@exposify/next 0.0.3 → 0.0.5

package/dist/index.js

@@ -20,10 +20,18 @@ import {
   handleLoginPage,
   hostedResolverInfo,
   loginResultFromResponse,
+  keepFailedCookies,
+  readStep,
+  rejectedBody,
+  readSupabaseAuth,
   reportAppLogin,
   samePath,
+  sessionFrom,
   setCookieLines,
   SIGNED_OUT_HEADER,
+  supabaseCookieName,
+  supabasePasswordLogin,
+  verifyFields,
   matchesPathGlob,
   formatFailed,
   formatReady,
@@ -704,6 +712,7 @@ function errorMessage(err) {
 }
 async function routesFrom(manifest, cfg, warnings) {
   const listed = Array.isArray(cfg.expose) ? cfg.expose.map(parseMethodEntry).filter((e) => e !== null) : [];
+  const callbacks = new Set(manifest.supabase?.callbacks ?? []);
   const perEntry = await Promise.all(
     manifest.routes.map(async (entry) => {
       const base = { path: entry.path, params: entry.params };
@@ -721,7 +730,7 @@ async function routesFrom(manifest, cfg, warnings) {
       const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
       return methods.filter((m) => m !== "OPTIONS").map((method) => {
         const marker = mod ? getMarker(mod[method]) : void 0;
-        return { ...base, method, ...marker ? { marker } : {} };
+        return { ...base, method, ...marker ? { marker } : {}, ...callbacks.has(entry.file) ? { optIn: true } : {} };
       });
     })
   );
@@ -879,29 +888,65 @@ function pagesFrom(manifest, cfg, config) {
   }
   return { routes, hidden: hidden3, forms };
 }
-function loginSpec(manifest, config, warnings) {
+function loginSpec(manifest, options, warnings) {
+  const config = options.login;
   if (config === false) return null;
-  if (config === void 0) return manifest.login ?? null;
+  let login;
+  if (config === void 0) login = manifest.login ?? null;
+  else {
+    const step = stepSpec(manifest, config, (name) => fieldKind(name), warnings, "login", "AI assistants can't sign in with your app's login");
+    login = step ? { ...step.step, where: step.where } : null;
+  }
+  if (!login || options.loginVerify === void 0) return login;
+  const { verify: _found, ...first } = login;
+  if (options.loginVerify === false) return first;
+  const kind = (name) => verifyFields([name], true)?.[0]?.kind ?? fieldKind(name);
+  const verify = stepSpec(manifest, options.loginVerify, kind, warnings, "loginVerify", "AI assistants can't finish your app's two-step login");
+  return verify ? { ...first, verify: verify.step, where: `${first.where ?? "your login"}, then a code: ${verify.where}` } : first;
+}
+function supabaseSpec(manifest, options, warnings) {
+  if (!manifest.supabase || options.supabase === false) return null;
+  if (options.supabase) return options.supabase;
+  const e = env3();
+  const url = e.NEXT_PUBLIC_SUPABASE_URL ?? e.SUPABASE_URL;
+  const key = e.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ?? e.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? e.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_OR_ANON_KEY;
+  if (!url || !key) {
+    warnings.push("your app uses Supabase Auth, but NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY (or _ANON_KEY) aren't both set where the MCP route runs, so AI assistants can't sign in to it; set them, or pass aiReady({ supabase: { url, key } })");
+    return null;
+  }
+  try {
+    new URL(url);
+  } catch {
+    warnings.push(`NEXT_PUBLIC_SUPABASE_URL isn't a URL (${url}), so AI assistants can't sign in to your Supabase Auth`);
+    return null;
+  }
+  return { url, key };
+}
+function stepSpec(manifest, config, kind, warnings, option, consequence) {
   if (typeof config === "object") {
-    const fields2 = config.fields.map((name) => ({ name, kind: fieldKind(name) }));
-    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json", where: `POST ${config.path}` };
+    const fields2 = config.fields.map((name) => ({ name, kind: kind(name) }));
+    return { step: { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json" }, where: `POST ${config.path}` };
   }
   const action = (manifest.actions ?? []).find((a) => a.key === config || a.export === config);
