@exposify/next 0.0.3 → 0.0.5

package/dist/index.cjs

@@ -698,6 +698,7 @@ function errorMessage(err) {
 }
 async function routesFrom(manifest, cfg, warnings) {
   const listed = Array.isArray(cfg.expose) ? cfg.expose.map(import_core.parseMethodEntry).filter((e) => e !== null) : [];
+  const callbacks = new Set(manifest.supabase?.callbacks ?? []);
   const perEntry = await Promise.all(
     manifest.routes.map(async (entry) => {
       const base = { path: entry.path, params: entry.params };
@@ -715,7 +716,7 @@ async function routesFrom(manifest, cfg, warnings) {
       const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
       return methods.filter((m) => m !== "OPTIONS").map((method) => {
         const marker = mod ? (0, import_core.getMarker)(mod[method]) : void 0;
-        return { ...base, method, ...marker ? { marker } : {} };
+        return { ...base, method, ...marker ? { marker } : {}, ...callbacks.has(entry.file) ? { optIn: true } : {} };
       });
     })
   );
@@ -873,29 +874,65 @@ function pagesFrom(manifest, cfg, config) {
   }
   return { routes, hidden: hidden3, forms };
 }
-function loginSpec(manifest, config, warnings) {
+function loginSpec(manifest, options, warnings) {
+  const config = options.login;
   if (config === false) return null;
-  if (config === void 0) return manifest.login ?? null;
+  let login;
+  if (config === void 0) login = manifest.login ?? null;
+  else {
+    const step = stepSpec(manifest, config, (name) => (0, import_core.fieldKind)(name), warnings, "login", "AI assistants can't sign in with your app's login");
+    login = step ? { ...step.step, where: step.where } : null;
+  }
+  if (!login || options.loginVerify === void 0) return login;
+  const { verify: _found, ...first } = login;
+  if (options.loginVerify === false) return first;
+  const kind = (name) => (0, import_core.verifyFields)([name], true)?.[0]?.kind ?? (0, import_core.fieldKind)(name);
+  const verify = stepSpec(manifest, options.loginVerify, kind, warnings, "loginVerify", "AI assistants can't finish your app's two-step login");
+  return verify ? { ...first, verify: verify.step, where: `${first.where ?? "your login"}, then a code: ${verify.where}` } : first;
+}
+function supabaseSpec(manifest, options, warnings) {
+  if (!manifest.supabase || options.supabase === false) return null;
+  if (options.supabase) return options.supabase;
+  const e = env3();
+  const url = e.NEXT_PUBLIC_SUPABASE_URL ?? e.SUPABASE_URL;
+  const key = e.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ?? e.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? e.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_OR_ANON_KEY;
+  if (!url || !key) {
+    warnings.push("your app uses Supabase Auth, but NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY (or _ANON_KEY) aren't both set where the MCP route runs, so AI assistants can't sign in to it; set them, or pass aiReady({ supabase: { url, key } })");
+    return null;
+  }
+  try {
+    new URL(url);
+  } catch {
+    warnings.push(`NEXT_PUBLIC_SUPABASE_URL isn't a URL (${url}), so AI assistants can't sign in to your Supabase Auth`);
+    return null;
+  }
+  return { url, key };
+}
+function stepSpec(manifest, config, kind, warnings, option, consequence) {
   if (typeof config === "object") {
-    const fields2 = config.fields.map((name) => ({ name, kind: (0, import_core.fieldKind)(name) }));
-    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json", where: `POST ${config.path}` };
+    const fields2 = config.fields.map((name) => ({ name, kind: kind(name) }));
+    return { step: { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json" }, where: `POST ${config.path}` };
   }
   const action = (manifest.actions ?? []).find((a) => a.key === config || a.export === config);
   if (!action) {
-    warnings.push(`aiReady({ login: "${config}" }): no server action by that name, so AI assistants can't sign in with your app's login`);
