@exposify/next 0.0.3 → 0.0.4

package/dist/config.js

@@ -7,13 +7,13 @@ import {
 
 // src/config.ts
 import { existsSync as existsSync3, watch } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { DESCRIPTIONS_FILE as DESCRIPTIONS_FILE2 } from "@exposify/core";
 
 // src/codegen.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync6, readdirSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join6, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync7, readdirSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join7, relative as relative2, sep as sep2 } from "path";
 import { DESCRIPTIONS_FILE, authStacksOf, dependencyNames, parseDescriptions } from "@exposify/core";
 import { globSync } from "tinyglobby";
 
@@ -342,8 +342,8 @@ function readsOf(fn, formNames, st, depth) {
       st.readsAll = true;
       const decl = [...parents].reverse().find((p) => !["TSAsExpression", "TSSatisfiesExpression", "ParenthesizedExpression"].includes(p.type));
       if (decl?.type === "VariableDeclarator" && decl.id.type === "ObjectPattern") {
-        for (const prop of decl.id.properties) {
-          const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+        for (const prop2 of decl.id.properties) {
+          const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
           if (key) addField(st, key, {}, false);
         }
       }
@@ -385,19 +385,19 @@ function analyzeFields(fn, roles, ctx) {
     if (literal?.type === "TSTypeLiteral") {
       for (const m of literal.members) if (m.type === "TSPropertySignature" && keyName(m.key)) members.set(keyName(m.key), m);
     }
-    for (const prop of id.properties) {
-      const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+    for (const prop2 of id.properties) {
+      const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
       if (!key) {
-        st.unresolved.push(`line ${lineOf(prop)}: a rest element in parameter ${role.name}`);
+        st.unresolved.push(`line ${lineOf(prop2)}: a rest element in parameter ${role.name}`);
         continue;
       }
       const member = members.get(key);
       const hint = annotated(member?.typeAnnotation?.typeAnnotation);
       if (!hint) {
-        st.unresolved.push(`line ${lineOf(prop)}: ${key} has no type it can read (string, number, boolean or a union of strings)`);
+        st.unresolved.push(`line ${lineOf(prop2)}: ${key} has no type it can read (string, number, boolean or a union of strings)`);
         continue;
       }
-      st.fields.set(key, { name: key, type: hint.type, ...hint.enum ? { enum: hint.enum } : {}, ...member?.optional || prop.value.type === "AssignmentPattern" ? {} : { required: true } });
+      st.fields.set(key, { name: key, type: hint.type, ...hint.enum ? { enum: hint.enum } : {}, ...member?.optional || prop2.value.type === "AssignmentPattern" ? {} : { required: true } });
     }
   });
   return { fields: [...st.fields.values()], readsAll: st.readsAll, unresolved: st.unresolved };
@@ -475,20 +475,20 @@ function renderedAttributes(el, fn, use, mod) {
     for (const p of pattern.properties) {
       if (p.type === "RestElement" && p.argument.type === "Identifier") restName = p.argument.name;
       if (p.type !== "ObjectProperty") continue;
-      const prop = keyName(p.key);
+      const prop2 = keyName(p.key);
       const value = p.value.type === "AssignmentPattern" ? p.value.left : p.value;
-      if (!prop || value.type !== "Identifier") continue;
+      if (!prop2 || value.type !== "Identifier") continue;
       const fallback = p.value.type === "AssignmentPattern" ? attrValue({ type: "JSXAttribute", value: { type: "JSXExpressionContainer", expression: p.value.right } }, [], mod.scope) : void 0;
-      locals.set(value.name, { prop, ...fallback ? { fallback } : {} });
+      locals.set(value.name, { prop: prop2, ...fallback ? { fallback } : {} });
     }
   }
-  const named2 = new Set([...locals.values()].map((l) => l.prop));
+  const named = new Set([...locals.values()].map((l) => l.prop));
   const out = /* @__PURE__ */ new Map();
   for (const a of el.openingElement.attributes) {
     if (a.type === "JSXSpreadAttribute") {
       const arg = unwrapTs(a.argument);
       if (arg?.type === "Identifier" && (arg.name === restName || arg.name === propsName)) {
-        for (const [k, v] of use) if (arg.name === propsName || !named2.has(k)) out.set(k, v);
+        for (const [k, v] of use) if (arg.name === propsName || !named.has(k)) out.set(k, v);
       }
       continue;
     }
@@ -496,14 +496,14 @@ function renderedAttributes(el, fn, use, mod) {
     if (!key) continue;