   if (!action) {
-    warnings.push(`aiReady({ login: "${config}" }): no server action by that name, so AI assistants can't sign in with your app's login`);
+    warnings.push(`aiReady({ ${option}: "${config}" }): no server action by that name, so ${consequence}`);
     return null;
   }
-  const fields = action.fields.map((f) => ({ name: f.name, kind: fieldKind(f.name) }));
-  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {}, where: `${action.export} in ${action.file}` };
+  const fields = action.fields.map((f) => ({ name: f.name, kind: kind(f.name) }));
+  return { step: { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {} }, where: `${action.export} in ${action.file}` };
 }
-async function actionLoginResult(raw, exportName) {
+async function actionLoginResult(raw, exportName, reading = {}) {
   if (actionNotFound(raw)) return { ok: false, message: "The app's sign-in page didn't run its login. Its developer needs to rebuild the app." };
-  const cookies = cookieChanges(raw).filter((c) => !c.deleted && c.value !== "");
+  const changes = cookieChanges(raw);
   const out = await readActionResponse(raw, exportName);
   const body = await out.json().catch(() => void 0);
+  const location = raw.headers.get("x-action-redirect")?.split(";")[0] ?? (typeof body?.redirectedTo === "string" ? body.redirectedTo : null);
+  const step = readStep({ status: location ? 303 : out.status, location, body, cookies: changes }, reading);
+  if (step) return keepFailedCookies(step, changes, reading);
   const message = errorMessageOf(body);
-  if (out.status >= 400 || message && !body?.redirectedTo) return { ok: false, message };
-  return cookies.length > 0 ? { ok: true, session: { cookies } } : { ok: false, message };
+  if (out.status >= 400 || message && !body?.redirectedTo || rejectedBody(body)) return keepFailedCookies({ ok: false, message }, changes, reading);
+  const session = sessionFrom(changes, reading, Boolean(location) || body !== void 0 && body !== null && typeof body === "object");
+  return session ? { ok: true, session } : keepFailedCookies({ ok: false, message }, changes, reading);
 }
 var clientIp = (headers) => headers.get("x-forwarded-for")?.split(",")[0]?.trim() || headers.get("x-real-ip") || void 0;
 function aiReady(manifest, options = {}) {
@@ -914,9 +959,39 @@ function aiReady(manifest, options = {}) {
   const actionsBase = (manifest.mcpPath ?? "").replace(/\/$/, "");
   const actionUrl = manifest.mcpPath === void 0 ? null : new RegExp(`${actionsBase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/actions/([^/]+)/?$`);
   const loginWarnings = [];
-  const login = hostedResolverInfo(cfg.auth) ? loginSpec(manifest, options.login, loginWarnings) : null;
+  const login = hostedResolverInfo(cfg.auth) ? loginSpec(manifest, options, loginWarnings) : null;
   const loginPagePath = `${(manifest.mcpPath ?? "/mcp").replace(/\/$/, "")}/login`;
   if (login) cfg.signedOutPaths = [login.kind === "action" ? login.host : login.path].filter((p) => Boolean(p)).map((p) => `${manifest.basePath ?? ""}${hostPath(p)}`);
+  const supabase = hostedResolverInfo(cfg.auth) ? supabaseSpec(manifest, options, loginWarnings) : null;
+  if (supabase && manifest.supabase?.loginPages?.length) {
+    cfg.signedOutPaths = [...cfg.signedOutPaths ?? [], ...manifest.supabase.loginPages.map((p) => `${manifest.basePath ?? ""}${hostPath(p)}`)];
+  }
+  const supabasePassword = supabase ? supabasePasswordLogin({
+    ...supabase,
+    onCaptcha: () => warnOnce("your Supabase project asks for a CAPTCHA to sign in, so AI assistants can't sign in with a password; social sign-ins still work")
+  }) : null;
+  const supabaseLoginNow = () => {
+    if (!supabasePassword) return null;
+    const choice = hostedResolverInfo(cfg.auth)?.supabasePasswordDirect();
+    return choice ?? (!login && manifest.supabase?.direct.includes("password")) ? supabasePassword : null;
+  };
+  let supabaseAuth;
+  const supabaseReport = () => {
+    if (!supabase || !manifest.supabase) return Promise.resolve(void 0);