+    warnings.push(`aiReady({ ${option}: "${config}" }): no server action by that name, so ${consequence}`);
     return null;
   }
-  const fields = action.fields.map((f) => ({ name: f.name, kind: (0, import_core.fieldKind)(f.name) }));
-  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {}, where: `${action.export} in ${action.file}` };
+  const fields = action.fields.map((f) => ({ name: f.name, kind: kind(f.name) }));
+  return { step: { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {} }, where: `${action.export} in ${action.file}` };
 }
-async function actionLoginResult(raw, exportName) {
+async function actionLoginResult(raw, exportName, reading = {}) {
   if (actionNotFound(raw)) return { ok: false, message: "The app's sign-in page didn't run its login. Its developer needs to rebuild the app." };
-  const cookies = (0, import_core.cookieChanges)(raw).filter((c) => !c.deleted && c.value !== "");
+  const changes = (0, import_core.cookieChanges)(raw);
   const out = await readActionResponse(raw, exportName);
   const body = await out.json().catch(() => void 0);
+  const location = raw.headers.get("x-action-redirect")?.split(";")[0] ?? (typeof body?.redirectedTo === "string" ? body.redirectedTo : null);
+  const step = (0, import_core.readStep)({ status: location ? 303 : out.status, location, body, cookies: changes }, reading);
+  if (step) return (0, import_core.keepFailedCookies)(step, changes, reading);
   const message = (0, import_core.errorMessageOf)(body);
-  if (out.status >= 400 || message && !body?.redirectedTo) return { ok: false, message };
-  return cookies.length > 0 ? { ok: true, session: { cookies } } : { ok: false, message };
+  if (out.status >= 400 || message && !body?.redirectedTo || (0, import_core.rejectedBody)(body)) return (0, import_core.keepFailedCookies)({ ok: false, message }, changes, reading);
+  const session = (0, import_core.sessionFrom)(changes, reading, Boolean(location) || body !== void 0 && body !== null && typeof body === "object");
+  return session ? { ok: true, session } : (0, import_core.keepFailedCookies)({ ok: false, message }, changes, reading);
 }
 var clientIp = (headers) => headers.get("x-forwarded-for")?.split(",")[0]?.trim() || headers.get("x-real-ip") || void 0;
 function aiReady(manifest, options = {}) {
@@ -908,9 +945,39 @@ function aiReady(manifest, options = {}) {
   const actionsBase = (manifest.mcpPath ?? "").replace(/\/$/, "");
   const actionUrl = manifest.mcpPath === void 0 ? null : new RegExp(`${actionsBase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/actions/([^/]+)/?$`);
   const loginWarnings = [];
-  const login = (0, import_core.hostedResolverInfo)(cfg.auth) ? loginSpec(manifest, options.login, loginWarnings) : null;
+  const login = (0, import_core.hostedResolverInfo)(cfg.auth) ? loginSpec(manifest, options, loginWarnings) : null;
   const loginPagePath = `${(manifest.mcpPath ?? "/mcp").replace(/\/$/, "")}/login`;
   if (login) cfg.signedOutPaths = [login.kind === "action" ? login.host : login.path].filter((p) => Boolean(p)).map((p) => `${manifest.basePath ?? ""}${hostPath(p)}`);
+  const supabase = (0, import_core.hostedResolverInfo)(cfg.auth) ? supabaseSpec(manifest, options, loginWarnings) : null;
+  if (supabase && manifest.supabase?.loginPages?.length) {
+    cfg.signedOutPaths = [...cfg.signedOutPaths ?? [], ...manifest.supabase.loginPages.map((p) => `${manifest.basePath ?? ""}${hostPath(p)}`)];
+  }
+  const supabasePassword = supabase ? (0, import_core.supabasePasswordLogin)({
+    ...supabase,
+    onCaptcha: () => warnOnce("your Supabase project asks for a CAPTCHA to sign in, so AI assistants can't sign in with a password; social sign-ins still work")
+  }) : null;
+  const supabaseLoginNow = () => {
+    if (!supabasePassword) return null;
+    const choice = (0, import_core.hostedResolverInfo)(cfg.auth)?.supabasePasswordDirect();
+    return choice ?? (!login && manifest.supabase?.direct.includes("password")) ? supabasePassword : null;
+  };
