@exposify/next 0.0.4 → 0.0.5

package/dist/exposify-next.js

@@ -2667,6 +2667,10 @@ var nextAdapter = {
   bin: "npx @exposify/next",
   entryExample: "apps/web",
   entryHelp: "The Next.js project directory",
+  commands: [
+    ["generate", "Write exposify.generated.ts (withExposify() in next.config does it on dev and build)"],
+    ["test-sign-in", "Check, on your running app, that the Supabase session Connect sends signs you in"]
+  ],
   locate(cwd, entryFlag) {
     const root = findNextRoot(entryFlag ? resolve2(cwd, entryFlag) : cwd);
     return root ? { entry: root, root, via: "package.json" } : void 0;
@@ -2697,11 +2701,9 @@ ${block}
     if (stubs.some((s) => s.includes("TODO(exposify)"))) {
       lines.push("Go through the TODO(exposify) lines: an action whose input is still incomplete stays hidden until you write it out.");
     }
-    if (!hasWithExposify(root)) {
-      lines.push(
-        'Wrap your next.config export: `export default withExposify(nextConfig)`, imported from "@exposify/next/config". It keeps exposify.generated.ts current on `next dev` and `next build`.'
-      );
-    }
+    const wrap = hasWithExposify(root) ? null : wrapNextConfig(root);
+    const also = wrap && "plan" in wrap ? [{ plan: wrap.plan, manual: WRAP_HINT }] : [];
+    if (wrap && !("plan" in wrap)) lines.push(WRAP_HINT);
     const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join9(root, f)).find((f) => existsSync4(f));
     const manifestFile = existing ?? generate(root, {}, () => {
     }).file;
@@ -2709,11 +2711,8 @@ ${block}
     if (result.aiReady?.site) {
       const file = relative3(root, result.aiReady.site.file);
       if (usesZod) lines.push('The input stubs use zod: `import { z } from "zod";` in that file, if it isn\'t there.');
-      return {
-        code: options,
-        hint: { lines: [`Replace the aiReady(...) call in ${file}:${result.aiReady.site.line} with this.`, ...lines] },
-        apply: applyReplace(result.aiReady.site, config, entries, usesZod, file)
-      };
+      const apply = withAlso(applyReplace(result.aiReady.site, config, entries, usesZod, file), also, lines);
+      return { code: options, hint: { lines: [`Replace the aiReady(...) call in ${file}:${result.aiReady.site.line} with this.`, ...lines] }, apply };
     }
     const routeFile = `${d.appDir ?? "app"}/${MCP_ROUTE_DIR}/route.${generated.endsWith(".ts") ? "ts" : "js"}`;
     const manifestImport = relative3(join9(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
@@ -2729,13 +2728,47 @@ ${block}
     return {
       code,
       apply: { plan: { file: join9(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
-` } },
+` }, ...also.length ? { also } : {} },
       hint: { lines: [`Create ${routeFile} with this (agents connect to /mcp). It imports ${generated}${existing ? "" : ", written just now"}.`, ...lines] }
     };
   }
 };
+var WRAP_HINT = 'Wrap your next.config export: `export default withExposify(nextConfig)`, imported from "@exposify/next/config". It keeps exposify.generated.ts current on `next dev` and `next build`.';
+var NEXT_CONFIGS = ["next.config.ts", "next.config.mjs", "next.config.js", "next.config.cjs", "next.config.mts"];
+function withAlso(outcome, also, lines) {
+  if ("plan" in outcome) return also.length ? { ...outcome, also } : outcome;
+  lines.push(...also.map((a) => a.manual));
+  return outcome;
+}
+function wrapNextConfig(root) {
+  const name = NEXT_CONFIGS.find((n) => existsSync4(join9(root, n)));
+  if (!name) return { blocked: "no next.config file" };
+  const file = join9(root, name);
+  const before = readFileSync9(file, "utf8");
+  const program = parseModule(before, name);
+  if (!program) return { blocked: `couldn't parse ${name}` };
+  const body = program.body;
+  const esm = body.find((n) => n.type === "ExportDefaultDeclaration");
+  const cjs = body.find((n) => {
+    const e = n.type === "ExpressionStatement" ? unwrapTs(n.expression) : void 0;
+    return e?.type === "AssignmentExpression" && e.left?.type === "MemberExpression" && e.left.object?.name === "module" && e.left.property?.name === "exports";
+  });
+  const value = esm ? esm.declaration : cjs ? unwrapTs(cjs.expression)?.right : void 0;