+    const found = manifest.supabase;
+    supabaseAuth ??= readSupabaseAuth(supabase.url, supabase.key).then((read) => {
+      if (!read) {
+        supabaseAuth = void 0;
+        return void 0;
+      }
+      return {
+        ...read,
+        cookie: found.cookieName ?? supabaseCookieName(supabase.url),
+        found: { direct: found.direct, where: found.found, ...found.unusable ? { unusable: found.unusable } : {}, ...found.callbacks ? { callbacks: found.callbacks } : {} }
+      };
+    });
+    return supabaseAuth;
+  };
   let built = null;
   const build = async (endpoint) => {
     const warnings = [...loginWarnings];
@@ -1020,7 +1095,12 @@ function aiReady(manifest, options = {}) {
     if (cfg.expose === "*") details.push('all write routes exposed (expose: "*")');
     if (counts.hiddenWrites > 0) details.push(`${counts.hiddenWrites} write route${counts.hiddenWrites === 1 ? "" : "s"} hidden (opt in with exposed())`);
     if (pages.routes.length > 0) details.push(`${pages.routes.length} page${pages.routes.length === 1 ? "" : "s"} readable`);
-    if (login) details.push(`AI assistants sign in with your app's own login (${login.kind === "action" ? `server action ${login.key}` : `POST ${login.path}`}) at ${loginPagePath}`);
+    if (supabaseLoginNow()) {
+      details.push(`AI assistants sign in to your Supabase Auth with a password at ${loginPagePath}`);
+    } else if (login) {
+      const step = (l) => l.kind === "action" ? `server action ${l.key}` : `POST ${l.path}`;
+      details.push(`AI assistants sign in with your app's own login (${step(login)}${login.verify ? `, then a code: ${step(login.verify)}` : ""}) at ${loginPagePath}`);
+    }
     if (pages.forms > 0) details.push(`${pages.forms} page${pages.forms === 1 ? "" : "s"} left out as just a form (list in aiReady({ pages }) to include)`);
     if (exposedActions > 0) details.push(`${exposedActions} server action${exposedActions === 1 ? "" : "s"} exposed, each checking auth itself`);
     if (hiddenActions > 0) details.push(`${hiddenActions} server action${hiddenActions === 1 ? "" : "s"} hidden (opt in with aiReady({ actions }))`);
@@ -1092,34 +1172,34 @@ function aiReady(manifest, options = {}) {
     const reply = encodeReply(actionArguments(live.action.params, fields, jsonFieldsOf(live.action)));
     return fetch(new URL(path, origin), { method: "POST", headers: out, body: reply, redirect: "manual", cache: "no-store" });
   };
-  const appLoginFor = (req, spec) => ({
-    label: spec.kind === "action" ? `server action ${spec.key}` : `POST ${spec.path}`,
-    fields: spec.fields,
-    signedOutPaths: cfg.signedOutPaths ?? [],
-    attempt: async (values, ctx) => {
+  const appLoginFor = (req, spec) => {
+    const pathOf = (p) => {
+      let path = `${manifest.basePath ?? ""}${p}`;
+      if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
+      return path;
+    };
+    const stepPath = (step) => step.kind === "action" ? step.host ? pathOf(hostPath(step.host)) : void 0 : pathOf(step.path);
+    const verifyPaths = spec.verify ? [stepPath(spec.verify)].filter((p) => Boolean(p)) : void 0;
+    const send = async (step, values, ctx, reading, cookies = []) => {
       const target = options.baseUrl ?? env3().EXPOSIFY_BASE_URL ?? new URL(req.url).origin;
       const pub = new URL(ctx.origin);
       const headers = new Headers({ origin: pub.origin, "x-forwarded-proto": pub.protocol.slice(0, -1), "x-forwarded-host": pub.host });
       if (ctx.ip) headers.set("x-forwarded-for", ctx.ip);
       const ua = req.headers.get("user-agent");
       if (ua) headers.set("user-agent", ua);
+      if (cookies.length) headers.set("cookie", cookies.map((c) => `${c.name}=${c.value}`).join("; "));
       const bypass = env3().VERCEL_AUTOMATION_BYPASS_SECRET;
       if (bypass) headers.set("x-vercel-protection-bypass", bypass);
-      const pathOf = (p) => {
-        let path = `${manifest.basePath ?? ""}${p}`;
-        if (manifest.trailingSlash && !path.endsWith("/")) path += "/";
-        return path;
-      };