+  let supabaseAuth;
+  const supabaseReport = () => {
+    if (!supabase || !manifest.supabase) return Promise.resolve(void 0);
+    const found = manifest.supabase;
+    supabaseAuth ??= (0, import_core.readSupabaseAuth)(supabase.url, supabase.key).then((read) => {
+      if (!read) {
+        supabaseAuth = void 0;
+        return void 0;
+      }
+      return {
+        ...read,
+        cookie: found.cookieName ?? (0, import_core.supabaseCookieName)(supabase.url),
+        found: { direct: found.direct, where: found.found, ...found.unusable ? { unusable: found.unusable } : {}, ...found.callbacks ? { callbacks: found.callbacks } : {} }
+      };
+    });
+    return supabaseAuth;
+  };
   let built = null;
   const build = async (endpoint) => {
     const warnings = [...loginWarnings];
@@ -1014,7 +1081,12 @@ function aiReady(manifest, options = {}) {
     if (cfg.expose === "*") details.push('all write routes exposed (expose: "*")');
     if (counts.hiddenWrites > 0) details.push(`${counts.hiddenWrites} write route${counts.hiddenWrites === 1 ? "" : "s"} hidden (opt in with exposed())`);
     if (pages.routes.length > 0) details.push(`${pages.routes.length} page${pages.routes.length === 1 ? "" : "s"} readable`);
-    if (login) details.push(`AI assistants sign in with your app's own login (${login.kind === "action" ? `server action ${login.key}` : `POST ${login.path}`}) at ${loginPagePath}`);
+    if (supabaseLoginNow()) {
+      details.push(`AI assistants sign in to your Supabase Auth with a password at ${loginPagePath}`);
+    } else if (login) {
+      const step = (l) => l.kind === "action" ? `server action ${l.key}` : `POST ${l.path}`;
+      details.push(`AI assistants sign in with your app's own login (${step(login)}${login.verify ? `, then a code: ${step(login.verify)}` : ""}) at ${loginPagePath}`);
+    }
     if (pages.forms > 0) details.push(`${pages.forms} page${pages.forms === 1 ? "" : "s"} left out as just a form (list in aiReady({ pages }) to include)`);
     if (exposedActions > 0) details.push(`${exposedActions} server action${exposedActions === 1 ? "" : "s"} exposed, each checking auth itself`);
     if (hiddenActions > 0) details.push(`${hiddenActions} server action${hiddenActions === 1 ? "" : "s"} hidden (opt in with aiReady({ actions }))`);
@@ -1086,34 +1158,34 @@ function aiReady(manifest, options = {}) {
     const reply = encodeReply(actionArguments(live.action.params, fields, jsonFieldsOf(live.action)));
     return fetch(new URL(path, origin), { method: "POST", headers: out, body: reply, redirect: "manual", cache: "no-store" });
   };
-  const appLoginFor = (req, spec) => ({
-    label: spec.kind === "action" ? `server action ${spec.key}` : `POST ${spec.path}`,
-    fields: spec.fields,
-    signedOutPaths: cfg.signedOutPaths ?? [],
-    attempt: async (values, ctx) => {
+  const appLoginFor = (req, spec) => {
+    const pathOf = (p) => {
+      let path = `${manifest.basePath ?? ""}${p}`;
+      if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
+      return path;
+    };
+    const stepPath = (step) => step.kind === "action" ? step.host ? pathOf(hostPath(step.host)) : void 0 : pathOf(step.path);
+    const verifyPaths = spec.verify ? [stepPath(spec.verify)].filter((p) => Boolean(p)) : void 0;
+    const send = async (step, values, ctx, reading, cookies = []) => {
       const target = options.baseUrl ?? env3().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
       const pub = new URL(ctx.origin);
       const headers = new Headers({ origin: pub.origin, "x-forwarded-proto": pub.protocol.slice(0, -1), "x-forwarded-host": pub.host });
       if (ctx.ip) headers.set("x-forwarded-for", ctx.ip);
       const ua = req.headers.get("user-agent");
       if (ua) headers.set("user-agent", ua);
+      if (cookies.length) headers.set("cookie", cookies.map((c) => `${c.name}=${c.value}`).join("; "));
       const bypass = env3().VERCEL_AUTOMATION_BYPASS_SECRET;