     const expr = a.value?.type === "JSXExpressionContainer" ? unwrapTs(a.value.expression) : void 0;
     if (expr?.type === "Identifier" && locals.has(expr.name)) {
-      const { prop, fallback } = locals.get(expr.name);
-      const v = use.has(prop) ? use.get(prop) : fallback;
+      const { prop: prop2, fallback } = locals.get(expr.name);
+      const v = use.has(prop2) ? use.get(prop2) : fallback;
       if (v !== void 0) out.set(key, v);
       continue;
     }
     if (expr?.type === "MemberExpression" && unwrapTs(expr.object)?.type === "Identifier" && unwrapTs(expr.object).name === propsName) {
-      const prop = keyName(expr.property);
-      if (prop && use.has(prop)) out.set(key, use.get(prop));
+      const prop2 = keyName(expr.property);
+      if (prop2 && use.has(prop2)) out.set(key, use.get(prop2));
       continue;
     }
     out.set(key, attrValue(a, [], mod.scope));
@@ -850,8 +850,8 @@ function actionHosts(pages, graph, actionExports) {
 // src/login.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
-import { LOGIN_NAME, NOT_A_LOGIN, loginFields } from "@exposify/core";
-var SESSION_CODE = /cookies\(\)\s*\.set|\.cookies\.set\(|cookieStore\.set|set-cookie|setCookie|\bjwt\.sign\(|new\s+SignJWT|\bsign\(|createSession|session\.(save|create)|\.login\(/i;
+import { LOGIN_NAME, NOT_A_LOGIN, NOT_A_VERIFY, START_NAME, VERIFY_NAME, loginFields, startFields, verifyFields } from "@exposify/core";
+var SESSION_CODE = /cookies\(\)\)?\s*\.set|\.cookies\.set\(|cookieStore\.set|set-cookie|setCookie|\bjwt\.sign\(|new\s+SignJWT|\bsign\(|createSession|session\.(save|create)|\.login\(/i;
 function routeBodyFields(source) {
   const names = /* @__PURE__ */ new Set();
   let body = null;
@@ -872,16 +872,27 @@ function routeBodyFields(source) {
   }
   return names.size && body ? { fields: [...names], body } : null;
 }
-function actionCandidate(a) {
-  if (NOT_A_LOGIN.test(a.key) || NOT_A_LOGIN.test(a.action.name)) return null;
+var LOGIN_RULE = { not: NOT_A_LOGIN, name: LOGIN_NAME, mustBeNamed: false, fields: (n) => loginFields(n), session: true };
+var VERIFY_RULE = { not: NOT_A_VERIFY, name: VERIFY_NAME, mustBeNamed: true, fields: (n, named) => verifyFields(n, named), session: true };
+var START_RULE = { not: NOT_A_LOGIN, name: new RegExp(`${LOGIN_NAME.source}|${START_NAME.source}`, "i"), mustBeNamed: true, fields: (n) => startFields(n), session: false };
+var knownKey = (l) => l.kind === "action" ? `${l.file}#${l.export}` : l.file;
+function actionCandidate(a, rule, known) {
+  if (rule.not.test(a.key) || rule.not.test(a.action.name)) return null;
   if (!a.action.params.some((p) => p.role === "formData" || p.role === "object")) return null;
-  const fields = loginFields(a.action.fields.map((f) => f.name));
+  const isNamed = rule.name.test(a.action.name);
+  if (rule.mustBeNamed && !isNamed) return null;
+  const fields = rule.fields(
+    a.action.fields.map((f) => f.name),
+    isNamed
+  );
   if (!fields) return null;
-  if (!a.action.setsCookies && !LOGIN_NAME.test(a.action.name)) return null;
+  if (rule.session && !a.action.setsCookies && !LOGIN_NAME.test(a.action.name) && !(rule === LOGIN_RULE && known.has(`${a.file}#${a.action.name}`))) return null;
   return { kind: "action", key: a.key, export: a.action.name, file: a.file, fields, ...a.host ? { host: a.host } : {} };
 }
-function routeCandidate(root, r) {
-  if (r.router !== "app" || !r.module.methods.includes("POST") || r.params.length > 0 || NOT_A_LOGIN.test(r.path)) return null;
+function routeCandidate(root, r, rule, known) {
+  if (r.router !== "app" || !r.module.methods.includes("POST") || r.params.length > 0 || rule.not.test(r.path)) return null;
+  const isNamed = rule.name.test(r.path);
+  if (rule.mustBeNamed && !isNamed) return null;
   let source;
   try {
     source = readFileSync2(join2(root, r.file), "utf8");
@@ -889,26 +900,41 @@ function routeCandidate(root, r) {
     return null;
   }
   const read2 = routeBodyFields(source);
-  const fields = read2 ? loginFields(read2.fields) : null;
+  const fields = read2 ? rule.fields(read2.fields, isNamed) : null;
   if (!read2 || !fields) return null;
-  if (!LOGIN_NAME.test(r.path) && !SESSION_CODE.test(source)) return null;
+  if (rule.session && !LOGIN_NAME.test(r.path) && !SESSION_CODE.test(source) && !(rule === LOGIN_RULE && known.has(r.file))) return null;
   return { kind: "route", path: r.path, file: r.file, fields, body: read2.body };
 }
-var named = (l) => LOGIN_NAME.test(l.kind === "action" ? l.export : l.path);
-function findLogin(d) {
-  const candidates = [];
+var nameOf = (l) => l.kind === "action" ? l.export : l.path;
