGE = `Usage: @exposify/next generate [options]
 
 Writes exposify.generated.ts (the route table and docs the MCP route uses).
 withExposify() in next.config runs this on \`next dev\` and \`next build\`.
@@ -2638,11 +3026,57 @@ ${GENERATE_USAGE}`);
   console.log(
     `${result.changed ? "Wrote" : "Unchanged:"} ${relative4(cwd, result.file) || result.file}: ${app} App Router route file${app === 1 ? "" : "s"}, ${routes.length - app} Pages Router API file${routes.length - app === 1 ? "" : "s"}.`
   );
-  if (!result.discovery.mcpRoute) console.log("No MCP route yet: run `npx exposify-next setup`.");
+  if (!result.discovery.mcpRoute) console.log("No MCP route yet: run `npx @exposify/next setup`.");
   return 0;
 }
+function prompt(question, secret = false) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+  if (secret) {
+    const write = rl._writeToOutput.bind(rl);
+    rl._writeToOutput = (s) => write(s.startsWith(question) ? s : s.replace(/[^\r\n]/g, ""));
+  }
+  return new Promise(
+    (resolve3) => rl.question(question, (answer) => {
+      rl.close();
+      if (secret) process.stdout.write("\n");
+      resolve3(answer);
+    })
+  );
+}
+async function runTestSignIn(argv2, cwd) {
+  let entry;
+  let url = "http://localhost:3000";
+  let page;
+  for (let i = 0; i < argv2.length; i++) {
+    const flag = argv2[i];
+    const value = () => {
+      const v = argv2[++i];
+      if (v === void 0) throw new Error(`${flag} needs a value`);
+      return v;
+    };
+    if (flag === "--entry") entry = value();
+    else if (flag === "--url") url = value();
+    else if (flag === "--page") page = value();
+    else if (flag === "--help" || flag === "-h") {
+      console.log(TEST_SIGN_IN_USAGE);
+      return 0;
+    } else {
+      console.error(`Unknown option: ${flag}
+
+${TEST_SIGN_IN_USAGE}`);
+      return 1;
+    }
+  }
+  const root = findNextRoot(entry ? `${cwd}/${entry}` : cwd);
+  if (!root) {
+    console.error("Couldn't find a Next.js project (a package.json with next, and an app/ or pages/ directory).");
+    return 1;
+  }
+  return testSignIn(root, { url, ...page ? { page } : {}, env: process.env }, { ask: (q) => prompt(q), askSecret: (q) => prompt(q, true), log: (l) => console.log(l), fetch });
+}
 var argv = process.argv.slice(2);
-(argv[0] === "generate" ? Promise.resolve().then(() => runGenerate(argv.slice(1), process.cwd())) : runCli(argv, nextAdapter)).then(
+var run = argv[0] === "generate" ? Promise.resolve().then(() => runGenerate(argv.slice(1), process.cwd())) : argv[0] === "test-sign-in" ? runTestSignIn(argv.slice(1), process.cwd()) : runCli(argv, nextAdapter);
+run.then(
   (code) => process.exit(code),
   (err) => {
     console.error(err instanceof Error ? err.message : err);