+  if (!value || value.start == null || value.end == null || /Declaration$/.test(value.type)) return { blocked: `couldn't find the config ${name} exports` };
+  const wrapped = `${before.slice(0, value.start)}withExposify(${before.slice(value.start, value.end)})${before.slice(value.end)}`;
+  const imports = body.filter((n) => n.type === "ImportDeclaration" || n.type === "VariableDeclaration" && /require\(/.test(before.slice(n.start, n.end)));
+  const at = imports.length ? imports.at(-1).end : 0;
+  const last = at ? before.slice(imports.at(-1).start, at) : "";
+  const q = /'/.test(last) ? "'" : '"';
+  const semi = !last || last.trimEnd().endsWith(";") ? ";" : "";
+  const line = esm ? `import { withExposify } from ${q}@exposify/next/config${q}${semi}` : `const { withExposify } = require(${q}@exposify/next/config${q})${semi}`;
+  const after = at ? `${wrapped.slice(0, at)}
+${line}${wrapped.slice(at)}` : `${line}
+${wrapped}`;
+  return { plan: { file, summary: `Wrap ${name}'s export in withExposify()`, before, after } };
+}
 function hasWithExposify(root) {
-  for (const name of ["next.config.ts", "next.config.mjs", "next.config.js", "next.config.cjs", "next.config.mts"]) {
+  for (const name of NEXT_CONFIGS) {
     try {
       if (readFileSync9(join9(root, name), "utf8").includes("withExposify")) return true;
     } catch {
@@ -2752,13 +2785,21 @@ function scanProject(root) {
   const notes = [];
   const descriptions = readDescriptions(root, (m) => notes.push(m));
   const rows = [];
+  const callbacks = new Set(d.supabase?.choice.callbacks ?? []);
   for (const r of d.routes) {
     if (r.router === "app") {
+      const callback = callbacks.has(r.file);
       for (const method of r.module.methods.filter((m) => m !== "OPTIONS")) {
         const m = r.module.markers[method];
         const marker = m ? m.kind === "described" ? { kind: "described", ...m.name ? { name: m.name } : {}, ...m.description ? { description: m.description } : {} } : { kind: m.kind } : void 0;
         const source = r.module.sources[method];
-        rows.push({ info: { method, path: r.path, params: r.params, ...marker ? { marker } : {} }, ...m?.name ? { describedName: m.name } : {}, ...m?.description ? { describedText: m.description } : {}, ...source ? { source } : {} });
+        rows.push({
+          info: { method, path: r.path, params: r.params, ...marker ? { marker } : {}, ...callback ? { optIn: true } : {} },
+          ...m?.name ? { describedName: m.name } : {},
+          ...m?.description ? { describedText: m.description } : {},
+          ...source ? { source } : {},
+          ...callback ? { callback: true } : {}
+        });
       }
       continue;
     }
@@ -2817,8 +2858,9 @@ function scanProject(root) {
       tool: names.get(key),
       ...derived ? { derived } : {},
       exposed: decision.exposed,
-      reason: row.formOnly && !decision.exposed ? `a page that's just a form posting to a Server Action (the action is the tool); list "GET ${row.info.path}" in expose to read it anyway` : row.page && decision.exposed ? "a page: read like a browser reads it" : decision.reason,
+      reason: row.formOnly && !decision.exposed ? `a page that's just a form posting to a Server Action (the action is the tool); list "GET ${row.info.path}" in expose to read it anyway` : row.callback && !decision.exposed ? `finishes a Supabase sign-in from an email link or a redirect, which an agent has no use for; list "${key}" in expose to make it a tool anyway` : row.page && decision.exposed ? "a page: read like a browser reads it" : decision.reason,
       ...row.info.optIn ? { optIn: true } : {},
+      ...row.formOnly || row.callback ? { offByDefault: true } : {},
       ...row.page ? { kind: "page" } : {},
       ...row.source ? { source: row.source } : {}
     };
@@ -2886,10 +2928,13 @@ var TEST_SIGN_IN_USAGE = `Usage: @exposify/next test-sign-in [options]
 Signs in to your app's Supabase Auth as AI assistants will (a password, then
 the authenticator code if you have one), and checks that a page your app
 protects accepts the session cookie Connect sends. Run it with your app up.
+With no page that turns signed-out visitors away, it looks for one that
+shows your email once signed in.
 