+function candidates(d, rule, known) {
+  const out = [];
   for (const a of d.actions) {
-    const c = actionCandidate(a);
-    if (c) candidates.push(c);
+    const c = actionCandidate(a, rule, known);
+    if (c) out.push(c);
   }
   for (const r of d.routes) {
-    const c = routeCandidate(d.root, r);
-    if (c) candidates.push(c);
+    const c = routeCandidate(d.root, r, rule, known);
+    if (c) out.push(c);
+  }
+  const score = (l) => (rule === LOGIN_RULE && known.has(knownKey(l)) ? 0 : 8) + (rule.name.test(nameOf(l)) ? 0 : 4) + (l.kind === "action" && l.host ? 0 : 2) + l.fields.length / 100;
+  return out.sort((a, b) => score(a) - score(b));
+}
+function findLogin(d, known = /* @__PURE__ */ new Set()) {
+  const verifies = candidates(d, VERIFY_RULE, known);
+  const logins = candidates(d, LOGIN_RULE, known);
+  if (logins.length > 0) {
+    const [first2, ...others2] = logins;
+    return { login: { ...first2, ...verifies[0] ? { verify: verifies[0] } : {} }, others: others2 };
+  }
+  const pairs = [];
+  for (const start of candidates(d, START_RULE, known)) {
+    const who = new Set(start.fields.filter((f) => f.kind === "identity").map((f) => f.name));
+    const verify = verifies.find((v) => v.fields.some((f) => who.has(f.name))) ?? verifies.find((v) => !v.fields.some((f) => f.kind === "identity"));
+    if (verify) pairs.push({ ...start, passwordless: true, verify });
   }
-  if (candidates.length === 0) return null;
-  const score = (l) => (named(l) ? 0 : 4) + (l.kind === "action" && l.host ? 0 : 2) + l.fields.length / 100;
-  candidates.sort((a, b) => score(a) - score(b));
-  return { login: candidates[0], others: candidates.slice(1) };
+  if (pairs.length === 0) return null;
+  const [first, ...others] = pairs;
+  return { login: first, others };
 }
 
 // src/guards.ts
@@ -1090,9 +1116,9 @@ function pageSearchParams(program) {
     if (!FUNCTION_TYPES.has(fn.type)) return;
     const param = fn.params?.[0];
     if (param?.type === "ObjectPattern") {
-      for (const prop of param.properties) {
-        if (prop.type !== "ObjectProperty" || keyName(prop.key) !== "searchParams") continue;
-        const value = prop.value.type === "AssignmentPattern" ? prop.value.left : prop.value;
+      for (const prop2 of param.properties) {
+        if (prop2.type !== "ObjectProperty" || keyName(prop2.key) !== "searchParams") continue;
+        const value = prop2.value.type === "AssignmentPattern" ? prop2.value.left : prop2.value;
         if (value.type === "Identifier") sources.add(value.name);
         for (const k of patternKeys(value)) names.add(k);
       }
@@ -1159,10 +1185,10 @@ function staticMetadata(program) {
       const init = unwrapTs(d.init);
       if (d.id?.type !== "Identifier" || d.id.name !== "metadata" || init?.type !== "ObjectExpression") continue;
       const out = {};
-      for (const prop of init.properties) {
-        if (prop.type !== "ObjectProperty") continue;
-        const key = keyName(prop.key);
-        const value = unwrapTs(prop.value);
+      for (const prop2 of init.properties) {
+        if (prop2.type !== "ObjectProperty") continue;
+        const key = keyName(prop2.key);
+        const value = unwrapTs(prop2.value);
         if (key === "description") {
           const s = stringValue(value);
           if (s) out.description = s;
@@ -1265,15 +1291,15 @@ function readTsconfig(root) {
   }
 }
 function asFile(path) {
-  const candidates = [path, ...EXTENSIONS.map((e) => path + e), ...EXTENSIONS.map((e) => join5(path, `index${e}`))];
-  if (/\.[mc]?jsx?$/.test(path)) candidates.push(...EXTENSIONS.map((e) => path.replace(/\.[mc]?jsx?$/, e)));
-  return candidates.find((c) => existsSync(c) && statSync(c).isFile());
+  const candidates2 = [path, ...EXTENSIONS.map((e) => path + e), ...EXTENSIONS.map((e) => join5(path, `index${e}`))];
+  if (/\.[mc]?jsx?$/.test(path)) candidates2.push(...EXTENSIONS.map((e) => path.replace(/\.[mc]?jsx?$/, e)));
+  return candidates2.find((c) => existsSync(c) && statSync(c).isFile());
 }
 function moduleLoader(root) {
   const { baseUrl, paths } = readTsconfig(root);
   const base = join5(root, baseUrl ?? ".");
   const cache = /* @__PURE__ */ new Map();
-  const candidates = (specifier2, fromFile) => {
+  const candidates2 = (specifier2, fromFile) => {
     if (specifier2.startsWith(".")) return [resolve(root, dirname(fromFile), specifier2)];
     for (const [pattern, targets] of Object.entries(paths ?? {})) {
       const star = pattern.indexOf("*");
@@ -1290,7 +1316,7 @@ function moduleLoader(root) {