       if (bypass) headers.set("x-vercel-protection-bypass", bypass);
-      const pathOf = (p) => {
-        let path = `${manifest.basePath ?? ""}${p}`;
-        if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
-        return path;
-      };
-      if (spec.kind === "route") {
-        headers.set("content-type", spec.body === "form" ? "application/x-www-form-urlencoded" : "application/json");
-        const body = spec.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
-        return (0, import_core.loginResultFromResponse)(await fetch(new URL(pathOf(spec.path), target), { method: "POST", headers, body, redirect: "manual", cache: "no-store" }));
+      if (step.kind === "route") {
+        headers.set("content-type", step.body === "form" ? "application/x-www-form-urlencoded" : "application/json");
+        const body = step.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
+        return (0, import_core.loginResultFromResponse)(await fetch(new URL(pathOf(step.path), target), { method: "POST", headers, body, redirect: "manual", cache: "no-store" }), reading);
       }
-      const action = (manifest.actions ?? []).find((a) => a.key === spec.key);
+      const action = (manifest.actions ?? []).find((a) => a.key === step.key);
       const fn = action ? (await action.load())[action.export] : void 0;
       const id = fn?.$$id;
       if (!action?.host || typeof id !== "string") {
-        warnOnce(`server action ${spec.key} is your app's login, but no page uses it, so the sign-in form can't run it; use it from a page's form`);
+        warnOnce(`server action ${step.key} is part of your app's login, but no page uses it, so the sign-in form can't run it; use it from a page's form`);
         return { ok: false, message: "This app's sign-in can't be used by AI assistants yet." };
       }
       headers.set("next-action", id);
@@ -1121,9 +1193,28 @@ function aiReady(manifest, options = {}) {
       headers.set("accept", "text/x-component");
       const reply = encodeReply(actionArguments(action.params, values, jsonFieldsOf(action)));
       const raw = await fetch(new URL(pathOf(hostPath(action.host)), target), { method: "POST", headers, body: reply, redirect: "manual", cache: "no-store" });
-      return actionLoginResult(raw, action.export);
-    }
-  });
+      return actionLoginResult(raw, action.export, reading);
+    };
+    const verify = spec.verify;
+    return {
+      label: spec.kind === "action" ? `server action ${spec.key}` : `POST ${spec.path}`,
+      fields: spec.fields,
+      signedOutPaths: cfg.signedOutPaths ?? [],
+      ...spec.passwordless ? { passwordless: true } : {},
+      attempt: (values, ctx) => send(spec, values, ctx, {
+        ...verifyPaths ? { verifyPaths } : {},
+        ...verify ? { verifyFields: verify.fields.map((f) => f.name) } : {},
+        ...spec.passwordless ? { start: true } : {}
+      }),
+      ...verify ? {
+        verify: {
+          label: verify.kind === "action" ? `server action ${verify.key}` : `POST ${verify.path}`,
+          fields: verify.fields,
+          attempt: (values, ctx) => send(verify, values, ctx, { carried: ctx.carry.cookies, verifyPaths: verifyPaths ?? [] }, ctx.carry.cookies)
+        }
+      } : {}
+    };
+  };
   const carrySession = (raw, out) => {
     const lines = (0, import_core.setCookieLines)(raw);
     const redirect = raw.headers.get("x-action-redirect")?.split(";")[0];
@@ -1168,9 +1259,10 @@ function aiReady(manifest, options = {}) {
   };
   return async (req) => {
     const pathname = new URL(req.url).pathname;
-    if (login && (0, import_core.samePath)(pathname, [loginPagePath, `${manifest.basePath ?? ""}${loginPagePath}`])) {
+    const supabaseLogin = supabaseLoginNow();
+    if ((login || supabaseLogin) && (0, import_core.samePath)(pathname, [loginPagePath, `${manifest.basePath ?? ""}${loginPagePath}`])) {
       const pub = new URL((0, import_core.publicRequestUrl)(req.url, req.headers));
