@exposify/next 0.0.2 → 0.0.4

package/dist/manifest-DZQCvzQy.d.cts

@@ -0,0 +1,176 @@
+import { ProposedField, LoginField, DocSource } from '@exposify/core';
+
+type FieldType = "string" | "number" | "boolean" | "json" | "file";
+interface ActionField {
+    name: string;
+    type: FieldType;
+    /** Read with getAll(): a repeated field, sent as an array. */
+    array?: true;
+    /** Its allowed values, from `LIST.includes(x)` over a constant list. */
+    enum?: string[];
+    /** Always needed: a parameter of its own (a `.bind` argument), a non-optional key of an object parameter, or required by every form that submits to it. */
+    required?: true;
+    /** From the form's input (pass 3, forms.ts). */
+    min?: number;
+    max?: number;
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+    /** Where it was found: the action's code, its form, or both. */
+    origin?: "action" | "form" | "both";
+    /** For the agent: format, units, what it refers to (from an accepted proposal). */
+    description?: string;
+}
+
+interface AppRouteEntry {
+    router: "app";
+    /** `/api/orders/:id`; catch-alls as `:slug*`, optional ones as `:slug*?`. */
+    path: string;
+    params: string[];
+    /** Project-relative, for messages. */
+    file: string;
+    /** Exported methods when generated; the loaded module's exports win at runtime. */
+    methods: string[];
+    /** Loads the route module to read exposed()/hidden()/describe() off its exports. Absent for edge routes. */
+    load?: () => Promise<Record<string, unknown>>;
+    /** `export const runtime = "edge"`: not loaded into the Node MCP route, so markers there aren't read. */
+    edge?: boolean;
+}
+interface PagesRouteEntry {
+    router: "pages";
+    path: string;
+    params: string[];
+    file: string;
+}
+type ManifestRoute = AppRouteEntry | PagesRouteEntry;
+/** An exported function of a `"use server"` module. */
+interface ManifestAction {
+    /** Unique among actions: the default tool name, and the URL segment under `<mcpPath>/actions/`. */
+    key: string;
+    file: string;
+    export: string;
+    /** How each parameter is filled on a call, in order: see `ActionParamRole` in parse.ts. */
+    params: Array<{
+        name: string;
+        role: "formData" | "prev" | "input" | "object";
+    }>;
+    /** It sets or deletes a cookie, which would land on exposify's internal call rather than the agent's client. */
+    setsCookies?: boolean;
+    /** What it takes, worked out from its code (fields.ts): its tool schema when the app doesn't write one. */
+    fields: ActionField[];
+    /** It reads every form field, so its code doesn't say which exist. */
+    readsAll?: boolean;
+    /** What the analysis couldn't work out ("line N: …"): with any, the app writes the schema. */
+    unresolved?: string[];
+    /** The forms that submit to it (pass 3), where they are. */
+    forms?: Array<{
+        file: string;
+        line: number;
+    }>;
+    /** An input `describe` proposed and a person accepted, current with the code: used when `fields` can't be the schema. */
+    proposed?: ProposedField[];
+    /**
+     * A page that uses it (`/checkout`, `/admin/orders/:id`): tool calls are
+     * sent there as a real Server Action request. Absent when no page uses it;
+     * it's then called in-process by the MCP route.
+     */
+    host?: string;
+    /**
+     * The app's own checks it runs first (`lib/auth.ts#requireAdmin`): a
+     * user who doesn't pass one doesn't see the tool (guards.ts).
+     */
+    guards?: string[];
+    load: () => Promise<Record<string, unknown>>;
+}
+/** An App Router page: a read tool that fetches it like a browser (pages.ts). */
+interface ManifestPage {
+    /** Tool name, e.g. `view_product_slug`. */
+    name: string;
+    /** `/product/:slug`, as routes are written. */
+    path: string;
+    params: string[];
+    file: string;
+    /** Search params its code reads: optional tool arguments, sent as the query. */
+    search?: string[];
+    /** From its static `metadata`. */
+    title?: string;
+    description?: string;
+    /** Just a form posting to a Server Action: not a tool unless `pages` lists it. */
+    formOnly?: boolean;
+    /** The app's own checks it runs (`lib/auth.ts#requireAdmin`), see ManifestAction.guards. */
+    guards?: string[];
+}
+/**
+ * The app's own login (login.ts): a sign-in form under the MCP route makes
+ * this request, for Connect with no code. `host` is the page with the
+ * action's form, which tool calls redirected to mean "signed out".
+ */
+type ManifestLogin = ManifestLoginStep & {
+    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
+    where?: string;
+    /** The first step takes no password: an email or phone number, then the code. */
+    passwordless?: boolean;
+    /** The login's second step, a code; `host` (or the route's path) is where the first step redirects to ask for it. */
+    verify?: ManifestLoginStep;
+};
+/** One request of the login. */
+type ManifestLoginStep = {
+    kind: "action";
+    key: string;
+    fields: LoginField[];
+    host?: string;
+} | {
+    kind: "route";
+    path: string;
+    fields: LoginField[];
+    body: "json" | "form";
+};
+/**
+ * A Next app on Supabase Auth with `@supabase/ssr` (supabase.ts): which
+ * sign-ins Connect makes on Supabase directly, decided at build time from
+ * where the app signs its users in (plan Part 2, decisions A and B).
+ */
+interface ManifestSupabase {
+    /** The session cookie's name when the app sets one; else `sb-<ref>-auth-token`, from the project's URL. */
+    cookieName?: string;
+    /**
+     * Signed in to on Supabase directly: by password on the form at
+     * `<MCP path>/login` (the password goes from the app's server to Supabase),
+     * the rest on the broker's pages. A method the app signs in with on its
+     * server isn't here: the app's own login does it, or nothing does.
+     */
+    direct: Array<"password" | "email-code" | "social">;
+    /** Where the app signs in, as found: "signInWithPassword in components/login-form.tsx:42 (browser: "use client")". */
+    found: string[];
+    /** Server sign-ins the app's own login couldn't be made from, so that method has no sign-in until the owner switches to Supabase directly. */
+    unusable?: string[];
+    /** Routes that finish a sign-in (`exchangeCodeForSession`): their checks don't run for Connect's sign-ins. */
+    callbacks?: string[];
+    /** The app's sign-in pages (`/auth/login`): a tool call redirected there was signed out. */
+    loginPages?: string[];
+}
+interface ExposifyManifest {
+    info: {
+        name: string;
+        version: string;
+    };
+    /** next.config's basePath, prefixed to every tool call's path. */
+    basePath?: string;
+    /** next.config's trailingSlash: tool calls add one, so they aren't redirected. */
+    trailingSlash?: boolean;
+    routes: ManifestRoute[];
+    /** The MCP route's URL without its catch-all segment, e.g. `/mcp`: Server Actions are served under `<mcpPath>/actions/`. */
+    mcpPath?: string;
+    actions?: ManifestAction[];
+    pages?: ManifestPage[];
+    login?: ManifestLogin;
+    supabase?: ManifestSupabase;
+    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
+    authStacks?: string[];
+    /** Docs for search_docs, embedded so they work without a file system. */
+    docs: DocSource[];
+    /** exposify.descriptions.json's texts, "METHOD /path" -> text. */
+    descriptions?: Record<string, string>;
+}
+
+export type { ActionField as A, ExposifyManifest as E, ManifestSupabase as M, PagesRouteEntry as P, AppRouteEntry as a, ManifestAction as b, ManifestLogin as c, ManifestLoginStep as d, ManifestPage as e, ManifestRoute as f };