     const key = `${fromFile}\0${specifier2}`;
     if (cache.has(key)) return cache.get(key);
     let found;
-    for (const candidate of candidates(specifier2, fromFile)) {
+    for (const candidate of candidates2(specifier2, fromFile)) {
       const path = asFile(candidate);
       const rel = path && relative(root, path);
       if (!path || !rel || rel.startsWith("..") || rel.split(sep).includes("node_modules")) continue;
@@ -1322,11 +1348,11 @@ function writtenInput(n) {
   n = unwrapTs(n);
   if (n?.type !== "ObjectExpression") return "opaque";
   const out = {};
-  for (const prop of n.properties) {
-    const key = prop.type === "ObjectProperty" ? keyName(prop.key) : void 0;
+  for (const prop2 of n.properties) {
+    const key = prop2.type === "ObjectProperty" ? keyName(prop2.key) : void 0;
     if (!key) continue;
     let values;
-    walk(prop.value, (c) => {
+    walk(prop2.value, (c) => {
       if (values || c.type !== "CallExpression" || keyName(c.callee?.property) !== "enum") return;
       const list = unwrapTs(c.arguments[0]);
       const items = list?.type === "ArrayExpression" ? list.elements.map((e) => stringValue(e)) : [];
@@ -1346,13 +1372,13 @@ function markerOf(init, imports) {
   const meta = call.arguments[1];
   const marker = { kind: "described" };
   if (meta?.type === "ObjectExpression") {
-    for (const prop of meta.properties) {
-      if (prop.type !== "ObjectProperty") continue;
-      const key = keyName(prop.key);
-      const value = stringValue(prop.value);
+    for (const prop2 of meta.properties) {
+      if (prop2.type !== "ObjectProperty") continue;
+      const key = keyName(prop2.key);
+      const value = stringValue(prop2.value);
       if (key === "name" && value) marker.name = value;
       if (key === "description" && value) marker.description = value;
-      if (key === "input") marker.input = writtenInput(prop.value);
+      if (key === "input") marker.input = writtenInput(prop2.value);
     }
   }
   return { marker, handler };
@@ -1623,18 +1649,241 @@ function findInlineActions(source, file) {
   const program = parseModule(source, file);
   if (!program) return [];
   const out = [];
-  const named2 = /* @__PURE__ */ new Map();
+  const named = /* @__PURE__ */ new Map();
   walk(program, (n) => {
-    if (n.type === "VariableDeclarator" && n.id.type === "Identifier" && n.init) named2.set(unwrapTs(n.init), n.id.name);
+    if (n.type === "VariableDeclarator" && n.id.type === "Identifier" && n.init) named.set(unwrapTs(n.init), n.id.name);
     if (!FUNCTION_TYPES.has(n.type) || n.body?.type !== "BlockStatement") return;
     if (!n.body.directives.some((d) => d.value?.value === "use server")) return;
     if (isActionModule(program) && program.body.some((s) => s === n || s.declaration === n || s.declaration?.declarations?.some((d) => unwrapTs(d.init) === n))) return;
-    const name = n.id?.name ?? named2.get(n);
+    const name = n.id?.name ?? named.get(n);
     out.push({ ...name ? { name } : {}, line: n.loc?.start.line ?? 1 });
   });
   return out;
 }
 
+// src/supabase.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
+var AUTH_CALLS = {
+  signInWithPassword: "password",
+  signInWithOtp: "email-code",
+  verifyOtp: "email-code",
+  signInWithOAuth: "social",
+  signInWithIdToken: "other",
+  signInWithSSO: "other",
+  signInAnonymously: "other",
+  signInWithWeb3: "other"
+};
+var MFA_CALLS = /* @__PURE__ */ new Set(["challenge", "verify", "challengeAndVerify"]);
+var APP_SERVER_FILE = /^(page|layout|template|route|default|loading|not-found|forbidden|unauthorized|error|global-error)\.[^.]+$/;
+var MIDDLEWARE_FILE = /^(src\/)?(middleware|proxy|instrumentation)\.[^./]+$/;
+var directive2 = (program) => program.directives?.[0]?.value?.value;
+var baseName = (f) => f.slice(f.lastIndexOf("/") + 1);
+function isAuthObject(n) {
+  n = unwrapTs(n);
+  if (n?.type === "Identifier") return n.name === "auth";
+  return (n?.type === "MemberExpression" || n?.type === "OptionalMemberExpression") && keyName(n.property) === "auth" && !n.computed;
+}
+var propertyOf = (n) => n.computed ? stringValue(n.property) : keyName(n.property);
+function prop(obj, name) {
+  obj = unwrapTs(obj);
+  if (obj?.type !== "ObjectExpression") return void 0;
+  return obj.properties.find((p) => p.type === "ObjectProperty" && keyName(p.key) === name)?.value;
+}
+function findSupabase(root, files, graph, dependencies, dirs) {
+  const ssr = dependencies.includes("@supabase/ssr");
+  if (!ssr) return dependencies.includes("@supabase/auth-helpers-nextjs") ? { authHelpers: true, signIns: [], callbacks: [] } : null;