-      if (spec.kind === "route") {
-        headers.set("content-type", spec.body === "form" ? "application/x-www-form-urlencoded" : "application/json");
-        const body = spec.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
-        return loginResultFromResponse(await fetch(new URL(pathOf(spec.path), target), { method: "POST", headers, body, redirect: "manual", cache: "no-store" }));
+      if (step.kind === "route") {
+        headers.set("content-type", step.body === "form" ? "application/x-www-form-urlencoded" : "application/json");
+        const body = step.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
+        return loginResultFromResponse(await fetch(new URL(pathOf(step.path), target), { method: "POST", headers, body, redirect: "manual", cache: "no-store" }), reading);
       }
-      const action = (manifest.actions ?? []).find((a) => a.key === spec.key);
+      const action = (manifest.actions ?? []).find((a) => a.key === step.key);
       const fn = action ? (await action.load())[action.export] : void 0;
       const id = fn?.$$id;
       if (!action?.host || typeof id !== "string") {
-        warnOnce(`server action ${spec.key} is your app's login, but no page uses it, so the sign-in form can't run it; use it from a page's form`);
+        warnOnce(`server action ${step.key} is part of your app's login, but no page uses it, so the sign-in form can't run it; use it from a page's form`);
         return { ok: false, message: "This app's sign-in can't be used by AI assistants yet." };
       }
       headers.set("next-action", id);
@@ -1127,9 +1207,28 @@ function aiReady(manifest, options = {}) {
       headers.set("accept", "text/x-component");
       const reply = encodeReply(actionArguments(action.params, values, jsonFieldsOf(action)));
       const raw = await fetch(new URL(pathOf(hostPath(action.host)), target), { method: "POST", headers, body: reply, redirect: "manual", cache: "no-store" });
-      return actionLoginResult(raw, action.export);
-    }
-  });
+      return actionLoginResult(raw, action.export, reading);
+    };
+    const verify = spec.verify;
+    return {
+      label: spec.kind === "action" ? `server action ${spec.key}` : `POST ${spec.path}`,
+      fields: spec.fields,
+      signedOutPaths: cfg.signedOutPaths ?? [],
+      ...spec.passwordless ? { passwordless: true } : {},
+      attempt: (values, ctx) => send(spec, values, ctx, {
+        ...verifyPaths ? { verifyPaths } : {},
+        ...verify ? { verifyFields: verify.fields.map((f) => f.name) } : {},
+        ...spec.passwordless ? { start: true } : {}
+      }),
+      ...verify ? {
+        verify: {
+          label: verify.kind === "action" ? `server action ${verify.key}` : `POST ${verify.path}`,
+          fields: verify.fields,
+          attempt: (values, ctx) => send(verify, values, ctx, { carried: ctx.carry.cookies, verifyPaths: verifyPaths ?? [] }, ctx.carry.cookies)
+        }
+      } : {}
+    };
+  };
   const carrySession = (raw, out) => {
     const lines = setCookieLines(raw);
     const redirect = raw.headers.get("x-action-redirect")?.split(";")[0];
@@ -1174,9 +1273,10 @@ function aiReady(manifest, options = {}) {
   };
   return async (req) => {
     const pathname = new URL(req.url).pathname;
-    if (login && samePath(pathname, [loginPagePath, `${manifest.basePath ?? ""}${loginPagePath}`])) {
+    const supabaseLogin = supabaseLoginNow();
+    if ((login || supabaseLogin) && samePath(pathname, [loginPagePath, `${manifest.basePath ?? ""}${loginPagePath}`])) {
       const pub = new URL(publicRequestUrl(req.url, req.headers));
-      return handleLoginPage(req, appLoginFor(req, login), hostedResolverInfo(cfg.auth), {
+      return handleLoginPage(req, supabaseLogin ?? appLoginFor(req, login), hostedResolverInfo(cfg.auth), {
         path: pub.pathname,
         secure: pub.protocol === "https:",
         origin: pub.origin,
@@ -1203,7 +1303,13 @@ function aiReady(manifest, options = {}) {
       const url = publicRequestUrl(req.url, req.headers);