package/dist/manifest-DZQCvzQy.d.ts

@@ -0,0 +1,176 @@
+import { ProposedField, LoginField, DocSource } from '@exposify/core';
+
+type FieldType = "string" | "number" | "boolean" | "json" | "file";
+interface ActionField {
+    name: string;
+    type: FieldType;
+    /** Read with getAll(): a repeated field, sent as an array. */
+    array?: true;
+    /** Its allowed values, from `LIST.includes(x)` over a constant list. */
+    enum?: string[];
+    /** Always needed: a parameter of its own (a `.bind` argument), a non-optional key of an object parameter, or required by every form that submits to it. */
+    required?: true;
+    /** From the form's input (pass 3, forms.ts). */
+    min?: number;
+    max?: number;
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+    /** Where it was found: the action's code, its form, or both. */
+    origin?: "action" | "form" | "both";
+    /** For the agent: format, units, what it refers to (from an accepted proposal). */
+    description?: string;
+}
+
+interface AppRouteEntry {
+    router: "app";
+    /** `/api/orders/:id`; catch-alls as `:slug*`, optional ones as `:slug*?`. */
+    path: string;
+    params: string[];
+    /** Project-relative, for messages. */
+    file: string;
+    /** Exported methods when generated; the loaded module's exports win at runtime. */
+    methods: string[];
+    /** Loads the route module to read exposed()/hidden()/describe() off its exports. Absent for edge routes. */
+    load?: () => Promise<Record<string, unknown>>;
+    /** `export const runtime = "edge"`: not loaded into the Node MCP route, so markers there aren't read. */
+    edge?: boolean;
+}
+interface PagesRouteEntry {
+    router: "pages";
+    path: string;
+    params: string[];
+    file: string;
+}
+type ManifestRoute = AppRouteEntry | PagesRouteEntry;
+/** An exported function of a `"use server"` module. */
+interface ManifestAction {
+    /** Unique among actions: the default tool name, and the URL segment under `<mcpPath>/actions/`. */
+    key: string;
+    file: string;
+    export: string;
+    /** How each parameter is filled on a call, in order: see `ActionParamRole` in parse.ts. */
+    params: Array<{
+        name: string;
+        role: "formData" | "prev" | "input" | "object";
+    }>;
+    /** It sets or deletes a cookie, which would land on exposify's internal call rather than the agent's client. */
+    setsCookies?: boolean;
+    /** What it takes, worked out from its code (fields.ts): its tool schema when the app doesn't write one. */
+    fields: ActionField[];
+    /** It reads every form field, so its code doesn't say which exist. */
+    readsAll?: boolean;
+    /** What the analysis couldn't work out ("line N: …"): with any, the app writes the schema. */
+    unresolved?: string[];
+    /** The forms that submit to it (pass 3), where they are. */
+    forms?: Array<{
+        file: string;
+        line: number;
+    }>;
+    /** An input `describe` proposed and a person accepted, current with the code: used when `fields` can't be the schema. */
+    proposed?: ProposedField[];
+    /**
+     * A page that uses it (`/checkout`, `/admin/orders/:id`): tool calls are
+     * sent there as a real Server Action request. Absent when no page uses it;
+     * it's then called in-process by the MCP route.
+     */
+    host?: string;
+    /**
+     * The app's own checks it runs first (`lib/auth.ts#requireAdmin`): a
+     * user who doesn't pass one doesn't see the tool (guards.ts).
+     */
+    guards?: string[];
+    load: () => Promise<Record<string, unknown>>;
+}
+/** An App Router page: a read tool that fetches it like a browser (pages.ts). */
+interface ManifestPage {
+    /** Tool name, e.g. `view_product_slug`. */
+    name: string;
+    /** `/product/:slug`, as routes are written. */
+    path: string;
+    params: string[];
+    file: string;
+    /** Search params its code reads: optional tool arguments, sent as the query. */