+  const facts = /* @__PURE__ */ new Map();
+  const factsOf = (file) => {
+    if (facts.has(file)) return facts.get(file);
+    let found = null;
+    try {
+      const source = readFileSync6(join6(root, file), "utf8");
+      const program = parseModule(source, file);
+      if (program) {
+        const d = directive2(program);
+        found = {
+          program,
+          ...d ? { directive: d } : {},
+          serverClient: /\bcreateServerClient\s*\(|from\s+["']next\/headers["']/.test(source),
+          browserClient: /\bcreateBrowserClient\s*\(/.test(source)
+        };
+      }
+    } catch {
+      found = null;
+    }
+    facts.set(file, found);
+    return found;
+  };
+  const isPagesPage = (f) => Boolean(dirs.pagesDir && f.startsWith(`${dirs.pagesDir}/`) && !f.startsWith(`${dirs.pagesDir}/api/`));
+  const isPagesApi = (f) => Boolean(dirs.pagesDir && f.startsWith(`${dirs.pagesDir}/api/`));
+  const isAppRoute = (f) => Boolean(dirs.appDir && f.startsWith(`${dirs.appDir}/`) && /^route\./.test(baseName(f)));
+  const candidates2 = files.filter((f) => {
+    try {
+      return /\b(signIn\w*|verifyOtp|exchangeCodeForSession|mfa|auth-ui-react|storageKey|cookieOptions)\b/.test(readFileSync6(join6(root, f), "utf8"));
+    } catch {
+      return false;
+    }
+  });
+  const clientRoots = [];
+  const serverRoots = [];
+  for (const f of files) {
+    if (isPagesPage(f)) {
+      clientRoots.push(f);
+      continue;
+    }
+    const isEntry = isPagesApi(f) || MIDDLEWARE_FILE.test(f) || Boolean(dirs.appDir && f.startsWith(`${dirs.appDir}/`) && APP_SERVER_FILE.test(baseName(f)));
+    let text2;
+    try {
+      text2 = readFileSync6(join6(root, f), "utf8");
+    } catch {
+      continue;
+    }
+    const head = /^\s*(?:\/\/[^\n]*\n|\/\*[\s\S]*?\*\/\s*)*\s*["']use (client|server)["']/.exec(text2)?.[1];
+    if (head === "client") clientRoots.push(f);
+    else if (head === "server" || isEntry) serverRoots.push(f);
+  }
+  const browserSet = graph.reachable(clientRoots);
+  const serverSet = /* @__PURE__ */ new Set();
+  const queue = [...serverRoots];
+  while (queue.length > 0 && serverSet.size < 2e3) {
+    const f = queue.shift();
+    if (serverSet.has(f)) continue;
+    if (!serverRoots.includes(f) && factsOf(f)?.directive === "use client") continue;
+    serverSet.add(f);
+    for (const e of graph.edges(f)) if (!serverSet.has(e.file)) queue.push(e.file);
+  }
+  const sideOf = (file, inServerFn) => {
+    const f = factsOf(file);
+    if (inServerFn || f?.directive === "use server") return { side: "server", why: "a Server Action" };
+    if (isAppRoute(file) || isPagesApi(file)) return { side: "server", why: "a route handler" };
+    if (f?.directive === "use client") return { side: "browser", why: '"use client"' };
+    if (isPagesPage(file)) return { side: "browser", why: "a Pages Router page" };
+    let server = f?.serverClient ?? false;
+    let browser = f?.browserClient ?? false;
+    let helper;
+    if (!server && !browser) {
+      for (const e of graph.edges(file)) {
+        const g = factsOf(e.file);
+        if (g?.serverClient && !g.browserClient) {
+          server = true;
+          helper = e.file;
+        }
+        if (g?.browserClient && !g.serverClient) {
+          browser = true;
+          helper = e.file;
+        }
+      }
+    }
+    if (server !== browser) return { side: server ? "server" : "browser", why: `uses the ${server ? "server" : "browser"} client${helper ? ` from ${helper}` : ""}` };
+    const inBrowser = browserSet.has(file);
+    const inServer = serverSet.has(file);
+    if (inBrowser && !inServer) return { side: "browser", why: "imported by browser code" };
+    if (inServer && !inBrowser) return { side: "server", why: "imported by server code" };
+    return { side: "unknown", why: inBrowser ? "imported by both browser and server code" : "not imported by a page or route we could follow" };
+  };
+  const out = { signIns: [], callbacks: [] };
+  for (const file of candidates2) {
+    const f = factsOf(file);
+    if (!f) continue;
+    const top = f.program;
+    const topName = (n) => {
+      const d = n.type === "ExportNamedDeclaration" ? n.declaration : n.type === "ExportDefaultDeclaration" ? n.declaration : n;
+      if (n.type === "ExportDefaultDeclaration") return "default";
+      if (d?.type === "FunctionDeclaration") return d.id?.name;
+      if (d?.type === "VariableDeclaration") return keyName(d.declarations?.[0]?.id);
+      return void 0;
+    };
+    let authUi;
+    walk(top, (n, parents) => {
+      if (n.type === "ImportDeclaration" && n.source?.value === "@supabase/auth-ui-react") {