       const isPrm = url.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(isPrm ? url.slice(0, -PRM_SUFFIX.length) : url);
-      const verdict = await reportAppLogin(cfg.auth, resource, login, { where: login?.where, stacks: manifest.authStacks, log: logReady });
+      const supabaseAuth2 = await supabaseReport();
+      const verdict = await reportAppLogin(cfg.auth, resource, supabaseLogin ?? login, {
+        where: supabaseLogin ? "your Supabase Auth (password)" : login?.where,
+        stacks: manifest.authStacks,
+        log: logReady,
+        ...supabaseAuth2 ? { supabase: supabaseAuth2 } : {}
+      });
       if (verdict === "open") {
         if (isPrm) return new Response("not found", { status: 404 });
       } else {

package/dist/manifest-DZQCvzQy.d.cts

@@ -0,0 +1,176 @@
+import { ProposedField, LoginField, DocSource } from '@exposify/core';
+
+type FieldType = "string" | "number" | "boolean" | "json" | "file";
+interface ActionField {
+    name: string;
+    type: FieldType;
+    /** Read with getAll(): a repeated field, sent as an array. */
+    array?: true;
+    /** Its allowed values, from `LIST.includes(x)` over a constant list. */
+    enum?: string[];
+    /** Always needed: a parameter of its own (a `.bind` argument), a non-optional key of an object parameter, or required by every form that submits to it. */
+    required?: true;
+    /** From the form's input (pass 3, forms.ts). */
+    min?: number;
+    max?: number;
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+    /** Where it was found: the action's code, its form, or both. */
+    origin?: "action" | "form" | "both";
+    /** For the agent: format, units, what it refers to (from an accepted proposal). */
+    description?: string;
+}
+
+interface AppRouteEntry {
+    router: "app";
+    /** `/api/orders/:id`; catch-alls as `:slug*`, optional ones as `:slug*?`. */
+    path: string;
+    params: string[];
+    /** Project-relative, for messages. */
+    file: string;
+    /** Exported methods when generated; the loaded module's exports win at runtime. */
+    methods: string[];
+    /** Loads the route module to read exposed()/hidden()/describe() off its exports. Absent for edge routes. */
+    load?: () => Promise<Record<string, unknown>>;
+    /** `export const runtime = "edge"`: not loaded into the Node MCP route, so markers there aren't read. */
+    edge?: boolean;
+}
+interface PagesRouteEntry {
+    router: "pages";
+    path: string;
+    params: string[];
+    file: string;
+}
+type ManifestRoute = AppRouteEntry | PagesRouteEntry;
+/** An exported function of a `"use server"` module. */
+interface ManifestAction {
+    /** Unique among actions: the default tool name, and the URL segment under `<mcpPath>/actions/`. */
+    key: string;
+    file: string;
+    export: string;
+    /** How each parameter is filled on a call, in order: see `ActionParamRole` in parse.ts. */
+    params: Array<{
+        name: string;
+        role: "formData" | "prev" | "input" | "object";
+    }>;
+    /** It sets or deletes a cookie, which would land on exposify's internal call rather than the agent's client. */
+    setsCookies?: boolean;
+    /** What it takes, worked out from its code (fields.ts): its tool schema when the app doesn't write one. */
+    fields: ActionField[];
+    /** It reads every form field, so its code doesn't say which exist. */
+    readsAll?: boolean;
+    /** What the analysis couldn't work out ("line N: …"): with any, the app writes the schema. */
+    unresolved?: string[];
+    /** The forms that submit to it (pass 3), where they are. */
+    forms?: Array<{
+        file: string;
+        line: number;
+    }>;
+    /** An input `describe` proposed and a person accepted, current with the code: used when `fields` can't be the schema. */
+    proposed?: ProposedField[];
+    /**
+     * A page that uses it (`/checkout`, `/admin/orders/:id`): tool calls are
+     * sent there as a real Server Action request. Absent when no page uses it;
+     * it's then called in-process by the MCP route.