+    search?: string[];
+    /** From its static `metadata`. */
+    title?: string;
+    description?: string;
+    /** Just a form posting to a Server Action: not a tool unless `pages` lists it. */
+    formOnly?: boolean;
+    /** The app's own checks it runs (`lib/auth.ts#requireAdmin`), see ManifestAction.guards. */
+    guards?: string[];
+}
+/**
+ * The app's own login (login.ts): a sign-in form under the MCP route makes
+ * this request, for Connect with no code. `host` is the page with the
+ * action's form, which tool calls redirected to mean "signed out".
+ */
+type ManifestLogin = ManifestLoginStep & {
+    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
+    where?: string;
+    /** The first step takes no password: an email or phone number, then the code. */
+    passwordless?: boolean;
+    /** The login's second step, a code; `host` (or the route's path) is where the first step redirects to ask for it. */
+    verify?: ManifestLoginStep;
+};
+/** One request of the login. */
+type ManifestLoginStep = {
+    kind: "action";
+    key: string;
+    fields: LoginField[];
+    host?: string;
+} | {
+    kind: "route";
+    path: string;
+    fields: LoginField[];
+    body: "json" | "form";
+};
+/**
+ * A Next app on Supabase Auth with `@supabase/ssr` (supabase.ts): which
+ * sign-ins Connect makes on Supabase directly, decided at build time from
+ * where the app signs its users in (plan Part 2, decisions A and B).
+ */
+interface ManifestSupabase {
+    /** The session cookie's name when the app sets one; else `sb-<ref>-auth-token`, from the project's URL. */
+    cookieName?: string;
+    /**
+     * Signed in to on Supabase directly: by password on the form at
+     * `<MCP path>/login` (the password goes from the app's server to Supabase),
+     * the rest on the broker's pages. A method the app signs in with on its
+     * server isn't here: the app's own login does it, or nothing does.
+     */
+    direct: Array<"password" | "email-code" | "social">;
+    /** Where the app signs in, as found: "signInWithPassword in components/login-form.tsx:42 (browser: "use client")". */
+    found: string[];
+    /** Server sign-ins the app's own login couldn't be made from, so that method has no sign-in until the owner switches to Supabase directly. */
+    unusable?: string[];
+    /** Routes that finish a sign-in (`exchangeCodeForSession`): their checks don't run for Connect's sign-ins. */
+    callbacks?: string[];
+    /** The app's sign-in pages (`/auth/login`): a tool call redirected there was signed out. */
+    loginPages?: string[];
+}
+interface ExposifyManifest {
+    info: {
+        name: string;
+        version: string;
+    };
+    /** next.config's basePath, prefixed to every tool call's path. */
+    basePath?: string;
+    /** next.config's trailingSlash: tool calls add one, so they aren't redirected. */
+    trailingSlash?: boolean;
+    routes: ManifestRoute[];
+    /** The MCP route's URL without its catch-all segment, e.g. `/mcp`: Server Actions are served under `<mcpPath>/actions/`. */
+    mcpPath?: string;
+    actions?: ManifestAction[];
+    pages?: ManifestPage[];
+    login?: ManifestLogin;
+    supabase?: ManifestSupabase;
+    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
+    authStacks?: string[];
+    /** Docs for search_docs, embedded so they work without a file system. */
+    docs: DocSource[];
+    /** exposify.descriptions.json's texts, "METHOD /path" -> text. */
+    descriptions?: Record<string, string>;
+}
+
+export type { ActionField as A, ExposifyManifest as E, ManifestSupabase as M, PagesRouteEntry as P, AppRouteEntry as a, ManifestAction as b, ManifestLogin as c, ManifestLoginStep as d, ManifestPage as e, ManifestRoute as f };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.2",
-    "@exposify/core": "0.3.14",
+    "@exposify/cli": "0.0.3",
+    "@exposify/core": "0.3.16",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"
   },