-      return (0, import_core.handleLoginPage)(req, appLoginFor(req, login), (0, import_core.hostedResolverInfo)(cfg.auth), {
+      return (0, import_core.handleLoginPage)(req, supabaseLogin ?? appLoginFor(req, login), (0, import_core.hostedResolverInfo)(cfg.auth), {
         path: pub.pathname,
         secure: pub.protocol === "https:",
         origin: pub.origin,
@@ -1197,7 +1289,13 @@ function aiReady(manifest, options = {}) {
       const url = (0, import_core.publicRequestUrl)(req.url, req.headers);
       const isPrm = url.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(isPrm ? url.slice(0, -PRM_SUFFIX.length) : url);
-      const verdict = await (0, import_core.reportAppLogin)(cfg.auth, resource, login, { where: login?.where, stacks: manifest.authStacks, log: logReady });
+      const supabaseAuth2 = await supabaseReport();
+      const verdict = await (0, import_core.reportAppLogin)(cfg.auth, resource, supabaseLogin ?? login, {
+        where: supabaseLogin ? "your Supabase Auth (password)" : login?.where,
+        stacks: manifest.authStacks,
+        log: logReady,
+        ...supabaseAuth2 ? { supabase: supabaseAuth2 } : {}
+      });
       if (verdict === "open") {
         if (isPrm) return new Response("not found", { status: 404 });
       } else {

package/dist/index.d.cts

@@ -1,126 +1,7 @@
-import { ProposedField, LoginField, DocSource, RouteMarker, AgentReadyOptions } from '@exposify/core';
+import { RouteMarker, AgentReadyOptions } from '@exposify/core';
 export { HostedAuthResolverConfig, completeMcpLogin, createHostedAuthResolver, describe, exposed, hidden, hostedBroker } from '@exposify/core';
-import { A as ActionField } from './fields-olvyFnxj.cjs';
-
-interface AppRouteEntry {
-    router: "app";
-    /** `/api/orders/:id`; catch-alls as `:slug*`, optional ones as `:slug*?`. */
-    path: string;
-    params: string[];
-    /** Project-relative, for messages. */
-    file: string;
-    /** Exported methods when generated; the loaded module's exports win at runtime. */
-    methods: string[];
-    /** Loads the route module to read exposed()/hidden()/describe() off its exports. Absent for edge routes. */
-    load?: () => Promise<Record<string, unknown>>;
-    /** `export const runtime = "edge"`: not loaded into the Node MCP route, so markers there aren't read. */
-    edge?: boolean;
-}
-interface PagesRouteEntry {
-    router: "pages";
-    path: string;
-    params: string[];
-    file: string;
-}
-type ManifestRoute = AppRouteEntry | PagesRouteEntry;
-/** An exported function of a `"use server"` module. */
-interface ManifestAction {
-    /** Unique among actions: the default tool name, and the URL segment under `<mcpPath>/actions/`. */
-    key: string;
-    file: string;
-    export: string;
-    /** How each parameter is filled on a call, in order: see `ActionParamRole` in parse.ts. */
-    params: Array<{
-        name: string;
-        role: "formData" | "prev" | "input" | "object";
-    }>;
-    /** It sets or deletes a cookie, which would land on exposify's internal call rather than the agent's client. */
-    setsCookies?: boolean;
-    /** What it takes, worked out from its code (fields.ts): its tool schema when the app doesn't write one. */
-    fields: ActionField[];
-    /** It reads every form field, so its code doesn't say which exist. */
-    readsAll?: boolean;
-    /** What the analysis couldn't work out ("line N: …"): with any, the app writes the schema. */
-    unresolved?: string[];
-    /** The forms that submit to it (pass 3), where they are. */
-    forms?: Array<{
-        file: string;
-        line: number;
-    }>;
-    /** An input `describe` proposed and a person accepted, current with the code: used when `fields` can't be the schema. */
-    proposed?: ProposedField[];
-    /**
-     * A page that uses it (`/checkout`, `/admin/orders/:id`): tool calls are
-     * sent there as a real Server Action request. Absent when no page uses it;
-     * it's then called in-process by the MCP route.