+     */
+    host?: string;
+    /**
+     * The app's own checks it runs first (`lib/auth.ts#requireAdmin`): a
+     * user who doesn't pass one doesn't see the tool (guards.ts).
+     */
+    guards?: string[];
+    load: () => Promise<Record<string, unknown>>;
+}
+/** An App Router page: a read tool that fetches it like a browser (pages.ts). */
+interface ManifestPage {
+    /** Tool name, e.g. `view_product_slug`. */
+    name: string;
+    /** `/product/:slug`, as routes are written. */
+    path: string;
+    params: string[];
+    file: string;
+    /** Search params its code reads: optional tool arguments, sent as the query. */
+    search?: string[];
+    /** From its static `metadata`. */
+    title?: string;
+    description?: string;
+    /** Just a form posting to a Server Action: not a tool unless `pages` lists it. */
+    formOnly?: boolean;
+    /** The app's own checks it runs (`lib/auth.ts#requireAdmin`), see ManifestAction.guards. */
+    guards?: string[];
+}
+/**
+ * The app's own login (login.ts): a sign-in form under the MCP route makes
+ * this request, for Connect with no code. `host` is the page with the
+ * action's form, which tool calls redirected to mean "signed out".
+ */
+type ManifestLogin = ManifestLoginStep & {
+    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
+    where?: string;
+    /** The first step takes no password: an email or phone number, then the code. */
+    passwordless?: boolean;
+    /** The login's second step, a code; `host` (or the route's path) is where the first step redirects to ask for it. */
+    verify?: ManifestLoginStep;
+};
+/** One request of the login. */
+type ManifestLoginStep = {
+    kind: "action";
+    key: string;
+    fields: LoginField[];
+    host?: string;
+} | {
+    kind: "route";
+    path: string;
+    fields: LoginField[];
+    body: "json" | "form";
+};
+/**
+ * A Next app on Supabase Auth with `@supabase/ssr` (supabase.ts): which
+ * sign-ins Connect makes on Supabase directly, decided at build time from
+ * where the app signs its users in (plan Part 2, decisions A and B).
+ */
+interface ManifestSupabase {
+    /** The session cookie's name when the app sets one; else `sb-<ref>-auth-token`, from the project's URL. */
+    cookieName?: string;
+    /**
+     * Signed in to on Supabase directly: by password on the form at
+     * `<MCP path>/login` (the password goes from the app's server to Supabase),
+     * the rest on the broker's pages. A method the app signs in with on its
+     * server isn't here: the app's own login does it, or nothing does.
+     */
+    direct: Array<"password" | "email-code" | "social">;
+    /** Where the app signs in, as found: "signInWithPassword in components/login-form.tsx:42 (browser: "use client")". */
+    found: string[];
+    /** Server sign-ins the app's own login couldn't be made from, so that method has no sign-in until the owner switches to Supabase directly. */
+    unusable?: string[];
+    /** Routes that finish a sign-in (`exchangeCodeForSession`): their checks don't run for Connect's sign-ins. */
+    callbacks?: string[];
+    /** The app's sign-in pages (`/auth/login`): a tool call redirected there was signed out. */
+    loginPages?: string[];
+}
+interface ExposifyManifest {
+    info: {
+        name: string;
+        version: string;
+    };
+    /** next.config's basePath, prefixed to every tool call's path. */
+    basePath?: string;
+    /** next.config's trailingSlash: tool calls add one, so they aren't redirected. */
+    trailingSlash?: boolean;
+    routes: ManifestRoute[];
+    /** The MCP route's URL without its catch-all segment, e.g. `/mcp`: Server Actions are served under `<mcpPath>/actions/`. */
+    mcpPath?: string;
+    actions?: ManifestAction[];
+    pages?: ManifestPage[];
+    login?: ManifestLogin;
+    supabase?: ManifestSupabase;
+    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
+    authStacks?: string[];