package/dist/fields-olvyFnxj.d.cts

@@ -1,23 +0,0 @@
-type FieldType = "string" | "number" | "boolean" | "json" | "file";
-interface ActionField {
-    name: string;
-    type: FieldType;
-    /** Read with getAll(): a repeated field, sent as an array. */
-    array?: true;
-    /** Its allowed values, from `LIST.includes(x)` over a constant list. */
-    enum?: string[];
-    /** Always needed: a parameter of its own (a `.bind` argument), a non-optional key of an object parameter, or required by every form that submits to it. */
-    required?: true;
-    /** From the form's input (pass 3, forms.ts). */
-    min?: number;
-    max?: number;
-    minLength?: number;
-    maxLength?: number;
-    pattern?: string;
-    /** Where it was found: the action's code, its form, or both. */
-    origin?: "action" | "form" | "both";
-    /** For the agent: format, units, what it refers to (from an accepted proposal). */
-    description?: string;
-}
-
-export type { ActionField as A };

package/dist/fields-olvyFnxj.d.ts

@@ -1,23 +0,0 @@
-type FieldType = "string" | "number" | "boolean" | "json" | "file";
-interface ActionField {
-    name: string;
-    type: FieldType;
-    /** Read with getAll(): a repeated field, sent as an array. */
-    array?: true;
-    /** Its allowed values, from `LIST.includes(x)` over a constant list. */
-    enum?: string[];
-    /** Always needed: a parameter of its own (a `.bind` argument), a non-optional key of an object parameter, or required by every form that submits to it. */
-    required?: true;
-    /** From the form's input (pass 3, forms.ts). */
-    min?: number;
-    max?: number;
-    minLength?: number;
-    maxLength?: number;
-    pattern?: string;
-    /** Where it was found: the action's code, its form, or both. */
-    origin?: "action" | "form" | "both";
-    /** For the agent: format, units, what it refers to (from an accepted proposal). */
-    description?: string;
-}
-
-export type { ActionField as A };