+        authUi = n.specifiers.find((s) => s.type === "ImportSpecifier" && keyName(s.imported) === "Auth")?.local?.name;
+      }
+      if (n.type === "ObjectProperty" && !out.cookieName) {
+        const key = keyName(n.key);
+        const value = stringValue(unwrapTs(n.value));
+        const parentProp = parents.at(-2);
+        if (key === "storageKey" && value) out.cookieName = value;
+        if (key === "name" && value && parentProp?.type === "ObjectProperty" && keyName(parentProp.key) === "cookieOptions") out.cookieName = value;
+      }
+      const push = (call, method2, extra = {}) => {
+        const inServerFn = parents.some((p) => FUNCTION_TYPES.has(p.type) && p.body?.directives?.some((d) => d.value?.value === "use server"));
+        const { side, why } = sideOf(file, inServerFn);
+        const holder = parents.find((p) => top.body.includes(p));
+        const name2 = holder ? topName(holder) : void 0;
+        out.signIns.push({
+          method: method2,
+          call,
+          ...extra,
+          file,
+          line: n.loc?.start.line ?? 1,
+          side,
+          why,
+          ...side === "server" && name2 && (isActionModule(top) || inServerFn) ? { action: `${file}#${name2}` } : {},
+          ...side === "server" && (isAppRoute(file) || isPagesApi(file)) ? { route: file } : {}
+        });
+      };
+      if (n.type === "JSXOpeningElement" && authUi && n.name?.type === "JSXIdentifier" && n.name.name === authUi) {
+        push("<Auth />", "password");
+        return;
+      }
+      if (n.type !== "CallExpression" && n.type !== "OptionalCallExpression") return;
+      const callee = unwrapTs(n.callee);
+      if (callee?.type !== "MemberExpression" && callee?.type !== "OptionalMemberExpression") return;
+      const name = propertyOf(callee);
+      if (!name) return;
+      const object = unwrapTs(callee.object);
+      if (MFA_CALLS.has(name) && (object?.type === "MemberExpression" || object?.type === "OptionalMemberExpression") && propertyOf(object) === "mfa" && isAuthObject(object.object)) {
+        push(`mfa.${name}`, "totp");
+        return;
+      }
+      if (!isAuthObject(object)) return;
+      const arg = n.arguments?.[0];
+      if (name === "exchangeCodeForSession" || name === "verifyOtp" && prop(arg, "token_hash")) {
+        if (!out.callbacks.includes(file)) out.callbacks.push(file);
+        return;
+      }
+      const method = Object.hasOwn(AUTH_CALLS, name) ? AUTH_CALLS[name] : void 0;
+      if (!method) return;
+      const provider = name === "signInWithOAuth" ? stringValue(unwrapTs(prop(arg, "provider"))) : void 0;
+      push(name, method, provider ? { provider } : {});
+    });
+  }
+  return out;
+}
+function signInLabel(s) {
+  const side = s.side === "unknown" ? "side unclear, counted as server" : s.side;
+  return `${s.call}${s.provider ? ` (${s.provider})` : ""} in ${s.file}:${s.line} (${side}: ${s.why})`;
+}
+function supabaseChoice(found, login, loginPages2 = []) {
+  const onServer = (method) => found.signIns.filter((s) => s.method === method && s.side !== "browser");
+  const direct = [];
+  const unusable = [];
+  for (const method of ["password", "email-code"]) {
+    const server = onServer(method);
+    if (server.length === 0) direct.push(method);
+    else if (!login) unusable.push(...server.map(signInLabel));
+  }
+  direct.push("social");
+  return {
+    ...found.cookieName ? { cookieName: found.cookieName } : {},
+    direct,
+    found: found.signIns.map(signInLabel),
+    ...unusable.length ? { unusable } : {},
+    ...found.callbacks.length ? { callbacks: found.callbacks } : {},
+    ...loginPages2.length ? { loginPages: loginPages2 } : {}
+  };
+}
+function knownLogins(found) {
+  const out = /* @__PURE__ */ new Set();
+  for (const s of found?.signIns ?? []) {
+    if (s.method !== "password" || s.side === "browser") continue;
+    if (s.action) out.add(s.action);
+    if (s.route) out.add(s.route);
+  }
+  return out;
+}
+
 // src/codegen.ts
 var DEFAULT_DOCS = ["README.md", "docs/**/*.md"];
 var actionRoute = (mcpPath, key) => `POST ${(mcpPath ?? "/mcp").replace(/\/$/, "")}/actions/${key}`;
@@ -1644,14 +1893,14 @@ function actionSignature(route, source) {
 }
 var posix = (p) => p.split(sep2).join("/");
 function firstDir(root, names) {
-  return names.find((n) => existsSync2(join6(root, n)));
+  return names.find((n) => existsSync2(join7(root, n)));
 }
 function filesUnder(root, dir) {
   const out = [];
   const visit = (rel) => {
     let entries;
     try {