+    /** Docs for search_docs, embedded so they work without a file system. */
+    docs: DocSource[];
+    /** exposify.descriptions.json's texts, "METHOD /path" -> text. */
+    descriptions?: Record<string, string>;
+}
+
+export type { ActionField as A, ExposifyManifest as E, ManifestSupabase as M, PagesRouteEntry as P, AppRouteEntry as a, ManifestAction as b, ManifestLogin as c, ManifestLoginStep as d, ManifestPage as e, ManifestRoute as f };

package/dist/manifest-DZQCvzQy.d.ts

@@ -0,0 +1,176 @@
+import { ProposedField, LoginField, DocSource } from '@exposify/core';
+
+type FieldType = "string" | "number" | "boolean" | "json" | "file";
+interface ActionField {
+    name: string;
+    type: FieldType;
+    /** Read with getAll(): a repeated field, sent as an array. */
+    array?: true;
+    /** Its allowed values, from `LIST.includes(x)` over a constant list. */
+    enum?: string[];
+    /** Always needed: a parameter of its own (a `.bind` argument), a non-optional key of an object parameter, or required by every form that submits to it. */
+    required?: true;
+    /** From the form's input (pass 3, forms.ts). */
+    min?: number;
+    max?: number;
+    minLength?: number;
+    maxLength?: number;
+    pattern?: string;
+    /** Where it was found: the action's code, its form, or both. */
+    origin?: "action" | "form" | "both";
+    /** For the agent: format, units, what it refers to (from an accepted proposal). */
+    description?: string;
+}
+
+interface AppRouteEntry {
+    router: "app";
+    /** `/api/orders/:id`; catch-alls as `:slug*`, optional ones as `:slug*?`. */
+    path: string;
+    params: string[];
+    /** Project-relative, for messages. */
+    file: string;
+    /** Exported methods when generated; the loaded module's exports win at runtime. */
+    methods: string[];
+    /** Loads the route module to read exposed()/hidden()/describe() off its exports. Absent for edge routes. */
+    load?: () => Promise<Record<string, unknown>>;
+    /** `export const runtime = "edge"`: not loaded into the Node MCP route, so markers there aren't read. */
+    edge?: boolean;
+}
+interface PagesRouteEntry {
+    router: "pages";
+    path: string;
+    params: string[];
+    file: string;
+}
+type ManifestRoute = AppRouteEntry | PagesRouteEntry;
+/** An exported function of a `"use server"` module. */
+interface ManifestAction {
+    /** Unique among actions: the default tool name, and the URL segment under `<mcpPath>/actions/`. */
+    key: string;
+    file: string;
+    export: string;
+    /** How each parameter is filled on a call, in order: see `ActionParamRole` in parse.ts. */
+    params: Array<{
+        name: string;
+        role: "formData" | "prev" | "input" | "object";
+    }>;
+    /** It sets or deletes a cookie, which would land on exposify's internal call rather than the agent's client. */
+    setsCookies?: boolean;
+    /** What it takes, worked out from its code (fields.ts): its tool schema when the app doesn't write one. */
+    fields: ActionField[];
+    /** It reads every form field, so its code doesn't say which exist. */
+    readsAll?: boolean;
+    /** What the analysis couldn't work out ("line N: …"): with any, the app writes the schema. */
+    unresolved?: string[];
+    /** The forms that submit to it (pass 3), where they are. */
+    forms?: Array<{
+        file: string;
+        line: number;
+    }>;
+    /** An input `describe` proposed and a person accepted, current with the code: used when `fields` can't be the schema. */
+    proposed?: ProposedField[];
+    /**
+     * A page that uses it (`/checkout`, `/admin/orders/:id`): tool calls are
+     * sent there as a real Server Action request. Absent when no page uses it;
+     * it's then called in-process by the MCP route.
+     */
+    host?: string;
+    /**
+     * The app's own checks it runs first (`lib/auth.ts#requireAdmin`): a
+     * user who doesn't pass one doesn't see the tool (guards.ts).