-     */
-    host?: string;
-    /**
-     * The app's own checks it runs first (`lib/auth.ts#requireAdmin`): a
-     * user who doesn't pass one doesn't see the tool (guards.ts).
-     */
-    guards?: string[];
-    load: () => Promise<Record<string, unknown>>;
-}
-/** An App Router page: a read tool that fetches it like a browser (pages.ts). */
-interface ManifestPage {
-    /** Tool name, e.g. `view_product_slug`. */
-    name: string;
-    /** `/product/:slug`, as routes are written. */
-    path: string;
-    params: string[];
-    file: string;
-    /** Search params its code reads: optional tool arguments, sent as the query. */
-    search?: string[];
-    /** From its static `metadata`. */
-    title?: string;
-    description?: string;
-    /** Just a form posting to a Server Action: not a tool unless `pages` lists it. */
-    formOnly?: boolean;
-    /** The app's own checks it runs (`lib/auth.ts#requireAdmin`), see ManifestAction.guards. */
-    guards?: string[];
-}
-/**
- * The app's own login (login.ts): a sign-in form under the MCP route makes
- * this request, for Connect with no code. `host` is the page with the
- * action's form, which tool calls redirected to mean "signed out".
- */
-type ManifestLogin = ({
-    kind: "action";
-    key: string;
-    fields: LoginField[];
-    host?: string;
-} | {
-    kind: "route";
-    path: string;
-    fields: LoginField[];
-    body: "json" | "form";
-}) & {
-    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
-    where?: string;
-};
-interface ExposifyManifest {
-    info: {
-        name: string;
-        version: string;
-    };
-    /** next.config's basePath, prefixed to every tool call's path. */
-    basePath?: string;
-    /** next.config's trailingSlash: tool calls add one, so they aren't redirected. */
-    trailingSlash?: boolean;
-    routes: ManifestRoute[];
-    /** The MCP route's URL without its catch-all segment, e.g. `/mcp`: Server Actions are served under `<mcpPath>/actions/`. */
-    mcpPath?: string;
-    actions?: ManifestAction[];
-    pages?: ManifestPage[];
-    login?: ManifestLogin;
-    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
-    authStacks?: string[];
-    /** Docs for search_docs, embedded so they work without a file system. */
-    docs: DocSource[];
-    /** exposify.descriptions.json's texts, "METHOD /path" -> text. */
-    descriptions?: Record<string, string>;
-}
+import { E as ExposifyManifest } from './manifest-DZQCvzQy.cjs';
+export { a as AppRouteEntry, b as ManifestAction, c as ManifestLogin, d as ManifestLoginStep, e as ManifestPage, f as ManifestRoute, P as PagesRouteEntry } from './manifest-DZQCvzQy.cjs';
 
 /** Header carrying `<ip>;<unix seconds>;<signature>` on a tool call. */
 declare const AGENT_IP_HEADER = "x-exposify-agent-ip";
@@ -205,6 +86,29 @@ interface NextAiReadyOptions extends Omit<AgentReadyOptions, "docs"> {
         fields: string[];
         body?: "json" | "form";
     };
+    /**
+     * The login's second step, when it asks for a code after the first (a
+     * password, then a code; or an email, then a code). Found by
+     * `withExposify` (a Server Action or POST route named like `verify`,
+     * `2fa`, `otp` that takes one code and sets the session). Name another
+     * Server Action, a route (`{ path, fields }`), or `false` for none.
+     */
+    loginVerify?: false | string | {
+        path: string;
+        fields: string[];
+        body?: "json" | "form";
+    };
+    /**
+     * The app's Supabase project, for Connect when the app uses Supabase Auth
+     * with `@supabase/ssr`: AI assistants sign in to it directly, and tool
+     * calls carry the session cookie `@supabase/ssr` reads. Default: read from
+     * `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY`
+     * (or `NEXT_PUBLIC_SUPABASE_ANON_KEY`). `false` to not offer it.