-      entries = readdirSync(join6(root, rel), { withFileTypes: true });
+      entries = readdirSync(join7(root, rel), { withFileTypes: true });
     } catch {
       return;
     }
@@ -1678,7 +1927,7 @@ function discover(root, opts = {}) {
       const dirSegs = file.slice(appDir.length + 1).split("/").slice(0, -1);
       const route = appRoute(dirSegs);
       if (!route) continue;
-      const source = readFileSync6(join6(root, file), "utf8");
+      const source = readFileSync7(join7(root, file), "utf8");
       const module = analyzeRouteModule(source, file);
       if (module.mcpRoute) {
         out.mcpRoute ??= { file, source };
@@ -1694,7 +1943,7 @@ function discover(root, opts = {}) {
       const segs = file.slice(pagesDir.length + 1).replace(extPattern, "").split("/");
       const route = pagesApiRoute(segs);
       if (!route) continue;
-      const source = readFileSync6(join6(root, file), "utf8");
+      const source = readFileSync7(join7(root, file), "utf8");
       const src = defaultExportSource(source, file);
       out.routes.push({ router: "pages", file, ...route, detected: detectPagesMethods(source, file), ...src ? { source: src } : {} });
     }
@@ -1706,14 +1955,22 @@ function discover(root, opts = {}) {
     const catchAll = route ? /^(.*)\/:[A-Za-z0-9_]+\*\??$/.exec(route.path) : null;
     if (catchAll) out.mcpPath = catchAll[1] || "/";
   }
-  discoverActions(root, out, exts);
-  const found = findLogin(out);
+  const { files, graph, pages } = discoverActions(root, out, exts);
+  const supabase = findSupabase(root, files, graph, dependencyNames(readJson(join7(root, "package.json"))), out);
+  const found = findLogin(out, knownLogins(supabase));
   if (found) {
     out.login = found.login;
     out.loginOthers = found.others;
   }
+  if (supabase && !supabase.authHelpers) out.supabase = { found: supabase, choice: supabaseChoice(supabase, out.login, loginPages(supabase, pages, graph)) };
+  else if (supabase) out.supabase = { found: supabase, choice: { direct: [], found: [] } };
   return out;
 }
+function loginPages(found, pages, graph) {
+  const files = new Set(found.signIns.filter((s) => s.method === "password" || s.method === "email-code").map((s) => s.file));
+  if (files.size === 0) return [];
+  return pages.filter((p) => p.params.length === 0 && [...graph.reachable(p.roots)].some((f) => files.has(f))).map((p) => p.path);
+}
 var SOURCE_GLOB = "**/*.{ts,tsx,js,jsx,mjs,cjs}";
 var NOT_SOURCE = ["**/node_modules/**", ".next/**", "out/**", "build/**", "dist/**", "coverage/**", "**/*.d.ts"];
 function snakeCase(name) {
@@ -1727,7 +1984,7 @@ function discoverActions(root, out, exts) {
   for (const file of files) {
     let source;
     try {
-      source = readFileSync6(join6(root, file), "utf8");
+      source = readFileSync7(join7(root, file), "utf8");
     } catch {
       continue;
     }
@@ -1784,24 +2041,25 @@ function discoverActions(root, out, exts) {
     const found2 = guards.action(a.file, a.action.name);
     if (found2.length > 0) a.guards = found2;
   }
+  return { files, graph, pages };
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function readProposedInputs(root) {
-  const path = join6(root, DESCRIPTIONS_FILE);
+  const path = join7(root, DESCRIPTIONS_FILE);
   if (!existsSync2(path)) return {};
-  const parsed = parseDescriptions(readFileSync6(path, "utf8"));
+  const parsed = parseDescriptions(readFileSync7(path, "utf8"));
   return typeof parsed === "string" ? {} : parsed.inputs ?? {};
 }
 function readDescriptions(root, warn) {
-  const path = join6(root, DESCRIPTIONS_FILE);
+  const path = join7(root, DESCRIPTIONS_FILE);
   if (!existsSync2(path)) return {};
-  const parsed = parseDescriptions(readFileSync6(path, "utf8"));
+  const parsed = parseDescriptions(readFileSync7(path, "utf8"));
   if (typeof parsed === "string") {
     warn(`ignoring ${DESCRIPTIONS_FILE}: ${parsed}`);
     return {};
@@ -1813,22 +2071,28 @@ function readDocs(root, globs) {
   const docs = [];
   for (const path of paths) {
     try {
-      docs.push({ path, content: readFileSync6(join6(root, path), "utf8") });
+      docs.push({ path, content: readFileSync7(join7(root, path), "utf8") });
     } catch {
     }
   }
   return docs;
 }
 function defaultOutFile(root) {
-  return existsSync2(join6(root, "tsconfig.json")) ? "exposify.generated.ts" : "exposify.generated.js";
+  return existsSync2(join7(root, "tsconfig.json")) ? "exposify.generated.ts" : "exposify.generated.js";
 }
 function specifier(outFile, file) {
   const rel = posix(relative2(dirname2(outFile), file)).replace(/\.[^./]+$/, "");
   return rel.startsWith(".") ? rel : `./${rel}`;