+     */
+    guards?: string[];
+    load: () => Promise<Record<string, unknown>>;
+}
+/** An App Router page: a read tool that fetches it like a browser (pages.ts). */
+interface ManifestPage {
+    /** Tool name, e.g. `view_product_slug`. */
+    name: string;
+    /** `/product/:slug`, as routes are written. */
+    path: string;
+    params: string[];
+    file: string;
+    /** Search params its code reads: optional tool arguments, sent as the query. */
+    search?: string[];
+    /** From its static `metadata`. */
+    title?: string;
+    description?: string;
+    /** Just a form posting to a Server Action: not a tool unless `pages` lists it. */
+    formOnly?: boolean;
+    /** The app's own checks it runs (`lib/auth.ts#requireAdmin`), see ManifestAction.guards. */
+    guards?: string[];
+}
+/**
+ * The app's own login (login.ts): a sign-in form under the MCP route makes
+ * this request, for Connect with no code. `host` is the page with the
+ * action's form, which tool calls redirected to mean "signed out".
+ */
+type ManifestLogin = ManifestLoginStep & {
+    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
+    where?: string;
+    /** The first step takes no password: an email or phone number, then the code. */
+    passwordless?: boolean;
+    /** The login's second step, a code; `host` (or the route's path) is where the first step redirects to ask for it. */
+    verify?: ManifestLoginStep;
+};
+/** One request of the login. */
+type ManifestLoginStep = {
+    kind: "action";
+    key: string;
+    fields: LoginField[];
+    host?: string;
+} | {
+    kind: "route";
+    path: string;
+    fields: LoginField[];
+    body: "json" | "form";
+};
+/**
+ * A Next app on Supabase Auth with `@supabase/ssr` (supabase.ts): which
+ * sign-ins Connect makes on Supabase directly, decided at build time from
+ * where the app signs its users in (plan Part 2, decisions A and B).
+ */
+interface ManifestSupabase {
+    /** The session cookie's name when the app sets one; else `sb-<ref>-auth-token`, from the project's URL. */
+    cookieName?: string;
+    /**
+     * Signed in to on Supabase directly: by password on the form at
+     * `<MCP path>/login` (the password goes from the app's server to Supabase),
+     * the rest on the broker's pages. A method the app signs in with on its
+     * server isn't here: the app's own login does it, or nothing does.
+     */
+    direct: Array<"password" | "email-code" | "social">;
+    /** Where the app signs in, as found: "signInWithPassword in components/login-form.tsx:42 (browser: "use client")". */
+    found: string[];
+    /** Server sign-ins the app's own login couldn't be made from, so that method has no sign-in until the owner switches to Supabase directly. */
+    unusable?: string[];
+    /** Routes that finish a sign-in (`exchangeCodeForSession`): their checks don't run for Connect's sign-ins. */
+    callbacks?: string[];
+    /** The app's sign-in pages (`/auth/login`): a tool call redirected there was signed out. */
+    loginPages?: string[];
+}
+interface ExposifyManifest {
+    info: {
+        name: string;
+        version: string;
+    };
+    /** next.config's basePath, prefixed to every tool call's path. */
+    basePath?: string;
+    /** next.config's trailingSlash: tool calls add one, so they aren't redirected. */
+    trailingSlash?: boolean;
+    routes: ManifestRoute[];
+    /** The MCP route's URL without its catch-all segment, e.g. `/mcp`: Server Actions are served under `<mcpPath>/actions/`. */
+    mcpPath?: string;
+    actions?: ManifestAction[];
+    pages?: ManifestPage[];
+    login?: ManifestLogin;
+    supabase?: ManifestSupabase;
+    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
+    authStacks?: string[];
+    /** Docs for search_docs, embedded so they work without a file system. */
+    docs: DocSource[];
+    /** exposify.descriptions.json's texts, "METHOD /path" -> text. */
+    descriptions?: Record<string, string>;
+}
+
+export type { ActionField as A, ExposifyManifest as E, ManifestSupabase as M, PagesRouteEntry as P, AppRouteEntry as a, ManifestAction as b, ManifestLogin as c, ManifestLoginStep as d, ManifestPage as e, ManifestRoute as f };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.2",
-    "@exposify/core": "0.3.15",
+    "@exposify/cli": "0.0.4",
+    "@exposify/core": "0.3.16",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"
   },