+     */
+    supabase?: false | {
+        url: string;
+        key: string;
+    };
 }
 interface NextPageOptions {
     /** Tool name. Default: `view_` and the path, snake_cased. */
@@ -214,4 +118,4 @@ interface NextPageOptions {
 type NextMcpHandler = (req: Request) => Promise<Response>;
 declare function aiReady(manifest: ExposifyManifest, options?: NextAiReadyOptions): NextMcpHandler;
 
-export { AGENT_IP_HEADER, type AppRouteEntry, DISPATCH_HEADER, type ExposifyManifest, type ManifestAction, type ManifestLogin, type ManifestPage, type ManifestRoute, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, type PagesRouteEntry, agentIp, aiReady };
+export { AGENT_IP_HEADER, DISPATCH_HEADER, ExposifyManifest, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, agentIp, aiReady };

package/dist/index.d.ts

@@ -1,126 +1,7 @@
-import { ProposedField, LoginField, DocSource, RouteMarker, AgentReadyOptions } from '@exposify/core';
+import { RouteMarker, AgentReadyOptions } from '@exposify/core';
 export { HostedAuthResolverConfig, completeMcpLogin, createHostedAuthResolver, describe, exposed, hidden, hostedBroker } from '@exposify/core';
-import { A as ActionField } from './fields-olvyFnxj.js';
-
-interface AppRouteEntry {
-    router: "app";
-    /** `/api/orders/:id`; catch-alls as `:slug*`, optional ones as `:slug*?`. */
-    path: string;
-    params: string[];
-    /** Project-relative, for messages. */
-    file: string;
-    /** Exported methods when generated; the loaded module's exports win at runtime. */
-    methods: string[];
-    /** Loads the route module to read exposed()/hidden()/describe() off its exports. Absent for edge routes. */
-    load?: () => Promise<Record<string, unknown>>;
-    /** `export const runtime = "edge"`: not loaded into the Node MCP route, so markers there aren't read. */
-    edge?: boolean;
-}
-interface PagesRouteEntry {
-    router: "pages";
-    path: string;
-    params: string[];
-    file: string;
-}
-type ManifestRoute = AppRouteEntry | PagesRouteEntry;
-/** An exported function of a `"use server"` module. */
-interface ManifestAction {
-    /** Unique among actions: the default tool name, and the URL segment under `<mcpPath>/actions/`. */
-    key: string;
-    file: string;
-    export: string;
-    /** How each parameter is filled on a call, in order: see `ActionParamRole` in parse.ts. */
-    params: Array<{
-        name: string;
-        role: "formData" | "prev" | "input" | "object";
-    }>;
-    /** It sets or deletes a cookie, which would land on exposify's internal call rather than the agent's client. */
-    setsCookies?: boolean;
-    /** What it takes, worked out from its code (fields.ts): its tool schema when the app doesn't write one. */
-    fields: ActionField[];
-    /** It reads every form field, so its code doesn't say which exist. */
-    readsAll?: boolean;
-    /** What the analysis couldn't work out ("line N: …"): with any, the app writes the schema. */
-    unresolved?: string[];
-    /** The forms that submit to it (pass 3), where they are. */
-    forms?: Array<{
-        file: string;
-        line: number;
-    }>;
-    /** An input `describe` proposed and a person accepted, current with the code: used when `fields` can't be the schema. */
-    proposed?: ProposedField[];
-    /**
-     * A page that uses it (`/checkout`, `/admin/orders/:id`): tool calls are
-     * sent there as a real Server Action request. Absent when no page uses it;
-     * it's then called in-process by the MCP route.
-     */
-    host?: string;
-    /**
-     * The app's own checks it runs first (`lib/auth.ts#requireAdmin`): a
-     * user who doesn't pass one doesn't see the tool (guards.ts).
-     */
-    guards?: string[];
-    load: () => Promise<Record<string, unknown>>;
-}
-/** An App Router page: a read tool that fetches it like a browser (pages.ts). */
-interface ManifestPage {
-    /** Tool name, e.g. `view_product_slug`. */
-    name: string;
-    /** `/product/:slug`, as routes are written. */
-    path: string;
-    params: string[];
-    file: string;
-    /** Search params its code reads: optional tool arguments, sent as the query. */
-    search?: string[];
-    /** From its static `metadata`. */
-    title?: string;
-    description?: string;
-    /** Just a form posting to a Server Action: not a tool unless `pages` lists it. */
-    formOnly?: boolean;
-    /** The app's own checks it runs (`lib/auth.ts#requireAdmin`), see ManifestAction.guards. */
-    guards?: string[];
-}
-/**
- * The app's own login (login.ts): a sign-in form under the MCP route makes
- * this request, for Connect with no code. `host` is the page with the
- * action's form, which tool calls redirected to mean "signed out".