 }
 function manifestLogin(l) {
-  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {}, where: `${l.export} in ${l.file}` } : { kind: "route", path: l.path, fields: l.fields, body: l.body, where: `POST ${l.path} in ${l.file}` };
+  const verify = l.verify ? manifestStep(l.verify) : void 0;
+  const where = l.verify ? `${whereOf(l)}, then a code: ${whereOf(l.verify)}` : whereOf(l);
+  return { ...manifestStep(l), where, ...l.passwordless ? { passwordless: true } : {}, ...verify ? { verify } : {} };
 }
+function manifestStep(l) {
+  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {} } : { kind: "route", path: l.path, fields: l.fields, body: l.body };
+}
+var whereOf = (l) => l.kind === "action" ? `${l.export} in ${l.file}` : `POST ${l.path} in ${l.file}`;
 function renderManifest(d, opts) {
   const ts = opts.outFile.endsWith(".ts");
   const j = (v) => JSON.stringify(v);
@@ -1872,13 +2136,14 @@ function renderManifest(d, opts) {
     `  info: ${j(opts.info)},`,
     ...opts.basePath ? [`  basePath: ${j(opts.basePath)},`] : [],
     ...opts.trailingSlash ? ["  trailingSlash: true,"] : [],
-    ...d.mcpPath && (actions.length > 0 || d.login) ? [`  mcpPath: ${j(d.mcpPath)},`] : [],
+    ...d.mcpPath && (actions.length > 0 || d.login || d.supabase) ? [`  mcpPath: ${j(d.mcpPath)},`] : [],
     "  routes: [",
     ...routes,
     "  ],",
     ...actions.length > 0 ? ["  actions: [", ...actions, "  ],"] : [],
     ...pages.length > 0 ? ["  pages: [", ...pages, "  ],"] : [],
     ...d.login ? [`  login: ${j(manifestLogin(d.login))},`] : [],
+    ...d.supabase && !d.supabase.found.authHelpers ? [`  supabase: ${j(d.supabase.choice)},`] : [],
     ...opts.authStacks?.length ? [`  authStacks: ${j(opts.authStacks)},`] : [],
     `  docs: ${j(opts.docs)},`,
     ...Object.keys(opts.descriptions).length > 0 ? [`  descriptions: ${JSON.stringify(opts.descriptions, null, 2).replace(/\n/g, "\n  ")},`] : [],
@@ -1890,7 +2155,7 @@ function renderManifest(d, opts) {
 function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)) {
   const outFile = opts.out ?? defaultOutFile(root);
   const discovery = discover(root, opts);
-  const pkg = readJson(join6(root, "package.json"));
+  const pkg = readJson(join7(root, "package.json"));
   const info = { name: typeof pkg?.name === "string" ? pkg.name : "next-app", version: typeof pkg?.version === "string" ? pkg.version : "0.0.0" };
   const content = renderManifest(discovery, {
     outFile,
@@ -1901,6 +2166,12 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     ...opts.trailingSlash ? { trailingSlash: true } : {},
     authStacks: authStacksOf(dependencyNames(pkg)).map((s) => s.pkg)
   });
+  if (discovery.supabase?.found.authHelpers) {
+    warn("@supabase/auth-helpers-nextjs keeps its session in an older cookie format AI assistants can't sign in with; move to @supabase/ssr (Supabase's replacement for it) to use Connect");
+  }
+  for (const s of discovery.supabase?.choice.unusable ?? []) {
+    warn(`your app signs users in to Supabase on the server (${s}), but not in a Server Action or route the sign-in form can run, so AI assistants can't sign in with a password; switch on "Sign in with Supabase" on the dashboard to have them sign in to Supabase directly`);
+  }
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
     warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`@exposify/next describe\` reviews it again`);
   }
@@ -1909,10 +2180,10 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
       discovery.mcpRoute ? `found ${discovery.actions.length} Server Action(s), but the MCP route (${discovery.mcpRoute.file}) isn't a catch-all route, which they're served under: move it to app/mcp/[[...transport]]/route.ts` : `found ${discovery.actions.length} Server Action(s), but no MCP route to serve them under: create app/mcp/[[...transport]]/route.ts (npx @exposify/next setup)`
     );
   }
-  const file = join6(root, outFile);
+  const file = join7(root, outFile);
   let current;
   try {
-    current = readFileSync6(file, "utf8");
+    current = readFileSync7(file, "utf8");
   } catch {
     current = void 0;
   }
@@ -1959,9 +2230,9 @@ function watchRoutes(root, run) {
     timer = setTimeout(run, 150);
   };
   for (const dir of ["app", "pages", "src", "lib", "actions", "server"]) {
-    if (!existsSync3(join7(root, dir))) continue;
+    if (!existsSync3(join8(root, dir))) continue;
     try {
-      watch(join7(root, dir), { recursive: true }, schedule).unref();
+      watch(join8(root, dir), { recursive: true }, schedule).unref();
     } catch {
     }
   }