 Options:
   --url <origin>   Where the app runs (default: http://localhost:3000)
-  --page <path>    A page that redirects signed-out visitors (default: found)
+  --page <path>    A page that redirects signed-out visitors, or shows
+                   who's signed in (default: found)
   --entry <path>   The Next.js project directory (default: detected)
 
 Reads NEXT_PUBLIC_SUPABASE_URL and the publishable (or anon) key from the
@@ -2920,36 +2965,27 @@ async function testSignIn(root, opts, deps) {
     return 1;
   }
   const origin = opts.url.replace(/\/+$/, "");
-  const get = (path, cookie) => deps.fetch(`${origin}${path}`, { headers: cookie ? { cookie } : {}, redirect: "manual" }).catch(() => null);
-  let page = opts.page;
-  if (!page) {
-    const skip = new Set(d.supabase.choice.loginPages ?? []);
-    const candidates2 = d.pages.filter((p) => p.params.length === 0 && !skip.has(p.path) && !p.path.startsWith(d.mcpPath ?? "/mcp")).slice(0, 15);
-    for (const p of candidates2) {
-      const res2 = await get(p.path);
-      if (res2 === null) {
-        deps.log(`Couldn't reach ${origin}. Start your app (next dev), or pass --url.`);
-        return 1;
-      }
-      if (redirected(res2)) {
-        page = p.path;
-        break;
-      }
-    }
-    if (!page) {
-      deps.log("No page turned a signed-out request away, so there's nothing to check the session against. Pass --page with one that does.");
-      return 1;
-    }
-  } else {
-    const res2 = await get(page);
-    if (res2 === null) {
+  const get = (path, cookie2) => deps.fetch(`${origin}${path}`, { headers: cookie2 ? { cookie: cookie2 } : {}, redirect: "manual" }).catch(() => null);
+  let page;
+  const open = [];
+  const candidates2 = opts.page ? [opts.page] : d.pages.filter((p) => p.params.length === 0 && !(d.supabase.choice.loginPages ?? []).includes(p.path) && !p.path.startsWith(d.mcpPath ?? "/mcp")).slice(0, 15).map((p) => p.path);
+  for (const path of candidates2) {
+    const res = await get(path);
+    if (res === null) {
       deps.log(`Couldn't reach ${origin}. Start your app (next dev), or pass --url.`);
       return 1;
     }
-    if (!redirected(res2)) {
-      deps.log(`${page} answered ${res2.status} without signing in, so it can't tell whether the session works. Pass --page with a page that redirects signed-out visitors.`);
-      return 1;
+    if (redirected(res)) {
+      page = path;
+      break;
     }
+    if (res.ok) open.push({ path, body: await res.text() });
+  }
+  if (!page && open.length === 0) {
+    deps.log(
+      opts.page ? `${opts.page} answered with an error without signing in, so it can't tell whether the session works. Pass --page with a page that redirects signed-out visitors or shows who's signed in.` : "No page answered a signed-out request, so there's nothing to check the session against. Pass --page with one that redirects signed-out visitors or shows who's signed in."
+    );
+    return 1;
   }
   const login = supabasePasswordLogin({ ...project, fetch: deps.fetch });
   const ctx = { origin };
@@ -2967,13 +3003,31 @@ async function testSignIn(root, opts, deps) {
   const session = result.session.supabase;
   const name = d.supabase.choice.cookieName ?? supabaseCookieName(project.url);
   const cookies = supabaseSessionCookies(name, session);
-  const res = await get(page, cookies.map((c) => `${c.name}=${c.value}`).join("; "));
-  await deps.fetch(`${project.url.replace(/\/+$/, "")}/auth/v1/logout?scope=local`, { method: "POST", headers: { apikey: project.key, authorization: `Bearer ${session.accessToken}` } }).catch(() => null);
-  if (res && res.status >= 200 && res.status < 300) {
-    deps.log(`\u2713 ${page} answered ${res.status} with the session cookie Connect sends (${cookies.length === 1 ? name : `${name}.0\u2013.${cookies.length - 1}`}), and turned you away without it.`);
-    return 0;
+  const cookie = cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+  const cookieLabel = cookies.length === 1 ? name : `${name}.0\u2013.${cookies.length - 1}`;
+  let ok = false;
+  if (page) {
+    const res = await get(page, cookie);
+    ok = Boolean(res && res.status >= 200 && res.status < 300);
+    if (ok) deps.log(`\u2713 ${page} answered ${res.status} with the session cookie Connect sends (${cookieLabel}), and turned you away without it.`);
+    else deps.log(`\u2717 ${page} answered ${res?.status ?? "nothing"} with the session cookie${res?.headers.get("location") ? ` (to ${res.headers.get("location")})` : ""}: your app didn't accept it.`);
+  } else {
+    const shown = (typeof session.user?.email === "string" ? session.user.email : email).toLowerCase();
+    for (const p of open.filter((o) => !o.body.toLowerCase().includes(shown))) {
+      const res = await get(p.path, cookie);
+      if (res?.ok && (await res.text()).toLowerCase().includes(shown)) {
+        deps.log(`\u2713 ${p.path} showed ${shown} with the session cookie Connect sends (${cookieLabel}), and didn't without it.`);
+        ok = true;
+        break;
+      }
+    }
+    if (!ok) {
+      deps.log(`\u2717 No page turns signed-out visitors away, and none of ${open.map((o) => o.path).join(", ")} showed ${shown} with the session cookie: your app may not have accepted it.`);
+      deps.log("  Pass --page with a page that redirects signed-out visitors or shows who's signed in, to check against it.");
+    }
   }
-  deps.log(`\u2717 ${page} answered ${res?.status ?? "nothing"} with the session cookie${res?.headers.get("location") ? ` (to ${res.headers.get("location")})` : ""}: your app didn't accept it.`);
+  await deps.fetch(`${project.url.replace(/\/+$/, "")}/auth/v1/logout?scope=local`, { method: "POST", headers: { apikey: project.key, authorization: `Bearer ${session.accessToken}` } }).catch(() => null);
+  if (ok) return 0;
   if (d.supabase.choice.cookieName === void 0) deps.log(`  It was named ${name}. If your app sets another cookie name, the generator didn't see it.`);
   return 1;
 }