- */
-type ManifestLogin = ({
-    kind: "action";
-    key: string;
-    fields: LoginField[];
-    host?: string;
-} | {
-    kind: "route";
-    path: string;
-    fields: LoginField[];
-    body: "json" | "form";
-}) & {
-    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
-    where?: string;
-};
-interface ExposifyManifest {
-    info: {
-        name: string;
-        version: string;
-    };
-    /** next.config's basePath, prefixed to every tool call's path. */
-    basePath?: string;
-    /** next.config's trailingSlash: tool calls add one, so they aren't redirected. */
-    trailingSlash?: boolean;
-    routes: ManifestRoute[];
-    /** The MCP route's URL without its catch-all segment, e.g. `/mcp`: Server Actions are served under `<mcpPath>/actions/`. */
-    mcpPath?: string;
-    actions?: ManifestAction[];
-    pages?: ManifestPage[];
-    login?: ManifestLogin;
-    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
-    authStacks?: string[];
-    /** Docs for search_docs, embedded so they work without a file system. */
-    docs: DocSource[];
-    /** exposify.descriptions.json's texts, "METHOD /path" -> text. */
-    descriptions?: Record<string, string>;
-}
+import { E as ExposifyManifest } from './manifest-DZQCvzQy.js';
+export { a as AppRouteEntry, b as ManifestAction, c as ManifestLogin, d as ManifestLoginStep, e as ManifestPage, f as ManifestRoute, P as PagesRouteEntry } from './manifest-DZQCvzQy.js';
 
 /** Header carrying `<ip>;<unix seconds>;<signature>` on a tool call. */
 declare const AGENT_IP_HEADER = "x-exposify-agent-ip";
@@ -205,6 +86,29 @@ interface NextAiReadyOptions extends Omit<AgentReadyOptions, "docs"> {
         fields: string[];
         body?: "json" | "form";
     };
+    /**
+     * The login's second step, when it asks for a code after the first (a
+     * password, then a code; or an email, then a code). Found by
+     * `withExposify` (a Server Action or POST route named like `verify`,
+     * `2fa`, `otp` that takes one code and sets the session). Name another
+     * Server Action, a route (`{ path, fields }`), or `false` for none.
+     */
+    loginVerify?: false | string | {
+        path: string;
+        fields: string[];
+        body?: "json" | "form";
+    };
+    /**
+     * The app's Supabase project, for Connect when the app uses Supabase Auth
+     * with `@supabase/ssr`: AI assistants sign in to it directly, and tool
+     * calls carry the session cookie `@supabase/ssr` reads. Default: read from
+     * `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY`
+     * (or `NEXT_PUBLIC_SUPABASE_ANON_KEY`). `false` to not offer it.
+     */
+    supabase?: false | {
+        url: string;
+        key: string;
+    };
 }
 interface NextPageOptions {
     /** Tool name. Default: `view_` and the path, snake_cased. */
@@ -214,4 +118,4 @@ interface NextPageOptions {
 type NextMcpHandler = (req: Request) => Promise<Response>;
 declare function aiReady(manifest: ExposifyManifest, options?: NextAiReadyOptions): NextMcpHandler;
 
-export { AGENT_IP_HEADER, type AppRouteEntry, DISPATCH_HEADER, type ExposifyManifest, type ManifestAction, type ManifestLogin, type ManifestPage, type ManifestRoute, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, type PagesRouteEntry, agentIp, aiReady };
+export { AGENT_IP_HEADER, DISPATCH_HEADER, ExposifyManifest, type NextActionOptions, type NextAiReadyOptions, type NextMcpHandler, type NextPageOptions, agentIp, aiReady };