package/dist/index.cjs

@@ -698,6 +698,7 @@ function errorMessage(err) {
 }
 async function routesFrom(manifest, cfg, warnings) {
   const listed = Array.isArray(cfg.expose) ? cfg.expose.map(import_core.parseMethodEntry).filter((e) => e !== null) : [];
+  const callbacks = new Set(manifest.supabase?.callbacks ?? []);
   const perEntry = await Promise.all(
     manifest.routes.map(async (entry) => {
       const base = { path: entry.path, params: entry.params };
@@ -715,7 +716,7 @@ async function routesFrom(manifest, cfg, warnings) {
       const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
       return methods.filter((m) => m !== "OPTIONS").map((method) => {
         const marker = mod ? (0, import_core.getMarker)(mod[method]) : void 0;
-        return { ...base, method, ...marker ? { marker } : {} };
+        return { ...base, method, ...marker ? { marker } : {}, ...callbacks.has(entry.file) ? { optIn: true } : {} };
       });
     })
   );

package/dist/index.js

@@ -712,6 +712,7 @@ function errorMessage(err) {
 }
 async function routesFrom(manifest, cfg, warnings) {
   const listed = Array.isArray(cfg.expose) ? cfg.expose.map(parseMethodEntry).filter((e) => e !== null) : [];
+  const callbacks = new Set(manifest.supabase?.callbacks ?? []);
   const perEntry = await Promise.all(
     manifest.routes.map(async (entry) => {
       const base = { path: entry.path, params: entry.params };
@@ -729,7 +730,7 @@ async function routesFrom(manifest, cfg, warnings) {
       const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
       return methods.filter((m) => m !== "OPTIONS").map((method) => {
         const marker = mod ? getMarker(mod[method]) : void 0;
-        return { ...base, method, ...marker ? { marker } : {} };
+        return { ...base, method, ...marker ? { marker } : {}, ...callbacks.has(entry.file) ? { optIn: true } : {} };
       });
     })
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.3",
+    "@exposify/cli": "0.0.4",
     "@exposify/core": "0.3.16",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"